[Paper Review] Detection as Regression: Certified Object Detection by Median Smoothing

Ping-yeh Chiang, Michael J. Curry+4 more|arXiv (Cornell University)|Jul 7, 2020

Adversarial Robustness in Machine Learning36 references4 citations

TL;DR

This paper proposes the first model-agnostic, training-free, certified defense for object detection using median smoothing—a novel randomized smoothing technique tailored for regression tasks. By reducing object detection to a single regression problem and applying median-based smoothing, the method achieves non-trivial certified average precision (4.21% AP@50) on MS-COCO under ℓ₂-bounded adversarial attacks, marking the first certified defense for object detectors.

ABSTRACT

Despite the vulnerability of object detectors to adversarial attacks, very few defenses are known to date. While adversarial training can improve the empirical robustness of image classifiers, a direct extension to object detection is very expensive. This work is motivated by recent progress on certified classification by randomized smoothing. We start by presenting a reduction from object detection to a regression problem. Then, to enable certified regression, where standard mean smoothing fails, we propose median smoothing, which is of independent interest. We obtain the first model-agnostic, training-free, and certified defense for object detection against $\ell_2$-bounded attacks. The code for all experiments in the paper is available at http://github.com/Ping-C/CertifiedObjectDetection .

Motivation & Objective

• To address the lack of certified defenses for object detectors, which are vulnerable to adversarial attacks despite their widespread use in safety-critical systems.
• To overcome the limitations of standard mean-based randomized smoothing, which fails for regression tasks like object detection.
• To develop a training-free, model-agnostic defense that provides theoretical robustness guarantees against ℓ₂-bounded perturbations.
• To enable certified robustness for multi-stage detection pipelines by reducing them to a single regression problem.
• To demonstrate practical feasibility of certified object detection on large-scale benchmarks like MS-COCO.

Proposed method

• Reduces the full object detection pipeline—proposal generation, classification, and non-maximum suppression—into a single regression problem that outputs bounding box coordinates and class scores.
• Applies a novel median-based smoothing technique instead of mean-based smoothing, which is ineffective for regression tasks.
• Uses Monte Carlo sampling over a Gaussian distribution around the input image to estimate the median of predictions, enabling certified robustness via concentration inequalities.
• Employs a percentile-based smoothing approach where the median of smoothed predictions is used as the final output, ensuring robustness to perturbations within a bounded ℓ₂ norm.
• Treats the base detector as a black box, requiring no retraining or architectural modifications.
• Implements a binning and sorting strategy to group predictions and compute the median efficiently, improving stability and certification tightness.

Experimental results

Research questions

• RQ1 Can randomized smoothing be adapted to regression tasks such as object detection, where mean-based smoothing fails?
• RQ2 Is it possible to construct a certified defense for object detectors that is both training-free and model-agnostic?
• RQ3 What is the achievable level of certified robustness (in terms of average precision) for object detectors under ℓ₂-bounded perturbations using median smoothing?
• RQ4 How does the choice of base detector (e.g., YOLOv3, Mask R-CNN, Faster R-CNN) affect the final certified performance?
• RQ5 How tight is the certification bound compared to the actual robustness observed under adversarial attacks?

Key findings

• The proposed median smoothing method achieves the first non-trivial certified average precision of 4.21% AP@50 on the MS-COCO dataset using YOLOv3 as the base detector.
• Even though Mask R-CNN and Faster R-CNN have higher clean AP (51.28% and 50.47%), their certified AP drops to 1.67% and 1.54%, respectively, indicating architecture-dependent performance degradation under smoothing.
• The DAG attack, which targets the detection pipeline, only reduced recall by 1.1% within the certified radius, suggesting the certification bound is conservative but valid.
• Denoising the predictions via sorting and binning significantly improves both clean and certified AP, demonstrating the importance of preprocessing for robustness.
• The method is inherently expensive due to Monte Carlo sampling (2000 samples per image), making inference 2000× slower, but enables certification without retraining.
• The framework is general-purpose and can be applied to any regression model, suggesting broader applicability beyond object detection.