Object detection is a vital task in computer vision and has become an
integral component of numerous critical systems. However, state-of-the-art
object detectors, similar to their classification counterparts, are susceptible
to small adversarial perturbations that can significantly alter their normal
behavior. Unlike classification, the robustness of object detectors has not
been thoroughly explored. In this work, we take the initial step towards
bridging the gap between the robustness of classification and object detection
by leveraging adversarially trained classification models. Merely utilizing
adversarially trained models as backbones for object detection does not result
in robustness. We propose effective modifications to the classification-based
backbone to instill robustness in object detection without incurring any
computational overhead. To further enhance the robustness achieved by the
proposed modified backbone, we introduce two lightweight components: imitation
loss and delayed adversarial training. Extensive experiments on the MS-COCO and
Pascal VOC datasets are conducted to demonstrate the effectiveness of our
proposed approach.

本研究旨在利用对抗训练的分类模型作为目标检测的骨干，在不增加计算开销的情况下提高目标检测的鲁棒性，通过引入仿真损失和延迟对抗训练两个轻量级组件进一步增强鲁棒性。在 MS-COCO 和 Pascal VOC 数据集上进行了大量实验证明了我们提出方法的有效性。

FROD: 强健的免费物体检测

FROD: Robust Object Detection for Free

The current state-of-the-art defense methods against adversarial examples
typically focus on improving either empirical or certified robustness. Among
them, adversarially trained (AT) models produce empirical state-of-the-art
defense against adversarial examples without providing any robustness
guarantees for large classifiers or higher-dimensional inputs. In contrast,
existing randomized smoothing based models achieve state-of-the-art certified
robustness while significantly degrading the empirical robustness against
adversarial examples. In this paper, we propose a novel method, called
\emph{Certification through Adaptation}, that transforms an AT model into a
randomized smoothing classifier during inference to provide certified
robustness for $\ell_2$ norm without affecting their empirical robustness
against adversarial attacks. We also propose \emph{Auto-Noise} technique that
efficiently approximates the appropriate noise levels to flexibly certify the
test examples using randomized smoothing technique. Our proposed
\emph{Certification through Adaptation} with \emph{Auto-Noise} technique
achieves an \textit{average certified radius (ACR) scores} up to $1.102$ and
$1.148$ respectively for CIFAR-10 and ImageNet datasets using AT models without
affecting their empirical robustness or benign accuracy. Therefore, our paper
is a step towards bridging the gap between the empirical and certified
robustness against adversarial examples by achieving both using the same
classifier.

本文介绍了一种新方法，即通过自适应实现认证，将经过对抗训练的模型转化为随机平滑分类器，在推理过程中提供 l2 范数的认证鲁棒性，同时不影响它们对抗攻击的经验鲁棒性。