Metraipolis › archive › dc_bfa8a16f951a

Can Attack Difficulty Be Characterized Before Optimization? A Study of Pre-optimization Difficulty in Person-Vanishing Attacks — arXiv:2609.34501

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.34501
License (as archived): CC0-1.0
Archived: 2026-10-07T23:52:11.710Z
SHA-256 of the archived text: f7960a93eca9e2d37fed1b079d786c4e0f59a952dd08f539937bbc1f44cecdd1
Stable URL of this page: https://metraipolis.com/documento/dc_bfa8a16f951a

How to cite

Can Attack Difficulty Be Characterized Before Optimization? A Study of Pre-optimization Difficulty in Person-Vanishing Attacks — arXiv:2609.34501 — arXiv (en), https://arxiv.org/abs/2609.34501 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bfa8a16f951a (Metraipolis archive dc_bfa8a16f951a, sha256 f7960a93eca9e2d37fed1b079d786c4e0f59a952dd08f539937bbc1f44cecdd1)

BibTeX

@misc{dcbfa8a16f951a,
  title = {Can Attack Difficulty Be Characterized Before Optimization? A Study of Pre-optimization Difficulty in Person-Vanishing Attacks — arXiv:2609.34501},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.34501},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bfa8a16f951a; sha256 f7960a93eca9e2d37fed1b079d786c4e0f59a952dd08f539937bbc1f44cecdd1},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.34501. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Adversarial attacks against object detectors are traditionally studied from an optimization perspective, where attack difficulty is regarded as an outcome observed only after adversarial optimization. This raises a fundamental question: \emph{can the relative attack difficulty of different inputs be characterized before optimization begins?} In this paper, we investigate this question for person-vanishing attacks by introducing the concept of pre-optimization attack difficulty, which captures intrinsic differences in optimization effort across input images. To estimate this latent difficulty before optimization, we propose Quad-CLEVER, an efficient geometry-based estimator derived from a quadratic approximation of the local person-vanishing margin along the most attack-relevant direction. Extensive experiments across multiple attack algorithms demonstrate that Quad-CLEVER consistently correlates with the observed optimization cost, providing empirical evidence that attack difficulty exhibits a predictable pre-optimization structure. Building upon this finding, we further propose a difficulty-aware attack framework that leverages the estimated difficulty to adaptively allocate optimization budgets for a base attack under a fixed computational budget. On BDD100K, the proposed framework improves the image-level attack success rate by up to 5.78$\%$ while reducing the average optimization cost by up to 11.42 iterations. On the more challenging EventPed dataset, it saves 2.25 optimization iterations while maintaining comparable attack performance. These results demonstrate that attack difficulty can be meaningfully estimated before optimization and that exploiting such estimates enables more computationally efficient adversarial attacks.

Tema degli esploratori: statistica e scienza dei dati (retro-catalogo arXiv: annunci del 2026-09-29 in cs.CV).
Categorie arXiv: Computer Vision and Pattern Recognition (cs.CV).
Pagina del lavoro: https://arxiv.org/abs/2609.34501 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T23:29:27.380Z dalla pagina https://arxiv.org/catchup/cs.CV/2026-09-29?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).