Object Detection NMS Defenses Against Latency Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing object detection systems are vulnerable to latency attacks that target non-max suppression (NMS), leading to increased latency and reduced accuracy in object detection processes.
Innovation Solution
Implement defenses that include transformations such as blurring, masking, inpainting, and diffusion models before the object detection model, and thresholds on bounding boxes after the model to mitigate and detect NMS attacks, adapting the defense strategy based on context and environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If non-max suppression (NMS) is applied to object detection, then detection accuracy is improved, but the system becomes vulnerable to latency attacks
Solution Approach 1:
The patent applies image transformations (blurring, masking, inpainting, diffusion models) before the object detection model processes the image. These preliminary actions modify the input image to prevent attack perturbations from reaching the NMS stage, thereby maintaining detection accuracy while reducing vulnerability to latency attacks.
Solution Approach 2:
The patent introduces transformation operations as intermediary steps between image capture and object detection. These intermediaries (blurring, masking, inpainting, diffusion models) act as mediators that filter out malicious perturbations while preserving legitimate image features, protecting the NMS process from attack without degrading detection performance.
2Reliability
If defenses are applied to mitigate NMS attacks, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent applies multiple transformation operations (blurring, masking, inpainting, diffusion models) to the image before detection. While this increases processing complexity, it provides layered protection against attacks. The system selectively applies these transformations based on the need for attack mitigation, balancing the trade-off between reliability improvement and complexity increase.
3Reliability
If multiple transformation operations are applied before detection, then attack resistance is improved, but processing time increases
Solution Approach 1:
The patent applies transformations before detection to prevent attacks, but this preliminary processing increases time loss. The system accepts this time penalty as necessary to achieve attack resistance, particularly in security-critical applications where reliability outweighs processing speed requirements.
Data Source
AI summary
Systems and techniques are described for object detection. For example, a computing device can apply a transformation to an image of a scene to generate a transformed image. The computing device can determine a plurality of candidate bounding regions for the transformed image. Each candidate bounding region is associated with an object in the scene. The computing device can determine a subset of candidate bounding regions for the transformed image by removing, using a non-max suppression model, at least one candidate bounding region of the plurality of candidate bounding regions. The computing device can generate an output bounding box for the object based on the subset of candidate bounding regions. The computing device can output the output bounding box. In some cases, the computing device can use an output of an image processing operation on the image to reduce a number of the plurality of candidate bounding regions.