LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection
Summary
Introduces LipSSD, a Lipschitz-constrained variant of Single Shot MultiBox Detector that improves adversarial robustness in object detection while being attack-agnostic and complementary to adversarial training. Evaluated on Pascal VOC, LARD, and KITTI datasets.
View Cached Full Text
Cached at: 07/09/26, 07:57 AM
# LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection Source: [https://arxiv.org/abs/2607.06592](https://arxiv.org/abs/2607.06592) [View PDF](https://arxiv.org/pdf/2607.06592) > Abstract:Object detectors have many applications in safety\-critical systems, but they are known to be sensitive to worst\-case perturbations such as adversarial attacks, which limits their applicability in real\-world scenarios\. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures\. In this work, we introduce Lipschitz\-constrained variants of object detection architectures as robust\-by\-design alternatives to standard detectors\. We validate this approach with LipSSD, a Lipschitz\-constrained Single Shot MultiBox Detector \(SSD\), and provide a comprehensive study of its adversarial robustness using multiple white\-box adversarial attacks and datasets\. We first analyze the accuracyrobustness trade\-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter\. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD\. Finally, we use more specific safety\-critical datasets such as LARD and KITTI, and show that Lipschitz\-constrained detectors can improve robustness while largely preserving clean performance\. These results suggest that architectural Lipschitz control is a practical and attack\-agnostic direction for improving the robustness of object detectors\. ## Submission history From: Corentin FRIEDRICH \[[view email](https://arxiv.org/show-email/3030012a/2607.06592)\] \[via CCSD proxy\] **\[v1\]**Mon, 6 Jul 2026 08:33:28 UTC \(5,386 KB\)
Similar Articles
LiST: Lipschitz Scaling Training for Robust and Calibrated Neural Networks
Introduces LiST, a training paradigm that uses Lipschitz constraints to achieve robust and calibrated neural networks, selecting optimal operating points on the accuracy-robustness Pareto front. Demonstrates competitive performance on CIFAR and Tiny-ImageNet.
TASER: Task-Aware Stein Regularisation for Geometry-Driven Robustness
Introduces TASER, a training-time regularization framework derived from Langevin Stein operators that encourages geometric compatibility between predictors and data density, improving adversarial robustness and stability on CIFAR-10 without significant clean accuracy degradation.
USAD: Uncertainty-aware Statistical Adversarial Detection
USAD proposes two new statistics, Variance Discrepancy and Perturbation-based Covariance Discrepancy, to capture global and local uncertainty patterns of adversarial examples, achieving superior detection performance over baseline methods.
Lightweight Stylistic Consistency Profiling: Robust Detection of LLM-Generated Textual Content for Multimedia Moderation
Proposes LiSCP, a lightweight stylistic consistency profiling method for robust detection of LLM-generated textual content, focusing on feature stability under adversarial manipulation. Achieves superior performance on in-domain and cross-domain detection with notable robustness.
Design-Based Supervised Learning with Noisy Human Labels
Proposes Partially Adjudicated Design-Based Supervised Learning (PA-DSL), a method that corrects noisy human labels using a small set of adjudicated cases to debias automated classifiers, achieving nominal coverage and reducing RMSE by 10-17% in experiments.