LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

2026-07-06

AI Summary

Existing object detectors exhibit insufficient robustness under adversarial attacks, limiting their applicability in safety-critical scenarios. This work proposes LipSSD, the first single-stage detector that systematically incorporates Lipschitz constraints to achieve intrinsic robustness. By redesigning the SSD architecture with Lipschitz-bounded components, LipSSD attains attack-agnostic defense capabilities without relying on adversarial training. Extensive experiments demonstrate that LipSSD significantly outperforms conventional adversarial training methods across multiple white-box attacks on Pascal VOC, LARD, and KITTI datasets. Notably, it improves mAP@50 by up to 15 percentage points against unseen attacks while maintaining competitive performance on clean samples.

Abstract

Object detectors have many applications in safety-critical systems, but they are known to be sensitive to worst-case perturbations such as adversarial attacks, which limits their applicability in real-world scenarios. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures. In this work, we introduce Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors. We validate this approach with LipSSD, a Lipschitz-constrained Single Shot MultiBox Detector (SSD), and provide a comprehensive study of its adversarial robustness using multiple white-box adversarial attacks and datasets. We first analyze the accuracyrobustness trade-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD. Finally, we use more specific safety-critical datasets such as LARD and KITTI, and show that Lipschitz-constrained detectors can improve robustness while largely preserving clean performance. These results suggest that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.

Problem

• adversarial robustness
• object detection
• Lipschitz constraint
• safety-critical systems
• adversarial attacks

Innovation

• Lipschitz constraint
• adversarially robust object detection
• robust-by-design
• Single-Shot Detector
• accuracy-robustness trade-off