mlsanityData to 7 Oct 2026

Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors

arXiv 2205.13618 ↗First posted 26 May 2022cs.CV cs.CR cs.LGcited by 28

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks against deep learning-based object detectors have been studied extensively in the past few years. Most of the attacks proposed have targeted the model's integrity (i.e., caused the model to make incorrect predictions), while adversarial attacks targeting the model's availability, a critical aspect in safety-critical domains such as autonomous driving, have not yet been explored by the machine learning research community. In this paper, we propose a novel attack that negatively affects the decision latency of an end-to-end object detection pipeline. We craft a universal adversarial perturbation (UAP) that targets a widely used technique integrated in many object detector pipelines -- non-maximum suppression (NMS). Our experiments demonstrate the proposed UAP's ability to increase the processing time of individual frames by adding "phantom" objects that overload the NMS algorithm while preserving the detection of the original objects which allows the attack to go undetected for a longer period of time.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). Builds on 31 of its 37 references that are in the map. First posted on arXiv 26 May 2022.

Builds on

31 of 37 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2017Mask R-CNNcited by 7,259
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  10. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  11. 2018YOLOv3: An Incremental Improvementcited by 2,652
  12. 2020YOLOv4: Optimal Speed and Accuracy of Object Detectioncited by 1,624
19 more
  1. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  2. 2016Universal adversarial perturbationscited by 774
  3. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  4. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  5. 2020Scaled-YOLOv4: Scaling Cross Stage Partial Networkcited by 211
  6. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  7. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  8. 2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 108
  9. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  10. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  11. 2020The Translucent Patch: A Physical and Universal Attack on Object Detectorscited by 62
  12. 2017Predicting Driver Attention in Critical Situationscited by 61
  13. 2020A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inferencecited by 61
  14. 2021A Survey On Universal Adversarial Attackcited by 59
  15. 2018DARTS: Deceiving Autonomous Cars with Toxic Signscited by 53
  16. 2019The Mapillary Traffic Sign Dataset for Detection and Classification on a Global Scalecited by 49
  17. 2022Energy-Latency Attacks via Sponge Poisoningcited by 29
  18. 2021Who's Afraid of Adversarial Transferability?cited by 6
  19. 2020Neighbors From Hell: Voltage Attacks Against Deep Learning Accelerators on Multi-Tenant FPGAscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 8; 2025: 10; 2026: 7.

28 papers.

Sort:

By area:

  1. 2025ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinkingcited by 22
  2. 2023SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examplescited by 15
  3. 2023Overload: Latency Attacks on Object Detection for Edge Devicescited by 13
  4. 2025LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loopscited by 9
  5. 2024The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Visioncited by 7
  6. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  7. 2025LoopLLM: Transferable Energy-Latency Attacks in LLMs via Repetitive Generationcited by 7
  8. 2025Energy-Latency Attacks: A New Adversarial Threat to Deep Learningcited by 5
  9. 2026ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Modelscited by 5
  10. 2024The SkipSponge Attack: Sponge Weight Poisoning of Deep Neural Networkscited by 3
  11. 2024SlowPerception: Physical-World Latency Attack against Visual Perception in Autonomous Drivingcited by 3
  12. 2024Out-of-Bounding-Box Triggers: A Stealthy Approach to Cheat Object Detectorscited by 3
16 more
  1. 2024Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devicescited by 3
  2. 2025Breaking the Loop: Detecting and Mitigating Denial-of-Service Vulnerabilities in Large Language Modelscited by 3
  3. 2025CP-FREEZER: Latency Attacks against Vehicular Cooperative Perceptioncited by 3
  4. 2023QuantAttack: Exploiting Dynamic Quantization to Attack Vision Transformerscited by 2
  5. 2024DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms in Vision Transformerscited by 2
  6. 2024Steal Now and Attack Later: Evaluating Robustness of Object Detection against Black-box Adversarial Attackscited by 2
  7. 2025Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detectioncited by 2
  8. 2025BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Modelscited by 2
  9. 2025Resource Consumption Red-Teaming for Large Vision-Language Modelscited by 2
  10. 2026Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Modelcited by 2
  11. 2026Resource Consumption Threats in Large Language Modelscited by 2
  12. 2025Efficiency Robustness of Dynamic Deep Learning Systemscited by 1
  13. 2026LoopTrap: Termination Poisoning Attacks on LLM Agentscited by 1
  14. 2026AESOP: Adversarial Execution-path Selection to Overload Deep Learning Pipelinescited by 0
  15. 2026Event Burst Trigger: An Availability Backdoor Attack on Event-Based SNN Object Detectioncited by 0
  16. 2026Driving up Inference Energy on SNNs: Per-Sample and Universal Sponge Attackscited by 0