Project overview
This project evaluates adversarial vulnerability at two levels: conventional attacks applied to accumulated event frames and event-specific attacks that directly manipulate the asynchronous event representation. A frozen human detector is protected by an upstream attack detector and a conditional U-Net mitigator with a supervised localization head, avoiding retraining of the deployed model.
Core contributions
- A common evaluation of five classical frame attacks: FGSM, PGD, C&W, Square, and transfer attacks.
- Five event-specific attacks: event injection, deletion, polarity reversal, SpikeFool, and Event-PGD.
- A detector-mitigator defense that identifies the attack family, localizes corrupted pixels, and purifies the input before inference.
- Cross-dataset validation on the public PEDRo benchmark and a custom DAVIS346 industrial dataset.
Current evidence
The clean detector reaches 0.896 mAP50 on PEDRo and 0.769 on the industrial dataset. Recovery is strong for additive perturbations, but deletion remains the hardest attack because it removes the underlying signal rather than adding correctable noise.
Attack surface
The work separates dense frame-domain perturbations from sparse event-domain edits. Event injection adds activity, deletion removes informative events, polarity reversal swaps ON and OFF activity, and gradient-guided attacks target the detector through the event representation.
Safety relevance
Human detection supports collision avoidance, surveillance, navigation, and shared-workspace safety. Demonstrating and mitigating adversarial failure is therefore necessary before event-camera perception can be trusted in safety-critical human-robot systems.