Title: Latency NMS Attacks: Is It Real Life or Is It Just Fantasy?
Venue: NeurIPS 2025
Accepted: yes
Keywords: evaluation

adversarial attacks

latency attacks

NMS attack

Object Detection

adversarial defenses
Abstract: ``Caught in a landslide, no escape from reality" summarizes the state of the research in AI offense: an attack might work on paper but does not necessarily in practice. In the last 5 years, we have seen the rise of latency attacks against computer vision systems. Most of them targeted 2D object detection, especially its Non-Max-Suppression (NMS) block, via adversarial images. However, we uncovered that, when tested in realistic deployment settings, the NMS latency attacks, accepted to top conferences, have very limited negative effects. In this paper, we define an evaluation framework (EVADE) to assess the practicality of attacks, and apply it to state-of-the-art NMS latency attacks. Attacks were tested on different hardware platforms, and different model formats and quantization. Results show that these attacks are not able to generate the claimed latency increase, nor transfer to other models (from the same family or not). 
Moreover, the latency increases remain within the latency requirements of downstream tasks in our evaluation, suggesting limited practical impact under these conditions. We also tested three defenses, which were successful in mitigating the NMS latency attacks. Therefore, in their current form, NMS latency attacks are just fantasy.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe author proposes an evaluation framework named EVADE to assess the practicality of latency attacks, especially those targeting NMS in real-world scenarios, which is a novel direction. This framework comprises multiple components, providing a comprehensive combination of models, attacks, datasets, and more. It also employs different metrics to evaluate various aspects of the attacks. The extensive evaluation across different components reveals some interesting observations.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths:\n1. This paper focuses on the real-world practicality of NMS-based latency attacks, which is a novel and valuable direction. It offers a new perspective for evaluating such attacks and lays a solid foundation for future research in this area.\n\n2. The proposed EVADE framework consists of multiple components and configurations, serving as a flexible and effective testbed for adversarial image-based latency attacks.\n\n3. The paper presents a well-structured set of research questions, which are carefully designed to cover diverse evaluation dimensions. This provides a clear and thoughtful basis for analyzing the effectiveness of latency attacks.\n\n4. The experimental evaluation is extensive and well-aligned with the research questions. Each component is evaluated through detailed experiments, which demonstrate substantial effort and contribute to a comprehensive analysis of the proposed framework.\n\n## Weaknesses:\n1. The author calls EVADE a framework, but it feels more like a collection of inputs and questions. There’s no clear internal structure connecting the parts, which makes it look more like a testbed than a true framework.\n\n2. The paper only focuses on adversarial image attacks at the input level, which limits the scope of the work.\n\n3. The paper sets a very high bar for what counts as a “successful latency attack,” and some of the main conclusions are stated quite definitively, even though the evidence doesn’t always seem strong enough to fully support them.\n\n4. The analysis mainly stays at the model level, without a broader system-level view, which is quite important when considering real-world practicality.  \n\n5. Most importantly, the authors didn't prove that NMS latency attacks are harmless. Instead, they show that some existing attack methods fail under specific experimental settings, and from that, draw a broad conclusion that the overall attack idea is ineffective. However, the failure of current attacks does not mean the general approach is invalid. Similarly, lack of transferability does not imply real systems are safe, and partial defense success does not prove the attack is harmless. Overall, the conclusion feels overstated compared to the evidence provided.\n\nQUESTIONS:\n1. While the authors refer to EVADE as a “framework,” I feel it is closer to a structured evaluation protocol or a testbed, as it lacks clear relationships between the components. In my view, a framework should be a more integrated and end-to-end system that not only provides a methodology for combining findings and reasoning about them but also offers an analytical structure to explain how different factors jointly influence the outcome.\n\n\n2. The bar set for declaring an attack practical seems overly strict. In real-world systems, even an increase from 10ms to 50ms in the NMS step could break timing guarantees, especially in time-critical applications. Since object detection is typically just one stage in a tightly constrained processing pipeline, even small delays can compromise the overall system functionality. Evaluating latency variance, jitter, and system-level behavior under load would provide a more realistic assessment of an attack’s effectiveness.\n\n\n3. On the platform side, the paper only lists the hardware type but doesn’t provide details about the actual deployment environment. In practice, latency can vary a lot depending on things like OS-level optimizations, driver versions, or background load. It would be helpful if the authors could clarify how sensitive their results are to these factors and whether the conclusions would still hold under different system configurations.\n\n\n4. While the authors seem to treat lack of transferability as a sign that the attack isn’t effective, that mixes up two different things. Just because an attack doesn’t transfer well doesn’t mean it’s not dangerous, especially when the model is known or guessable. \n\n\n5. What does “GRID A100D-10C” stand for in Table 2? Also, the Jetson AGX Orin has much stronger performance than typical edge devices, so a small latency increase on this platform may not reflect what would happen on more constrained hardware. It would be good to clarify whether the conclusions would still hold under truly resource-limited edge settings.\n\n\n6. In the caption of Table 3, the authors mention using color “green (0–75), yellow (76–125), orange (126–225), red (226–300)” to divide the average number of bounding boxes. What’s the rationale behind choosing these specific thresholds? Are they based on empirical distributions, prior work, or some application-specific criteria?\n\n\n7. While the results in Sections 4.2 and 4.3 show limited transferability across different model versions and sizes, it looks like the attacks are optimized separately for each model. It might be worth discussing whether known techniques for improving attack generalization could help with cross-model or cross-size robustness. Adding a short discussion on this could make the conclusions more broadly applicable.\n\n\n8. In Section 4.7, the authors evaluate the defense methods using only one model, which makes it unclear whether the results generalize to other settings. Also, the evaluation focuses only on reducing the number of NMS outputs, without considering possible side effects of the defenses, such as degradation in performance on benign inputs. If a defense severely hurts normal performance, wouldn't that also count as a kind of attack success, even if latency remains unchanged?\n\n\n9. In Section 4.8, the authors use a yes/no checklist over 6 or 7 criteria to conclude whether an attack is harmless. But this feels like an oversimplified evaluation. Just because an attack doesn't meet all the listed conditions doesn't mean it's completely ineffective or irrelevant. Some of the criteria don’t directly reflect actual impact, and the evaluation ignores cases where an attack could still be harmful in specific deployment settings. The overall reasoning seems too rigid to support such a broad conclusion.\n\n\n10. While the paper claims to evaluate the real-world feasibility of NMS latency attacks, it mainly focuses on adversarial inputs. Other attack types like backdoors or bit-flips are dismissed as unrealistic, but in practice, these aren’t that uncommon, especially with social engineering or insider access. Also, just because an attacker has access to the model doesn’t mean they wouldn’t prefer a stealthy latency-based attack. The threat model feels a bit too narrow.\n\nLIMITATIONS:\nThe discussion section does not clearly address the work's limitations. It mostly repeats the conclusion that the attacks are harmless, without reflecting on the scope or assumptions of the study. The suggestions for future work are vague and lack concrete methods or supporting evidence. A clearer discussion of what the current analysis does not cover would improve the paper.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-25"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper challenges the practicability of the NMS attacks, which aims to increase the latency of object detector by increase the number of object proposals. To challenges the effectiveness of these existing attacks, this work proposed a new evaluation benchmark that studies the effectiveness of the existing attacks when (1) hardware changes, (2) architecture changes, (3) model size changes, (4) model format changes, (5) model is quantized, (6) input image has domain shift and (7) model has defense mechanism. The entire paper focus on the experimental discoveries. It concludes that the NMS attack remains effective when the model format and quantization changes and the NMS attack is no longer effective when the remaining factor changes.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n•\tThe paper is well organized and easy to follow and read. \n•\tThe evaluation benchmark can be helpful for the larger community for testing whether the new developed NMS attack is generalizable. \n•\tThis paper seems to be the pioneering in studying the effectiveness of existing NMS attack.\n•\tThe experiments investigate the effectiveness of the attack in multiple factors, which are well designed.\n\nWeakness\n•\tThis paper is a discovery type of work, where only observation is presented but there is not further explanation about why the attack fails or how to make the attack more effective.  For example, why switching across different hardware will decrease the effectiveness of the attack. \n•\tThe only contribution is the evaluation benchmark itself (perhaps also the conclusion), but it remains debatable whether this is sufficient for Neurips acceptance\n•\tWill the author release the evaluation benchmark for reproducibility? For the “Hardware” component, how does other researcher in the community reproduce the result without having the hardware? This is important as the benchmark is the core and only contribution of this work.\n•\tIn section 3.3, the author categorizes the number of bbox into 4 different ranges. However, it is, by nature, that some of the images in the evaluation benchmark has more bounding box (i.e. objects) than other images, without being attacked. How does the metric account for this? Doesn’t it make more sense to produce a normalize score, where the normalized score is (# bbox after attack) / (# of bbox before attack) ?\n\nQUESTIONS:\nPlease refer to the weakness section.\n\nLIMITATIONS:\nYes, the author has addressed the limitations of this work and proposed serveral directions to expand the proposed dataset.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n### Summary\nThe paper investigates the transferability and robustness of NMS latency attacks on object detection models. The authors evaluate the effectiveness of these attacks across different model formats, quantization levels , and versions of the same model. They also examine how defenses impact the success rate of these attacks.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n\n1. They perform comprehensive experiments. The study uses an evaluation framework -  EVADE to systematically assess various aspects of NMS latency attacks, including transferability, quantization effects, and defense mechanisms.\n2. The experiments involve real-world datasets such as COCO 2017 and consider practical factors like model conversion and optimization.\n3. The paper provides valuable insights into the limitations of current NMS latency attacks and suggests directions for future research, particularly in targeting NMS-free models or analyzing post-object detection processes.\n\n### Weaknesses\n1. The paper does not provide a comprehensive study of quantization techniques, which could limit its applicability in some contexts.\n2. While the paper identifies the need for more effective attacks, it does not propose concrete solutions or improvements.\n\nQUESTIONS:\nThe main conclusion—that NMS latency attacks are generally ineffective—might be seen as discouraging for those looking for practical adversarial strategies. However, this is balanced by the identification of new research avenues. Somewhat, these methods provide insight on the robustness of NMS mechanism. Do you have more insightful suggestions?\n\nLIMITATIONS:\n1. While the paper suggests exploring NMS-free models, it does not delve into developing specific attacks for these models. Creating and evaluating new attack vectors tailored for NMS-free architectures would be a valuable extension.\n2. More suitable for the position paper track.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 1, "ORIGINALITY": 3, "DATE": "2025-07-03"}