# AT-BOD: An Adversarial Attack on Fool DNN-Based Blackbox Object Detection Models
## 4 The Proposed Model
### Evaluation Metrics  
#### 4.3.1 Metrics for Object Detection  
Mean Average Precision (mAP)  
Which detection is accurate and performs better? There are multiple tools where each returns a list of objects containing data about object location in the image, its size, and the confidence score indicating what class label is probably the object belongs. Depending on the detection task, that could be one of two categories, detection of a particular object (for example, president [PERSON] face) or detecting a different object of a predefined category list such as cars, pedestrians, stop signs, etc. The main problem we might face using a naive approach such as binary scoring is the object localization that most of time is imperfectly indicating the bounding box shape where it might happen that a part of the object is out of the box. This approach failed because it depends on the exact coordinates defined in the ground truth to measure the detection and generate the score, whether \(1\) for matches and \(0\) otherwise. To obtain a reasonable measurement, we need to have a function that calculates how close is the detected box to the true box. However, we can rely on precision and recall that are frequently used in classification tasks.  
Hence, evaluating object detection is a non-trivial task due to its complexity where we need to determine the objectness and the localization, which means we have two tasks to measure classification and regression. Usually, the data used in object detection has many classes with a non-uniform distribution that might introduce biases using simple metrics. Furthermore, we have the problem of misclassification. Thus, associating each generated bounding box with the detected object confidence score and evaluating the model is important [54].  
Figure 4: Generating the perturbation-based AT-BOD framework.  
Average Precision (AP)  
AP is a metric used in evaluating the accuracy of object detection models. It calculates the average precision for recall over \([0,\ 1]\). The AP score is defined as the mean precision at the set of 11 equally spaced recall values, Recall \(i=[0,\ 0.1,\ 0.2,\ \ldots,\ 1.0]\)[54].  
\[AP=\frac{1}{11}\sum_{recall_{i}}Precision(Recall_{i}) \tag{9}\]  
The precision at each recall level \(r\) is interpolated by taking the maximum precision measured for a method for which the corresponding recall exceeds \(r\)[54].  
\[P_{interp}(r)=max_{\widetilde{r}\widetilde{r}\widetilde{r}}p(\widetilde{r}) \tag{10}\]  
Such that \(p(\widetilde{r})\) is the computed precision at recall \(\widetilde{r}\)[55].  
Precision computes the percentage of how is accurate the model prediction.  
\[Precision=\frac{TP}{TP+FP} \tag{11}\]  
Recall calculates the percentage of how the model is useful in finding all positives.  
\[Recall=\frac{TP}{TP+FN} \tag{12}\]  
Intersection over Union (IoU)  
IoU is the overlapping of the ground truth bounding box and the prediction bounding box to measure how much is the prediction covers the real object. Usually, we predefine an intersection threshold to classify the prediction as true or false positive.  
\[IoU=\frac{Area\ of\ Overlap}{Area\ of\ Union} \tag{13}\]  
where,  
Area of overlap is the shaded area in  
And the area of union is the shaded area in