Adversarial Patch Attack on Multi-Scale Object Detection for UAV Remote Sensing Images
, Yu Zhang 1, Jiahao Qi 1, Kangcheng Bin 1, Hao Wen 1, Xunqian Tong 2 and Ping Zhong 1,*
Round 1
Reviewer 1 Report
Please find the attached report
Comments for author File: 
Comments.pdf
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
Reviewer 2 Report
This paper proposed an adversarial attack method on object detection for RS data. Here are some issues:
1. The contribution in Introduction section should be rearranged. the proposed innovation is not reflected.
2. In P3L85, minimizing detect loss seems to be wrong.
3. Please explain in detail the difference between the proposed method and Ref 38, 39. Besides, the comparative experiments with Ref 39 should be added.
4. In Method section, I suggest first introducing the flowchart of the proposed method.
5. In Method section, I do not find an introduction on how to generate adversarial patches, please explain.
6. In Figure 5 and Figure 6. the rotation angle of adversarial random patches are different with other methods, and different methods should have the same rotation angle.
7. In Figure 7 and Figure 8, please give some examples of adversarial patch with rotation angle.
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
Reviewer 3 Report
The authors introduce the adversarial patch into the Yolo-V3 and Yolo-V5 to detect objects in remote sensing images. Several comments are given as follows:
1. Several parameters shown in the equations are not described—for example, Ci head.
2. Eq. 8 Lobj is supposed to be revised.
3. The adversarial patches with different methods are different. Could authors give more comparisons?
4. The results shown in Fig. 7 and 8 do demonstrate the feasibility of the proposed approach incorporating YOLO-V3 and YOLO-V5. Could the authors apply those methods to the same image?
5. The attack success rates (ASR) with thresholds seem to get more precise with a larger threshold. Did those defined ASRs reflect the correctness of object identification?
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
Round 2
Reviewer 1 Report
please see the attached file
Comments for author File: 
Comments.docx
Author Response
Please see the attachment
Author Response File: Author Response.pdf
Reviewer 2 Report
1. According to the author's explanation, the adversarial patch is randomly initialized. Please reflect it in Figure 2.
2.I do not find the comparative experiments with Ref 39 (Ref 42) in the new version.
Author Response
Please see the attachment.
Author Response File: Author Response.pdf
