Fluently Lying: Adversarial Robustness Can Be Substrate-Dependent

A study posted to the arXiv preprint server reports the first evidence that adversarial failure modes in object detectors can depend on the underlying computational substrate, challenging a foundational assumption in machine-learning security [1][2]. The work, initially submitted on 1 April 2026 and later withdrawn on 16 June 2026, examined how spiking neural network (SNN) object detectors behave under adversarial attack [1][2]. The authors, led by Daye Kang, observed a counterexample on a single model, EMS-YOLO, subjected to standard Projected Gradient Descent (PGD) [1][2]. Under attack, the model retained more than 70% of its detections while its mean average precision (mAP) collapsed from 0.528 to 0.042 [1][2]. The researchers termed this phenomenon Quality Corruption (QC), distinguishing it from the detection suppression that dominates untargeted evaluation [2]. The finding contradicts the widely held assumption that when adversarial accuracy degrades, detection count drops in tandem [2]. The study notes that this coupling had been assumed, not measured [2]. Across four SNN architectures and two threat models—l-infinity and l-2—QC appeared only in EMS-YOLO [2]. On that model, all five standard defense components failed to detect or mitigate QC, suggesting the defense ecosystem may rely on a shared assumption calibrated on a single substrate [2]. The paper was posted on arXiv, an open-access repository of electronic preprints that, as of November 2024, receives about 24,000 submissions per month [8]. Preprints on arXiv are moderated but not peer-reviewed [8]. The study’s withdrawal notice indicates that no PDF is available for the revised version [1]. The abstract and metadata remain accessible through the repository’s version history [1][2]. The results carry implications for the broader adversarial-robustness community, which has built monitoring and defense tools around the expectation that accuracy loss and detection-count loss move together [2]. The identification of a substrate-dependent failure mode—one that preserves detection count while hollowing out precision—raises questions about the generality of current defense evaluations [2]. The authors frame the work as a first step, noting that QC was observed on only one of four tested detectors, and call for further investigation across additional architectures and threat models [2].