MonoPure: Multi-Component Purification via Disentangled, Projective Representations for Monocular 3D Object Detection

1 Introduction

Monocular 3D object detection has gained significant attention in autonomous perception as a cost-effective method for reconstructing 3D environments from single red, green, and blue (RGB) images by leveraging appearance and geometric cues. However, the inherent challenge of recovering 3D depth from a 2D plane renders these models exceptionally sensitive to subtle feature distortions. This sensitivity makes them highly vulnerable to adversarial perturbations injected through practical channels. As illustrated in Figure 1(a), the security of monocular 3D detection systems is threatened by practical adversarial scenarios targeting both sensory data and system configurations. On-board tampering executed via malware, memory corruption, or physical interception allows an adversary to compromise the integrity of various internal components beyond simple image-level perturbations. Furthermore, transmission-level attacks exploit RSU or server communications to inject malicious data or conduct replay attacks by retransmitting outdated system metadata or environmental parameters.

∗ Corresponding author

Based on the 3D detection performance under the attack scenarios shown in Figure 1(b), state-of-the-art models such as MonoDGP [Pu et al., 2025] and MonoDETR [Zhang et al., 2023] are exceptionally susceptible to these adversarial threats. Image adversarial attacks pose a severe threat by substantially degrading detection accuracy. However, the impact becomes far more destructive under multi-component attacks, where detection performance completely fails, reaching nearzero. Such extreme sensitivity to appearance and geometric mismatches necessitates monocular 3D object detectors that incorporate robust purification methods to ensure reliable 3D reasoning under adversarial conditions.

Input-level purification provides a practical defense but shifts distribution and oversmoothes geometric cues. This hampers localization under occlusion where evidence is weak. Moreover, it fails against multi-component attacks corrupting calibration. Visual restoration alone ignores geometric inconsistencies, leading to catastrophic 3D failures. To address these problems, this work presents MonoPure, a framework for multi-component purification via disentangled and projective representations for monocular 3D object detection.

Subsequently, the keypoint detector employs a curriculum strategy that adapts from labeled data to unlabeled scenarios via masked self-training. A dual-graph network refines these predictions by enforcing intra-instance geometry and inter-instance context to mitigate occlusion. These robust keypoints are integrated into the 3D decoder via depth-KP cross-attention, serving as spatial anchors for geometric reasoning. Ultimately, fusing these structural priors with visual and depth features stabilizes 3D localization against adversarial attacks and severe occlusion. Finally, this approach exploits the observation that 2D boxes predicted by the 2D detection decoder remain largely insensitive to camera calibration attacks. Treating these boxes as reliable references, the method purifies the compromised calibration by iteratively minimizing the spatial gap between the 2D boxes reprojected from the 3D predictions and the reliable 2D detection anchors. In Figure 1(c), MonoPure remains robust under image and multi-component adversarial attacks. Our source code and appendix are available at https://github.com/yeonwoo29/ MonoPure. We summarize the contributions below:

• This work presents a monocular 3D object detection framework that, for the first time, explicitly addresses multi-component adversarial attacks that jointly corrupt input images and camera calibration parameters.
• This paper introduces a disentangled purification and segmentation module that separates backbone features into two complementary subspaces for purification and segmentation. This design removes adversarial perturbations while preserving detection-critical structures.
• This approach presents a 3D decoder with 2D skeleton keypoint detector that combines mask-enhanced selfcurriculum learning with a dual-graph 2D keypoint refinement network. This module localizes and reconstructs the keypoints under occlusion.
• This paper introduces a projective calib-purification module that iteratively narrows the spatial gap between 3D reprojections and 2D anchors to refine camera calibration parameters, ensuring robust 3D localization.

2 RelatedWork

2.1 Adversarial Attack

Vision-based perception systems for autonomous driving are highly vulnerable to adversarial attacks [Liu and Jiang, 2025; Zhu et al., 2023; Kou et al., 2023], and the attack surface is rapidly expanding. Beyond image-only perturbations [Zhang et al., 2025; Chen et al., 2024], recent studies show that autonomous-driving perception can be attacked by corrupting sensory inputs and system parameters [Cheng et al., 2022]. Yet, despite the safety-critical role of monocular 3D object detection, adversarial robustness remains underexplored in this domain. Existing efforts mostly focus on single-component attacks that target either the input image [Li et al., 2023] or camera calibration parameters [Zhou et al., 2021]. In practice, such access is often realistic, as both sensory inputs and system parameters are exposed. Unlike single-component attacks, multi-component attacks couple image perturbations with calibration corruption, causing severe projection inconsistencies and making 3D reasoning highly unstable. Therefore, MonoPure is designed to explicitly target multi-component threats by unifying the handling of image-level and system-level corruption, enabling robust monocular 3D detection.

2.2 Adversarial Purification

Adversarial attacks pose a serious threat to vision-based perception systems, prompting extensive research on input-level purification as a practical defense. Prior work has explored learning-based purification, including autoencoder-style reconstruction [Niu and Yang, 2023] and diffusion-based denoising [Yoon et al., 2021; Kang et al., 2024; Choi et al., 2024]. However, most diffusion-based purification methods have been developed for image classification [Lei et al., 2025] and segmentation [Lee et al., 2024], where preserving global semantics is often sufficient. In monocular 3D detection, generic purification can blur object-level geometric cues and destabilize 3D localization. To address this, MonoPure uses target region probability maps for object-centric purification and disentangles reconstruction and segmentation features to enable task-aware denoising that preserves geometry-critical cues. Moreover, monocular 3D object detection is vulnerable to calibration attacks that perturb camera intrinsics and distort 3D geometry, but existing purification methods do not handle attacked calibration parameters. MonoPure purifies both images and calibration. In addition, since real-time inference is critical in this field, MonoPure enables fast purification compared to iterative diffusion-based defenses.

2.3 Monocular 3DObject Detection

Monocular 3D object detection [Liu et al., 2025] has attracted considerable attention because it is cost-efficient and simple to deploy compared to LiDAR- [Gambashidze et al., 2024] or multi-view [Xue et al., 2025; Qi et al., 2025] systems. Early approaches [Chen et al., 2016] impose geometric constraints by aligning 2D detections with projected 3D bounding boxes. More recent transformer-based methods [Shi et al., 2025] improve depth reasoning and localization by applying the global context and learned geometric priors. However, these detectors remain fragile when input is corrupted, and performance can degrade sharply under adversarial perturbations or occlusion [Lin et al., 2024]. To address this, MonoPure bridges these lines of research by unifying adversarially robust purification and occlusion-robust skeleton keypoint cues. It improves reliability against adversarial perturbations through purification and tackles occlusion using skeleton keypoint cues.

3 Method

3.1 Overview

Figure 2 presents MonoPure, a robust monocular 3D object detection framework designed to withstand multi-component adversarial attacks that jointly corrupt the input image and camera calibration. Given an attacked image, MonoPure employs a disentangled module that separates purification and segmentation representations, using segmentation-aware guidance to suppress adversarial noise while preserving the structure for detection. Following MonoDGP [Pu et al., 2025], the purified features are processed using a visual encoder for 2D localization and a depth encoder for geometric reasoning [Duan et al., 2019]. MonoPure employs a 3D detection decoder with occlusion-robust 2D skeleton keypoints, using object-level spatial cues and refined semantic keypoint guidance to stabilize 3D localization under occlusion. Finally, MonoPure corrects compromised intrinsics at inference by minimizing the reprojection error between 3D-to-2D projections and 2D detection boxes, providing geometrically consistent 3D predictions.

3.2 Disentangled Image-purification and Segmentation

To improve robustness against attacked input, this work introduces a disentangled purification and segmentation module (Figure 3). Conventional purification can often be overly aggressive in denoising, blurring object boundaries and weakening appearance-geometry correlations. Motivated by taskspecific disentangling [Yang et al., 2021], we explicitly separate the encoder representation into a purification feature fp for reconstruction and a segmentation feature fs for detection-oriented structure learning.

This approach trains a disentangling encoder that splits the shared representation into channel-wise subspaces, using task-driven objectives for each branch and an independence constraint that reduces feature correlation. Given an attacked image, fp is input into a reconstruction decoder to obtain a restored image. Next, fp is decoded by the reconstruction decoder to produce an image Ir, and a clean segmentation feature fs is then extracted from the purified Ir. This procedure directly reconstructs the image from the encoded features, which can substantially reduce the number of costly denoising steps required by the subsequent diffusion purifier.

Target-Probability guided Diffusion Purifier. This work encodes the restored image into the latent space using a variational autoencoder E [Hinton and Salakhutdinov, 2006], producing a latent code z0. Next, this work applies the forward diffusion process to obtain zt, which is input into the diffusion denoiser. At this time, fp is routed to the reconstruction branch and applied to produce a restored image, which is refined using the target-guided diffusion purifier. To generate guidance, this work applies convolution layers followed by a squeeze and excitation (SE) block [Hu et al., 2018] to emphasize the foreground structure and suppress irrelevant background responses. The resulting spatial probability map R, consisting of probability values between 0 and 1, guides the diffusion denoising process by focusing the refinement on detection-relevant regions, and is computed as follows:

where P(·) denotes global average pooling, ⊙ represents channel-wise multiplication, ∗ indicates a convolution operator, and · signifies matrix multiplication. Moreover, W1 and W2 denote learnable convolutional parameters for the gating and spatial projection. zt and the probability map R are fed into the diffusion denoiser, as formulated below:

where fθ is the consistency model parameterized by θ that predicts the clean latent code, and c represents the auxiliary conditioning signals and other contexts. Furthermore, ˆ ϵθ (·) indicates the noise prediction of the denoiser, and αt represents the cumulative noise schedule at timestep t.

To ensure efficiency, this work performs diffusion in the latent space and adopts low-rank adaptation (LoRA) [Hu et al., 2022] to specialize a pretrained Stable Diffusion [Rombach et al., 2022] denoiser for purification with only a few training parameters. Specifically, this work implements LoRA adapters in Stable Diffusion layers and optimizes them using a latent consistency objective. To our knowledge, MonoPure is among the first attempts to apply a target-region probability map as spatial guidance in diffusion-based purification for monocular 3D detection. This approach defines a consistency target ztarget from a teacher denoising trajectory and trains the student to match it in a single step. The LoRA loss is:

Trained with the LoRA loss, the Stable Diffusion model performs L purification iterations. Ultimately, through this process, we obtain zp 0 .

Segmentation Step. To support 3D object detection, the proposed module predicts a segmentation feature and employs it as a guide. The segmentation branch is derived from the encoder output, normalized using a convolutional network with group normalization, and passed through the segmentation decoder to obtain fs. We then multiply fs by the targetregion probability map R to emphasize detection-critical regions. Segmentation can occasionally be unreliable under strong attacks; thus, this work introduces a confidence-driven filtering mechanism based on the SE block. This approach inherently derives purified features through disentangled representations and secures a reliable segmentation feature by utilizing an SE block to preemptively suppress erroneous extractions during 3D localization.

3.3 3DDetection Decoder with Occlusion-robust 2D Skeleton Keypoint

This section explains how MonoPure predicts and refines occlusion-robust 2D skeleton keypoints for 3D localization. This module is built around three key elements, namely a mask-enhanced 2D keypoint detector, self-curriculum learning, and dual-graph 2D keypoint refinement. MonoPure separates the 2D and 3D detection decoders to balance reliable 2D localization and geometry-aware 3D reasoning, using fs as a shared structural cue. The visual encoder extracts appearance features for 2D localization, whereas the depth encoder provides depth features for geometry-aware reasoning. The 2D decoder further predicts occlusion-robust 2D skeleton keypoints and object-level spatial cues. The refined 2D keypoints are then injected into the 3D decoder through depth-KP cross-attention, serving as object-level geometric anchors for 3D localization.

Mask-enhanced 2D Skeleton Keypoint Detector. This work adopts CenterNet [Duan et al., 2019] as the 2D detection decoder and keypoint heatmap-based detector. Using the 2D bounding boxes predicted by the 2D detection decoder as priors, the detector predicts I keypoint heatmaps { ˆHi}Ii=1 with ˆHi ∈ RS×S . This approach initializes the mask-enhanced 2D keypoint detector on labeled source data DL by minimizing the mean squared error (MSE) between predicted heatmaps and Gaussian heatmaps rendered from ground-truth keypoints H. Next, this method improves occlusion robustness by initializing training with mask augmentation, sampling a rectangular occlusion mask m ∼ Pocc, where Pocc reflects source-domain occlusion statistics, and applying A(x;m) to zero out the masked region. The initialization objective is:

Following this initialization, a curriculum learning strategy is adopted that progressively adapts the model from labeled source data to more challenging unlabeled target scenarios. This scheme applies the detector to the unlabeled target set DU and refines the raw predictions using the dualgraph refinement network (DGR-Net). This approach retains pseudo-labeled keypoints as S(x) = {i | σi > 0.5} with Kx = |S(x)| and retrains the detector using both labeled and pseudo-labeled data:

Keypoint pseudo-labels are filtered by confidence. For unlabeled data, masking was disabled during self-training to avoid amplifying pseudo-label noise. The pseudo-label loss is:

This iterative curriculum learning process ensures stabilization on reliable pseudo-labels and continues until the entire dataset is labeled. All training is done off-line, and during inference, this approach applies only the mask-enhanced 2D keypoint detector and DGR-Net using trained models.

Dual-Graph 2D Keypoint Refinement. DGR-Net refines initial 2D keypoints via a hierarchical spatial reasoning strategy that models both local geometric constraints and global scene context. This dual-branch architecture is motivated by the fact that keypoint accuracy depends not only on an object's rigid topology but also on its spatial interactions with neighboring instances, especially under occlusion.

Given the initial keypoints Kinit = {ˆ kinit i }Ki=1 , this approach builds an object-specific graph whose nodes are keypoints and whose edges follow a fixed adjacency matrix defined by the canonical skeletal topology. Using this structural prior, a lightweight GCN propagates geometric cues to predict intra-instance offsets ∆Kintra = {∆ˆ kintra,i}Ki=1 .

This approach builds a dynamic neighbor graph for each image to resolve ambiguities induced by scene-level interactions. Each node represents an object instance, and the edges are adaptively established between spatially proximal objects based on 2D centroid distances. Features from these neighboring nodes are aggregated via a GCN to compute inter-instance offsets: ∆Kinter = {∆ˆ kinter,i}Ki=1 .

The final refined keypoints are computed as Kref = Kinit + ∆Kintra+∆Kinter. This work follows the standard GCN [Kipf and Welling, 2017] protocols regarding layer depth and neighborhood definitions to maintain lightweight computation while ensuring training convergence.

DGR-Net is trained exclusively on labeled data DL by minimizing the Smooth ℓ1 loss between the refined keypoints and the ground-truth keypoints Kgt . We adopt this loss function to strike a balance between robustness against large coordinate outliers and stable, oscillation-free convergence for small residual errors during the fine-grained refinement process, which is formulated as follows:

3D Detection Decoder. The 3D detection decoder integrates depth cues and structural priors via depth and depth-KP cross-attention layers. The depth-KP cross-attention layer applies the refined keypoints Kref from the previous stage. This approach employs the depth features fd ∈ RN×D as queries and refined keypoints Kref ∈ RN×D as keys or values, where N denotes the number of feature tokens. The cross-attention yields the refined depth feature ˜ fd as follows:

where D denotes the feature (embedding) dimension. Moreover, WQ, WK and WV ∈ RD×D are learnable linear projection matrices for the query, key, and value, respectively.

Next, the 3D detection decoder Dec(·), which consists of inter-instance self-attention, visual cross-attention, and a feed-forward network, is applied to compute the final 3D box X3D as follows:

where ϕ ∈ R3×4 denotes the camera calibration parameters, fv denotes the visual encoder feature.

3.4 Projective Calib-purification

Although the 3D decoder enforces internal geometric consistency, accurate calibration is critical for 3D localization. In monocular detection, calibration bridges the 3D scene and 2D image plane; thus, adversarial distortions can cause severe localization errors even when image features are extracted well [Veicht et al., 2024]. Projecting 3D predictions onto the 2D plane visualizes mismatches with reliable image-based anchors. Therefore, purifying corrupted calibration parameters is crucial to restoring geometric alignment for robust 3D localization.

The proposed method relies on the fact that image-based 2D detection results remain invariant to changes in camera calibration parameters. For each 3D vertex with homogeneous coordinates X3D = [X, Y, Z, 1]T , the 2D pixel coordinate X2D = [u, v]T is obtained by the perspective projection:

where π(·) denotes the perspective projection operator that performs depth scaling to obtain the final pixel coordinates.

The eight projected vertices are determined using X2D and are employed to derive the 2D axis-aligned bounding box B3D→2D, representing the 2D footprint of the predicted 3D structure. The coordinates of B3D are transformed into eight corner coordinates, which are projected onto 2D coordinates using Eqs. (12) and (13), yielding {uj}8j=1 and {vi}8i=1 . Based on these projected values, the projected 2D bounding box B3D→2D is defined to encompass the corners of B3D as follows:

where umin and umax denote the minimum and maximum uvalues of uj . Further, vmin and vmax denote the minimum and maximum v-values of vi. This method minimizes reprojection loss by enforcing intrinsic constraints that strictly restrict all camera parameters from exceeding the physical boundaries of the image resolution. It ensures focal lengths and the principal point stay within the image frame size. To enhance the consistency between B3D→2D and B2D and reduce outlier corners outside B2D, the loss is expressed as follows:

Crucially, errors in 2D detections do not affect the 3D-to2D projection, enhancing robustness. This work updates the parameters until the reprojection loss converges using backpropagation Lreproj via the differentiable projection layer:

where η = 10-4 represents the learning rate, and ϕt+1 denotes the purified parameters for the next step. The iterative process terminates after the reprojection loss has sufficiently converged. Despite severe system-level distortions, MonoPure purifies calibration and ensures robust 3D localization by minimizing the 3D-to-2D projection gap.

4 Experiments

4.1 Dataset

The experiments were conducted on two autonomous-driving datasets: KITTI [Geiger et al., 2013] and nuScenes [Caesar et al., 2020]. The KITTI dataset contains 7,481 annotated images, with 3,712 images for training and 3,769 images for validation, following the standard split. The nuScenes dataset was employed under a monocular setting with frontview camera images, where 28,130 images were for training and 6,019 images for validation. Following DEVIANT [Kumar et al., 2022], this work adopts a KITTI-style data split for nuScenes to enable a fair evaluation protocol. Across all datasets, only monocular RGB images and camera calibration information were used during training and inference. The experimental results were evaluated using the 3D average precision metric with 40 recall positions.

4.2 Experiment Settings

Training Settings. MonoPure was trained for 95 epochs with an initial learning rate of 2e-4 and a batch size of 1 on a single RTX-4080 GPU, using the AdamW optimizer with weight decay. In the disentangled image-purification and segmentation module, the disentangling encoder adopted ResNet50 [He et al., 2016] as the feature backbone. For diffusion model training, Stable Diffusion [Rombach et al., 2022] was employed as the base model and fine-tuned via LoRA [Hu et al., 2022] with the TCD scheduler [Zheng et al., 2024]. Training was conducted with a batch size of 2 for 1,000 steps, using an initial learning rate of 1e-4. During this process, only the LoRA parameters were updated. With the LoRA fine-tuned Stable Diffusion model, the number of purification iterations is set to L=1, and additional analyses under varying L are provided in Appendix A.

Attack Settings. This work considers a strong adversarial setting in which the attacker has full access to the input images, camera calibration parameters, visual/depth encoder, and 2D/3D detection decoder. This work uses MIFGSM [Dong et al., 2018] and PGD [Madry et al., 2017], widely used adversarial attacks, to attack the input images and camera calibration parameters for adversarial evaluation. The perturbation strength is controlled by an ℓ∞ norm bound with ϵ = 32, following standard practice in adversarial attacks. Unlike an adversarial learning approach, MonoPure performs purification without any prior knowledge of the attack, and its purification remains effective against unseen adversarial attacks. Appendix A provides additional comparison results on universal adversarial perturbations (UAP) attacks [Moosavi-Dezfooli et al., 2017], as well as results for a wider range of ϵ values.

4.3 Result and Analysis

All experiments apply image purification under image attacks, calibration purification under calibration attacks, and no purification under clean settings. For fair comparison, this work reports results of prior monocular 3D detectors on purified images. Methods marked with * use Stable Diffusion with the TCD scheduler for purification when image attacks are present. For multi-component attacks, we additionally report prior detectors with MonoPure's calib-purification denoted in parentheses (·), as no existing method purifies attacked camera calibration parameters. Bold text indicates the best, and underlined text indicates the second-best results.

Table 1 reveals that the proposed method achieved the best accuracy across adversarial and clean settings. The approach surpasses prior SOTA across three difficulty levels. Under a single-component attack, across attack methods, MonoPure improved over the second-best method by an average of 3.68%p across difficulty levels on AP3D and APBEV . Notably, the multi-component attack is highly destructive. All prior methods collapsed to near-zero performance. In contrast, the proposed approach retained strong detection performance, with pronounced gains in APBEV . The method consistently maintains strong performance under adversarial attacks and clean settings. Appendix A provides additional quantitative results on pedestrian class, showing that MonoPure achieves SOTA performance with the same trend as in Table 1.

In addition to the quantitative analysis, Figure 6 presents qualitative visual comparisons among MonoDETR, MonoDGP and MonoPure under adversarial and clean settings. Under the multi-component adversarial attack, where the camera calibration parameter is adversarially perturbed, MonoDETR and MonoDGP displayed pronounced geometric distortions, with the 3D bounding boxes in the top KITTI image appearing vertically misaligned. Likewise, under the single-component adversarial image attack, the BEV visualizations revealed that image-space perturbations substantially disrupt object detection in MonoDETR and MonoDGP, leading to missing 3D bounding boxes or inaccurate localization. In contrast, MonoPure remained robust to calibration and image attacks, producing stable predictions and 3D bounding boxes that remained closely aligned with the ground truth annotations. Moreover, under the clean setting, MonoPure consistently demonstrates strong performance, remaining particularly robust in occluded scenarios by using keypoint-based spatial cues. Appendix B provides additional qualitative visualizations of detection results and skeleton keypoints on the KITTI and nuScenes datasets.

To verify that the observed robustness trends are consistent beyond KITTI, this work evaluates MonoPure on nuScenes (Table 2). Consistent with the results in Table 1, MonoPure achieved SOTA performance across all attack scenarios and in clean settings. Notably, under the multi-component attack, MonoPure retained meaningful detection accuracy, yielding dramatic performance improvement. Limitations and future work are discussed in Appendix D.

4.4 Efficiency

Figure 7 compares the complexity of monocular 3D object detectors, evaluated in terms of the number of training parameters, FLOPs, and latency. MonoPure maintained a comparable number of training parameters to prior methods due to LoRA. Although MonoPure uses slightly more parameters, its model size remains practical for deployment on invehicle automotive platforms (e.g., NVIDIA DRIVE AGX Orin), enabling real-time inference with around 50M parameters. Notably, MonoPure achieved the lowest FLOPs and latency, making it suitable for real-time deployment. This efficiency is fostered by performing purification and detection at half-resolution of input images, parallelizing the visual encoder and depth encoder, and sharing a 2D detection decoder with the 2D keypoint detector.

4.5 Ablation Study

Each component is crucial under the multi-component adversarial attack (Table 3). Removing the disentangled imagepurification and segmentation module or the projective calibration purification caused a catastrophic decrease in AP3D, to under 1, indicating that image and calibration purification are necessary for reliable 3D detection. In addition, the occlusion-robust keypoint-based 3D detection decoder consistently improved performance, confirming its role in mitigating occlusion-induced ambiguities. Appendix A provides additional ablation studies on the nuScenes dataset, which show trends similar to those observed on KITTI. It also reports detailed quantitative evaluations for each of the three components ablated in Table 3.

5 Conclusion

This paper addresses the vulnerability of monocular 3D object detection to challenging multi-component adversarial attacks, where images and camera calibration parameters are compromised. To address this problem, this work proposes MonoPure, which performs detection-aligned image purification by combining a disentanglement-based design with a target-region probability map. Moreover, MonoPure presents a 3D detection decoder that improves structural robustness under occlusion by using 2D skeleton keypoints. Finally, it purifies corrupted camera calibration parameters via a 2D box reprojection constraint. Across diverse attack settings, including multi-component adversarial attacks, MonoPure achieved real-time SOTA performance.

Acknowledgements

This work was supported by the IITP grant funded by the Korea government (MSIT) (RS-2022-00156287, RS-202300256629, RS-2024-00437718, RS-2026-25619158).

Contribution Statement

Yeon Woo Cho, Jung Woo Cheon, Seung-hyeok Back contributed equally to this work.