Validated Adaptation for Aerial Crowd Monitoring at Mass Gathering Scale: A Deployment Protocol, a Severity Law, and a Diagnostic for Label-Free Drone Crowd Counting, Toward the FIFA World Cup 2034 (Saudi Arabia)
Saudi Arabia will host the 2034 FIFA World Cup and already operates crowd management at Hajj scale. Drone-based counting must hold accuracy on footage unlike anything in its training corpus, without labels, and must warn of dangerous inflow before a crush forms. We deliver a validated answer built on 525 controlled runs, a full-resolution corpus study, five falsification ablations, and a five-condition safety-interlock evaluation. Label-free adaptation recovers 31-49% of shift-induced error across four corruptions and five severities, with the strongest method gaining 41.8 MAE over the frozen source (95% CI [34.1, 49.6], p=7.5x10^-10, d=2.52). We establish a severity law separating methods with a constant absolute margin from the one whose margin grows, and a stability budget identifying which configuration is safe to fly. On a full-resolution corpus carrying a genuine +48 MAE aerial gap (source retrained to 14.6 validation MAE, a 34% improvement), adaptation repairs the dense-scene undercounting that would otherwise under-report a forming crush, and the flux-based risk module fires on real congestion episodes in 2 of 6 full-length clips. We localise the recoverable error: in a regime built to favor a physics-informed conservation prior (300-frame clips at 200ms spacing, five times wider than standard), the adaptation signal is normalisation-driven, not flow-driven; the continuity residual is invariant to the proportional counting errors domain shift produces, confirmed by four on/off ablations correlated at r=0.999 and a 40% input corruption moving accuracy by only 0.05 MAE. A label-free shift gate shows shift magnitude and accuracy damage are rank-independent (Spearman rho=0.20; rho=-0.60 among genuine shifts), quantifying the 58% of headroom a magnitude gate forgoes. We establish unconditional adaptation with tail monitoring as policy, closing with a six-point protocol.
Figures & tables
Track A
Track B
Purpose
controlled shift
real domain gap
Corpus
subset, n=750
full release, full-res
Clip length
short
300 frames
Frame spacing
40 ms
∼200 ms
Source val mae
26.1
14.6
Runs
525
ablations + risk
Table 1: The three experimental tracks. All adaptation is label-free and updates only BN parameters. Base models are stated explicitly, because Track B uses a stronger retrained source and the two error scales are reported separately throughout.
Figure 1: Adaptation across corruption severity. (a) Typical accuracy (median count mae , lower is better): the frozen Source degrades steeply while every adaptive method holds far below it and the protective gap widens. (b) Stability (worst replicate, min–max band): TENT+Ours carries the extreme tail, peaking near 113 mae at motion-blur severity 1 (best typical accuracy, widest spread). Panel (b) is the basis for the stability budget in Section 10 .
mae
Bias
Density band
Source
Adapt
Source
Adapt
n
Dense ( >291 )
194.7
98.5
−194.7
−98.4
605
Medium ( 129 – 291 )
170.1
96.2
−170.1
−96.2
591
Sparse ( ≤129 )
70.3
9.4
−70.3
−8.3
598
Table 2: Counting error and bias by scene density on the full corpus (Track B), source model versus adapted. Bias is mean (predicted − true); negative is undercounting. Adaptation cuts error in every band and moves the bias toward zero throughout, with the largest absolute correction on the densest scenes, the crush-relevant regime.
Table 3: Conservation on/off across four regimes. Δ is mae (physics on) − mae (physics off). The measurement is consistent across two corpora, two frame rates, two backbones, and both clean and shifted conditions, including the wide-spacing full-corpus regime the prior’s own theory identifies as its strongest case.
Condition
s
fires
Source
Adapt
Gate
none
0.00110
no
36.9
34.6
36.9
JPEG
0.00135
no
87.5
44.3
87.5
motion blur
0.00207
no
93.4
42.2
93.4
Gaussian
0.00655
yes
102.3
67.1
67.1
low light
0.04279
yes
81.2
46.4
46.4
mean
80.3
46.9
66.3
Table 4: Shift-gated policy. The gate fires when the label-free shift score exceeds τ=2sclean=0.0022 . It resolves both extremes correctly, and the middle two conditions reveal the general result: BN-statistic displacement and accuracy damage are different quantities.
Figure 2: The shift-gated policy, decomposed. (a) The label-free shift score against the decision threshold τ=2sclean , annotated with the error that adaptation could recover in each condition. (b) What each policy delivered against what was available. The ordering of the bars in (a) and the ordering of the gains in (b) are close to independent (Spearman ρ=0.20 ; among the four genuine shifts, ρ=−0.60 ): statistical displacement and accuracy damage are different quantities, which is the general result of Section 8 .
Condition
Source
AdaBN
TENT
Ours (phys.)
TENT+Ours
Clean
36.92±0.00
33.77±17.69
33.66±17.41
32.93±15.50
57.12±55.42
Gaussian noise
101.15±0.00
73.66±5.35
76.57±5.28
78.83±5.30
65.49±7.32
Motion blur
115.80±0.00
48.71±5.60
49.62±6.47
51.35±7.18
48.62±16.09
Low light
86.96±0.00
46.68±7.48
49.18±7.96
51.46±7.98
45.86±9.91
JPEG
80.44±0.00
47.91±5.46
49.34±5.81
50.95±6.16
47.58±7.50
Mean (4 shifts)
96.09
54.24
56.18
58.15
51.89
Table 5: Track A, reference severity. mae (mean ± std over 5 replicates). Every adaptive method beats Source on every condition. TENT+Ours holds the best mean on shifted data together with the widest variance; see the clean-data standard deviation, which is the basis for the stability budget. Lower is better; best per row in bold.
Mean mae
TENT recovered
Ours recovered
TENT+Ours recovered
Severity
Source
TENT
Ours
TENT+Ours
abs.
%
abs.
%
abs.
%
1
73.6
37.9
38.9
43.2
35.7
48.5
34.7
47.2
30.4
41.3
2
87.5
46.4
48.1
45.2
41.2
47.0
39.5
45.1
42.4
48.4
3
96.1
56.2
58.1
51.9
39.9
41.5
37.9
39.5
44.2
46.0
4
104.9
68.0
70.0
59.3
37.0
35.2
34.9
33.3
45.7
43.5
5
112.0
76.7
78.6
66.1
35.3
31.5
33.4
29.8
45.8
40.9
Table 6: The severity law ( 4 corruptions ×5 severities ×5 replicates =400 runs), pooled over corruptions. Left: mean mae per method. Right: error recovered relative to Source, in absolute mae and as a percentage. Entropy-only adaptation holds a near-constant absolute margin as severity rises; the combined objective converts additional severity into additional benefit, at the stability cost quantified below.
Automated crowd counting in Hajj video is difficult not because current models lack capacity, but because the footage violates the assumptions those models were built on: cameras observe the crowd from steep, near-vertical angles, individuals occlude one another extensively, and a single frame can contain well over a thousand people. Benchmarks that test crowd counting in such an environment are either private or not detailed per second. We revisit the HAJJv2 dataset and contribute HAJJv2-CrowdCount: per-second human-annotated crowd counts for its testing videos. Using these annotations, we benchmark three recent zero-shot counting paradigms: an open-vocabulary detector (YOLO-World), a point-based counter (APGCC), and a promptable segmentation-based counter (SAM3Count). SAM3Count attains the lowest overall mean absolute error (MAE 70.4, 95% CI 56.0-86.1), ahead of YOLO-World (92.0) and APGCC (152.9). This ordering reverses, however, in the regime most relevant to deployment: on the densest frames, the detection- and segmentation-based counters both degrade sharply (MAE exceeding 300), while the point-based counter degrades far more gracefully (MAE 114.9). This inversion is decision-relevant for Hajj crowd management, where reliable counts are needed most precisely in the densest and most occluded scenes. The annotations are released to support reproduction and extension of these results.
State-of-the-art crowd counting and localization are primarily modeled using two paradigms: density maps and point regression. Given the field's security ramifications, there is active interest in model robustness against adversarial attacks. Recent studies have demonstrated transferability across density-map-based approaches via adversarial patches, but cross-paradigm attacks (i.e., across both density map-based models and point regression-based models) remain unexplored. We introduce a novel adversarial framework that compromises both density map and point regression architectural paradigms through a comprehensive multi-task loss optimization. For point-regression models, we employ scene-density-specific high-confidence logit suppression; for density-map approaches, we use peak-targeted density map suppression. Both are combined with model-agnostic perceptual constraints to ensure that perturbations are effective and imperceptible to the human eye. Extensive experiments demonstrate the effectiveness of our attack, achieving on average a 7X increase in Mean Absolute Error compared to clean images while maintaining competitive visual quality, and successfully transferring across seven state-of-the-art crowd models with transfer ratios ranging from 0.55 to 1.69. Our approach strikes a balance between attack effectiveness and imperceptibility compared to state-of-the-art transferable attack strategies. The source code is available at https://github.com/simurgh7/CrowdGen
Learning from few labeled examples is a central challenge in tabular machine learning, and it becomes the binding constraint in domains where labeling is costly, such as crowd monitoring during Hajj and Umrah. Tabular foundation models, which predict from only a handful of examples without task-specific training, were recently introduced to address this very-few-label regime. In this study we test them on crowd-state classification to assess how much they help when labels are scarce, and we compare them against standard machine learning methods to characterize the accuracy and efficiency trade-offs between the two approaches. Using three real datasets we evaluate different machine learning models, in untuned and tuned forms, against three foundation models. Results show that no single family is best everywhere. The right choice depends on the label budget. When labels are very few, foundation models lead. As labels grow, tuned conventional models catch up and significantly surpass the foundation models on the more structural geometry target. Efficiency separates them further where tuned machine learning models incur a large tuning cost that foundation models avoid, although foundation models reprocess their context at every prediction. We summarize these results as a practical map of which approach to prefer under a given label budget and computational budget.
AlJawharh S. AlOtaibi, Mohamed Eltahir, Jude AlSubaie