Hierarchical convolution stages

ConvNeXt keeps the classic convolutional pyramid. A patchify stem first downsamples the 224×224 image to a 56×56 feature map, then four stages run in sequence. Each stage halves the spatial resolution (56 → 28 → 14 → 7) and roughly doubles the channel count (192 → 384 → 768 → 1536), trading where for what: fine spatial detail early, abstract semantic features late.

Every feature is computed by a kernel applied identically across all positions — locality and weight-sharing. Unlike a transformer, the receptive field starts tiny and grows only with depth, which is the inductive bias that makes CNNs data-efficient.

Large-kernel depthwise blocks

The modern part is inside each block. A ConvNeXt block leads with a 7×7 depthwise convolution — one filter per channel — so it reads a wide spatial context cheaply, echoing a transformer's wide view without leaving convolution. That is followed by a pointwise inverted bottleneck (expand channels 4×, GELU, project back), with far fewer activation and normalization layers than a ResNet bottleneck.

ConvNeXt-V2 adds Global Response Normalization (GRN), which encourages channels to specialise and was co-designed with the masked-autoencoder pretraining. The result is a pure-conv block that borrows the recipe, but not the attention, of transformers.

Masked-autoencoder pretraining, then fine-tune

The backbone is pretrained with FCMAE — a fully-convolutional masked autoencoder that hides most of the image and learns to reconstruct it — on ImageNet-22k, with no labels. This gives strong general visual features before a single weapon is seen.

We then fine-tune the whole network on the nine weapon classes. Because nothing is gated or frozen and there is no external dependency at inference, ConvNeXt-V2 is self-contained — which is why it is the primary model behind the live workshop on this page.

ConvNeXt-V2 is the strongest modern convolutional family, and it ships with masked-autoencoder pretraining, so like DINOv3 it transfers well from few images. It is also fully self-contained at inference — no gated backbone, no external download — which is why it is the model behind the live workshop on this page.

It is the convolution counterpart to DINOv3 in a deliberate head-to-head. If a pure-convolution model and a pure-attention model land within a point of each other on clean data, the dataset — not the architecture — is the ceiling.

Unlike DINOv3, the whole network is fine-tuned. At 198 M parameters it is large, but it still fits in 12 GB with fp16 and batch size 16. A smaller learning rate (1e-4) keeps the pretrained features from being washed out on so few images. The same heavy augmentation applies — the online transforms plus the DiffuseMix corpus that expands the clean training set about fivefold — to widen the limited data.

As with DINOv3 we keep the best-validation checkpoint. Clean-split accuracy peaks at epoch 14 (96.9%) and declines afterward; the headline number is that peak, and the curve below makes the selection explicit.

Before trusting any accuracy number we checked the dataset itself. A perceptual-hash audit compared every image to every other and found 82 train↔val duplicate pairs — roughly half of the validation set are near-identical copies of training images. The models had effectively already seen part of the test set, so every number on the official split is optimistic. This is a normal data-quality issue in scraped datasets, not anyone's mistake.

So we built a leakage-proof split by construction: de-duplicate within each class (union-find over the perceptual hashes, keep the highest-resolution copy), then re-split 80/20 stratified with a fixed seed. 221 of 714 images — nearly 1 in 3 — were duplicates, leaving 493 unique images (395 train / 98 val). The originals are untouched and every change is logged. From here, accuracy means performance on genuinely unseen weapons.

The full leakage audit and de-duplication figures are on the case-study overview. Every metric below is reported on both splits so the inflation is visible.

The deck shows one accuracy number; here is the full picture. Each metric appears on the leaky original split (n=143) and on the clean, leakage-proof split (n=98). Values are computed from the saved best-checkpoint predictions: precision/recall/F1 are macro-averaged over the nine classes, ROC-AUC and specificity are one-vs-rest then averaged, and MCC is the multiclass Matthews coefficient.

Per-class precision, recall and F1 on bothsplits — the macro figures above are the unweighted mean of each table's rows. Every miss sits in the long-gun group; blades and the handgun are perfect on both.

Original (leaky) split · n=143

Clean (leakage-proof) split · n=98

On the clean split ConvNeXt makes only 3 mistakes out of 98 — two grenade launchers read as a bazooka, one rifle read as an SMG. Every error is inside the long-gun group; knife, sword and handgun are perfect.

Stack the models weak-to-strong and the leakage gap collapses: the weak Inception+LogReg baseline drops ~12 points from the leaky to the clean split, while the two frontier models barely move. On the clean split DINOv3 and ConvNeXt — attention versus convolution — disagree on just 2 of 98 images. McNemar's exact test gives p = 0.50: the difference is not significant. They are tied, not ranked. When two opposite designs land in the same place, the dataset, not the model, is the ceiling.

These are closed-set models: shown any image they must pick one of the nine weapon classes, even when there is no weapon in frame. We tested 27 everyday objects — cows, planes, vintage cars — and the classifier labelled every single one as a weapon. Its most confident mistake was a purple-painted cow called a "sword" at 85%.

There is a signal to lean on: on real weapons confidence sits around 96%, on the non-weapons it falls to a median of ~55%. A confidence threshold near 0.80 would reject 26 of the 27 non-weapons — a good first defence, not a solution (the purple cow still sails through). The proper fix is an explicit "no weapon" class, and for real security use you would tune the threshold toward catching every real weapon.