{"id":"905d0363-47bf-403b-9237-034762c465de","arxiv_id":"2506.18591","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SpaNN detects adversarial patches by clustering binarized first-layer feature maps across a sweep of saliency thresholds and feeding the cluster curves into a small CNN.","lead":"SpaNN is a new detector that spots adversarial patches on CNNs by tracking how clusters of highly activated neurons change across many saliency thresholds instead of using one fixed threshold. It reports strong detection accuracy on object detection and image classification, including for attacks with multiple patches.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Multi-patch evaluations use reflected or rescaled copies of a single optimized patch, so the claimed accuracy for \"any number of patches\" is not tested against independently or jointly optimized multi-patch attacks.","rationale":"The reader's weakest assumption already identifies the synthetic multi-patch attacks as the main gap, and my read agrees. The load-bearing point is that the central multi-patch claim generalizes from reflected or rescaled copies of a single optimized patch to arbitrary numbers and configurations of independently optimized patches. The paper's own Appendix D admits the multi-patch attacks are not optimized, and Table III confirms their low effectiveness. That does not make the method wrong, but it means the headline claim is currently conditional on an untested adversarial model. I considered the adaptive-attack gradient details as an alternative concern, but the multi-patch threat model is more directly tied to the paper's central claim and is the one the authors themselves flag. I therefore keep the reader's CONDITIONAL verdict unchanged.","tokens_in":25384,"tokens_out":4974,"duration_ms":63285,"concrete_test":"Construct a multi-patch attack in which two or three patches are jointly optimized with independent pixel patterns and independent locations, without reflection symmetry, using e.g. projected gradient descent over disjoint regions. Rerun SpaNN under the same protocol as Table I and report detection accuracy for effective attacks. If accuracy falls below the claimed 86.13% (object detection) or 96.64% (classification), the \"any number of patches\" claim is not supported; if accuracy remains comparable, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that SpaNN detects patch attacks with at least 86.13% accuracy on object detection and 96.64% on image classification for any number of patches. The multi-patch evidence for this claim rests on attacks that are not independently optimized. In Appendix D the authors state that their multiple-patch attacks are not optimized, and Table III shows the resulting weakness: on INRIA, attack effectiveness drops from 0.8090 for a single patch to 0.5139 for a double patch. For object detection, the two patches are diagonally reflected copies of the same 10% region, with identical pixel content; for image classification, extra patches are symmetrically reflected copies of the same optimized region. Thus the experiments vary the number of copies of one adversarial object, not the number of independently chosen adversarial perturbations. Consequently, the high detection accuracy for double and quadruple patches in Table I could depend on the specific reflection/placement geometry or on the relative weakness of these attacks, rather than on a true invariance of SpaNN's clustering features to the number of patches. The claim is also extrapolated beyond the tested range of one, two, and four patches, with four patches tested only for classification, not object detection. This is a scope gap rather than an internal inconsistency: the mechanism is plausible, the method is described in sufficient detail to reimplement, and the single-patch and unseen-patch evaluations are more convincing. But the multi-patch threat model, which is the paper's headline contribution, is not yet supported by the submitted evidence.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SpaNN, a detector for adversarial patch attacks on CNNs. It extracts a shallow-layer feature map, binarizes it at multiple saliency thresholds, applies DBSCAN to each binarized map, and feeds the resulting cluster statistics (number of clusters, mean intra-cluster distance, standard deviation, number of important neurons) as four threshold-dependent curves to a small CNN classifier. The authors claim that SpaNN detects patch attacks with at least 86.13% accuracy for object detection and 96.64% for image classification, for any number of patches, and that its computational cost is independent of the number of patches. They evaluate against Themis, Jedi, NAPGuard, and ObjectSeeker on INRIA, Pascal VOC, ImageNet, and CIFAR-10, and additionally report adaptive-attack experiments, feature-ablation and SHAP analyses, and an unsupervised one-class variant.","tokens_in":25655,"tokens_out":4591,"duration_ms":47854,"significance":"If the claimed detection accuracy holds for genuinely arbitrary multi-patch attacks, SpaNN would be a practically valuable defense: it avoids a fixed saliency threshold, is simple to implement, and is computationally cheap. The paper ships code, evaluates on unseen patch types (DM-NAP, GAP GL2/GL3, UAP), includes a one-class variant that does not use attack samples during training, and provides a clear computational-cost analysis. However, the central multi-patch claim is currently supported only by multi-patch attacks that are reflected or rescaled copies of a single optimized patch, not by jointly optimized attacks, so the practical significance for arbitrary multi-patch adversaries remains uncertain.","major_comments":[{"comment":"The multi-patch attack evaluations use reflected or rescaled copies of a single optimized patch, not jointly or independently optimized multi-patch attacks. For object detection, the two patches are 'diagonally reflected from each other' and have the same pixel content; for image classification, extra patches are 'symmetrically reflected' copies of the same optimized region. Appendix D explicitly states that 'we do not optimize these attacks and instead rescale, reshape, and translate attacks optimized under the single-patch scenario,' and Table III shows that the double-patch attack on INRIA is substantially weaker than the single-patch attack (effectiveness drops from 0.8090 to 0.5139). Because the paper's headline claim is that SpaNN detects attacks 'for any number of patches,' the current evidence does not establish that the clustering-feature signature separates clean images from images containing multiple distinct, jointly optimized adversarial patches. Please add experiments with jointly optimized multi-patch attacks, or explicitly restrict the claim to attacks composed of replicated copies of a single patch.","section":"Section V-A and Appendix D"},{"comment":"The claim of detection accuracy 'for any number of patches' is extrapolated from experiments with one, two, and four patches, and for object detection only one and two patches are tested. While the computational cost of SpaNN is, by construction, independent of the number of patches, the detection accuracy for other counts (e.g., three, five, or ten patches) is not established. The authors should either test additional patch counts or qualify the claim to the tested range, e.g., 'for the tested numbers of patches.'","section":"Section I, contribution (ii); Section V-A"},{"comment":"The adaptive-attack evaluation covers only single-patch attacks on object detection (INRIA). Since the paper's main novelty is multi-patch detection, the robustness claim against an adaptive attacker is untested in the multi-patch setting. An adaptive attacker that jointly optimizes multiple patches while accounting for the detector could plausibly produce feature-map statistics that are harder to distinguish from clean inputs, especially because the multi-patch training/evaluation attacks are not jointly optimized. Please extend the adaptive-attack evaluation to multi-patch attacks or clearly scope the robustness claim to the single-patch adaptive setting.","section":"Section V-E"}],"minor_comments":[{"comment":"Table I reports attack detection accuracy using the 'best-performing setting' for each detector, which compares methods at different operating points. The ROC curves are informative, but the accuracy numbers would be easier to interpret if the authors also reported accuracy at a fixed false-positive rate or a fixed detection threshold.","section":"Section V-D, Table I"},{"comment":"The decision threshold for the AD network output is not specified. Please state the threshold used for SpaNN's reported accuracy figures, or clarify that the ROC curve's operating point was selected on a validation set.","section":"Section V-B"},{"comment":"The feature-motivation study in Section III-B uses a random subset of 3,334 ImageNet validation images, and Section V-B later trains and evaluates SpaNN on a different subset of the same ImageNet validation set. This shared distribution is a mild design circularity; its impact is mitigated by the additional evaluations on CIFAR-10 and unseen attacks, but it should be acknowledged explicitly.","section":"Section III-B"},{"comment":"The column header 'Default OCC (DM-NAP)' is ambiguous; it appears to list two numbers (default and one-class variant) under each ensemble size. Please separate 'Default' and 'OCC (DM-NAP)' into distinct columns for readability.","section":"Table II"},{"comment":"The symbol B is used both for the set of thresholds and for the binarized feature maps (e.g., 'for βb ∈ B ... Bb := M ≥ t'). Consider using a different notation, such as B_b for binarized maps, to avoid confusion.","section":"Algorithm 1 and Section IV-A"}],"recommendation":"major_revision","confidential_remarks":"The paper presents a plausible and well-engineered method, and the single-patch results are strong. The main concern is that the central multi-patch claim is supported only by synthetically replicated single-patch attacks, not by jointly optimized multi-patch attacks. This is fixable with additional experiments or careful claim qualification, which is why I recommend major revision rather than rejection. The authors should also be asked to justify the 'any number of patches' wording given the limited tested counts."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, this is a real new idea: instead of choosing one saliency threshold to find adversarial regions, SpaNN sweeps a set of thresholds, runs DBSCAN on the binarized first-layer feature maps, and feeds the cluster-statistic curves to a small CNN. That is a clear departure from fixed-threshold detectors like Themis, Jedi, and Z-Mask. Second, the single-patch evaluation on four datasets, two tasks, with multiple baselines, is solid. The code is available. The tests on unseen patch types (DM-NAP, GAP, UAP) and the one-class variant are good extras and make the core mechanism more believable.\n\nThe soft spot is the multi-patch evaluation. The paper's key selling point is detecting multiple patches, but the double and quadruple patches are reflected or rescaled copies of one optimized patch. The authors admit in Appendix D that these attacks are not optimized for the multi-patch setting. Table III shows the consequences: on INRIA, single-patch effectiveness is 0.8090, double-patch drops to 0.5139. So the clustering signature might be separating strong from weak attacks, not attacks with a different number of patches. The claim that accuracy holds 'for any number of patches' is extrapolated from one, two, and four patches, with object detection only tested up to two. The adaptive attack evaluation is a step in the right direction but omits details on how gradients are handled through the non-differentiable binarization/DBSCAN steps, so it is not yet a full white-box adaptive story. Minor point: the features were motivated using a subset of the ImageNet validation set that was later used for training and evaluation; a small design-circularity, not a fundamental flaw.\n\nNone of this sinks the paper. The central mechanism is plausible, the method is described in enough detail to reimplement, and the single-patch results are convincing. What's missing is a proper multi-patch threat model: jointly optimized or at least independently optimized patches. That's a scope gap, not an internal contradiction. I'd send it to peer review with a request to address that gap. The paper will be useful to anyone working on patch defenses for CNNs, and I'd cite it for the threshold-sweep idea and the OCC variant.","headline":"Genuinely new threshold-sweep detector with strong single-patch results; the multi-patch evidence is weaker than the abstract implies, but the paper deserves a serious referee.","tokens_in":26210,"tokens_out":2688,"would_cite":true,"duration_ms":28160,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SpaNN claims adversarial patch attacks are detectable at 86.13% accuracy for object detection and 96.64% for image classification regardless of how many patches an attacker uses, because cluster statistics from a sweep of saliency…","keywords":["adversarial patches","patch attack detection","saliency thresholds","binarized feature maps","DBSCAN clustering","object detection","image classification","convolutional neural networks"],"falsifier":"Train a two-patch attack that jointly optimizes two distinct patch patterns to minimize both attack loss and SpaNN's detection score, then measure SpaNN's detection accuracy on that attack set. If accuracy falls materially below the reported 86.13% for object detection or 96.64% for image classification at comparable false alarm rates, the claim that detection accuracy holds for any number of patches is falsified.","tokens_in":1808,"feed_emoji":"🛡️","tokens_out":2027,"duration_ms":106184,"temperature":0.7,"pith_summary":"The paper tries to establish that adversarial patch attacks on convolutional neural networks can be detected reliably no matter how many patches an attacker places, provided the detector looks at how the spatial pattern of strongly activated neurons changes across a sweep of saliency thresholds rather than committing to one threshold. It proposes SpaNN, which binarizes the first convolutional layer's feature map at a set of thresholds, clusters each binary map with DBSCAN, and classifies the resulting cluster-statistic curves with a small neural network. On four datasets the claimed detection accuracy is at least 86.13% for object detection and 96.64% for image classification for one, two, or four patches, with runtime independent of the number of patches. A sympathetic reader would care because existing defenses either assume a single patch or depend on thresholds that an adaptive attacker can exploit, and SpaNN addresses both concerns at once.","feed_headline":"Patch detector stays above 86% accuracy for any number of patches","feed_subtitle":"Sweeping saliency thresholds catches multi-patch attacks a fixed threshold would miss, at constant runtime.","key_machinery":"The central object is an ensemble of binarized feature maps produced by a sweep of saliency thresholds. Given the victim model's first-layer feature map $M$, SpaNN binarizes it at each threshold $\\beta$ in a set $B = \\{0, 0.05, \\dots, 0.95\\}$ by keeping neurons with activation at least $\\beta \\cdot \\max(M)$, then runs DBSCAN, a density-based clustering algorithm, on each binary map to group adjacent important neurons into clusters and discard scattered points as outliers. For every threshold it records four quantities: number of clusters, mean intra-cluster distance, standard deviation of intra-cluster distances, and number of important neurons. These quantities form a $4 \\times B$ curve vector, normalized and fed to a small one-dimensional convolutional network called AD, whose output is the detection score. The ensemble does the work of representing how the spatial pattern of important neurons evolves with the threshold, which is what makes detection independent of both a fixed threshold and the number of patches.","core_discovery":"The central claim is that an attack detector can separate clean from attacked images by reading how the spatial layout of important neurons in a shallow feature map changes as the definition of 'important' is varied, and that this signature is insensitive to how many patches are present. Concretely, the paper claims that SpaNN detects effective and ineffective patch attacks with accuracy at least 86.13% on object detection and 96.64% on image classification for one, two, and four patches, and that its per-image computational cost is independent of the number of patches. The paper further claims the detector does not rely on any fixed saliency threshold, which makes it harder for a white-box adversary to craft attacks that look clean to the detector.","pith_inferences":["If the threshold-spanning mechanism is what carries the result, the same curve-based feature representation could be applied to other detectors that currently hinge on a single scalar threshold, such as entropy or activation thresholds, without modifying the victim model.","The success of the one-class variant suggests the cluster-statistic curves encode a general property of clean CNN activations; a testable extension is to measure how the curves transfer across victim architectures and datasets without retraining AD.","The paper's multi-patch evaluation does not include jointly optimized multi-patch attacks, so the natural next stress test is to optimize several distinct patches together against SpaNN's detection score and measure where the 'any number of patches' claim breaks.","The paper leaves open whether the same clustering features could support attack localization and recovery; if pursued, the features that feed the detector could also drive patch removal."],"forward_implications":["SpaNN detects attacks that fail to change the victim's output, because it does not consult the final prediction; this turns detection into early warning rather than post-hoc alert.","Detection accuracy stays roughly constant as the number of patches grows from one to four, whereas baseline detectors degrade or improve irregularly with patch count.","Runtime is set by the ensemble size and image size, not by the number of patches, so a deployment can fix worst-case cost by choosing an ensemble size around 10.","An adaptive attacker who optimizes patches to evade SpaNN loses attack effectiveness faster than SpaNN loses true positive rate.","A one-class variant trained only on clean images still detects unseen patch types and outperforms baseline detectors in most tested settings."],"supporting_citations":[{"why":"Supplies the DBSCAN density-based clustering algorithm used to turn each binarized feature map into cluster statistics.","marker":"[35]"},{"why":"Defines the object-detection patch attack model used to train and evaluate SpaNN on INRIA and Pascal VOC.","marker":"[32]"},{"why":"Provides the DM-NAP-Princess naturalistic patch used as an unseen test-time attack for object detection.","marker":"[33]"},{"why":"Provides the PatchGuard++ attack implementation used to generate single, double, and quadruple patch attacks for image classification.","marker":"[14]"},{"why":"Defines the ResNet-50 victim model whose first-layer activations SpaNN analyzes for image classification.","marker":"[34]"},{"why":"Defines the YOLOv2 victim model whose first-layer activations SpaNN analyzes for object detection.","marker":"[36]"},{"why":"Themis baseline, also the source of the idea that binarized first-layer feature maps reveal patches through a saliency threshold.","marker":"[22]"},{"why":"Jedi baseline, an entropy-threshold detector whose fixed-threshold dependence motivates the threshold sweep.","marker":"[23]"},{"why":"NAPGuard baseline and the GAP dataset benchmark used for comparing detection of unseen naturalistic patches.","marker":"[21]"},{"why":"ObjectSeeker baseline whose computational cost grows with the number of patches, providing the contrast for SpaNN's constant-cost claim.","marker":"[24]"}],"fun_headline_variants":["SpaNN: Sweep saliency thresholds to catch multiple patches","SpaNN sweeps saliency to spot multiple adversarial patches","Saliency threshold sweep detects multiple adversarial patches","SpaNN varies saliency threshold to catch any number of patches"],"cache_read_input_tokens":28288,"weakest_assumption_plain":"The multi-patch evaluation is built from one optimized patch that is rescaled and reflected into multiple locations, not from patches jointly optimized as a multi-patch attack; if an adversary jointly optimizes distinct patches, the cluster signature SpaNN relies on may separate clean and attacked inputs less cleanly.","fun_headline_variants_meta":{"raw":{"variants":["SpaNN: Sweep saliency thresholds to catch multiple patches","SpaNN sweeps saliency to spot multiple adversarial patches","Saliency threshold sweep detects multiple adversarial patches","SpaNN varies saliency threshold to catch any number of patches"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001567,"raw_usage":{"total_tokens":6251,"prompt_tokens":936,"completion_tokens":5315,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":552,"completion_tokens_details":{"reasoning_tokens":5246}},"tokens_in":552,"tokens_out":5315,"duration_ms":40246,"temperature":1.0,"reasoning_tokens":5246,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T23:15:42.390055+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a two-patch attack that jointly optimizes two distinct patch patterns to minimize both attack loss and SpaNN's detection score, then measure SpaNN's detection accuracy on that attack set. If accuracy falls materially below the reported 86.13% for object detection or 96.64% for image classification at comparable false alarm rates, the claim that detection accuracy holds for any number of patches is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the DBSCAN density-based clustering algorithm used to turn each binarized feature map into cluster statistics."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the object-detection patch attack model used to train and evaluate SpaNN on INRIA and Pascal VOC."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the DM-NAP-Princess naturalistic patch used as an unseen test-time attack for object detection."},{"cited_title":"Athalye, L","cited_arxiv_id":null,"evidence_quote":"Provides the PatchGuard++ attack implementation used to generate single, double, and quadruple patch attacks for image classification."},{"cited_title":"Kirillov, E","cited_arxiv_id":null,"evidence_quote":"Defines the ResNet-50 victim model whose first-layer activations SpaNN analyzes for image classification."},{"cited_title":"Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detector","cited_arxiv_id":"2307.08076","evidence_quote":"Defines the YOLOv2 victim model whose first-layer activations SpaNN analyzes for object detection."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Themis baseline, also the source of the idea that binarized first-layer feature maps reveal patches through a saliency threshold."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Jedi baseline, an entropy-threshold detector whose fixed-threshold dependence motivates the threshold sweep."},{"cited_title":"Real-time Detection of Practical Universal Adversarial Perturbations","cited_arxiv_id":"2105.07334","evidence_quote":"NAPGuard baseline and the GAP dataset benchmark used for comparing detection of unseen naturalistic patches."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"ObjectSeeker baseline whose computational cost grows with the number of patches, providing the contrast for SpaNN's constant-cost claim."}],"review_version":1}