Pith. sign in

REVIEW 3 major objections 5 minor 49 references

SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SpaNN claims adversarial patch attacks are detectable at 86.13% accuracy for object detection and 96.64% for image classification regardless of how many patches an attacker uses, because cluster statistics from a sweep of saliency…

desk verdict Genuinely new threshold-sweep detector with strong single-patch results; the multi-patch evidence is weaker than the abstract implies, but the paper deserves a serious referee. read the letter →

arxiv 2506.18591 v1 pith:4G6FNSY4 submitted 2025-06-23 cs.CV cs.LG

Mauricio Byrd Victorica , György Dán , Henrik Sandberg This is my paper · ORCID
classification cs.CVcs.LG
keywords adversarialpatchespatchattackdetectionsaliencythresholdsbinarizedfeaturemapsDBSCANclusteringobjectimageclassificationconvolutionalneuralnetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that adversarial patch attacks on convolutional neural networks can be detected reliably no matter how many patches an attacker places, provided the detector looks at how the spatial pattern of strongly activated neurons changes across a sweep of saliency thresholds rather than committing to one threshold. It proposes SpaNN, which binarizes the first convolutional layer's feature map at a set of thresholds, clusters each binary map with DBSCAN, and classifies the resulting cluster-statistic curves with a small neural network. On four datasets the claimed detection accuracy is at least 86.13% for object detection and 96.64% for image classification for one, two, or four patches, with runtime independent of the number of patches. A sympathetic reader would care because existing defenses either assume a single patch or depend on thresholds that an adaptive attacker can exploit, and SpaNN addresses both concerns at once.

What carries the argument

The central object is an ensemble of binarized feature maps produced by a sweep of saliency thresholds. Given the victim model's first-layer feature map $M$, SpaNN binarizes it at each threshold $\beta$ in a set $B = \{0, 0.05, \dots, 0.95\}$ by keeping neurons with activation at least $\beta \cdot \max(M)$, then runs DBSCAN, a density-based clustering algorithm, on each binary map to group adjacent important neurons into clusters and discard scattered points as outliers. For every threshold it records four quantities: number of clusters, mean intra-cluster distance, standard deviation of intra-cluster distances, and number of important neurons. These quantities form a $4 \times B$ curve vector, normalized and fed to a small one-dimensional convolutional network called AD, whose output is the detection score. The ensemble does the work of representing how the spatial pattern of important neurons evolves with the threshold, which is what makes detection independent of both a fixed threshold and the number of patches.

What would settle it

Train a two-patch attack that jointly optimizes two distinct patch patterns to minimize both attack loss and SpaNN's detection score, then measure SpaNN's detection accuracy on that attack set. If accuracy falls materially below the reported 86.13% for object detection or 96.64% for image classification at comparable false alarm rates, the claim that detection accuracy holds for any number of patches is falsified.

Watch

Extended reading notes

Core claim

The central claim is that an attack detector can separate clean from attacked images by reading how the spatial layout of important neurons in a shallow feature map changes as the definition of 'important' is varied, and that this signature is insensitive to how many patches are present. Concretely, the paper claims that SpaNN detects effective and ineffective patch attacks with accuracy at least 86.13% on object detection and 96.64% on image classification for one, two, and four patches, and that its per-image computational cost is independent of the number of patches. The paper further claims the detector does not rely on any fixed saliency threshold, which makes it harder for a white-box adversary to craft attacks that look clean to the detector.

Load-bearing premise

The multi-patch evaluation is built from one optimized patch that is rescaled and reflected into multiple locations, not from patches jointly optimized as a multi-patch attack; if an adversary jointly optimizes distinct patches, the cluster signature SpaNN relies on may separate clean and attacked inputs less cleanly.

Editorial extensions

If this is right

  • SpaNN detects attacks that fail to change the victim's output, because it does not consult the final prediction; this turns detection into early warning rather than post-hoc alert.
  • Detection accuracy stays roughly constant as the number of patches grows from one to four, whereas baseline detectors degrade or improve irregularly with patch count.
  • Runtime is set by the ensemble size and image size, not by the number of patches, so a deployment can fix worst-case cost by choosing an ensemble size around 10.
  • An adaptive attacker who optimizes patches to evade SpaNN loses attack effectiveness faster than SpaNN loses true positive rate.
  • A one-class variant trained only on clean images still detects unseen patch types and outperforms baseline detectors in most tested settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the threshold-spanning mechanism is what carries the result, the same curve-based feature representation could be applied to other detectors that currently hinge on a single scalar threshold, such as entropy or activation thresholds, without modifying the victim model.
  • The success of the one-class variant suggests the cluster-statistic curves encode a general property of clean CNN activations; a testable extension is to measure how the curves transfer across victim architectures and datasets without retraining AD.
  • The paper's multi-patch evaluation does not include jointly optimized multi-patch attacks, so the natural next stress test is to optimize several distinct patches together against SpaNN's detection score and measure where the 'any number of patches' claim breaks.
  • The paper leaves open whether the same clustering features could support attack localization and recovery; if pursued, the features that feed the detector could also drive patch removal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes SpaNN, a detector for adversarial patch attacks on CNNs. It extracts a shallow-layer feature map, binarizes it at multiple saliency thresholds, applies DBSCAN to each binarized map, and feeds the resulting cluster statistics (number of clusters, mean intra-cluster distance, standard deviation, number of important neurons) as four threshold-dependent curves to a small CNN classifier. The authors claim that SpaNN detects patch attacks with at least 86.13% accuracy for object detection and 96.64% for image classification, for any number of patches, and that its computational cost is independent of the number of patches. They evaluate against Themis, Jedi, NAPGuard, and ObjectSeeker on INRIA, Pascal VOC, ImageNet, and CIFAR-10, and additionally report adaptive-attack experiments, feature-ablation and SHAP analyses, and an unsupervised one-class variant.

Significance. If the claimed detection accuracy holds for genuinely arbitrary multi-patch attacks, SpaNN would be a practically valuable defense: it avoids a fixed saliency threshold, is simple to implement, and is computationally cheap. The paper ships code, evaluates on unseen patch types (DM-NAP, GAP GL2/GL3, UAP), includes a one-class variant that does not use attack samples during training, and provides a clear computational-cost analysis. However, the central multi-patch claim is currently supported only by multi-patch attacks that are reflected or rescaled copies of a single optimized patch, not by jointly optimized attacks, so the practical significance for arbitrary multi-patch adversaries remains uncertain.

major comments (3)
  1. [Section V-A and Appendix D] The multi-patch attack evaluations use reflected or rescaled copies of a single optimized patch, not jointly or independently optimized multi-patch attacks. For object detection, the two patches are 'diagonally reflected from each other' and have the same pixel content; for image classification, extra patches are 'symmetrically reflected' copies of the same optimized region. Appendix D explicitly states that 'we do not optimize these attacks and instead rescale, reshape, and translate attacks optimized under the single-patch scenario,' and Table III shows that the double-patch attack on INRIA is substantially weaker than the single-patch attack (effectiveness drops from 0.8090 to 0.5139). Because the paper's headline claim is that SpaNN detects attacks 'for any number of patches,' the current evidence does not establish that the clustering-feature signature separates clean images from images containing multiple distinct, jointly optimized adversarial patches. Please add experiments with jointly optimized multi-patch attacks, or explicitly restrict the claim to attacks composed of replicated copies of a single patch.
  2. [Section I, contribution (ii); Section V-A] The claim of detection accuracy 'for any number of patches' is extrapolated from experiments with one, two, and four patches, and for object detection only one and two patches are tested. While the computational cost of SpaNN is, by construction, independent of the number of patches, the detection accuracy for other counts (e.g., three, five, or ten patches) is not established. The authors should either test additional patch counts or qualify the claim to the tested range, e.g., 'for the tested numbers of patches.'
  3. [Section V-E] The adaptive-attack evaluation covers only single-patch attacks on object detection (INRIA). Since the paper's main novelty is multi-patch detection, the robustness claim against an adaptive attacker is untested in the multi-patch setting. An adaptive attacker that jointly optimizes multiple patches while accounting for the detector could plausibly produce feature-map statistics that are harder to distinguish from clean inputs, especially because the multi-patch training/evaluation attacks are not jointly optimized. Please extend the adaptive-attack evaluation to multi-patch attacks or clearly scope the robustness claim to the single-patch adaptive setting.
minor comments (5)
  1. [Section V-D, Table I] Table I reports attack detection accuracy using the 'best-performing setting' for each detector, which compares methods at different operating points. The ROC curves are informative, but the accuracy numbers would be easier to interpret if the authors also reported accuracy at a fixed false-positive rate or a fixed detection threshold.
  2. [Section V-B] The decision threshold for the AD network output is not specified. Please state the threshold used for SpaNN's reported accuracy figures, or clarify that the ROC curve's operating point was selected on a validation set.
  3. [Section III-B] The feature-motivation study in Section III-B uses a random subset of 3,334 ImageNet validation images, and Section V-B later trains and evaluates SpaNN on a different subset of the same ImageNet validation set. This shared distribution is a mild design circularity; its impact is mitigated by the additional evaluations on CIFAR-10 and unseen attacks, but it should be acknowledged explicitly.
  4. [Table II] The column header 'Default OCC (DM-NAP)' is ambiguous; it appears to list two numbers (default and one-class variant) under each ensemble size. Please separate 'Default' and 'OCC (DM-NAP)' into distinct columns for readability.
  5. [Algorithm 1 and Section IV-A] The symbol B is used both for the set of thresholds and for the binarized feature maps (e.g., 'for βb ∈ B ... Bb := M ≥ t'). Consider using a different notation, such as B_b for binarized maps, to avoid confusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SpaNN is an empirically trained detector whose features are deterministic functions of the input and whose accuracy is measured on held-out and unseen attack models; multi-patch evaluation gaps are scope limitations, not by-construction reductions.

full rationale

The paper does not derive its detection result from its own definition, nor does it rename a fitted parameter as a prediction. SpaNN's features are computed deterministically from first-layer feature maps by threshold binarization and DBSCAN clustering (Sec. IV), with no dependence on the attack label; the trainable component AD is a small CNN trained with binary cross-entropy on single-patch attacks (Sec. V-B) and evaluated on held-out images, unseen patches (DM-NAP in Table II, GAP in App. B, UAP in App. C), and an unsupervised one-class variant trained without any attack images (Sec. V-G). The claimed invariance to the number of patches is supported by evaluating double- and quadruple-patch attacks that are reflected or rescaled copies of a single optimized patch; the paper itself acknowledges in Appendix D that these multi-patch attacks are not optimized for the multi-patch setting. This weakens the external validity of the 'any number of patches' claim, but it is not a circularity: the detector does not encode the number of patches or the reflection geometry, the training set contains only single-patch attacks, and the multi-patch test inputs are disjoint from training. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via the authors' prior work; all cited baselines and attack generators are external. The only mild design overlap is that the motivating visualization in Sec. III-B uses a random subset of the ImageNet validation set, and later 2% of that validation set is used for AD training; this is a small data-selection overlap, not a by-construction equivalence between input and output. Overall, the derivation chain is self-contained and the numerical claims come from supervised learning with held-out evaluation, so no enumerated circularity pattern is present.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical entities. Its load-bearing assumptions are empirical: the saliency-cluster signature of patches, the realism of the synthetic multi-patch attacks, and the transferability of a single-patch-trained classifier.

free parameters (4)
  • DBSCAN epsilon = 1
    Hand-chosen so that only adjacent neurons are clustered; affects all clustering features and hence detection.
  • DBSCAN min_samples (wmin) = 4
    Hand-chosen so that clusters need at least 4 adjacent neurons; sets the minimum density for a cluster.
  • Saliency threshold set B = {0, 0.05, ..., 0.95} (default, |B|=20)
    The set of thresholds spanning [0,1]; ablated with |B| in {4,10,20,50}.
  • AD output decision threshold = not stated
    The attack detection accuracy in Table I requires a threshold on the sigmoid output of AD, but the value is not specified.
assumptions (4)
  • domain assumption Adversarial patches create dense, localized clusters of high-activation neurons in the first convolutional layer.
    Used to justify DBSCAN density clustering in Section IV-B and to motivate the features from Figure 1.
  • domain assumption The curve shapes of clustering features across thresholds distinguish clean from attacked images.
    The core premise of the method, supported empirically in Figure 1 but not proven.
  • ad hoc to paper Multi-patch attacks are adequately represented by reflected or rescaled copies of a single optimized patch.
    Section V-A generates double-patch attacks by splitting one patch; Appendix D states these attacks are not optimized for the multi-patch setting. The 'any number of patches' claim depends on this assumption.
  • domain assumption A detector trained on single-patch attacks transfers to unseen patch types and patch counts.
    Training uses only single-patch attacks (Section V-B), yet the claims cover double and quadruple patches and unseen patches such as DM-NAP and GAP. This transferability is tested only for a limited set of attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds." pith.science (2026). https://pith.science/paper/4G6FNSY4

@misc{pith2026250618591,
  author       = {Pith},
  title        = {Pith review of: SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4G6FNSY4}},
  note         = {Machine review of arXiv:2506.18591}
}
read the original abstract

State-of-the-art convolutional neural network models for object detection and image classification are vulnerable to physically realizable adversarial perturbations, such as patch attacks. Existing defenses have focused, implicitly or explicitly, on single-patch attacks, leaving their sensitivity to the number of patches as an open question or rendering them computationally infeasible or inefficient against attacks consisting of multiple patches in the worst cases. In this work, we propose SpaNN, an attack detector whose computational complexity is independent of the expected number of adversarial patches. The key novelty of the proposed detector is that it builds an ensemble of binarized feature maps by applying a set of saliency thresholds to the neural activations of the first convolutional layer of the victim model. It then performs clustering on the ensemble and uses the cluster features as the input to a classifier for attack detection. Contrary to existing detectors, SpaNN does not rely on a fixed saliency threshold for identifying adversarial regions, which makes it robust against white box adversarial attacks. We evaluate SpaNN on four widely used data sets for object detection and classification, and our results show that SpaNN outperforms state-of-the-art defenses by up to 11 and 27 percentage points in the case of object detection and the case of image classification, respectively. Our code is available at https://github.com/gerkbyrd/SpaNN.

Figures

Figures reproduced from arXiv: 2506.18591 by the authors.

Figure 1
Figure 1. Input characteristics vs. saliency threshold [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. SpaNN: For any input xi , after extracting a feature map M from a shallow layer of the victim model h, a binarized feature map Bb is obtained for each threshold βb in the set B. DBSCAN is applied to each element in the ensemble, and the resulting clustering feature vector s is fed to the neural network AD, which outputs an attack detection score AD(s). (a) Single patch. (b) Double patch. (c) Single patch. (d) Double… view at source ↗
Figure 3
Figure 3. Single and multiple patches for object detection (a-b) and for image classification (c-e). [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Attack detection vs. false alarm rate for single (left) and double (right) adversarial patches for object detection (INRIA). [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Attack detection vs. false alarm rates for single (left), double (middle), and quadruple (right) adversarial patches for [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Accuracy (a) and computation time (b-c) vs. ensemble size [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Attack detection (TP) and attack effectiveness vs. stealthiness of adaptive attack. Error bars show one standard deviation. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Impact on SpaNN’s attack detection accuracy vs. ensemble size |B| after dropping each of the four clustering features: number of clusters (nclus), mean average intra-cluster distance (avg), standard deviation of average intra-cluster distance (sd), and number of import…
Figure 9
Figure 9. Figure 9: Violin plots for feature importance calculated with [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]
Figure 11
Figure 11. Figure 11: Attack detection and false alarm rates for single (top), [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: SpaNN’s attack detection accuracy (a) and computation time (b-c) vs. ensemble size |B|, using Pascal VOC and CIFAR-10. 0.0 0.1 0.2 0.3 0.4 0.5 0.6 False Positive Rate 0.00 0.25 0.50 0.75 1.00 True Positive Rate SpaNN NAPGuard 0.0 0.1 0.2 0.3 0.4 0.5 0.6 False Positive…
Figure 13
Figure 13. Figure 13: Attack detection and false alarm rates for the GL2 [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 15
Figure 15. Figure 15: Attack detection and false alarm rates for adversarial [PITH_FULL_IMAGE:figures/full_fig_p016_15.png]
Figure 16
Figure 16. Figure 16: Single and multiple patches for image classification using the UAP attack [45]. [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]
Figure 17
Figure 17. Figure 17: Computational cost of existing defenses against patch attacks. Error bars represent the first and third quartiles across [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]
Figure 18
Figure 18. Figure 18: Input characteristics vs. saliency threshold [PITH_FULL_IMAGE:figures/full_fig_p017_18.png]
Figure 19
Figure 19. Figure 19: Input characteristics vs. saliency threshold [PITH_FULL_IMAGE:figures/full_fig_p018_19.png]
Figure 20
Figure 20. Figure 20: Input characteristics vs. saliency threshold [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 45 canonical work pages

  1. [1]

    write newline

    " write newline "" initialize.prev.this.status FUNCTION begin.bib " write newline preamble empty 'skip preamble write newline if " thebibliography " longest.label * " " * write newline " [1] #1 " write newline " url@samestyle " write newline " " write newline " [2] #2 " write newline " =0pt " write newline " " ALTinterwordstretchfactor * " " * write newli...

  2. [2]

    4" FUNCTION default.is.dash.repeated.names #1 FUNCTION default.name.format.string

    11em plus .33em minus .07em 4000 4000 100 4000 4000 500 `\.=1000 = #1 \@IEEEnotcompsoconly \@IEEEcompsoconly #1 * [1] 0pt [0pt][0pt] #1 * [1] 0pt [0pt][0pt] #1 * \| ** #1 \@IEEEauthorblockNstyle \@IEEEcompsocnotconfonly \@IEEEauthorblockAstyle \@IEEEcompsocnotconfonly \@IEEEcompsocconfonly \@IEEEauthordefaulttextstyle \@IEEEcompsocnotconfonly \@IEEEauthor...

    work page 2007

  3. [3]

    write newline

    " write newline "" initialize.prev.this.status FUNCTION begin.bib " write newline preamble empty 'skip preamble write newline if " thebibliography " longest.label * " " * write newline " [1] #1 " write newline " url@samestyle " write newline " " write newline " [2] #2 " write newline " =0pt " write newline " " ALTinterwordstretchfactor * " " * write newli...

  4. [4]

    I. J. Goodfellow, J. Shlens, and C. Szegedy, ``Explaining and harnessing adversarial examples,'' in Proc. of International Conference on Learning Representations (ICLR) , 2015

    work page 2015

  5. [5]

    T. B. Brown, D. Man \' e , A. Roy, M. Abadi, and J. Gilmer, ``Adversarial patch,'' ArXiv , vol. abs/1712.09665, 2017

    arXiv 2017

  6. [6]

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y. Chen, Y. Wang, and X. Lin, `` Adversarial T-Shirt! E vading person detectors in a physical world,'' in Proc. of European Conference on Computer Vision (ECCV) , 2020

    work page 2020

  7. [7]

    Carlini and D

    N. Carlini and D. A. Wagner, ``Towards evaluating the robustness of neural networks,'' in Proc. of IEEE Symposium on Security and Privacy , 2016

    work page 2016

  8. [8]

    Moosavi-Dezfooli, A

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, `` DeepFool : A simple and accurate method to fool deep neural networks,'' in Proc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    work page 2016

Show all 49 references
  1. [9]

    Carlini and D

    N. Carlini and D. A. Wagner, ``Adversarial examples are not easily detected: Bypassing ten detection methods,'' in Proc. of ACM Workshop on Artificial Intelligence and Security , 2017

    2017

  2. [10]

    Feinman, R

    R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, ``Detecting adversarial samples from artifacts,'' ArXiv , vol. abs/1703.00410, 2017

    2017 arXiv

  3. [11]

    Ilyas, S

    A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, ``Adversarial examples are not bugs, they are features,'' in Proc. of Conference on Neural Information Processing Systems (NIPS) , 2019

    2019

  4. [12]

    J. M. Cohen, E. Rosenfeld, and J. Z. Kolter, ``Certified adversarial robustness via randomized smoothing,'' in Proc. of International Conference on Machine Learning (ICML) , 2019

    2019

  5. [13]

    A. A. Abusnaina, Y. Wu, S. S. Arora, Y. Wang, F. Wang, H. Yang, and D. A. Mohaisen, ``Adversarial example detection using latent neighborhood graph,'' in Proc. of International Conference on Computer Vision (ICCV) , 2021

    2021

  6. [14]

    Athalye, L

    A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, ``Synthesizing robust adversarial examples,'' in Proc. of International Conference on Machine Learning (ICML) , 2017

    2017

  7. [15]

    B. G. Doan, M. Xue, S. Ma, E. Abbasnejad, and D. C. Ranasinghe, `` TnT attacks! universal naturalistic adversarial patches against deep neural network systems,'' IEEE Transactions on Information Forensics and Security (TIFS) , 2022

    2022

  8. [16]

    Nassi, Y

    B. Nassi, Y. Mirsky, J. Shams, R. Ben-Netanel, D. Nassi, and Y. Elovici, ``Protecting autonomous cars from phantom attacks,'' Commun. ACM , 2023

    2023

  9. [17]

    Xiang and P

    C. Xiang and P. Mittal, `` PatchGuard++ : Efficient provable attack detection against adversarial patches,'' Proc. of International Conference on Learning Representations Workshops (ICLRW) , 2021

    2021

  10. [18]

    Rossolini, F

    G. Rossolini, F. Nesti, F. Brau, A. Biondi, and G. Buttazzo, ``Defending from physically-realizable adversarial attacks through internal over-activation analysis,'' in Proc. of the AAAI Conference on Artificial Intelligence , 2023

    2023

  11. [19]

    McCoyd, W

    M. McCoyd, W. Park, S. Chen, N. Shah, R. Roggenkemper, M. Hwang, J. X. Liu, and D. Wagner, ``Minority reports defense: Defending against adversarial patches,'' in Proc. of Applied Cryptography and Network Security Workshops , 2020

    2020

  12. [20]

    H. Han, K. Xu, X. Hu, X. Chen, L. Liang, Z. Du, Q. Guo, Y. Wang, and Y. Chen, `` ScaleCert : Scalable certified defense against adversarial patches with sparse superficial layers,'' in Proc. of Conference on Neural Information Processing Systems (NIPS) , 2021

    2021

  13. [21]

    K. T. Co, L. Mu \ n oz - Gonz \' a lez, L. Kanthan, and E. C. Lupu, ``Real-time detection of practical universal adversarial perturbations,'' ArXiv , vol. abs/2105.07334, 2021

    2021 arXiv

  14. [22]

    J. Li, H. Zhang, and C. Xie, `` ViP : Unified certified detection and recovery for patch attack with vision transformers,'' in Proc. of European Conference on Computer Vision (ECCV) , 2022

    2022

  15. [23]

    Z. Xu, F. Yu, C. Liu, and X. Chen, `` LanCeX : A versatile and lightweight defense method against condensed adversarial attacks in image and audio recognition,'' ACM Trans. Embed. Comput. Syst. , 2022

    2022

  16. [24]

    S. Wu, J. Wang, J. Zhao, Y. Wang, and X. Liu, `` NAPG uard: Towards detecting naturalistic adversarial patches,'' in Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2024

    2024

  17. [25]

    H. Han, X. Hu, Y. Hao, K. Xu, P. Dang, Y. Wang, Y. Zhao, Z. Du, Q. Guo, Y. Wang, X. Zhang, and T. Chen, ``Real-time robust video object detection system against physical-world adversarial attacks,'' IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems ...

    2023

  18. [26]

    Tarchoun, A

    B. Tarchoun, A. B. Khalifa, M. A. Mahjoub, N. B. Abu-Ghazaleh, and I. Alouani, ``Jedi: Entropy-based localization and removal of adversarial patches,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  19. [27]

    Xiang, A

    C. Xiang, A. Valtchanov, S. Mahloujifar, and P. Mittal, `` ObjectSeeker : Certifiably robust object detection against patch hiding attacks via patch-agnostic masking,'' in Proc. of IEEE Symposium on Security and Privacy , 2023

    2023

  20. [28]

    H. Liu, B. Zhao, K. Zhang, and P. Liu, ``Nowhere to hide: A lightweight unsupervised detector against adversarial examples,'' ArXiv , vol. abs/2210.08579, 2022

    2022 arXiv

  21. [29]

    T. Kim, Y. Yu, and Y. M. Ro, ``Defending physical adversarial attack on object detection via adversarial patch-feature energy,'' in Proc. of ACM International Conference on Multimedia , 2022

    2022

  22. [30]

    K. Xu, Y. Xiao, Z. Zheng, K. Cai, and R. Nevatia, `` PatchZero : Defending against adversarial patch attacks by detecting and zeroing the patch,'' in Proc. of IEEE/CVF Winter Conference on Applications of Computer Vision (WACV) , 2023

    2023

  23. [31]

    Liang, J

    B. Liang, J. Li, and J. Huang, ``We can always catch you: Detecting adversarial patched objects WITH or WITHOUT signature,'' ArXiv , vol. abs/2106.05261, 2021

    2021

  24. [32]

    L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, `` PAD : Patch-agnostic defense against adversarial patch attacks,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2024

    2024

  25. [33]

    C. Yu, J. Chen, Y. Wang, Y. Xue, and H. Ma, ``Improving adversarial robustness against universal patch attacks through feature norm suppressing,'' IEEE Transactions on Neural Networks and Learning Systems (TNNLS) , 2023

    2023

  26. [34]

    Kirillov, E

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y. Lo, P. Dollár, and R. Girshick, ``Segment A nything,'' in Proc. of IEEE/CVF International Conference on Computer Vision (ICCV) , 2023

    2023

  27. [35]

    S. Thys, W. V. Ranst, and T. Goedem \'e , ``Fooling automated surveillance cameras: Adversarial patches to attack person detection,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) , 2019

    2019

  28. [36]

    S. Lin, E. Chu, C.-H. Lin, J.-C. Chen, and J.-C. Wang, ``Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector,'' ArXiv , vol. abs/2307.08076, 2023

    2023 arXiv

  29. [37]

    K. He, X. Zhang, S. Ren, and J. Sun, ``Deep residual learning for image recognition,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    2016

  30. [38]

    Ester, H.-P

    M. Ester, H.-P. Kriegel, J. Sander, and X. Xu, ``A density-based algorithm for discovering clusters in large spatial databases with noise,'' in Proc. of International Conference on Knowledge Discovery and Data Mining (KDD) , 1996

    1996

  31. [39]

    Redmon and A

    J. Redmon and A. Farhadi, `` YOLO9000 : Better, faster, stronger,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2017

    2017

  32. [40]

    Dalal and B

    N. Dalal and B. Triggs, ``Histograms of oriented gradients for human detection,'' in Proc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2005

    2005

  33. [41]

    Everingham, L

    M. Everingham, L. Van Gool, and C. Williams, ``The PASCAL visual object classes (VOC) challenge,'' in International Journal of Computer Vision , 2010

    2010

  34. [42]

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, `` ImageNet : A large-scale hierarchical image database,'' in Proc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2009

    2009

  35. [43]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, et al. , ``Learning multiple layers of features from tiny images,'' tech. rep., University of Toronto, 2009

    2009

  36. [44]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, `` PyTorch : An imperative style, high...

    2019

  37. [45]

    S. M. Lundberg and S.-I. Lee, ``A unified approach to interpreting model predictions,'' in Proc. of Conference on Neural Information Processing Systems (NIPS) , 2017

    2017

  38. [46]

    Z. Lin, Y. Zhao, K. Chen, and J. He, ``I don't know you, but I can catch you: Real-time defense against diverse adversarial patches for object detectors,'' in Proc. of ACM Conference on Computer and Communications Security (CCS) , 2024

    2024

  39. [47]

    Oza and V

    P. Oza and V. M. Patel, ``One-class convolutional neural network,'' IEEE Signal Processing Letters , 2019

    2019

  40. [48]

    Pintor, D

    M. Pintor, D. Angioni, A. Sotgiu, L. Demetrio, A. Demontis, B. Biggio, and F. Roli, `` ImageNet-Patch : A dataset for benchmarking machine learning robustness against adversarial patches,'' Pattern Recognition , 2023

    2023

  41. [49]

    Huang, Z

    H. Huang, Z. Chen, H. Chen, Y. Wang, and K. Zhang, `` T-SEA : Transfer-based self-ensemble attack on object detection,'' in Proc. of IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.