Pith. sign in

REVIEW 4 major objections 7 minor 70 references

SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models

T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SuperPure claims to be the first plug-and-play defense that purifies both localized and distributed adversarial patches using iterative GAN-based masking.

desk verdict The empirical story is interesting and may be right, but the printed Algorithm 1 masks in the wrong direction, so the paper is not reproducible as written. read the letter →

arxiv 2505.16318 v1 pith:D23TOXTL submitted 2025-05-22 cs.CV cs.CReess.IV

Hossein Khalili , Seongbin Park , Venkat Bollapragada , Nader Sehatbakhsh This is my paper · ORCID
classification cs.CVcs.CReess.IV
keywords adversarialpatchesGANsuper-resolutionpixelmaskingdistributedpatchattacksImageNetclassifiersdefenselatencyplug-and-play
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a defense built from iterative GAN-guided pixel masking, followed by one super-resolution enhancement pass, can purify both localized and distributed adversarial patches without retraining the target classifier. If true, it would close the distributed-patch blind spot that certifiable defenses such as PatchCleanser have, and it would do so at a fraction of the latency, making robust defenses practical for latency-sensitive systems. The paper reports more than 20% average robustness gains against localized patches, roughly 10% higher clean accuracy, 58% robustness against the DorPatch distributed attack compared to 0% for PatchCleanser, and an over 98% reduction in end-to-end defense latency.

What carries the argument

The engine is Real-ESRGAN, a pretrained GAN-based super-resolution network that reconstructs low-resolution inputs into natural-looking high-resolution images. Because it was trained on natural images, it preserves clean texture but fails to reconstruct adversarial patch structure, so patch pixels produce large reconstruction errors. A pixel-wise L2 comparison between the original image and the GAN-upsampled image yields a binary mask using a threshold lambda, and the mask is overlaid on the original to remove suspicious pixels. The loop stops when the fraction of newly masked pixels falls below epsilon, and the final enhancement step upsamples by two and then downsamples by two to eliminate subtle distributed perturbations.

What would settle it

Optimize a patch under the full SuperPure pipeline in a white-box setting with an objective that minimizes the L2 reconstruction error between the patch and the GAN-upsampled image while maximizing classifier loss, using low-amplitude perturbations or natural texture patterns. If such a patch reliably flips the classifier while also masking clean pixels rather than the patch itself, the reconstruction-error dominance assumption in Eq. (5) fails and the reported robustness numbers would not transfer.

Watch

Extended reading notes

Core claim

The central claim is that a GAN-based super-resolution network, trained only on natural images, can act as a natural-image prior that exposes adversarial patches. After downsampling an input image by a factor of four and upsampling it with Real-ESRGAN, adversarial patch pixels show much larger reconstruction error than clean pixels, so a pixel-wise L2 comparison with a threshold reliably separates patch pixels from clean pixels. SuperPure masks those high-error pixels, repeats the downsampling-GAN-masking cycle until few new pixels are masked, and then applies a final up-down enhancement step that removes small, low-noise distributed perturbations. On ImageNet with ResNet, EfficientNet, and ViT, the paper reports substantially higher robust accuracy than PatchCleanser and PAD on localized patches, 58% robust accuracy against DorPatch where PatchCleanser achieves 0%, and clean accuracy that is often higher than the undefended baseline.

Load-bearing premise

Everything depends on the premise that after downsampling and GAN upsampling, adversarial patch pixels have far larger reconstruction errors than clean pixels, so a single threshold can separate them; the paper states this as Eq. (5) without proof and illustrates it with a single example.

Editorial extensions

If this is right

  • Defenders would no longer need to retrain or modify classifiers to block physical patches: SuperPure is preprocessing-only and runs with ResNet, EfficientNet, and ViT without architectural changes.
  • The distributed-patch blind spot that lets DorPatch fool certified defenses would close, with 58% robust accuracy on ImageNet compared to 0% for PatchCleanser.
  • End-to-end defense time would drop from tens of seconds to about half a second per image, making purification viable for latency-sensitive autonomous and cyber-physical systems.
  • Clean-image accuracy would improve by roughly 10 points, because the final enhancement step acts as a learned sharpener rather than a utility-degrading denoiser.
  • Even with full white-box access to the defense, large-patch robustness stays around 51-60% on ResNet, indicating that the GAN's nonlinearity is not trivially differentiable around.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the same reconstruct-then-diff masking principle should apply to any corruption the GAN prior can distinguish, such as JPEG compression artifacts or sensor noise, not just adversarial patches; a natural test is evaluating SuperPure on images degraded by standard compression codecs.
  • Editorial extension: because the defense is classifier-agnostic, it could be composed with certified defenses or adversarial training to combine complementary forms of robustness, though the paper does not explore such compositions.
  • Editorial extension: the reported clean-accuracy gain from the enhancement step suggests that the GAN up-down pass is a generic image sharpener, so if that roughly 10-point gain transfers to other datasets, the enhancement step could be used as a standalone preprocessing module independent of any threat model.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes SuperPure, a preprocessing defense against localized and distributed adversarial patches. The method iteratively downsamples the input by a factor of four, upsamples it with a pretrained Real-ESRGAN model, and masks pixels whose L2 reconstruction error exceeds a threshold lambda, stopping when the number of newly masked pixels falls below epsilon; a final up-down enhancement step (SuperPure+) is added to remove low-amplitude distributed perturbations. On a 5,000-image ImageNet subset, the authors report that SuperPure and SuperPure+ improve robust accuracy over PatchCleanser and PAD by more than 20% on average for localized patches, achieve 59% robustness against DorPatch, increase clean top-1 accuracy by roughly 10%, and reduce per-image latency to about 0.58 seconds. The paper also presents white-box attack results, an ablation study for the masking threshold, and comparisons on COCO, CIFAR, and against PatchCURE.

Significance. If the reported results hold, SuperPure would be a practically valuable plug-and-play defense: it requires no classifier retraining, uses an external pretrained super-resolution model, handles both localized and distributed patches, and is much faster than certified baselines. The paper also includes ablation studies and claims open-source code. However, the manuscript currently contains an internal inconsistency in the core masking algorithm and relies on an unproved stochastic-dominance assumption; until these are resolved, the numerical claims cannot be taken at face value. Unlike PatchCleanser, SuperPure offers no certified guarantee, so its contribution is empirical rather than theoretical.

major comments (4)
  1. [Algorithm 1 (GetDiff, lines 17-22)] As printed, the masking step does the opposite of what the text describes: m <- (d > lambda) and x_adv <- x_adv * m retain exactly the high-error pixels and zero out all pixels whose reconstruction error lies below lambda. The text in Section IV-B and the pipeline in Figure 1 indicate that high-error adversarial pixels should be suppressed, i.e., the update should be x_adv * (1-m). If the printed algorithm were executed on a clean image, the first iteration would leave a mostly black image, making the 70-83% clean accuracies in Table I and the convergence behavior in Figure 3 impossible. Please correct the update to suppress the high-error pixels and re-verify that the iterative masking, the stopping condition, and the reported robustness numbers are consistent with the corrected algorithm.
  2. [Section IV-B, Eq. (5)] The central premise that adversarial pixels stochastically dominate clean pixels in GAN reconstruction error is stated as an inequality without proof and is illustrated with only a single example in Figure 11. This is load-bearing because the entire masking rationale depends on it. Moreover, Section IV-D concedes that DorPatch's low-amplitude perturbations fall below the masking threshold, so Eq. (5) is already violated for the distributed attack that motivates the paper. Even if Eq. (5) holds in expectation, it does not imply that a pointwise threshold separates the two pixel classes, since individual patch pixels can have small reconstruction errors. Please provide the empirical distribution of reconstruction errors over patch versus clean pixels across the evaluation set, and evaluate the defense under an adaptive attack that explicitly minimizes reconstruction error subject to misclassification; the current evidence is insufficient for the claimed mechanism.
  3. [Section VI-C and Table I] The default masking threshold lambda = 0.7 and stopping criterion epsilon = 4 are selected based on the same ImageNet validation subset used for the final evaluation (see Figure 7), with no held-out split. Table I therefore reports tuned, single-run numbers, and no error bars or confidence intervals are given. Since the headline claims of more than 20% robustness improvement, roughly 10% clean-accuracy gain, and 59% DorPatch robustness all depend on these tuned hyperparameters, the evaluation protocol should include a validation/test split or cross-validation, and variance across runs or bootstrap intervals should be reported.
  4. [Section V-B3, Table III] The white-box comparison is not apples-to-apples: PatchCleanser is evaluated under its original non-white-box setup while SuperPure+ is evaluated under a white-box attacker, so the gap in Table III does not establish that SuperPure is more robust against an equally strong threat. In addition, the masking operation m <- (d > lambda) is non-differentiable, and the paper does not specify how the white-box attacker obtains gradients through the full pipeline. If a smooth surrogate or BPDA is used, that procedure should be described. Please report the attack optimization details and, if possible, evaluate PatchCleanser under the same adaptive threat model, or clearly state why such an evaluation is out of scope.
minor comments (7)
  1. [Section I] The introduction attributes DorPatch to 'Tang et al.', but reference [1] lists He et al.; please correct the author attribution.
  2. [Section V-B1] The text says 'Table I compares ... on EfficientNet and ResNet models,' but Table I also includes ViT; please update the wording to include all three architectures.
  3. [Section IV-C and Algorithm 1] The stopping condition is described as a 'percentage' in the text, but Algorithm 1 and the default epsilon = 4 are pixel counts; please reconcile the units.
  4. [Algorithm 1] The procedure name GetDiff suggests it only computes a difference, but it also updates x_adv and returns both the updated image and the mask count; please rename it or document the side effect.
  5. [Section II-B and V-D] The method name PatchCURE is spelled 'PatchCure' in Section II-B and 'PatchCURE' elsewhere; please standardize.
  6. [References] References [45] and [50] appear to be the same DiffPure paper; please consolidate them.
  7. [Abstract and Section V-C] The paper claims that the code is open-source, but no repository URL is provided; please include a link to the code.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense chain rests on an external Real-ESRGAN model and an explicit empirical assumption rather than on self-citations or construction-defined outputs.

full rationale

SuperPure's derivation chain is not circular. The core mechanism is an assumed stochastic-dominance inequality (Eq. 5): the reconstruction error of adversarial pixels is asserted to dominate clean pixels because Real-ESRGAN was trained on natural images. This is an external, pretrained model (Ref. [49], "we use a pre-trained model provided by the authors, with no further fine-tuning on our datasets"), so the behavior is not fitted by the paper and is not defined in terms of the robustness numbers being predicted. The reported clean-accuracy gain is likewise an empirical effect of the external super-resolution model, not an output that was baked into the input. The thresholds lambda=0.7 and epsilon=4 are chosen by preliminary analysis and studied in the ablation (Sec. VI-C), so the headline numbers are configuration-dependent; however, the paper presents these as empirical settings rather than as predictions derived from Eq. (5), so this is hyperparameter selection, not circularity. The paper contains no load-bearing self-citations; the reference list is entirely external work. I do flag two non-circular weaknesses: (i) Algorithm 1 as printed sets m=(d>lambda) and updates x_adv <- x_adv elementwise-multiplied by m, which retains high-error pixels and zeros clean pixels; this is the opposite of the 'masking' described in the text and cannot produce the reported clean accuracies unless the mask direction is corrected in code; (ii) Eq. (5) is an assumption, and Section IV-D concedes low-amplitude DorPatch perturbations fall below lambda, so distributed-patch robustness rests on the enhancement step rather than the masking inequality. Neither weakness is a derivation-by-construction circularity.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The method adds no new physical entities; its free parameters are threshold, stopping criterion, and rescaling factors chosen on the benchmark. The theoretical support rests on heuristic inequalities, not on derived guarantees.

free parameters (4)
  • Masking threshold lambda = 0.7
    Chosen in Section V-A3 via preliminary analysis; Section VI-C ablates it on the same benchmark, so it is tuned to the evaluation setup.
  • Stopping criterion epsilon = 4 pixels
    Set in Section V-A3; controls how many newly masked pixels stop the iteration and directly affects robustness and latency.
  • Downsampling factor for masking iterations = 4
    Chosen based on preliminary analysis in Section V-A3; affects GAN reconstruction behavior and the masking threshold scale.
  • Enhancement upsampling factor = 2
    Chosen based on preliminary analysis in Section V-A3; used only in the final up-down enhancement step.
assumptions (3)
  • domain assumption Adversarial patch energy is reduced by roughly s^2 under downsampling: ||D_s(delta)||_2^2 ~ (1/s^2)||delta||_2^2 (Eq. 4).
    Invoked in Section IV-A to argue downsampling degrades patches more than clean content; holds for high-frequency perturbations but not for smooth patches, and is not a proven bound.
  • domain assumption GAN super-resolution reconstruction error is much larger on adversarial pixels than on clean pixels: E(|p_a - G(D_s(pi))|) >> E(|p_c - G(D_s(pi))|) (Eq. 5).
    This inequality is the load-bearing premise for the pixel masking in Section IV-B and Algorithm 1 lines 17-22; it is stated without proof and illustrated with one example in Figure 11.
  • domain assumption A final upsampling-then-downsampling pass removes low-noise distributed perturbations while improving clean accuracy (Section IV-D).
    The enhancement step is justified by analogy to diffusion denoising and by Table VIII, but no mechanism or bound is given; the clean-accuracy gain of about 10 points is unexplained.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models." pith.science (2026). https://pith.science/paper/D23TOXTL

@misc{pith2026250516318,
  author       = {Pith},
  title        = {Pith review of: SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D23TOXTL}},
  note         = {Machine review of arXiv:2505.16318}
}
read the original abstract

As vision-based machine learning models are increasingly integrated into autonomous and cyber-physical systems, concerns about (physical) adversarial patch attacks are growing. While state-of-the-art defenses can achieve certified robustness with minimal impact on utility against highly-concentrated localized patch attacks, they fall short in two important areas: (i) State-of-the-art methods are vulnerable to low-noise distributed patches where perturbations are subtly dispersed to evade detection or masking, as shown recently by the DorPatch attack; (ii) Achieving high robustness with state-of-the-art methods is extremely time and resource-consuming, rendering them impractical for latency-sensitive applications in many cyber-physical systems. To address both robustness and latency issues, this paper proposes a new defense strategy for adversarial patch attacks called SuperPure. The key novelty is developing a pixel-wise masking scheme that is robust against both distributed and localized patches. The masking involves leveraging a GAN-based super-resolution scheme to gradually purify the image from adversarial patches. Our extensive evaluations using ImageNet and two standard classifiers, ResNet and EfficientNet, show that SuperPure advances the state-of-the-art in three major directions: (i) it improves the robustness against conventional localized patches by more than 20%, on average, while also improving top-1 clean accuracy by almost 10%; (ii) It achieves 58% robustness against distributed patch attacks (as opposed to 0% in state-of-the-art method, PatchCleanser); (iii) It decreases the defense end-to-end latency by over 98% compared to PatchCleanser. Our further analysis shows that SuperPure is robust against white-box attacks and different patch sizes. Our code is open-source.

Figures

Figures reproduced from arXiv: 2505.16318 by the authors.

Figure 1
Figure 1. SuperPure pipeline: at each iteration, we downsample, GAN-upsample, and mask high-error pixels. If newly masked pixels exceed the threshold, we [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Shows the masking process of SuperPure across multiple time steps. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Total and new adversarial pixels masked (ImageNet, Patch Size 64, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Quality results for SuperPure before (top) and after purification (down). super-resolution setup, attack configurations, and evaluation metrics. 1) Datasets: Similar to prior work [14], we conduct our experiments using the ImageNet dataset [21], specifically uti￾lizing…
Figure 6
Figure 6. Figure 6: Clean images before (top) and after (bottom) enhancement. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 5
Figure 5. Figure 5: Relationship between patch size, accuracy, and average number of [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 7
Figure 7. Figure 7: Effect of changing threshold (λ) on top-1 accuracy and average iterations for ResNet and Patch Size= 64 [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: (a) White-box attack with the smoothed adversarial patch. (b) Result [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 10
Figure 10. Figure 10: Comparison of the impact of increasing the number of patches [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 9
Figure 9. Figure 9: shows an example COCO image before and after purification. On the left (a), the original image with a 96×96 DPatch is shown. On the right (b), SuperPure effectively neutralizes the patch while minimally affecting the rest of the scene. These results confirm that SuperP…
Figure 11
Figure 11. Figure 11: Reconstruction error across adversarial patch regions versus non [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 53 canonical work pages

  1. [1]

    DorPatch: Distributed and occlusion-robust adversarial patch to evade certifiable defenses,

    C. He, X. Ma, B. B. Zhu, Y . Zeng, H. Hu, X. Bai, H. Jin, and D. Zhang, “DorPatch: Distributed and occlusion-robust adversarial patch to evade certifiable defenses,” inNetwork and Distributed System Security Sym- posium, NDSS, 2024, San Diego, CA, USA, February 26 - March 1, 2024, The Internet Society, 2024

    work page 2024

  2. [2]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” inAdvances in Neural Infor- mation Processing Systems, vol. 25, pp. 1097–1105, 2012

    work page 2012

  3. [3]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016

    2016

  4. [4]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly,et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” inInternational Conference on Learning Representations, 2021

    2021

  5. [5]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014

    2014

  6. [6]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” inInternational Conference on Learning Repre- sentations, 2015

    2015

  7. [7]

    Adversarial patch,

    T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,”arXiv preprint arXiv:1712.09665, 2017

    arXiv 2017

  8. [8]

    Lavan: Localized and visible adversarial noise,

    D. Karmon, D. Zoran, and Y . Goldberg, “Lavan: Localized and visible adversarial noise,” inInternational Conference on Machine Learning, pp. 2507–2515, 2018

    work page 2018

Show all 70 references
  1. [9]

    Robust physical-world attacks on deep learning visual classification,

    K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1625– 1634, 2018

    2018

  2. [10]

    Dpatch: An adversarial patch attack on object detectors,

    X. Liu, H. Yang, Z. Liu, L. Song, H. Li, and Y . Chen, “Dpatch: An adversarial patch attack on object detectors,”arXiv preprint arXiv:1806.02299, 2018

    2018 arXiv

  3. [11]

    Pad: Patch- agnostic defense against adversarial patch attacks,

    L. Jing, R. Wang, W. Ren, X. Dong, and C. Zou, “Pad: Patch- agnostic defense against adversarial patch attacks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24472–24481, 2024

    2024

  4. [12]

    Certified defenses for adversarial patches,

    P.-y. Chiang, R. Ni, A. Abdelkader, C. Zhu, C. Studer, and T. Goldstein, “Certified defenses for adversarial patches,” in8th International Con- ference on Learning Representations (ICLR 2020)(virtual), International Conference on Learning Representations, 2020

    2020

  5. [13]

    {PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,

    C. Xiang, A. N. Bhagoji, V . Sehwag, and P. Mittal, “{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking,” in30th USENIX Security Symposium (USENIX Security 21), pp. 2237–2254, 2021

    2021

  6. [14]

    {PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,

    C. Xiang, S. Mahloujifar, and P. Mittal, “{PatchCleanser}: Certifiably robust defense against adversarial patches for any image classifier,” in 31st USENIX Security Symposium (USENIX Security 22), pp. 2065– 2082, 2022

    2022

  7. [15]

    {PatchCURE}: Improving certifiable robustness, model utility, and computation effi- ciency of adversarial patch defenses,

    C. Xiang, T. Wu, S. Dai, J. Petit, S. Jana, and P. Mittal, “{PatchCURE}: Improving certifiable robustness, model utility, and computation effi- ciency of adversarial patch defenses,” in33rd USENIX Security Sympo- sium (USENIX Security 24), pp. 3675–3692, 2024

    2024

  8. [16]

    Defending against adversarial attacks by randomized diversification,

    C. Mao, Y . Zhu, N. Z. Gong, and X. Zhang, “Defending against adversarial attacks by randomized diversification,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 3, pp. 1313– 1327, 2022

    2022

  9. [17]

    Feature squeezing: Detecting adversarial examples in deep neural networks,

    W. Xu, D. Evans, and Y . Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” inNetwork and Distributed System Security Symposium (NDSS), Internet Society, 2018

    2018

  10. [18]

    Communication in the presence of noise,

    C. E. Shannon, “Communication in the presence of noise,”Proceedings of the IRE, vol. 37, no. 1, pp. 10–21, 1949

    1949

  11. [19]

    Fourier features let networks learn high-frequency functions in low-dimensional domains,

    M. Tancik, P. P. Srinivasan, B. Mildenhall, S. Fridovich-Keil, N. Ragha- van, U. Singhal, R. Ramamoorthi, J. T. Barron, and R. Ng, “Fourier features let networks learn high-frequency functions in low-dimensional domains,”Advances in Neural Information Processing Systems, vol. ...

    2020

  12. [20]

    Statistics of natural image categories,

    A. Torralba and A. Oliva, “Statistics of natural image categories,” Network: Computation in Neural Systems, vol. 14, no. 3, pp. 391–412, 2003

    2003

  13. [21]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248–255, IEEE, 2009

    2009

  14. [22]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in2017 ieee symposium on security and privacy (sp), pp. 39– 57, Ieee, 2017

    2017

  15. [23]

    The security of machine learning,

    M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar, “The security of machine learning,”Machine learning, vol. 81, pp. 121–148, 2010

    2010

  16. [24]

    Evasion attacks against machine learning at test time,

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndi´c, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” inMachine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, Septemb...

    2013

  17. [25]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in 2016 IEEE European symposium on security and privacy (EuroS&P), pp. 372–387, IEEE, 2016

    2016

  18. [26]

    Minimally distorted adversarial examples with a fast adaptive boundary attack,

    F. Croce and M. Hein, “Minimally distorted adversarial examples with a fast adaptive boundary attack,” inInternational Conference on Machine Learning, pp. 2196–2205, PMLR, 2020

    2020

  19. [27]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  20. [28]

    On visible adversarial perturbations & digital watermarking,

    J. Hayes, “On visible adversarial perturbations & digital watermarking,” inProceedings of the IEEE conference on computer vision and pattern recognition workshops, pp. 1597–1604, 2018

    2018

  21. [29]

    Adversarial sticker: A stealthy attack method in the physical world,

    X. Wei, Y . Guo, and J. Yu, “Adversarial sticker: A stealthy attack method in the physical world,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 3, pp. 2711–2725, 2022

    2022

  22. [30]

    Patchattack: A black-box texture-based attack with reinforcement learning,

    C. Yang, A. Kortylewski, C. Xie, Y . Cao, and A. Yuille, “Patchattack: A black-box texture-based attack with reinforcement learning,” inEu- ropean Conference on Computer Vision, pp. 681–698, Springer, 2020

    2020

  23. [31]

    On physical adversarial patches for object detection,

    M. Lee and Z. Kolter, “On physical adversarial patches for object detection,”arXiv preprint arXiv:1906.11897, 2019

    1906 arXiv

  24. [32]

    Local gradients smoothing: Defense against localized adversarial attacks,

    M. Naseer, S. Khan, and F. Porikli, “Local gradients smoothing: Defense against localized adversarial attacks,” in2019 IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 1300–1307, IEEE, 2019

    2019

  25. [33]

    Clipped bagnet: Defending against sticker attacks with clipped bag-of-features,

    Z. Zhang, B. Yuan, M. McCoyd, and D. Wagner, “Clipped bagnet: Defending against sticker attacks with clipped bag-of-features,” in2020 IEEE Security and Privacy Workshops (SPW), pp. 55–61, IEEE, 2020

    2020

  26. [34]

    Sentinet: Detecting localized universal attacks against deep learning systems,

    E. Chou, F. Tramer, and G. Pellegrino, “Sentinet: Detecting localized universal attacks against deep learning systems,” in2020 IEEE Security and Privacy Workshops (SPW), pp. 48–54, IEEE, 2020

    2020

  27. [35]

    Jedi: Entropy-based localization and removal of adversarial patches,

    B. Tarchoun, A. Ben Khalifa, M. A. Mahjoub, N. Abu-Ghazaleh, and I. Alouani, “Jedi: Entropy-based localization and removal of adversarial patches,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4087–4095, 2023

    2023

  28. [36]

    Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch,

    K. Xu, Y . Xiao, Z. Zheng, K. Cai, and R. Nevatia, “Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 4632–4641, 2023

    2023

  29. [37]

    Adversarial training against location- optimized adversarial patches,

    S. Rao, D. Stutz, and B. Schiele, “Adversarial training against location- optimized adversarial patches,” inEuropean conference on computer vision, pp. 429–448, Springer, 2020

    2020

  30. [38]

    Defending against physically realizable attacks on image classification,

    T. Wu, L. Tong, and Y . V orobeychik, “Defending against physically realizable attacks on image classification,” inInternational Conference on Learning Representations, 2020

    2020

  31. [39]

    Efficient training methods for achieving adversarial robustness against sparse attacks,

    S. Addepalli, D. Behl, G. Sriramanan, and R. V . Babu, “Efficient training methods for achieving adversarial robustness against sparse attacks,” in Proceedings of International Conference on Computer Vision Workshops (ICCV Workshops). IEEE, 2021

    2021

  32. [40]

    Learning a deep convolu- tional network for image super-resolution,

    C. Dong, C. C. Loy, K. He, and X. Tang, “Learning a deep convolu- tional network for image super-resolution,” inEuropean Conference on Computer Vision, pp. 184–199, Springer, 2014

    2014

  33. [41]

    Accurate image super-resolution using very deep convolutional networks,

    J. Kim, J. Kwon Lee, and K. Mu Lee, “Accurate image super-resolution using very deep convolutional networks,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1646– 1654, 2016

    2016

  34. [42]

    Photo-realistic single image super-resolution using a generative adversarial network,

    C. Ledig, L. Theis, F. Husz ´ar, J. Caballero, A. Aitken, A. Tejani, J. Totz, Z. Wang, and W. Shi, “Photo-realistic single image super-resolution using a generative adversarial network,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4681–...

    2017

  35. [43]

    Esrgan: Enhanced super-resolution generative adversar- ial networks,

    X. Wang, K. Yu, S. Wu, J. Gu, Y . Liu, C. Dong, Y . Qiao, and C. Change Loy, “Esrgan: Enhanced super-resolution generative adversar- ial networks,” inProceedings of the European Conference on Computer Vision Workshops, pp. 63–79, 2018

    2018

  36. [44]

    Image super- resolution as a defense against adversarial attacks,

    A. Mustafa, S. H. Khan, M. Hayat, J. Shen, and L. Shao, “Image super- resolution as a defense against adversarial attacks,”IEEE Transactions on Image Processing, vol. 29, pp. 1711–1724, 2019

    2019

  37. [45]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandku- mar, “Diffusion models for adversarial purification,”arXiv preprint arXiv:2205.07460, 2022

    2022 arXiv

  38. [46]

    Analysis and comparison of various image downsampling and upsampling methods,

    A. Youssef, “Analysis and comparison of various image downsampling and upsampling methods,” inProceedings DCC’98 Data Compression Conference (Cat. No. 98TB100225), p. 583, IEEE, 1998

    1998

  39. [47]

    Image quality assessment: From error visibility to structural similarity,

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli, “Image quality assessment: From error visibility to structural similarity,”IEEE Transactions on Image Processing, vol. 13, no. 4, pp. 600–612, 2004

    2004

  40. [48]

    Countering adver- sarial images using input transformations,

    C. Guo, M. Rana, M. Ciss ´e, and L. van der Maaten, “Countering adver- sarial images using input transformations,” inInternational Conference on Learning Representations, 2018

    2018

  41. [49]

    Real-esrgan: Training real- world blind super-resolution with pure synthetic data,

    X. Wang, L. Xie, C. Dong, and Y . Shan, “Real-esrgan: Training real- world blind super-resolution with pure synthetic data,” inProceedings of the IEEE/CVF international conference on computer vision, pp. 1905– 1914, 2021

    1905

  42. [50]

    Diffusion models for adversarial purification,

    W. Nie, B. Chen, A. Anandkumar, and J. Huang, “Diffusion models for adversarial purification,” inAdvances in Neural Information Processing Systems, 2022

    2022

  43. [51]

    Efficientnet: Rethinking model scaling for con- volutional neural networks,

    M. Tan and Q. Le, “Efficientnet: Rethinking model scaling for con- volutional neural networks,” inInternational conference on machine learning, pp. 6105–6114, PMLR, 2019

    2019

  44. [52]

    Identity mappings in deep residual networks,

    K. He, X. Zhang, S. Ren, and J. Sun, “Identity mappings in deep residual networks,” inComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14, pp. 630–645, Springer, 2016

    2016

  45. [53]

    Pytorch: An imperative style, high-performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga,et al., “Pytorch: An imperative style, high-performance deep learning library,”Advances in neural information processing systems, vol. 32, 2019

    2019

  46. [54]

    Ntire 2017 challenge on single image super-resolution: Dataset and study,

    E. Agustsson and R. Timofte, “Ntire 2017 challenge on single image super-resolution: Dataset and study,” inProceedings of the IEEE confer- ence on computer vision and pattern recognition workshops, pp. 126– 135, 2017

    2017

  47. [55]

    Ntire 2017 challenge on single image super-resolution: Methods and results,

    R. Timofte, E. Agustsson, L. Van Gool, M.-H. Yang, and L. Zhang, “Ntire 2017 challenge on single image super-resolution: Methods and results,” inProceedings of the IEEE conference on computer vision and pattern recognition workshops, pp. 114–125, 2017

    2017

  48. [56]

    Recovering realistic texture in image super-resolution by deep spatial feature transform,

    X. Wang, K. Yu, C. Dong, and C. C. Loy, “Recovering realistic texture in image super-resolution by deep spatial feature transform,” inProceedings of the IEEE conference on computer vision and pattern recognition, pp. 606–615, 2018

    2018

  49. [57]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” inInternational Conference on Learning Representations, 2015

    2015

  50. [58]

    Wide residual networks,

    S. Zagoruyko and N. Komodakis, “Wide residual networks,” inBritish Machine Vision Conference 2016, British Machine Vision Association, 2016

    2016

  51. [59]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean Conference on Computer Vision (ECCV), pp. 740– 755, 2014

    2014

  52. [60]

    Faster r-cnn: Towards real-time object detection with region proposal networks,

    S. Ren, K. He, R. Girshick, and J. Sun, “Faster r-cnn: Towards real-time object detection with region proposal networks,” inNeural Information Processing Systems (NeurIPS), pp. 91–99, 2015

    2015

  53. [61]

    Dpatch: An adversarial patch attack on object detectors,

    Y . Chen, J. Zhao, and ..., “Dpatch: An adversarial patch attack on object detectors,” inCVPR, 2022

    2022

  54. [62]

    Adversarial robustness toolbox (art),

    “Adversarial robustness toolbox (art),” 2023. Available at: https://adversarial-robustness-toolbox.readthedocs.io/

    2023

  55. [63]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” tech. rep., University of Toronto, 2009

    2009

  56. [64]

    Image super-resolution via iterative refinement (sr3),

    J. Ho, C. Saharia, and T. Salimans, “Image super-resolution via iterative refinement (sr3),”arXiv preprint arXiv:2104.07636, 2021. APPENDIX A. COCO & DPatch Attack We evaluateSuperPureon theCOCOdataset [59] using Faster R-CNN[60] for object detection, under aDPatch threat [61]...

    2021 arXiv

  57. [65]

    This underscoresSuperPure’splug-and-playcapability, as no task-specific retraining is required

    Experimental Setup:We do not retrain or modify the detector; instead, we applySuperPureto each adversarial image, then feed the purified output into the original Faster R- CNN. This underscoresSuperPure’splug-and-playcapability, as no task-specific retraining is required

  58. [66]

    Clean detection accuracy of60%plunges to35%under DPatch, but SuperPurerestores it to58%, indicating robust generalization beyond classification tasks

    Results and Observations:Table IX summarizes the micro-precision on randomly selected COCO pictures. Clean detection accuracy of60%plunges to35%under DPatch, but SuperPurerestores it to58%, indicating robust generalization beyond classification tasks. TABLE IX FASTERR-CNN [60]...

  59. [67]

    The total adversarial area thus becomes increasingly fragmented, posing a stronger challenge

    Experimental Setup:For each experiment, we increment the number of32×32patches scattered across the image. The total adversarial area thus becomes increasingly fragmented, posing a stronger challenge. WhileSuperPurefaces a white- box attacker, PatchCleanser is tested as-is. Th...

  60. [68]

    De- spite the attacker’s full knowledge ofSuperPure, our method 0 1 2 4 80 0.2 0.4 0.6 0.8 1 Number of Patches Robustness SuperPure+ PatchCleanser [14] Fig

    Results and Observations:Figure 10 plots the robust accuracy as the number of distributed patches increases. De- spite the attacker’s full knowledge ofSuperPure, our method 0 1 2 4 80 0.2 0.4 0.6 0.8 1 Number of Patches Robustness SuperPure+ PatchCleanser [14] Fig. 10. Compari...

  61. [69]

    Experimental Setup and Preliminary Results:Table X shows the accuracy on clean CIFAR images, the accuracy under the32×32patch attack, and the recovered accuracy after applyingSuperPure. Despite the aggressive upscaling,Super- Puresubstantially mitigates adversarial damage, sug...

  62. [70]

    Robustness Trade-off:Our tests show that while SR3 can improve image fidelity slightly, it issignifi- cantly slower

    Latency vs. Robustness Trade-off:Our tests show that while SR3 can improve image fidelity slightly, it issignifi- cantly slower. On a single image, SR3 may takeseveral sec- onds, making multiple passes impractical. By contrast, Real- ESRGAN performs sufficiently fast to allow ...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.