Research map / Detection and segmentation / CNN features
NAPGuard: Towards Detecting Naturalistic Adversarial Patches
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NAPGuard, a YOLOv5-based patch detector trained with high-frequency aggressive feature alignment and inference-time low-frequency natural feature suppression, plus a new GAP dataset for detecting naturalistic adversarial patches.
Problem
Detecting physical adversarial patches, especially naturalistic adversarial patches (NAPs) that have deceptive appearance and diverse representations, where existing detectors show low precision and poor generalization.
Approach
Modulates features in two stages: during training, a Laplacian-based pattern alignment loss aligns aggressive (high-frequency) features of patches with their surroundings; during inference, a feature shield module suppresses natural (low-frequency, texture-rich) regions via FFT low-pass masking and Gaussian smoothing so aggressive patterns stand out.
Key results
- NAPGuard reaches 91.00% AP@0.5 on NAPs on average and 92.24% on the mixture set, versus 76.84% for the base detector.
- Reports an average AP@0.5 improvement of 60.24% over compared baselines on NAPs.
- Ablation: AFAL alone raises NAP AP@0.5 by 38.01%, while NFSI yields a modest gain (+1.14% on NAPs).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add aggressive feature aligned learning (AFAL) (ablation) | YOLOv5 patch detector · GAP, including NAPs and Non-NAPs | AP@0.5: 76.84 -> 91.89 | Helped |
| add natural feature suppressed inference (NFSI) (ablation) | YOLOv5 patch detector · GAP mixture | AP@0.5: 76.84 -> 77.19 | Helped |
| add both AFAL and NFSI (ablation) | YOLOv5 patch detector · GAP mixture | AP@0.5: 91.89 -> 92.24 | Helped |
| add NFSI alongside AFAL (ablation) | YOLOv5 patch detector · GAP mixture | AP@0.5: 91.89 -> 92.24 | Helped |
| replace the low-frequency feature shield with alternative high-frequency module NFSI-A (ablation) | YOLOv5 patch detector · GL2 | AP@0.5: 62.87 -> 65.42 | Helped |
| replace the low-frequency feature shield with alternative high-frequency module NFSI-A (ablation) | YOLOv5 patch detector · GL1 | AP@0.5: 94.75 -> 94.52 | Hurt |
| add AFAL with alternative high-frequency module NFSI-A (ablation) | YOLOv5 patch detector · GL3 | AP@0.5: 27.14 -> 90.56 | Helped |
| add AFAL and alternative high-frequency module NFSI-A (ablation) | YOLOv5 patch detector · GAP mixture | AP@0.5: 76.84 -> 92.76 | Helped |
| use NAPGuard rather than Base | YOLOv5 patch detector · AdvCloak | AP@0.5: 59.94 -> 92.24 | Helped |
| use NAPGuard rather than Base | YOLOv5 patch detector · AdvTshirt | AP@0.5: +27.46% | Helped |
| use NAPGuard rather than Base | YOLOv5 patch detector · DM-NAP | AP@0.5: +44.18% | Helped |
| use NAPGuard rather than Base | YOLOv5 patch detector · LAP | AP@0.5: +49.84% | Helped |
Surprising findings
- Ad-YOLO, a model-assisted detector, performs worse on NAPs than the plain base YOLOv5 detector, which the authors attribute to multi-category learning hindering aggressive pattern capture.
- Inference-time natural feature suppression contributes only modestly on its own; the large gains come from combining it with training-time alignment.
Limitations
- Evaluated only on the GAP dataset with a single YOLOv5 detector; authors plan to apply to various models.
- Real-world robustness not yet assessed.
- Natural feature suppression relies on empirical hyperparameters (gamma, sigma, filter radius).
Experimental setup
Datasets: GAP (Generalized adversarial Patch detection dataset) INRIA-Person MS COCO
Benchmarks: GAP dataset
Metrics: AP@0.5
Baselines: LGS APE SAC PatchZero Ad-YOLO Base detector (YOLOv5)
Builds on: YOLOv5 Ad-YOLO
Closest papers by meaning
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.86)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.85)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.84)
- Detecting Adversarial Data Using Perturbation Forgery (CVPR 2025 · similarity 0.84)
- Saliuitl: Ensemble Salience Guided Recovery of Adversarial Patches against CNNs (CVPR 2025 · similarity 0.84)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.