Research map / Adversarial robustness and security / Attacks on text and graphs
PAD: Patch-Agnostic Defense against Adversarial Patch Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PAD, a training-free, patch-agnostic preprocessing defense that localizes adversarial patches via mutual-information semantic independence and recompression-based spatial heterogeneity, refines masks with SAM, and inpaints them black.
Problem
Defending object detectors against diverse adversarial patch attacks (localized noise, printable, naturalistic) without attack data, prior knowledge of patch appearance, or retraining.
Approach
Two inherent patch properties—semantic independence (low mutual information with neighboring regions) and spatial heterogeneity (different compression-recompression residuals from clean background)—are fused into a heat map, thresholded, morphologically refined, matched to SAM masks, and the matched regions are blacked out before detection.
Key results
- On Faster R-CNN, PAD reaches mAP of roughly 84-89% on natural-looking patches P1-P6, improving over the suboptimal defense by more than 10% on average.
- Patch Localization Recall on Faster R-CNN is 85.90% for OBJ patches versus 33.69% for SAC.
- On APRICOT, PAD reduces attack success rate to 2.27%, only 0.1% above SAC, which was trained on APRICOT data.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply PAD instead of the strongest listed baseline | Faster R-CNN · INRIA Person test, DPatch 75×75, DPatch 100×100, OBJ, OBJ-CLS, Upper, P1–P6 | mAP (%): 96.36 vs 96.23; 96.26 vs 96.06; 84.55 vs 80.70; 87.80 vs 86.20; 88.95 vs 81.05; 68.40 vs 60.70; 87.81 vs 75.80; 85.00 vs | Helped |
| Use the full PAD pipeline rather than semantic-independence localization alone (ablation) | PAD on YOLOv8n · INRIA Person test, OBJ, P3, P4, P5 | mAP (%): 86.3 vs 78.6; 78.7 vs 76.3; 85.4 vs 77.4; 81.5 vs 74.0 | Helped |
| Use the full PAD pipeline rather than semantic-independence localization alone (ablation) | PAD on YOLOv8n · INRIA Person test, Upper | mAP (%): 88.9 vs 86.7 | Mixed |
| Use the full PAD pipeline rather than spatial-heterogeneity localization alone (ablation) | PAD on YOLOv8n · INRIA Person test, OBJ, P3, P4 | mAP (%): 87.5 vs 86.3; 78.7 vs 76.1; 85.4 vs 85.4 | Helped |
| Use the full PAD pipeline rather than spatial-heterogeneity localization alone (ablation) | PAD on YOLOv8n · INRIA Person test, Upper, P5 | mAP (%): 88.9 vs 89.8; 81.5 vs 82.2 | Mixed |
| Use PAD without attack-specific training or prior attack knowledge | Faster R-CNN on APRICOT · APRICOT development set | Attack Success Rate (%): 2.27% | Helped |
Surprising findings
- ObjectSeeker performs worse than the undefended detector under several patch attacks.
- Spatial heterogeneity outperforms semantic independence in digital attacks, while semantic independence matters more in physical attacks.
Limitations
- Jedi requires prior entropy distribution knowledge and needed per-patch parameter tuning for fair comparison.
- Patch localization recall is limited for small pedestrian-scale patches (e.g., Upper, P1) where ground truth masks include background-like regions.
Experimental setup
Datasets: MS COCO INRIA Person
Benchmarks: INRIA Person APRICOT physical attack videos (self-captured)
Metrics: mAP@0.5 Patch Localization Recall ASR
Baselines: LGS SAC Jedi ObjectSeeker
Builds on: Segment Anything Model LGS SAC Jedi ObjectSeeker
Closest papers by meaning
- False Positives Matter: Multidimensional Localization Evaluation and Training-Free Explainable Adversarial Patch Defense (AAAI 2026 · similarity 0.91)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.89)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.87)
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.87)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.87)
- Steal the Patch Size: Adversarially Manipulate Vision Language Models (ICML 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.