Research map / Adversarial robustness and security / Attacks on text and graphs
A Unified, Resilient, and Explainable Adversarial Patch Detector
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdvPatchXAI, a prototype-based, self-supervised adversarial patch detector with a patch decorrelation loss and sparse non-negative linear classifier, evaluated zero-shot on COCO/ImageNet patch datasets with and without noise.
Problem
Detecting physical out-of-distribution adversarial patches that generalize to unseen patches, unseen datasets, and unseen natural corruptions, while providing human-aligned explanations.
Approach
Learns self-supervised prototypical parts with a patch decorrelation loss (contrastive, cross-correlation based) plus softmax alignment and tanh losses, then classifies with a sparse non-negative linear layer so decisions are interpretable via prototypes; uses grayscale augmentation to avoid color bias.
Key results
- AdvPatchXAI-R reaches 99.33% mean silent accuracy on COCO with Patch-9 and 98.94% on ImageNet.
- AdvPatchXAI-ViT trained on Patch-4 drops only from 89.6% to 86.02% on COCO under Gaussian noise, while AdvPatchXAI-M drops by 19.88%.
- AdvPatchXAI-R exceeds Ojaswee et al. by 13.35% and Kumar & Agarwal by 11.9% on COCO.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace RGB or YCbCr input with grayscale images (ablation) | AdvPatchXAI-ViT · COCO, Patch-4 training, silent | accuracy: 74.11 -> 92.95; 78.44 -> 92.95 | Helped |
| Replace RGB or YCbCr input with grayscale images (ablation) | AdvPatchXAI-R · COCO, Patch-4 training, silent | accuracy: 81.26 -> 96.09; 78.27 -> 96.09 | Helped |
| Add patch decorrelation loss (ablation) | AdvPatchXAI with ResNet50 · COCO, mean across Patch-0 to Patch-4 | mean accuracy: 86.44 -> 91.13 | Helped |
| Add patch decorrelation loss (ablation) | AdvPatchXAI with ViT · COCO, mean across Patch-0 to Patch-4 | mean accuracy: 92.66 -> 92.48 | No clear effect |
| Add patch decorrelation loss (ablation) | AdvPatchXAI with MobileNet · COCO, mean across Patch-0 to Patch-4 | mean accuracy: 77.71 -> 88.46 | Helped |
| Use AdvPatchXAI instead of PIP-Net | COCO, unseen patches, silent · COCO | accuracy: +4.73% | Helped |
| Use AdvPatchXAI instead of PIP-Net | COCO, unseen patches, silent · COCO | accuracy: +6.9% | Helped |
| Use AdvPatchXAI instead of PIP-Net | COCO, unseen patches, silent · COCO | accuracy: +0.28% | Helped |
Surprising findings
- Grayscale conversion outperformed RGB and YCbCr by at least 14.51% for ViT trained on Patch-4, suggesting color cues bias detectors.
Limitations
- Performance varies substantially across backbones and patches (e.g., MobileNet and ConvNeXt drop sharply on some patches).
- Evaluated only on binary patch detection with zero-shot patch/dataset settings; scalability and other attack types left to future work.
Experimental setup
Datasets: COCO ImageNet
Benchmarks: COCO adversarial patch subset ImageNet adversarial patch subset CUB-200-2011 Stanford Cars
Metrics: classification accuracy (mean) standard deviation
Baselines: PIP-Net Ojaswee et al. (2024) detector Kumar & Agarwal (2024) detector
Builds on: PIP-Net TrivialAugment Barlow Twins-style cross-correlation loss
Closest papers by meaning
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.89)
- DAP: A Dynamic Adversarial Patch for Evading Person Detectors (CVPR 2024 · similarity 0.88)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.87)
- Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patches (ICLR 2024 · similarity 0.86)
- PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies (CVPR 2025 · similarity 0.86)
- AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant Adversarial Patches (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.