Research map / Adversarial robustness and security / Attacks on text and graphs
PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PatchDEMUX, a framework that extends any single-label certifiable patch defense (here PatchCleanser) to multi-label classification by treating classes as isolated binary problems, plus a location-aware certification that tightens bounds under a single-patch attacker.
Problem
Certifiable robustness against adversarial patch attacks has been developed for single-label classifiers but largely not for multi-label classifiers on MS-COCO and PASCAL VOC.
Approach
Decompose multi-label prediction into per-class isolated binary classifiers, each protected by an off-the-shelf single-label CDPA, and aggregate certified true positives, false positive and false negative bounds; a location-aware certification tracks vulnerable patch locations across classes to tighten bounds when the attacker has a single patch.
Key results
- On MS-COCO with ViT, defended clean AP is 85.276 versus 91.146 undefended, about 94% of undefended AP.
- Location-aware certification reaches 44.902% certified AP on MS-COCO, improving certified AP by almost 3 points over the basic certified robust setting (41.763).
- Abstract reports 92.593% clean AP and 56.030% certified robust AP on PASCAL VOC versus 96.140% undefended.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use location-aware certification instead of baseline certification | PatchDEMUX with PatchCleanser backbone · MS-COCO 2014 validation | certified average precision: 41.763 -> 44.902 | Helped |
| Use location-aware certification instead of baseline certification | PatchDEMUX with PatchCleanser backbone · MS-COCO 2014 validation | precision at 50% certified recall: 50.950 -> 56.038 | Helped |
| Apply PatchDEMUX defense at clean inference instead of using the undefended model | ViT multi-label classifier · MS-COCO 2014 validation | average precision: 91.146 -> 85.276 | Hurt |
| Apply PatchDEMUX defense at clean inference instead of using the undefended model | Multi-label classifier · PASCAL VOC 2007 test | average precision: 96.140 -> 92.593 | Hurt |
| Reduce the mask count from 36 to 16 (ablation) | PatchDEMUX with PatchCleanser backbone · MS-COCO 2014 validation | average precision: maximum AP drop of 2 points | Hurt |
| Increase the estimated patch size (ablation) | PatchDEMUX with PatchCleanser backbone · MS-COCO 2014 validation | certified average precision: close to 0% | Hurt |
| Increase the estimated patch size (ablation) | PatchDEMUX with PatchCleanser backbone · MS-COCO 2014 validation | clean average precision: 85.731 to 69.952 | Hurt |
| Use variants of cutout fine-tuning (ablation) | PatchDEMUX · MS-COCO 2014 validation | robustness | Helped |
Surprising findings
- Attacks targeting false positives are relatively weaker than those targeting false negatives in the location-aware setting.
- Defended clean precision-recall curve is concave while certified curves are slightly convex, attributed to PatchCleanser's sensitivity to object occlusion from masks.
Limitations
- Certified robustness is limited at larger patch sizes (certified AP near 0 at 32% patch area).
- Location-aware certification assumes a single patch attacker and requires the single-label defense to expose vulnerability status arrays.
- Certified performance is sensitive to object occlusion from PatchCleanser masks, especially for small objects in MS-COCO.
Experimental setup
Datasets: MS-COCO 2014 PASCAL VOC 2007
Benchmarks: MS-COCO 2014 validation PASCAL VOC 2007 test
Metrics: average precision certified precision certified recall certified AP
Baselines: Undefended multi-label classifier Certified robust (Algorithm 2)
Builds on: PatchCleanser Cutout fine-tuning Asymmetric loss
Closest papers by meaning
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.87)
- Semantic-Aware Multi-Label Adversarial Attacks (CVPR 2024 · similarity 0.85)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.85)
- Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · similarity 0.85)
- Taming the Sigmoid Bottleneck: Provably Argmaxable Sparse Multi-Label Classification (AAAI 2024 · similarity 0.85)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.