Research map / Adversarial robustness and security / Attacks on text and graphs
PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomalies
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PatchGuard, an adversarially robust anomaly detection and localization method that trains a from-scratch ViT with foreground-aware pseudo-anomalies (with masks) and an attention-degree regularizer under PGD adversarial training.
Problem
Anomaly detection and localization models are highly vulnerable to adversarial attacks, and existing methods trained only on normal data, or with outlier exposure, lack robustness, especially for pixel-level localization and high-resolution data.
Approach
Generate near-distribution pseudo-anomalies with ground-truth masks by distorting Grad-CAM-identified foreground regions, train a from-scratch ViT with patch-level cross-entropy plus a regularizer that raises last-layer attention degree, and perform adversarial training with PGD.
Key results
- Under PGD-1000 (eps=8/255), PatchGuard reaches 88.1% AD and 92.7% AL AUROC on MVTec AD clean, with adversarial AD 71.1 vs. 13.7 for the best prior adversarial baseline (GeneralAD) on MVTec.
- Average adversarial AD AUROC of 74.1 versus 12.6 for GeneralAD and 20.9 for RODEO across eight datasets, with clean AD average of 89.3.
- Average adversarial AL AUROC of 81.1 versus 13.6 for GLAD, with clean AL average of 94.8.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use PatchGuard instead of the strongest listed baseline | PatchGuard · MVTec AD (average) | AUROC: 7.4 -> 74.1 | Helped |
| use PatchGuard instead of the strongest listed baseline | PatchGuard · Anomaly localization (average) | AUROC: 13.6 -> 81.1 | Helped |
| add attention regularization (α=1) instead of removing it (ablation) | PatchGuard · MVTec AD | AUROC: 60.7 -> 71.1 | Helped |
| add attention regularization (α=1) instead of removing it (ablation) | PatchGuard · MVTec AD localization | AUROC: 65.3 -> 73.8 | Helped |
| increase attention regularization scaling factor from 1 to 2 (ablation) | PatchGuard · MVTec AD | AUROC: 71.1 -> 70.1 | Hurt |
| increase attention regularization scaling factor from 1 to 5 (ablation) | PatchGuard · MVTec AD | AUROC: 71.1 -> 64.1 | Hurt |
| increase attention regularization scaling factor from 1 to 2 (ablation) | PatchGuard · MVTec AD localization | AUROC: 73.8 -> 68.9 | Hurt |
| increase attention regularization scaling factor from 1 to 5 (ablation) | PatchGuard · MVTec AD localization | AUROC: 73.8 -> 65.6 | Hurt |
| use foreground-aware pseudo-anomaly generation instead of CutPaste (ablation) | PatchGuard · MVTec AD | AUROC: 60.3 -> 71.1 | Helped |
| use foreground-aware pseudo-anomaly generation instead of FPI (ablation) | PatchGuard · MVTec AD | AUROC: 62.1 -> 71.1 | Helped |
| use foreground-aware pseudo-anomaly generation instead of NSA (ablation) | PatchGuard · MVTec AD | AUROC: 66.5 -> 71.1 | Helped |
| use foreground-aware pseudo-anomaly generation instead of GLASS (ablation) | PatchGuard · MVTec AD | AUROC: 62.0 -> 71.1 | Helped |
Surprising findings
- Adversarial training of existing SOTA AD/AL methods (e.g., ReContrast, SimpleNet) yields near-zero or low robust AUROC, indicating that naive adversarial training is insufficient.
- Images with higher last-layer attention degree show lower vulnerability to PGD attack, motivating the attention regularizer.
Limitations
- Clean-setting performance is lower than some SOTA methods (e.g., MVTec AD clean AD 88.1 vs. GLASS 99.9 and ReContrast 99.5).
- Regularization weight alpha is sensitive; large values (alpha=5) destabilize training.
Experimental setup
Datasets: MVTec AD VisA BTAD MPDD WFDD DTD-Synthetic Head-CT BraTS2021
Benchmarks: MVTec AD VisA BTAD MPDD WFDD DTD-Synthetic Head-CT BraTS2021
Metrics: AUROC
Baselines: DRAEM PatchCore SimpleNet ReContrast GeneralAD GLAD GLASS PrincipaLS ZARND RODEO MuSc ReConPatch
Builds on: Outlier Exposure PGD adversarial training DRAEM Grad-CAM Rodeo
Closest papers by meaning
- Boosting Fine-Grained Visual Anomaly Detection with Coarse-Knowledge-Aware Adversarial Learning (AAAI 2025 · similarity 0.89)
- FrameShield: Adversarially Robust Video Anomaly Detection (NeurIPS 2025 · similarity 0.87)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.87)
- NAPGuard: Towards Detecting Naturalistic Adversarial Patches (CVPR 2024 · similarity 0.86)
- A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.86)
- Revisiting Adversarial Patches for Designing Camera-Agnostic Attacks against Person Detection (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.