mlsanityData to 7 Oct 2026

Certified Defenses for Adversarial Patches

arXiv 2003.06693 ↗First posted 14 Mar 2020cs.CR cs.LG stat.MLcited by 100

Not on the map. Why?

Abstract (arXiv)

Adversarial patch attacks are among one of the most practical threat models against real-world computer vision systems. This paper studies certified and empirical defenses against patch attacks. We begin with a set of experiments showing that most existing defenses, which work by pre-processing input images to mitigate adversarial patches, are easily broken by simple white-box adversaries. Motivated by this finding, we propose the first certified defense against patch attacks, and propose faster methods for its training. Furthermore, we experiment with different patch shapes for testing, obtaining surprisingly good robustness transfer across shapes, and present preliminary results on certified defense against sparse attacks. Our complete implementation can be found on: https://github.com/Ping-C/certifiedpatchdefense.

Key facts. Cited by 100 papers in the map (data through 7 Oct 2026). First posted on arXiv 14 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 28; 2022: 16; 2023: 23; 2024: 16; 2025: 11; 2026: 6.

100 papers.

Sort:

By area:

  1. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  4. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  5. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  6. 2022Certified Training: Small Boxes are All You Needcited by 51
  7. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  8. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 44
  9. 2022Towards Practical Certifiable Patch Defense with Vision Transformercited by 44
  10. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  11. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
  12. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
38 more
  1. 2021Adversarial Training Helps Transfer Learning via Better Representationscited by 36
  2. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  3. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  4. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  5. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  6. 2021JEM++: Improved Techniques for Training JEMcited by 28
  7. 2021Efficient Certified Defenses Against Patch Attacks on Image Classifierscited by 23
  8. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  9. 2021Meta Adversarial Training against Universal Patchescited by 19
  10. 2021Generative Dynamic Patch Attackcited by 19
  11. 2021Center Smoothing: Certified Robustness for Networks with Structured Outputscited by 18
  12. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  13. 2021Attacking Video Recognition Models with Bullet-Screen Commentscited by 16
  14. 2023Run-Off Election: Improved Provable Defense against Data Poisoning Attackscited by 16
  15. 2021ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layerscited by 15
  16. 2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 15
  17. 2022Towards Bridging the Performance Gaps of Joint Energy-based Modelscited by 15
  18. 2022Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivitycited by 15
  19. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  20. 2024Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perceptioncited by 14
  21. 2021Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networkscited by 13
  22. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 11
  23. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  24. 2023Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustnesscited by 11
  25. 2021Shared Certificates for Neural Network Verificationcited by 10
  26. 2021Interpolated Joint Space Adversarial Training for Robust and Generalizable Defensescited by 10
  27. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 10
  28. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  29. 2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
  30. 2021Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysiscited by 7
  31. 2024Certified Robust Accuracy of Neural Networks Are Bounded due to Bayes Errorscited by 7
  32. 2023Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flowcited by 6
  33. 202110 Security and Privacy Problems in Large Foundation Modelscited by 5
  34. 2023OccRob: Efficient SMT-Based Occlusion Robustness Verification of Deep Neural Networkscited by 5
  35. 2023Revisiting Image Classifier Training for Improved Certified Robust Defense against Adversarial Patchescited by 5
  36. 2024Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIPcited by 5
  37. 2024I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectorscited by 5
  38. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5

50 most cited of 100 All 100 (JSON)