mlsanityData to 7 Oct 2026

PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning

arXiv 2004.05682 ↗First posted 12 Apr 2020cs.CVcited by 67

Not on the map. Why?

Abstract (arXiv)

Patch-based attacks introduce a perceptible but localized change to the input that induces misclassification. A limitation of current patch-based black-box attacks is that they perform poorly for targeted attacks, and even for the less challenging non-targeted scenarios, they require a large number of queries. Our proposed PatchAttack is query efficient and can break models for both targeted and non-targeted attacks. PatchAttack induces misclassifications by superimposing small textured patches on the input image. We parametrize the appearance of these patches by a dictionary of class-specific textures. This texture dictionary is learned by clustering Gram matrices of feature activations from a VGG backbone. PatchAttack optimizes the position and texture parameters of each patch using reinforcement learning. Our experiments show that PatchAttack achieves > 99% success rate on ImageNet for a wide range of architectures, while only manipulating 3% of the image for non-targeted attacks and 10% on average for targeted attacks. Furthermore, we show that PatchAttack circumvents state-of-the-art adversarial defense methods successfully.

Key facts. Cited by 67 papers in the map (data through 7 Oct 2026). First posted on arXiv 12 Apr 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 11; 2023: 15; 2024: 15; 2025: 9; 2026: 4.

67 papers.

Sort:

By area:

  1. 2021Are Transformers More Robust Than CNNs?cited by 187
  2. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 175
  3. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  4. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  5. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  6. 2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 48
  7. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  8. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 41
  9. 2023Physically Adversarial Infrared Patches with Learnable Shapes and Locationscited by 38
  10. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
  11. 2023Frequency Domain-based Dataset Distillationcited by 28
  12. 2022ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patchescited by 27
38 more
  1. 2023RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical Worldcited by 23
  2. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  3. 2023Efficient Decision-based Black-box Patch Attacks on Video Recognitioncited by 21
  4. 2022Pixle: a fast and effective black-box attack based on rearranging pixelscited by 20
  5. 2021Meta Adversarial Training against Universal Patchescited by 19
  6. 2021Generative Dynamic Patch Attackcited by 19
  7. 2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
  8. 2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 18
  9. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  10. 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
  11. 2021Attacking Video Recognition Models with Bullet-Screen Commentscited by 16
  12. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  13. 2023Black-box Targeted Adversarial Attack on Segment Anything (SAM)cited by 13
  14. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
  15. 2021Reinforcement Learning Based Sparse Black-box Adversarial Attack on Video Recognition Modelscited by 12
  16. 2024Failures Are Fated, But Can Be Faded: Characterizing and Mitigating Unwanted Behaviors in Large-Scale Vision and Language Modelscited by 11
  17. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 10
  18. 2023TrajPAC: Towards Robustness Verification of Pedestrian Trajectory Prediction Modelscited by 8
  19. 2023LogoStyleFool: Vitiating Video Recognition Systems via Logo Style Transfercited by 6
  20. 2024Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigationcited by 6
  21. 2022Adversarial Scratches: Deployable Attacks to CNN Classifierscited by 5
  22. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  23. 2023Patch of Invisibility: Naturalistic Physical Black-Box Adversarial Attacks on Object Detectorscited by 5
  24. 2021Multiplicative Reweighting for Robust Neural Network Optimizationcited by 4
  25. 2021Patch Shortcuts: Interpretable Proxy Models Efficiently Find Black-Box Vulnerabilitiescited by 4
  26. 2022On the interplay of adversarial robustness and architecture components: patches, convolution and attentioncited by 4
  27. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  28. 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
  29. 2021The Duo of Artificial Intelligence and Big Data for Industry 4.0: Review of Applications, Techniques, Challenges, and Future Research Directionscited by 3
  30. 2023Distributional Modeling for Location-Aware Adversarial Patchescited by 3
  31. 2024BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Taskscited by 3
  32. 2024Query-Efficient Video Adversarial Attack with Stylized Logo on Service Computingcited by 3
  33. 2025MFFI: Multi-Dimensional Face Forgery Image Dataset for Real-World Scenarioscited by 3
  34. 2026VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijackingcited by 3
  35. 2023Agnostic Multi-Robust Learning Using ERMcited by 2
  36. 2024Towards Robust Semantic Segmentation against Patch-based Attack via Attention Refinementcited by 2
  37. 2024Principles of Designing Robust Remote Face Anti-Spoofing Systemscited by 2
  38. 2025Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detectioncited by 2

50 most cited of 67 All 67 (JSON)