mlsanityData to 14 Oct 2026

Adversarial Training against Location-Optimized Adversarial Patches

arXiv 2005.02313 ↗First posted 5 May 2020cs.CV cs.CR cs.LGcited by 50

Not on the map. Why?

Abstract (arXiv)

Deep neural networks have been shown to be susceptible to adversarial examples -- small, imperceptible changes constructed to cause mis-classification in otherwise highly accurate image classifiers. As a practical alternative, recent work proposed so-called adversarial patches: clearly visible, but adversarially crafted rectangular patches in images. These patches can easily be printed and applied in the physical world. While defenses against imperceptible adversarial examples have been studied extensively, robustness against adversarial patches is poorly understood. In this work, we first devise a practical approach to obtain adversarial patches while actively optimizing their location within the image. Then, we apply adversarial training on these location-optimized adversarial patches and demonstrate significantly improved robustness on CIFAR10 and GTSRB. Additionally, in contrast to adversarial training on imperceptible adversarial examples, our adversarial patch training does not reduce accuracy.

Key facts. Cited by 50 papers in the map (data through 14 Oct 2026). First posted on arXiv 5 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 9; 2022: 12; 2023: 9; 2024: 7; 2025: 11; 2026: 2.

50 papers.

Sort:

By area:

  1. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  2. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  3. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  4. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 45
  5. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 42
  6. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  7. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
  8. 2022On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Drivingcited by 30
  9. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  10. 2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
  11. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  12. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
38 more
  1. 2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
  2. 2022REAP: A Large-Scale Realistic Adversarial Patch Benchmarkcited by 18
  3. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  4. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  5. 2021Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networkscited by 13
  6. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 12
  7. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  8. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  9. 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
  10. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  11. 2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
  12. 2023Revisiting Image Classifier Training for Improved Certified Robust Defense against Adversarial Patchescited by 6
  13. 2023Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flowcited by 6
  14. 2022Adversarial Scratches: Deployable Attacks to CNN Classifierscited by 5
  15. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  16. 2024Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patchescited by 4
  17. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  18. 2022Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attackscited by 3
  19. 2023Distributional Modeling for Location-Aware Adversarial Patchescited by 3
  20. 2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modificationcited by 3
  21. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  22. 2024Model Agnostic Defense against Adversarial Patch Attacks on Object Detection in Unmanned Aerial Vehiclescited by 2
  23. 2024DiffPAD: Denoising Diffusion-based Adversarial Patch Decontaminationcited by 2
  24. 2025CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coveragecited by 2
  25. 2021Reversible Attack based on Local Visual Adversarial Perturbationcited by 1
  26. 2025Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNscited by 1
  27. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  28. 2025Benchmarking Adversarial Patch Selection and Locationcited by 1
  29. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
  30. 2023Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Predictioncited by 0
  31. 2024Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attackscited by 0
  32. 2025Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Storescited by 0
  33. 2025SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Modelscited by 0
  34. 2025IPG: Incremental Patch Generation for Generalized Adversarial Patch Trainingcited by 0
  35. 2025TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networkscited by 0
  36. 2025NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbationscited by 0
  37. 2026STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTscited by 0
  38. 2026Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attackscited by 0