# PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking

arXiv: https://arxiv.org/abs/2005.10884 · HTML: https://mlsanity.com/paper/2005.10884/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 May 2020.

## Built on by (most cited first, 13 of 13)

- [BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning](https://mlsanity.com/paper/2108.00352/) (2021)
- [Towards Practical Certifiable Patch Defense with Vision Transformer](https://mlsanity.com/paper/2203.08519/) (2022)
- [Improved, Deterministic Smoothing for L_1 Certified Robustness](https://mlsanity.com/paper/2103.10834/) (2021)
- [DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks](https://mlsanity.com/paper/2102.02956/) (2021)
- [Efficient Certified Defenses Against Patch Attacks on Image Classifiers](https://mlsanity.com/paper/2102.04154/) (2021)
- [Defensive Patches for Robust Recognition in the Physical World](https://mlsanity.com/paper/2204.06213/) (2022)
- [Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patches](https://mlsanity.com/paper/2103.08860/) (2021)
- [Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey](https://mlsanity.com/paper/2206.08304/) (2022)
- [Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networks](https://mlsanity.com/paper/2108.05075/) (2021)
- [Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame](https://mlsanity.com/paper/2204.13004/) (2022)
- [Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attacks](https://mlsanity.com/paper/2208.09195/) (2022)
- [Agnostic Multi-Robust Learning Using ERM](https://mlsanity.com/paper/2303.08944/) (2023)
- [Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Prediction](https://mlsanity.com/paper/2311.01563/) (2023)

## Abstract (arXiv)

Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with small receptive fields to impose a bound on the number of features corrupted by an adversarial patch. Given a bounded number of corrupted features, the problem of designing an adversarial patch defense reduces to that of designing a secure feature aggregation mechanism. Towards this end, we present our robust masking defense that robustly detects and masks corrupted features to recover the correct prediction. Notably, we can prove the robustness of our defense against any adversary within our threat model. Our extensive evaluation on ImageNet, ImageNette (a 10-class subset of ImageNet), and CIFAR-10 datasets demonstrates that our defense achieves state-of-the-art performance in terms of both provable robust accuracy and clean accuracy.