# Vax-a-Net: Training-time Defence Against Adversarial Patch Attacks

arXiv: https://arxiv.org/abs/2009.08194 · HTML: https://mlsanity.com/paper/2009.08194/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2020.

## Built on by (most cited first, 11 of 11)

- [Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection](https://mlsanity.com/paper/2112.04532/) (2021)
- [PAD: Patch-Agnostic Defense against Adversarial Patch Attacks](https://mlsanity.com/paper/2404.16452/) (2024)
- [Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey](https://mlsanity.com/paper/2206.08304/) (2022)
- [Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flow](https://mlsanity.com/paper/2310.17403/) (2023)
- [Explaining Adversarial Vulnerability with a Data Sparsity Hypothesis](https://mlsanity.com/paper/2103.00778/) (2021)
- [PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification](https://mlsanity.com/paper/2308.11822/) (2023)
- [Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Prediction](https://mlsanity.com/paper/2311.01563/) (2023)
- [Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores](https://mlsanity.com/paper/2505.08835/) (2025)
- [IPG: Incremental Patch Generation for Generalized Adversarial Patch Training](https://mlsanity.com/paper/2508.10946/) (2025)
- [STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTs](https://mlsanity.com/paper/2603.12688/) (2026)
- [The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patches](https://mlsanity.com/paper/2604.26317/) (2026)

## Abstract (arXiv)

We present Vax-a-Net; a technique for immunizing convolutional neural networks (CNNs) against adversarial patch attacks (APAs). APAs insert visually overt, local regions (patches) into an image to induce misclassification. We introduce a conditional Generative Adversarial Network (GAN) architecture that simultaneously learns to synthesise patches for use in APAs, whilst exploiting those attacks to adapt a pre-trained target CNN to reduce its susceptibility to them. This approach enables resilience against APAs to be conferred to pre-trained models, which would be impractical with conventional adversarial training due to the slow convergence of APA methods. We demonstrate transferability of this protection to defend against existing APAs, and show its efficacy across several contemporary CNN architectures.