mlsanityData to 14 Oct 2026

Meta Adversarial Training against Universal Patches

arXiv 2101.11453 ↗First posted 27 Jan 2021cs.LG cs.AI cs.CVcited by 19

Not on the map. Why?

Abstract (arXiv)

Recently demonstrated physical-world adversarial attacks have exposed vulnerabilities in perception systems that pose severe risks for safety-critical applications such as autonomous driving. These attacks place adversarial artifacts in the physical world that indirectly cause the addition of a universal patch to inputs of a model that can fool it in a variety of contexts. Adversarial training is the most effective defense against image-dependent adversarial attacks. However, tailoring adversarial training to universal patches is computationally expensive since the optimal universal patch depends on the model weights which change during training. We propose meta adversarial training (MAT), a novel combination of adversarial training with meta-learning, which overcomes this challenge by meta-learning universal patches along with model training. MAT requires little extra computation while continuously adapting a large set of patches to the current model. MAT considerably increases robustness against universal patch attacks on image classification and traffic-light detection.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Builds on 37 of its 48 references that are in the map. First posted on arXiv 27 Jan 2021.

Builds on

37 of 48 references.

References · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,897
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  8. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  9. 2018YOLOv3: An Incremental Improvementcited by 2,659
  10. 2016Adversarial examples in the physical worldcited by 1,769
  11. 2018Group Normalizationcited by 1,524
  12. 2018On First-Order Meta-Learning Algorithmscited by 1,018
25 more
  1. 2016Universal adversarial perturbationscited by 784
  2. 2017Adversarial Patchcited by 517
  3. 2019Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentationcited by 105
  4. 2020Certified Defenses for Adversarial Patchescited by 101
  5. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  6. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  7. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  8. 2017Measuring the tendency of CNNs to Learn Surface Statistical Regularitiescited by 87
  9. 2018Universal Adversarial Trainingcited by 87
  10. 2018Low Frequency Adversarial Perturbationcited by 80
  11. 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 70
  12. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  13. 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 66
  14. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  15. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  16. 2019On the Effectiveness of Low Frequency Perturbationscited by 56
  17. 2019Efficient Adversarial Training with Transferable Adversarial Examplescited by 56
  18. 2019Micro-Batch Training with Batch-Channel Normalization and Weight Standardizationcited by 46
  19. 2019Attacking Optical Flowcited by 41
  20. 2019Intriguing properties of adversarial training at scalecited by 33
  21. 2019APRICOT: A Dataset of Physical Adversarial Attacks on Object Detectioncited by 31
  22. 2018Defending Against Universal Perturbations With Shared Adversarial Trainingcited by 25
  23. 2019Design and Interpretation of Universal Adversarial Patches in Face Detectioncited by 23
  24. 2020Improved Adversarial Training via Learned Optimizercited by 22
  25. 2018Playing the Game of Universal Adversarial Perturbationscited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 5; 2023: 4; 2024: 3; 2025: 4; 2026: 1.

19 papers.

Sort:

  1. 2021Are Vision Transformers Robust to Patch Perturbations?cited by 39
  2. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
  3. 2022On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Drivingcited by 30
  4. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  5. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  6. 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
  7. 2023Deep Learning Safety Concerns in Automated Driving Perceptioncited by 10
  8. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  9. 2022CARLA-GeAR: a Dataset Generator for a Systematic Evaluation of Adversarial Robustness of Vision Modelscited by 8
  10. 2021Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attackscited by 7
  11. 2024Adversarial Training: A Surveycited by 6
  12. 2023Distributional Modeling for Location-Aware Adversarial Patchescited by 3
7 more
  1. 2025Benchmarking the Spatial Robustness of DNNs via Natural and Adversarial Localized Corruptionscited by 3
  2. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  3. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  4. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
  5. 2023Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Predictioncited by 0
  6. 2024Dual Adversarial Perturbators Generate rich Views for Recommendationcited by 0
  7. 2026Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attackscited by 0