mlsanityData to 7 Oct 2026

Efficient Certified Defenses Against Patch Attacks on Image Classifiers

arXiv 2102.04154 ↗First posted 8 Feb 2021cs.LG cs.AI cs.CVcited by 23

Not on the map. Why?

Abstract (arXiv)

Adversarial patches pose a realistic threat model for physical world attacks on autonomous systems via their perception component. Autonomous systems in safety-critical domains such as automated driving should thus contain a fail-safe fallback component that combines certifiable robustness against patches with efficient inference while maintaining high performance on clean inputs. We propose BagCert, a novel combination of model architecture and certification procedure that allows efficient certification. We derive a loss that enables end-to-end optimization of certified robustness against patches of different sizes and locations. On CIFAR10, BagCert certifies 10.000 examples in 43 seconds on a single GPU and obtains 86% clean and 60% certified accuracy against 5x5 patches.

Key facts. Cited by 23 papers in the map (data through 7 Oct 2026). Builds on 31 of its 42 references that are in the map. First posted on arXiv 8 Feb 2021.

Builds on

31 of 42 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  8. 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,031
  9. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  10. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  12. 2017Adversarial Patchcited by 514
19 more
  1. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  2. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  3. 2016Safety Verification of Deep Neural Networkscited by 262
  4. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
  5. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  6. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  7. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  8. 2018Scaling provable adversarial defensescited by 141
  9. 2019Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentationcited by 105
  10. 2020Certified Defenses for Adversarial Patchescited by 100
  11. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
  12. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  13. 2017Shake-Shake regularizationcited by 87
  14. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  15. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  16. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  17. 2019Attacking Optical Flowcited by 41
  18. 2017Evaluating Robustness of Neural Networks with Mixed Integer Programmingcited by 14
  19. 2020PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Maskingcited by 13

Built on by

Cited by year

Citing papers per year: 2021: 5; 2022: 6; 2023: 6; 2024: 3; 2025: 3.

23 papers.

Sort:

By area:

  1. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  2. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  3. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 44
  4. 2022Towards Practical Certifiable Patch Defense with Vision Transformercited by 44
  5. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  6. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  7. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  8. 2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 15
  9. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 11
  10. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  11. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 10
  12. 2023Adversarial Examples in the Physical World: A Surveycited by 10
11 more
  1. 2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
  2. 2023Revisiting Image Classifier Training for Improved Certified Robust Defense against Adversarial Patchescited by 5
  3. 2024Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIPcited by 5
  4. 2023Agnostic Multi-Robust Learning Using ERMcited by 2
  5. 2025CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coveragecited by 2
  6. 2023Architecture-agnostic Iterative Black-box Certified Defense against Adversarial Patchescited by 1
  7. 2023A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Modelscited by 1
  8. 2024CrossCert: A Cross-Checking Detection Approach to Patch Robustness Certification for Deep Learning Modelscited by 1
  9. 2025PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patchescited by 1
  10. 2024Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attackscited by 0
  11. 2025Scalable and Precise Patch Robustness Certification for Deep Learning Models with Top-k Predictionscited by 0