mlsanityData to 14 Oct 2026

PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches

arXiv 2104.12609 ↗First posted 26 Apr 2021cs.CVcited by 29

Not on the map. Why?

Abstract (arXiv)

An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification. The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object. Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions. In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provable robust accuracy and clean accuracy. In PatchGuard++, we first use a CNN with small receptive fields for feature extraction so that the number of features corrupted by the adversarial patch is bounded. Next, we apply masks in the feature space and evaluate predictions on all possible masked feature maps. Finally, we extract a pattern from all masked predictions to catch the adversarial patch attack. We evaluate PatchGuard++ on ImageNette (a 10-class subset of ImageNet), ImageNet, and CIFAR-10 and demonstrate that PatchGuard++ significantly improves the provable robustness and clean performance.

Key facts. Cited by 29 papers in the map (data through 14 Oct 2026). Builds on 9 of its 19 references that are in the map. First posted on arXiv 26 Apr 2021.

Builds on

9 of 19 references.

References · 9

  1. 2017Adversarial Patchcited by 517
  2. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
  3. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  4. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  5. 2020Certified Defenses for Adversarial Patchescited by 101
  6. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  7. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  8. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  9. 2021Efficient Certified Defenses Against Patch Attacks on Image Classifierscited by 24

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 3; 2022: 7; 2023: 7; 2024: 4; 2025: 7; 2026: 1.

29 papers.

Sort:

By area:

  1. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 151
  2. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  3. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  4. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
  5. 2022On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Drivingcited by 30
  6. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  7. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  8. 2022REAP: A Large-Scale Realistic Adversarial Patch Benchmarkcited by 18
  9. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  10. 2022Certified Defences Against Adversarial Patch Attacks on Semantic Segmentationcited by 16
  11. 2021ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layerscited by 15
  12. 2021PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testingcited by 12
17 more
  1. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  2. 2023PECAN: A Deterministic Certified Defense Against Backdoor Attackscited by 5
  3. 2022Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attackscited by 3
  4. 2024CrossCert: A Cross-Checking Detection Approach to Patch Robustness Certification for Deep Learning Modelscited by 3
  5. 2023Agnostic Multi-Robust Learning Using ERMcited by 2
  6. 2023A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Modelscited by 2
  7. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  8. 2025GAN-Based Single-Stage Defense for Traffic Sign Classification Under Adversarial Patchcited by 1
  9. 2025PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patchescited by 1
  10. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  11. 2025RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Maskingcited by 1
  12. 2023Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Predictioncited by 0
  13. 2023Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Trainingcited by 0
  14. 2024Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attackscited by 0
  15. 2025Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Storescited by 0
  16. 2025SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholdscited by 0
  17. 2026CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Modelscited by 0