# PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches

arXiv: https://arxiv.org/abs/2104.12609 · HTML: https://mlsanity.com/paper/2104.12609/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 19 references that are in the map.
- First posted on arXiv 26 Apr 2021.

## Builds on (most cited first, 9 of 9)

- [Adversarial Patch](https://mlsanity.com/paper/1712.09665/) (2017)
- [Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet](https://mlsanity.com/paper/1904.00760/) (2019)
- [ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector](https://mlsanity.com/paper/1804.05810/) (2018)
- [LaVAN: Localized and Visible Adversarial Noise](https://mlsanity.com/paper/1801.02608/) (2018)
- [Certified Defenses for Adversarial Patches](https://mlsanity.com/paper/2003.06693/) (2020)
- [(De)Randomized Smoothing for Certifiable Defense against Patch Attacks](https://mlsanity.com/paper/2002.10733/) (2020)
- [Local Gradients Smoothing: Defense against localized adversarial attacks](https://mlsanity.com/paper/1807.01216/) (2018)
- [Minority Reports Defense: Defending Against Adversarial Patches](https://mlsanity.com/paper/2004.13799/) (2020)
- [Efficient Certified Defenses Against Patch Attacks on Image Classifiers](https://mlsanity.com/paper/2102.04154/) (2021)

## Built on by (most cited first, 29 of 29)

- [Certifiably Robust RAG against Retrieval Corruption](https://mlsanity.com/paper/2405.15556/) (2024)
- [PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier](https://mlsanity.com/paper/2108.09135/) (2021)
- [Jedi: Entropy-based Localization and Removal of Adversarial Patches](https://mlsanity.com/paper/2304.10029/) (2023)
- [PAD: Patch-Agnostic Defense against Adversarial Patch Attacks](https://mlsanity.com/paper/2404.16452/) (2024)
- [On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving](https://mlsanity.com/paper/2201.01850/) (2022)
- [PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch](https://mlsanity.com/paper/2207.01795/) (2022)
- [ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Masking](https://mlsanity.com/paper/2202.01811/) (2022)
- [REAP: A Large-Scale Realistic Adversarial Patch Benchmark](https://mlsanity.com/paper/2212.05680/) (2022)
- [Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey](https://mlsanity.com/paper/2206.08304/) (2022)
- [Certified Defences Against Adversarial Patch Attacks on Semantic Segmentation](https://mlsanity.com/paper/2209.05980/) (2022)
- [ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers](https://mlsanity.com/paper/2110.14120/) (2021)
- [PatchCensor: Patch Robustness Certification for Transformers via Exhaustive Testing](https://mlsanity.com/paper/2111.10481/) (2021)
- [PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defenses](https://mlsanity.com/paper/2310.13076/) (2023)
- [PECAN: A Deterministic Certified Defense Against Backdoor Attacks](https://mlsanity.com/paper/2301.11824/) (2023)
- [Real-Time Robust Video Object Detection System Against Physical-World Adversarial Attacks](https://mlsanity.com/paper/2208.09195/) (2022)
- [CrossCert: A Cross-Checking Detection Approach to Patch Robustness Certification for Deep Learning Models](https://mlsanity.com/paper/2405.07668/) (2024)
- [Agnostic Multi-Robust Learning Using ERM](https://mlsanity.com/paper/2303.08944/) (2023)
- [A Majority Invariant Approach to Patch Robustness Certification for Deep Learning Models](https://mlsanity.com/paper/2308.00452/) (2023)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)
- [GAN-Based Single-Stage Defense for Traffic Sign Classification Under Adversarial Patch](https://mlsanity.com/paper/2503.12567/) (2025)
- [PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches](https://mlsanity.com/paper/2505.24703/) (2025)
- [IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization](https://mlsanity.com/paper/2507.06856/) (2025)
- [RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Masking](https://mlsanity.com/paper/2512.23307/) (2025)
- [Assist Is Just as Important as the Goal: Image Resurfacing to Aid Model's Robust Prediction](https://mlsanity.com/paper/2311.01563/) (2023)
- [Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training](https://mlsanity.com/paper/2312.00105/) (2023)
- [Redesigning Traffic Signs to Mitigate Machine-Learning Patch Attacks](https://mlsanity.com/paper/2402.04660/) (2024)
- [Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores](https://mlsanity.com/paper/2505.08835/) (2025)
- [SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds](https://mlsanity.com/paper/2506.18591/) (2025)
- [CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models](https://mlsanity.com/paper/2608.20791/) (2026)

## Abstract (arXiv)

An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification. The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object. Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions. In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provable robust accuracy and clean accuracy. In PatchGuard++, we first use a CNN with small receptive fields for feature extraction so that the number of features corrupted by the adversarial patch is bounded. Next, we apply masks in the feature space and evaluate predictions on all possible masked feature maps. Finally, we extract a pattern from all masked predictions to catch the adversarial patch attack. We evaluate PatchGuard++ on ImageNette (a 10-class subset of ImageNet), ImageNet, and CIFAR-10 and demonstrate that PatchGuard++ significantly improves the provable robustness and clean performance.