mlsanityData to 14 Oct 2026

Generative Dynamic Patch Attack

arXiv 2111.04266 ↗First posted 8 Nov 2021cs.CVcited by 19

Not on the map. Why?

Abstract (arXiv)

Adversarial patch attack is a family of attack algorithms that perturb a part of image to fool a deep neural network model. Existing patch attacks mostly consider injecting adversarial patches at input-agnostic locations: either a predefined location or a random location. This attack setup may be sufficient for attack but has considerable limitations when using it for adversarial training. Thus, robust models trained with existing patch attacks cannot effectively defend other adversarial attacks. In this paper, we first propose an end-to-end patch attack algorithm, Generative Dynamic Patch Attack (GDPA), which generates both patch pattern and patch location adversarially for each input image. We show that GDPA is a generic attack framework that can produce dynamic/static and visible/invisible patches with a few configuration changes. Secondly, GDPA can be readily integrated for adversarial training to improve model robustness to various adversarial attacks. Extensive experiments on VGGFace, Traffic Sign and ImageNet show that GDPA achieves higher attack success rates than state-of-the-art patch attacks, while adversarially trained model with GDPA demonstrates superior robustness to adversarial patch attacks than competing methods. Our source code can be found at https://github.com/lxuniverse/gdpa.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Builds on 31 of its 43 references that are in the map. First posted on arXiv 8 Nov 2021.

Builds on

31 of 43 references.

References · 31

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2014Sequence to Sequence Learning with Neural Networkscited by 2,986
  6. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,371
  7. 2015Spatial Transformer Networkscited by 1,429
  8. 2016Universal adversarial perturbationscited by 784
  9. 2017Countering Adversarial Images using Input Transformationscited by 520
  10. 2017Adversarial Patchcited by 517
  11. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  12. 2018Generating Adversarial Examples with Adversarial Networkscited by 258
19 more
  1. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  2. 2017Generative Adversarial Perturbationscited by 153
  3. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  4. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  5. 2020Certified Defenses for Adversarial Patchescited by 101
  6. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  7. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  8. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  9. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  10. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 62
  11. 2017NAG: Network for Adversary Generationcited by 51
  12. 2017Defense against Universal Adversarial Perturbationscited by 48
  13. 2020Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Freecited by 48
  14. 2015A Unified Gradient Regularization Family for Adversarial Examplescited by 43
  15. 2015Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimizationcited by 32
  16. 2015Foveation-based Mechanisms Alleviate Adversarial Examplescited by 32
  17. 2019Design and Interpretation of Universal Adversarial Patches in Face Detectioncited by 23
  18. 2017DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samplescited by 22
  19. 2019Learning with Multiplicative Perturbationscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 2; 2023: 5; 2024: 3; 2025: 5; 2026: 3.

19 papers.

Sort:

By area:

  1. 2022Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attackscited by 42
  2. 2022ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patchescited by 27
  3. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  4. 2025Safety of Embodied Navigation: A Surveycited by 10
  5. 2023ODDR: Outlier Detection & Dimension Reduction Based Defense Against Adversarial Patchescited by 6
  6. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  7. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  8. 2023Distributional Modeling for Location-Aware Adversarial Patchescited by 3
  9. 2024DiffPAD: Denoising Diffusion-based Adversarial Patch Decontaminationcited by 2
  10. 2021SNEAK: Synonymous Sentences-Aware Adversarial Attack on Natural Language Video Localizationcited by 1
  11. 2023An Incremental Gray-box Physical Adversarial Attack on Neural Network Trainingcited by 1
  12. 2023Generating Visually Realistic Adversarial Patchcited by 1
7 more
  1. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  2. 2025Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNscited by 1
  3. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  4. 2025Benchmarking Adversarial Patch Selection and Locationcited by 1
  5. 2026PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devicescited by 0
  6. 2026Adversarial Patch Generation for Visual-Infrared Dense Prediction Tasks via Joint Position-Color Optimizationcited by 0
  7. 2026STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTscited by 0