# Generative Dynamic Patch Attack

arXiv: https://arxiv.org/abs/2111.04266 · HTML: https://mlsanity.com/paper/2111.04266/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- Builds on 31 of its 43 references that are in the map.
- First posted on arXiv 8 Nov 2021.

## Builds on (most cited first, 30 of 31)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Sequence to Sequence Learning with Neural Networks](https://mlsanity.com/paper/1409.3215/) (2014)
- [Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Maps](https://mlsanity.com/paper/1312.6034/) (2013)
- [Spatial Transformer Networks](https://mlsanity.com/paper/1506.02025/) (2015)
- [Universal adversarial perturbations](https://mlsanity.com/paper/1610.08401/) (2016)
- [Countering Adversarial Images using Input Transformations](https://mlsanity.com/paper/1711.00117/) (2017)
- [Adversarial Patch](https://mlsanity.com/paper/1712.09665/) (2017)
- [Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks](https://mlsanity.com/paper/1704.01155/) (2017)
- [Generating Adversarial Examples with Adversarial Networks](https://mlsanity.com/paper/1801.02610/) (2018)
- [A study of the effect of JPG compression on adversarial images](https://mlsanity.com/paper/1608.00853/) (2016)
- [Generative Adversarial Perturbations](https://mlsanity.com/paper/1712.02328/) (2017)
- [Towards Deep Neural Network Architectures Robust to Adversarial Examples](https://mlsanity.com/paper/1412.5068/) (2014)
- [LaVAN: Localized and Visible Adversarial Noise](https://mlsanity.com/paper/1801.02608/) (2018)
- [Certified Defenses for Adversarial Patches](https://mlsanity.com/paper/2003.06693/) (2020)
- [Local Gradients Smoothing: Defense against localized adversarial attacks](https://mlsanity.com/paper/1807.01216/) (2018)
- [Patch-wise Attack for Fooling Deep Neural Network](https://mlsanity.com/paper/2007.06765/) (2020)
- [PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning](https://mlsanity.com/paper/2004.05682/) (2020)
- [Defending Against Physically Realizable Attacks on Image Classification](https://mlsanity.com/paper/1909.09552/) (2019)
- [Adversarial Transformation Networks: Learning to Generate Adversarial Examples](https://mlsanity.com/paper/1703.09387/) (2017)
- [NAG: Network for Adversary Generation](https://mlsanity.com/paper/1712.03390/) (2017)
- [Defense against Universal Adversarial Perturbations](https://mlsanity.com/paper/1711.05929/) (2017)
- [Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free](https://mlsanity.com/paper/2010.11828/) (2020)
- [A Unified Gradient Regularization Family for Adversarial Examples](https://mlsanity.com/paper/1511.06385/) (2015)
- [Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization](https://mlsanity.com/paper/1511.05432/) (2015)
- [Foveation-based Mechanisms Alleviate Adversarial Examples](https://mlsanity.com/paper/1511.06292/) (2015)
- [Design and Interpretation of Universal Adversarial Patches in Face Detection](https://mlsanity.com/paper/1912.05021/) (2019)
- [DeepCloak: Masking Deep Neural Network Models for Robustness Against Adversarial Samples](https://mlsanity.com/paper/1702.06763/) (2017)

## Built on by (most cited first, 19 of 19)

- [Simultaneously Optimizing Perturbations and Positions for Black-box Adversarial Patch Attacks](https://mlsanity.com/paper/2212.12995/) (2022)
- [ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patches](https://mlsanity.com/paper/2203.04412/) (2022)
- [DIFFender: Diffusion-Based Adversarial Defense against Patch Attacks](https://mlsanity.com/paper/2306.09124/) (2023)
- [Safety of Embodied Navigation: A Survey](https://mlsanity.com/paper/2508.05855/) (2025)
- [ODDR: Outlier Detection & Dimension Reduction Based Defense Against Adversarial Patches](https://mlsanity.com/paper/2311.12084/) (2023)
- [Real-world Adversarial Defense against Patch Attacks based on Diffusion Model](https://mlsanity.com/paper/2409.09406/) (2024)
- [DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Time](https://mlsanity.com/paper/2412.08053/) (2024)
- [Distributional Modeling for Location-Aware Adversarial Patches](https://mlsanity.com/paper/2306.16131/) (2023)
- [DiffPAD: Denoising Diffusion-based Adversarial Patch Decontamination](https://mlsanity.com/paper/2410.24006/) (2024)
- [SNEAK: Synonymous Sentences-Aware Adversarial Attack on Natural Language Video Localization](https://mlsanity.com/paper/2112.04154/) (2021)
- [An Incremental Gray-box Physical Adversarial Attack on Neural Network Training](https://mlsanity.com/paper/2303.01245/) (2023)
- [Generating Visually Realistic Adversarial Patch](https://mlsanity.com/paper/2312.03030/) (2023)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)
- [Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNs](https://mlsanity.com/paper/2503.07058/) (2025)
- [IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization](https://mlsanity.com/paper/2507.06856/) (2025)
- [Benchmarking Adversarial Patch Selection and Location](https://mlsanity.com/paper/2508.01676/) (2025)
- [PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devices](https://mlsanity.com/paper/2601.00367/) (2026)
- [Adversarial Patch Generation for Visual-Infrared Dense Prediction Tasks via Joint Position-Color Optimization](https://mlsanity.com/paper/2603.00266/) (2026)
- [STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTs](https://mlsanity.com/paper/2603.12688/) (2026)

## Abstract (arXiv)

Adversarial patch attack is a family of attack algorithms that perturb a part of image to fool a deep neural network model. Existing patch attacks mostly consider injecting adversarial patches at input-agnostic locations: either a predefined location or a random location. This attack setup may be sufficient for attack but has considerable limitations when using it for adversarial training. Thus, robust models trained with existing patch attacks cannot effectively defend other adversarial attacks. In this paper, we first propose an end-to-end patch attack algorithm, Generative Dynamic Patch Attack (GDPA), which generates both patch pattern and patch location adversarially for each input image. We show that GDPA is a generic attack framework that can produce dynamic/static and visible/invisible patches with a few configuration changes. Secondly, GDPA can be readily integrated for adversarial training to improve model robustness to various adversarial attacks. Extensive experiments on VGGFace, Traffic Sign and ImageNet show that GDPA achieves higher attack success rates than state-of-the-art patch attacks, while adversarially trained model with GDPA demonstrates superior robustness to adversarial patch attacks than competing methods. Our source code can be found at https://github.com/lxuniverse/gdpa.