mlsanityData to 7 Oct 2026

Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection

arXiv 2112.04532 ↗First posted 8 Dec 2021cs.CV cs.CR eess.IVcited by 67

Not on the map. Why?

Abstract (arXiv)

Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to state-of-the-art object detectors. Developing reliable defenses for object detectors against patch attacks is critical but severely understudied. In this paper, we propose Segment and Complete defense (SAC), a general framework for defending object detectors against patch attacks through detection and removal of adversarial patches. We first train a patch segmenter that outputs patch masks which provide pixel-level localization of adversarial patches. We then propose a self adversarial training algorithm to robustify the patch segmenter. In addition, we design a robust shape completion algorithm, which is guaranteed to remove the entire patch from the images if the outputs of the patch segmenter are within a certain Hamming distance of the ground-truth patch masks. Our experiments on COCO and xView datasets demonstrate that SAC achieves superior robustness even under strong adaptive attacks with no reduction in performance on clean images, and generalizes well to unseen patch shapes, attack budgets, and unseen attack methods. Furthermore, we present the APRICOT-Mask dataset, which augments the APRICOT dataset with pixel-level annotations of adversarial patches. We show SAC can significantly reduce the targeted attack success rate of physical patch attacks. Our code is available at https://github.com/joellliu/SegmentAndComplete.

Key facts. Cited by 67 papers in the map (data through 7 Oct 2026). Builds on 39 of its 54 references that are in the map. First posted on arXiv 8 Dec 2021.

Builds on

39 of 54 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2016Feature Pyramid Networks for Object Detectioncited by 5,021
  7. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  8. 2015Fast R-CNNcited by 2,930
  9. 2013Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computationcited by 2,031
  10. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2017Adversarial Patchcited by 514
27 more
  1. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  2. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  3. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  4. 2018Physical Adversarial Examples for Object Detectorscited by 163
  5. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  6. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  7. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  8. 2018xView: Objects in Context in Overhead Imagerycited by 145
  9. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  10. 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
  11. 2020Certified Defenses for Adversarial Patchescited by 100
  12. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
  13. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  14. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  15. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  16. 2019Towards Adversarially Robust Object Detectioncited by 55
  17. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  18. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  19. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  20. 2019Role of Spatial Context in Adversarial Robustness for Object Detectioncited by 35
  21. 2019APRICOT: A Dataset of Physical Adversarial Attacks on Object Detectioncited by 30
  22. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  23. 2021Class-Aware Robust Adversarial Training for Object Detectioncited by 27
  24. 2020Object Hider: Adversarial Patch Attack Against Object Detectorscited by 23
  25. 2021Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patchescited by 17
  26. 2018Exploring the Vulnerability of Single Shot Module in Object Detectors via Imperceptible Background Patchescited by 12
  27. 2020Vax-a-Net: Training-time Defence Against Adversarial Patch Attackscited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 5; 2023: 16; 2024: 19; 2025: 14; 2026: 12.

67 papers.

Sort:

By area:

  1. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  2. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 31
  3. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  4. 2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
  5. 2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
  6. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  7. 2023A White-Box False Positive Adversarial Attack Method on Contrastive Loss Based Offline Handwritten Signature Verification Modelscited by 15
  8. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  9. 2021Interpolated Joint Space Adversarial Training for Robust and Generalizable Defensescited by 10
  10. 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
  11. 2023Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detectorcited by 10
  12. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 10
38 more
  1. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  2. 2024Artwork Protection Against Neural Style Transfer Using Locally Adaptive Adversarial Color Attackcited by 9
  3. 2022Towards Improved Input Masking for Convolutional Neural Networkscited by 7
  4. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  5. 2023Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flowcited by 6
  6. 2023A Satellite Imagery Dataset for Long-Term Sustainable Development in United States Citiescited by 5
  7. 2024I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectorscited by 5
  8. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Modelscited by 5
  9. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  10. 2025Don't Lag, RAG: Training-Free Adversarial Detection Using RAGcited by 5
  11. 2024Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patchescited by 4
  12. 2024RS-Reg: Probabilistic and Robust Certified Regression Through Randomized Smoothingcited by 4
  13. 2024Self-Supervised Representation Learning for Adversarial Attack Detectioncited by 4
  14. 2024Natural Language Induced Adversarial Imagescited by 4
  15. 2024BadPatch: Diffusion-Based Generation of Physical Adversarial Patchescited by 4
  16. 2023Distributional Modeling for Location-Aware Adversarial Patchescited by 3
  17. 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
  18. 2023RADAP: A Robust and Adaptive Defense Against Diverse Adversarial Patches on Face Recognitioncited by 3
  19. 2023A Red Teaming Framework for Securing AI in Maritime Autonomous Systemscited by 3
  20. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  21. 2024Enhancing Object Detection Robustness: Detecting and Restoring Confidence in the Presence of Adversarial Patch Attackscited by 2
  22. 2024Model Agnostic Defense against Adversarial Patch Attacks on Object Detection in Unmanned Aerial Vehiclescited by 2
  23. 2024DiffPAD: Denoising Diffusion-based Adversarial Patch Decontaminationcited by 2
  24. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2
  25. 2022Defending Object Detectors against Patch Attacks with Out-of-Distribution Smoothingcited by 1
  26. 2023X-Detect: Explainable Adversarial Patch Detection for Object Detectors in Retailcited by 1
  27. 2023Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systemscited by 1
  28. 2023Defending Adversarial Patches via Joint Region Localizing and Inpaintingcited by 1
  29. 2023Fight Fire with Fire: Combating Adversarial Patch Attacks using Pattern-randomized Defensive Patchescited by 1
  30. 2024How to beat a Bayesian adversarycited by 1
  31. 2024MMAD-Purify: A Precision-Optimized Framework for Efficient and Scalable Multi-Modal Attackscited by 1
  32. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  33. 2025GAN-Based Single-Stage Defense for Traffic Sign Classification Under Adversarial Patchcited by 1
  34. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  35. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  36. 2025AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domaincited by 1
  37. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
  38. 2024Transient Adversarial 3D Projection Attacks on Object Detection in Autonomous Drivingcited by 0

50 most cited of 67 All 67 (JSON)