mlsanityData to 14 Oct 2026

PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patch

arXiv 2207.01795 ↗First posted 5 Jul 2022cs.CV cs.CR cs.LGcited by 30

Not on the map. Why?

Abstract (arXiv)

Adversarial patch attacks mislead neural networks by injecting adversarial pixels within a local region. Patch attacks can be highly effective in a variety of tasks and physically realizable via attachment (e.g. a sticker) to the real-world objects. Despite the diversity in attack patterns, adversarial patches tend to be highly textured and different in appearance from natural images. We exploit this property and present PatchZero, a general defense pipeline against white-box adversarial patches without retraining the downstream classifier or detector. Specifically, our defense detects adversaries at the pixel-level and "zeros out" the patch region by repainting with mean pixel values. We further design a two-stage adversarial training scheme to defend against the stronger adaptive attacks. PatchZero achieves SOTA defense performance on the image classification (ImageNet, RESISC45), object detection (PASCAL VOC), and video classification (UCF101) tasks with little degradation in benign performance. In addition, PatchZero transfers to different patch shapes and attack types.

Key facts. Cited by 30 papers in the map (data through 14 Oct 2026). Builds on 38 of its 49 references that are in the map. First posted on arXiv 5 Jul 2022.

Builds on

38 of 49 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  4. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
  7. 2016Densely Connected Convolutional Networkscited by 6,720
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  10. 2016Pyramid Scene Parsing Networkcited by 2,479
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
26 more
  1. 2017Remote Sensing Image Scene Classification: Benchmark and State of the Artcited by 797
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  3. 2017Countering Adversarial Images using Input Transformationscited by 520
  4. 2017Adversarial Patchcited by 517
  5. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  6. 2018Adversarial Logit Pairingcited by 224
  7. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  8. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
  9. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  10. 2020Certified Defenses for Adversarial Patchescited by 101
  11. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  12. 2019On Physical Adversarial Patches for Object Detectioncited by 93
  13. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  14. 2018Universal Adversarial Trainingcited by 87
  15. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  16. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  17. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  18. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  19. 2019Role of Spatial Context in Adversarial Robustness for Object Detectioncited by 35
  20. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 29
  21. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  22. 2020Defending Against Multiple and Unforeseen Adversarial Videoscited by 19
  23. 2021DI-AA: An Interpretable White-box Attack for Fooling Deep Neural Networkscited by 10
  24. 2020Overcomplete Representations Against Adversarial Videoscited by 6
  25. 2021We Can Always Catch You: Detecting Adversarial Patched Objects WITH or WITHOUT Signaturecited by 6
  26. 2020MultAV: Multiplicative Adversarial Videoscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 6; 2024: 9; 2025: 10; 2026: 5.

30 papers.

Sort:

By area:

  1. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
  2. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  3. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  4. 2025Safety of Embodied Navigation: A Surveycited by 10
  5. 2024Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patchescited by 4
  6. 2024Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detectioncited by 4
  7. 2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modificationcited by 3
  8. 2023Attention-Based Real-Time Defenses for Physical Adversarial Attacks in Vision Applicationscited by 3
  9. 2024Query-Efficient Video Adversarial Attack with Stylized Logo on Service Computingcited by 3
  10. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  11. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
  12. 2023X-Detect: Explainable Adversarial Patch Detection for Object Detectors in Retailcited by 1
18 more
  1. 2023Runtime Stealthy Perception Attacks against DNN-based Adaptive Cruise Control Systemscited by 1
  2. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  3. 2024How to beat a Bayesian adversarycited by 1
  4. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  5. 2025GAN-Based Single-Stage Defense for Traffic Sign Classification Under Adversarial Patchcited by 1
  6. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  7. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  8. 2025Concept-Based Masking: A Patch-Agnostic Defense Against Adversarial Patch Attackscited by 1
  9. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
  10. 2024Universal Multi-view Black-box Attack against Object Detectors via Layout Optimizationcited by 0
  11. 2024RED: Robust Environmental Designcited by 0
  12. 2025SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Modelscited by 0
  13. 2025SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholdscited by 0
  14. 2026Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decompositioncited by 0
  15. 2026The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patchescited by 0
  16. 2026Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attackscited by 0
  17. 2026AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Drivingcited by 0
  18. 2026CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Modelscited by 0