mlsanityData to 14 Oct 2026

Jedi: Entropy-based Localization and Removal of Adversarial Patches

arXiv 2304.10029 ↗First posted 20 Apr 2023cs.CR cs.CV cs.LGcited by 35

Not on the map. Why?

Abstract (arXiv)

Real-world adversarial physical patches were shown to be successful in compromising state-of-the-art models in a variety of computer vision applications. Existing defenses that are based on either input gradient or features analysis have been compromised by recent GAN-based attacks that generate naturalistic patches. In this paper, we propose Jedi, a new defense against adversarial patches that is resilient to realistic patch attacks. Jedi tackles the patch localization problem from an information theory perspective; leverages two new ideas: (1) it improves the identification of potential patch regions using entropy analysis: we show that the entropy of adversarial patches is high, even in naturalistic patches; and (2) it improves the localization of adversarial patches, using an autoencoder that is able to complete patch regions from high entropy kernels. Jedi achieves high-precision adversarial patch localization, which we show is critical to successfully repair the images. Since Jedi relies on an input entropy analysis, it is model-agnostic, and can be applied on pre-trained off-the-shelf models without changes to the training or inference of the protected models. Jedi detects on average 90% of adversarial patches across different benchmarks and recovers up to 94% of successful patch attacks (Compared to 75% and 65% for LGS and Jujutsu, respectively).

Key facts. Cited by 35 papers in the map (data through 14 Oct 2026). Builds on 15 of its 27 references that are in the map. First posted on arXiv 20 Apr 2023.

Builds on

15 of 27 references.

References · 15

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  4. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  5. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  6. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
  7. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  8. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  9. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
  10. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  11. 2017Defense against Universal Adversarial Perturbationscited by 48
  12. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 45
3 more
  1. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  2. 2020Dynamic Adversarial Patch for Evading Object Detection Modelscited by 20
  3. 2019LanCe: A Comprehensive and Lightweight CNN Defense Methodology against Physical Adversarial Attacks on Embedded Multimedia Applicationscited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 6; 2024: 6; 2025: 12; 2026: 11.

35 papers.

Sort:

By area:

  1. 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
  2. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  3. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  4. 2023ODDR: Outlier Detection & Dimension Reduction Based Defense Against Adversarial Patchescited by 6
  5. 2024I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectorscited by 5
  6. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  7. 2023DistriBlock: Identifying adversarial audio samples by leveraging characteristics of the output distributioncited by 3
  8. 2025PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detectioncited by 3
  9. 2024DiffPAD: Denoising Diffusion-based Adversarial Patch Decontaminationcited by 2
  10. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2
  11. 2023Eigenpatches -- Adversarial Patches from Principal Componentscited by 1
  12. 2023Fool the Hydra: Adversarial Attacks against Multi-view Object Detection Systemscited by 1
23 more
  1. 2024Traversing the Subspace of Adversarial Patchescited by 1
  2. 2025A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challengescited by 1
  3. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  4. 2025AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domaincited by 1
  5. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
  6. 2026Bypassing Prompt Injection Detectors through Evasive Injectionscited by 1
  7. 2026Physical Adversarial Clothing Evades Visible-Thermal Detectors via Non-Overlapping RGB-T Patterncited by 1
  8. 2024Resilience and Security of Deep Neural Networks Against Intentional and Unintentional Perturbations: Survey and Research Challengescited by 0
  9. 2025Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Storescited by 0
  10. 2025SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Modelscited by 0
  11. 2025SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholdscited by 0
  12. 2025TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networkscited by 0
  13. 2025DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Modelscited by 0
  14. 2025Deep learning models are vulnerable, but adversarial examples are even more vulnerablecited by 0
  15. 2026PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devicescited by 0
  16. 2026STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTscited by 0
  17. 2026Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decompositioncited by 0
  18. 2026The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patchescited by 0
  19. 2026Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attackscited by 0
  20. 2026AdROD: HyperNetwork-based Adversarially Robust Object Detection for Autonomous Drivingcited by 0
  21. 2026CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Modelscited by 0
  22. 2026ARMOR: Manifold-Oriented Training for Adversarially Robust Aerial Object Detection under Data Scarcitycited by 0
  23. 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policiescited by 0