# Jedi: Entropy-based Localization and Removal of Adversarial Patches

arXiv: https://arxiv.org/abs/2304.10029 · HTML: https://mlsanity.com/paper/2304.10029/

## Key facts

- Cited by 35 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 27 references that are in the map.
- First posted on arXiv 20 Apr 2023.

## Builds on (most cited first, 15 of 15)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks](https://mlsanity.com/paper/1511.04508/) (2015)
- [Fooling automated surveillance cameras: adversarial patches to attack person detection](https://mlsanity.com/paper/1904.08653/) (2019)
- [DPatch: An Adversarial Patch Attack on Object Detectors](https://mlsanity.com/paper/1806.02299/) (2018)
- [LaVAN: Localized and Visible Adversarial Noise](https://mlsanity.com/paper/1801.02608/) (2018)
- [(De)Randomized Smoothing for Certifiable Defense against Patch Attacks](https://mlsanity.com/paper/2002.10733/) (2020)
- [Local Gradients Smoothing: Defense against localized adversarial attacks](https://mlsanity.com/paper/1807.01216/) (2018)
- [PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier](https://mlsanity.com/paper/2108.09135/) (2021)
- [Defense against Universal Adversarial Perturbations](https://mlsanity.com/paper/1711.05929/) (2017)
- [Certified Patch Robustness via Smoothed Vision Transformers](https://mlsanity.com/paper/2110.07719/) (2021)
- [PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches](https://mlsanity.com/paper/2104.12609/) (2021)
- [Dynamic Adversarial Patch for Evading Object Detection Models](https://mlsanity.com/paper/2010.13070/) (2020)
- [LanCe: A Comprehensive and Lightweight CNN Defense Methodology against Physical Adversarial Attacks on Embedded Multimedia Applications](https://mlsanity.com/paper/1910.08536/) (2019)

## Built on by (most cited first, 30 of 35)

- [PAD: Patch-Agnostic Defense against Adversarial Patch Attacks](https://mlsanity.com/paper/2404.16452/) (2024)
- [DIFFender: Diffusion-Based Adversarial Defense against Patch Attacks](https://mlsanity.com/paper/2306.09124/) (2023)
- [PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defenses](https://mlsanity.com/paper/2310.13076/) (2023)
- [ODDR: Outlier Detection & Dimension Reduction Based Defense Against Adversarial Patches](https://mlsanity.com/paper/2311.12084/) (2023)
- [I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectors](https://mlsanity.com/paper/2406.10285/) (2024)
- [Real-world Adversarial Defense against Patch Attacks based on Diffusion Model](https://mlsanity.com/paper/2409.09406/) (2024)
- [DistriBlock: Identifying adversarial audio samples by leveraging characteristics of the output distribution](https://mlsanity.com/paper/2305.17000/) (2023)
- [PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection](https://mlsanity.com/paper/2506.23581/) (2025)
- [DiffPAD: Denoising Diffusion-based Adversarial Patch Decontamination](https://mlsanity.com/paper/2410.24006/) (2024)
- [Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights](https://mlsanity.com/paper/2508.00649/) (2025)
- [Eigenpatches -- Adversarial Patches from Principal Components](https://mlsanity.com/paper/2306.10963/) (2023)
- [Fool the Hydra: Adversarial Attacks against Multi-view Object Detection Systems](https://mlsanity.com/paper/2312.00173/) (2023)
- [Traversing the Subspace of Adversarial Patches](https://mlsanity.com/paper/2412.01527/) (2024)
- [A Survey of Adversarial Defenses in Vision-based Systems: Categorization, Methods and Challenges](https://mlsanity.com/paper/2503.00384/) (2025)
- [IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimization](https://mlsanity.com/paper/2507.06856/) (2025)
- [AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domain](https://mlsanity.com/paper/2509.03179/) (2025)
- [A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical World](https://mlsanity.com/paper/2510.17322/) (2025)
- [Bypassing Prompt Injection Detectors through Evasive Injections](https://mlsanity.com/paper/2602.00750/) (2026)
- [Physical Adversarial Clothing Evades Visible-Thermal Detectors via Non-Overlapping RGB-T Pattern](https://mlsanity.com/paper/2605.04675/) (2026)
- [Resilience and Security of Deep Neural Networks Against Intentional and Unintentional Perturbations: Survey and Research Challenges](https://mlsanity.com/paper/2408.00193/) (2024)
- [Robustness Analysis against Adversarial Patch Attacks in Fully Unmanned Stores](https://mlsanity.com/paper/2505.08835/) (2025)
- [SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models](https://mlsanity.com/paper/2505.16318/) (2025)
- [SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholds](https://mlsanity.com/paper/2506.18591/) (2025)
- [TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks](https://mlsanity.com/paper/2508.12132/) (2025)
- [DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Models](https://mlsanity.com/paper/2509.04597/) (2025)
- [Deep learning models are vulnerable, but adversarial examples are even more vulnerable](https://mlsanity.com/paper/2511.05073/) (2025)
- [PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devices](https://mlsanity.com/paper/2601.00367/) (2026)
- [STRAP-ViT: Segregated Tokens with Randomized -- Transformations for Defense against Adversarial Patches in ViTs](https://mlsanity.com/paper/2603.12688/) (2026)
- [Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decomposition](https://mlsanity.com/paper/2604.10715/) (2026)
- [The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patches](https://mlsanity.com/paper/2604.26317/) (2026)

## Abstract (arXiv)

Real-world adversarial physical patches were shown to be successful in compromising state-of-the-art models in a variety of computer vision applications. Existing defenses that are based on either input gradient or features analysis have been compromised by recent GAN-based attacks that generate naturalistic patches. In this paper, we propose Jedi, a new defense against adversarial patches that is resilient to realistic patch attacks. Jedi tackles the patch localization problem from an information theory perspective; leverages two new ideas: (1) it improves the identification of potential patch regions using entropy analysis: we show that the entropy of adversarial patches is high, even in naturalistic patches; and (2) it improves the localization of adversarial patches, using an autoencoder that is able to complete patch regions from high entropy kernels. Jedi achieves high-precision adversarial patch localization, which we show is critical to successfully repair the images. Since Jedi relies on an input entropy analysis, it is model-agnostic, and can be applied on pre-trained off-the-shelf models without changes to the training or inference of the protected models. Jedi detects on average 90% of adversarial patches across different benchmarks and recovers up to 94% of successful patch attacks (Compared to 75% and 65% for LGS and Jujutsu, respectively).