mlsanityData to 7 Oct 2026

PAD: Patch-Agnostic Defense against Adversarial Patch Attacks

arXiv 2404.16452 ↗First posted 25 Apr 2024cs.CVcited by 31

Not on the map. Why?

Abstract (arXiv)

Adversarial patch attacks present a significant threat to real-world object detectors due to their practical feasibility. Existing defense methods, which rely on attack data or prior knowledge, struggle to effectively address a wide range of adversarial patches. In this paper, we show two inherent characteristics of adversarial patches, semantic independence and spatial heterogeneity, independent of their appearance, shape, size, quantity, and location. Semantic independence indicates that adversarial patches operate autonomously within their semantic context, while spatial heterogeneity manifests as distinct image quality of the patch area that differs from original clean image due to the independent generation process. Based on these observations, we propose PAD, a novel adversarial patch localization and removal method that does not require prior knowledge or additional training. PAD offers patch-agnostic defense against various adversarial patches, compatible with any pre-trained object detectors. Our comprehensive digital and physical experiments involving diverse patch types, such as localized noise, printable, and naturalistic patches, exhibit notable improvements over state-of-the-art works. Our code is available at https://github.com/Lihua-Jing/PAD.

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). Builds on 35 of its 55 references that are in the map. First posted on arXiv 25 Apr 2024.

Builds on

35 of 55 references.

References · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2023Segment Anythingcited by 8,158
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2018YOLOv3: An Incremental Improvementcited by 2,652
  7. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  8. 2019Adversarial Training for Free!cited by 638
  9. 2017Adversarial Patchcited by 514
  10. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  11. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  12. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
23 more
  1. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  2. 2018LaVAN: Localized and Visible Adversarial Noisecited by 112
  3. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  4. 2018Improving DNN Robustness to Adversarial Attacks using Jacobian Regularizationcited by 88
  5. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 85
  6. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  7. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  8. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  9. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  10. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  11. 2019Towards Adversarially Robust Object Detectioncited by 55
  12. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  13. 2019Role of Spatial Context in Adversarial Robustness for Object Detectioncited by 35
  14. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  15. 2019APRICOT: A Dataset of Physical Adversarial Attacks on Object Detectioncited by 30
  16. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  17. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  18. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  19. 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
  20. 2021Meta Adversarial Training against Universal Patchescited by 19
  21. 2021Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patchescited by 17
  22. 2020Vax-a-Net: Training-time Defence Against Adversarial Patch Attackscited by 11
  23. 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 14; 2026: 13.

31 papers.

Sort:

By area:

  1. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  2. 2025SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMscited by 5
  3. 2024Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detectioncited by 4
  4. 2025AdvReal: Physical Adversarial Patch Generation Framework for Security Evaluation of Object Detection Systemscited by 4
  5. 2025Poisoning Prompt-Guided Sampling in Video Large Language Modelscited by 3
  6. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2
  7. 2024Toward Robust and Accurate Adversarial Camouflage Generation against Vehicle Detectorscited by 1
  8. 2025GAN-Based Single-Stage Defense for Traffic Sign Classification Under Adversarial Patchcited by 1
  9. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  10. 2025Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Drivingcited by 1
  11. 2025AutoDetect: Designing an Autoencoder-based Detection Method for Poisoning Attacks on Object Detection Applications in the Military Domaincited by 1
  12. 2025A Single Set of Adversarial Clothes Breaks Multiple Defense Methods in the Physical Worldcited by 1
19 more
  1. 2025Agentic Moderation: Multi-Agent Design for Safer Vision-Language Modelscited by 1
  2. 2026Physical Adversarial Clothing Evades Visible-Thermal Detectors via Non-Overlapping RGB-T Patterncited by 1
  3. 2026Digital-to-Physical Transfer of Adversarial Patches for Aerial Vehicle Detectioncited by 1
  4. 2024Universal Multi-view Black-box Attack against Object Detectors via Layout Optimizationcited by 0
  5. 2025SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Modelscited by 0
  6. 2025SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholdscited by 0
  7. 2025DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Modelscited by 0
  8. 2025Backdoor Attacks on Open Vocabulary Object Detectors via Multi-Modal Prompt Tuningcited by 0
  9. 2026PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devicescited by 0
  10. 2026Physical Evaluation of Naturalistic Adversarial Patches for Camera-Based Traffic-Sign Detectioncited by 0
  11. 2026Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decompositioncited by 0
  12. 2026Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Drivingcited by 0
  13. 2026REALM: A Unified Red-Teaming Benchmark for Physical-World VLMscited by 0
  14. 2026Phantom: A Unified Face-Swap Deepfake Protection Framework with Latent and Spatial Constraintscited by 0
  15. 2026Detectors Learn the Wrong Thing: Shortcut-Resistant Adversarial Training Against Physically Realizable Attackscited by 0
  16. 2026ARMOR: Manifold-Oriented Training for Adversarially Robust Aerial Object Detection under Data Scarcitycited by 0
  17. 2026Physical Adversarial Examples for Person Detectors in Thermal Images Based on 3D Modelingcited by 0
  18. 2026Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?cited by 0
  19. 2026Printability-Constrained Adversarial Decals for Near-Nadir Aerial Perception: Measured Ink Gamuts, Nested Realism Constraints, and a Physical-World Boundcited by 0