# Traversing the Subspace of Adversarial Patches

arXiv: https://arxiv.org/abs/2412.01527 · HTML: https://mlsanity.com/paper/2412.01527/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 33 references that are in the map.
- First posted on arXiv 2 Dec 2024.

## Builds on (most cited first, 13 of 13)

- [YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectors](https://mlsanity.com/paper/2207.02696/) (2022)
- [Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey](https://mlsanity.com/paper/1801.00553/) (2018)
- [CrowdHuman: A Benchmark for Detecting Human in a Crowd](https://mlsanity.com/paper/1805.00123/) (2018)
- [The Space of Transferable Adversarial Examples](https://mlsanity.com/paper/1704.03453/) (2017)
- [Are adversarial examples inevitable?](https://mlsanity.com/paper/1809.02104/) (2018)
- [Jedi: Entropy-based Localization and Removal of Adversarial Patches](https://mlsanity.com/paper/2304.10029/) (2023)
- [A Survey on the Robustness of Computer Vision Models against Common Corruptions](https://mlsanity.com/paper/2305.06024/) (2023)
- [Boosting Adversarial Transferability via Fusing Logits of Top-1 Decomposed Feature](https://mlsanity.com/paper/2305.01361/) (2023)
- [How many dimensions are required to find an adversarial example?](https://mlsanity.com/paper/2303.14173/) (2023)
- [Origins of Low-dimensional Adversarial Perturbations](https://mlsanity.com/paper/2203.13779/) (2022)
- [A Tutorial on Adversarial Learning Attacks and Countermeasures](https://mlsanity.com/paper/2202.10377/) (2022)
- [Energy Attack: On Transferring Adversarial Examples](https://mlsanity.com/paper/2109.04300/) (2021)
- [Eigenpatches -- Adversarial Patches from Principal Components](https://mlsanity.com/paper/2306.10963/) (2023)

## Built on by (most cited first, 1 of 1)

- [Novel Loss-Enhanced Universal Adversarial Patches for Sustainable Speaker Privacy](https://mlsanity.com/paper/2505.19951/) (2025)

## Abstract (arXiv)

Despite ongoing research on the topic of adversarial examples in deep learning for computer vision, some fundamentals of the nature of these attacks remain unclear. As the manifold hypothesis posits, high-dimensional data tends to be part of a low-dimensional manifold. To verify the thesis with adversarial patches, this paper provides an analysis of a set of adversarial patches and investigates the reconstruction abilities of three different dimensionality reduction methods. Quantitatively, the performance of reconstructed patches in an attack setting is measured and the impact of sampled patches from the latent space during adversarial training is investigated. The evaluation is performed on two publicly available datasets for person detection. The results indicate that more sophisticated dimensionality reduction methods offer no advantages over a simple principal component analysis.