Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insights
Not on the map. Why?
Abstract (arXiv)
Developing reliable defenses against patch attacks on object detectors has attracted increasing interest. However, we identify that existing defense evaluations lack a unified and comprehensive framework, resulting in inconsistent and incomplete assessments of current methods. To address this issue, we revisit 11 representative defenses and present the first patch defense benchmark, involving 2 attack goals, 13 patch attacks, 11 object detectors, and 4 diverse metrics. This leads to the large-scale adversarial patch dataset with 94 types of patches and 94,000 images. Our comprehensive analyses reveal new insights: (1) The difficulty in defending against naturalistic patches lies in the data distribution, rather than the commonly believed high frequencies. Our new dataset with diverse patch distributions can be used to improve existing defenses by 15.09% [email protected]. (2) The average precision of the attacked object, rather than the commonly pursued patch detection accuracy, shows high consistency with defense performance. (3) Adaptive attacks can substantially bypass existing defenses, and defenses with complex/stochastic models or universal patch properties are relatively robust. We hope that our analyses will serve as guidance on properly evaluating patch attacks/defenses and advancing their design. Code and dataset are available at https://github.com/Gandolfczjh/APDE, where we will keep integrating new attacks/defenses.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 43 of its 57 references that are in the map. First posted on arXiv 1 Aug 2025.
Builds on
43 of 57 references.
References · 43
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2014Microsoft COCO: Common Objects in Contextcited by 17,608
- 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
- 2023Segment Anythingcited by 8,234
- 2020End-to-End Object Detection with Transformerscited by 7,414
- 2017Mask R-CNNcited by 7,277
- 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
- 2015SSD: Single Shot MultiBox Detectorcited by 3,130
- 2018YOLOv3: An Incremental Improvementcited by 2,659
- 2020YOLOv4: Optimal Speed and Accuracy of Object Detectioncited by 1,630
31 more
- 2016YOLO9000: Better, Faster, Strongercited by 1,431
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2022YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectorscited by 982
- 2019CenterNet: Keypoint Triplets for Object Detectioncited by 654
- 2023End-to-end Autonomous Driving: Challenges and Frontierscited by 490
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
- 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
- 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
- 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
- 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
- 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
- 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
- 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
- 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 73
- 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
- 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
- 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
- 2024Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Drivingcited by 32
- 2024PAD: Patch-Agnostic Defense against Adversarial Patch Attackscited by 32
- 2019APRICOT: A Dataset of Physical Adversarial Attacks on Object Detectioncited by 31
- 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 29
- 2022ObjectSeeker: Certifiably Robust Object Detection against Patch Hiding Attacks via Patch-agnostic Maskingcited by 22
- 2021Adversarial YOLO: Defense Human Detection Patch Attacks via Detecting Adversarial Patchescited by 17
- 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
- 2023SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examplescited by 15
- 2023Quantization Aware Attack: Enhancing Transferable Adversarial Attacks by Model Quantizationcited by 14
- 2022Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysiscited by 10
- 2023Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detectorcited by 10
- 2024ControlLoc: Physical-World Hijacking Attack on Visual Perception in Autonomous Drivingcited by 6
- 2024I Don't Know You, But I Can Catch You: Real-Time Defense against Diverse Adversarial Patches for Object Detectorscited by 5
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.