Adversarial Patch

An adversarial patch concentrates the perturbation into a confined, contiguous region of the input, rather than distributing a faint noise pattern across the entire image. This spatial locality is the defining characteristic that makes physical realization feasible. The patch is optimized to act as a visual 'sink' that captures the model's attention.

• Contiguous Area: The perturbation is not scattered; it occupies a single, printable area.
• High Magnitude: Pixel changes within the patch are large and visually obvious, often unbounded by Lp-norm constraints.
• Attention Capture: Designed to produce a feature activation stronger than any real object in the scene.

The core purpose of an adversarial patch is to be deployed in the physical world, not just the digital domain. This requires the attack to be robust to a wide range of environmental conditions. Expectation Over Transformation (EOT) is a critical technique used during optimization to ensure the patch remains effective when printed, photographed, and viewed from different angles and distances.

• Printability: The patch's colors must be reproducible by a standard printer.
• Viewpoint Invariance: Effective across a range of distances, rotations, and lighting conditions.
• Material Agnosticism: Can be printed on paper, cardboard, fabric, or placed as a sticker.

The primary goal of an adversarial patch is not to cause a specific misclassification, but to completely suppress the detection of a target object. When placed on or near an object like a person or a stop sign, the patch causes the object detector to ignore it entirely, effectively making the object invisible to the model.

• Confidence Reduction: Drastically lowers the model's confidence score for the true object class.
• Bounding Box Elimination: Prevents the detector from proposing a bounding box around the target.
• Example: A patch on a person makes a pedestrian detector output 'background' for that region.

Beyond hiding an object, a patch can be optimized to cause a specific, attacker-chosen misclassification. This is a targeted attack where the patch's pattern is designed to maximize the model's probability for a desired adversarial class, regardless of the underlying scene.

• Class Substitution: A patch on a 'stop' sign makes the classifier output 'speed limit 80' with high confidence.
• Universal Trigger: The same patch can often cause the targeted misclassification when placed on a variety of different objects.
• High Confidence: The attack is designed to produce a confident, deterministic error.

Standard defenses like adversarial training on Lp-bounded perturbations are often ineffective against patches. Because patches use large, unbounded pixel changes, they operate outside the threat model most defenses are designed for. Specialized defenses like digital watermarking or local gradient smoothing are required.

• Bypasses Lp Defenses: Not constrained by small epsilon values used in standard adversarial training.
• Defense Strategies: Requires input pre-processing like clipping activations or using a dedicated patch detector.
• Certified Defenses: Techniques like De-randomized Smoothing can provide provable robustness against patches in specific regions.

Generating an effective patch is an iterative optimization problem. The process typically starts with random noise and uses gradient descent to update the patch pixels to minimize the target object's class probability while maximizing the adversarial objective. A key component is the patch application function, which digitally pastes the patch onto training images with random transformations during each iteration.

• Loss Function: loss = -log(P(adversarial_class)) + log(P(true_class))
• Random Transformations: Applies random scaling, rotation, and translation to the patch in each optimization step.
• Total Variation Minimization: Often added to the loss to encourage smooth, printable color transitions.