Adversarial Patch

The core algorithm for generating robust physical patches is Expectation over Transformation. Rather than optimizing for a single static input, EOT minimizes the expected loss over a distribution of random transformations applied during each training iteration. This forces the patch to learn features that remain adversarial across varied poses and conditions. The technique was formalized by Athalye et al. (2018) and remains the foundation for most physical adversarial attacks.

An attack class where the perturbation remains effective after being printed and captured by a camera in the physical world. Unlike digital-only attacks, a physical adversarial attack must survive varying lighting conditions, viewing angles, and camera resolutions. The adversarial patch is a prominent subtype, designed to be placed in a scene rather than overlaid digitally. Key challenges include maintaining attack efficacy across non-differentiable image capture pipelines and ensuring the perturbation is robust to affine transformations.

The measured resilience of a neural network against maliciously perturbed inputs. In the context of patches, robustness is quantified by the model's ability to maintain correct classification when a localized, high-magnitude perturbation occupies a portion of the scene. Defenses like adversarial training with patch augmentation and certified defenses against patch attacks aim to improve this metric. A model with high patch robustness should ignore or neutralize the attacker-controlled region.

A defensive technique that injects adversarial examples into the training dataset with correct labels. For patch attacks, this involves training on images where random rectangular occlusions or optimized patches are placed at varying positions. The model learns to treat these regions as uninformative noise. Efficient adversarial patch training often uses a dynamic, occlusion-based approach rather than full optimization to reduce compute cost while still hardening the model against localized attacks.

A variant of the patch attack applied directly to the digital image file before model ingestion, bypassing the physical capture step. This is the standard evaluation setting for white-box attacks where the attacker optimizes the patch pixels using Projected Gradient Descent (PGD). The digital patch is constrained to a specific region of the image and optimized to maximize the target class probability. It serves as a proxy for physical attacks during initial vulnerability assessment.

A technique for computing gradients through stochastic processes to create robust adversarial examples. For a physical adversarial patch, the attacker must optimize a patch that works under varying conditions. EoT averages the gradient over a distribution of random transformations—such as rotation, scaling, translation, and lighting changes—applied during the optimization loop. This produces a patch that remains effective after the non-differentiable physical imaging process.

A specific goal of adversarial patches where the attacker causes an object detector to completely fail to recognize a target object. By placing a carefully crafted patch on a stop sign or a person, the detector's confidence for the true class drops to zero. This is distinct from a targeted misclassification attack, where the patch forces the model to output a specific incorrect class. Vanishing attacks are critical threats to autonomous vehicle perception stacks.