Adversarial Patch

Unlike global adversarial perturbations constrained by tight Lp-norm bounds, a patch concentrates a high-magnitude distortion within a confined image region. This localization allows the attack to survive the printing and imaging process, as the perturbation energy does not need to be spread imperceptibly across the entire scene. The patch acts as a salient, localized noise source that overpowers the natural features of the target object.

A defining trait is the ability to transition from the digital domain to the physical world. The attacker prints the patch on a poster, sticker, or T-shirt and places it within the camera's field of view. This requires the perturbation to be robust to a nuisance variability suite including:

• Viewpoint shifts and perspective warping
• Illumination changes and shadows
• Motion blur and camera noise
• Printer color gamut limitations

To achieve physical robustness, the patch optimization process incorporates Expectation over Transformation. Instead of optimizing for a single static image, the loss function is minimized over a distribution of simulated physical transformations. This ensures the adversarial pattern remains effective after being subjected to random rotations, scales, translations, and photometric adjustments during the attack generation phase.

A highly effective adversarial patch exhibits universal properties within its threat model. The patch is designed to suppress the true class of any object it overlaps, regardless of the background scene. The classifier's attention mechanism is hijacked by the patch's high-contrast texture, causing it to ignore the contextual features of the actual object and output the adversary's target label with high confidence.

In the context of Automatic Modulation Classification, the concept translates to a localized, high-power interference burst overlaid on a target signal. This 'spectral patch' is a short-duration, high-energy waveform segment designed to dominate the classifier's input features. Unlike low-power adversarial perturbations spread across the entire signal, this localized jamming spike is easier to generate with a simple gated noise source.

Defenses against patches differ from standard input denoising. Local gradient smoothing and feature squeezing are often ineffective against high-magnitude local distortions. More robust defenses include:

• Digital watermarking to detect sticker boundaries
• Attention-based saliency clipping to mask high-activation regions
• Certified defenses using interval bound propagation specifically for localized corruptions

The seminal physical-world attack where a carefully crafted sticker pattern is placed on a Stop Sign, causing an autonomous vehicle's vision classifier to misclassify it as a Speed Limit 45 sign with high confidence. The patch exploits the model's reliance on high-activation feature regions, creating a localized visual signal that overpowers the global context of the octagonal sign shape. This attack is robust to changes in viewing distance, angle, and lighting conditions, demonstrating that physical realizability does not diminish adversarial effectiveness.

A printed pattern affixed to a piece of clothing or a rigid board that causes object detection models to fail entirely at localizing a person. The patch is optimized to suppress the 'person' class confidence score below the detection threshold across a wide range of bounding box proposals. By generating a universal perturbation that is effective regardless of the wearer's pose or background, an adversary can become effectively invisible to automated surveillance systems. This technique exploits the region proposal network stage of two-stage detectors like Faster R-CNN.

A direct translation of the visual adversarial patch into the radio frequency domain. An adversary transmits a short, high-power burst of carefully crafted interference that appears as a bright, localized patch on the spectrogram input to an Automatic Modulation Classification model. This burst is optimized to force a misclassification of the underlying signal's modulation scheme—for example, making a BPSK signal appear as 16-QAM. The attack is effective even when the patch occupies less than 2% of the total time-frequency representation, making it a practical over-the-air threat.

Unlike traditional camouflage that aims to blend a target into its background by mimicking surrounding textures and colors, an adversarial patch is conspicuously anomalous. It often appears as a chaotic, psychedelic cluster of pixels that is immediately obvious to a human observer. Its effectiveness derives not from concealment but from hijacking the feature extraction hierarchy of a convolutional neural network. The patch generates activation patterns that correlate more strongly with the target class's learned features than the actual object's features, effectively performing a targeted semantic override.

Defenses against adversarial patches exploit their localized, high-magnitude nature:

• Local Gradient Smoothing (LGS): Identifies regions with abnormally high gradient magnitudes in the input space, which are characteristic of patch boundaries, and smooths them.
• Digital Watermarking: Embeds a fragile, imperceptible watermark into the scene; the patch's occlusion or distortion of the watermark betrays its presence.
• PatchGuard: A defense that masks out suspicious high-saliency regions identified by a separate explainability model before the primary classifier processes the input.
• Interval Bound Propagation: Provides certified defenses by mathematically proving that a patch of a given size cannot change the classification outcome.

The adversarial patch is the primary mechanism for executing over-the-air attacks in signal classification. Unlike digital perturbations, a patch is a localized, printable pattern designed to survive the distortions of a wireless channel. When placed in the environment or on a transmitter, it creates a consistent, high-magnitude feature that dominates the receiver's attention mechanism. This exploits the model's reliance on spatially localized features rather than global signal structure, making it robust to translation, rotation, and noise.

The primary countermeasure against patch attacks is adversarial training with patch-augmented data. This involves generating patches using Projected Gradient Descent (PGD) constrained to a specific spatial region and injecting them into training samples. The model learns to treat the patch region as uninformative noise, forcing it to rely on uncorrupted signal features. However, this defense often trades standard accuracy for robustness and may not generalize to patches of different sizes or shapes than those seen during training.

For provable guarantees against patch attacks, randomized smoothing is adapted to the localized threat model. The technique applies random ablation or Gaussian noise to contiguous regions of the input spectrogram. If the majority vote of the smoothed classifier remains stable despite the patch, a certified radius is established. This provides a mathematical guarantee that no patch smaller than the certified size can change the classification, a critical requirement for safety-critical spectrum monitoring.

Rather than correctly classifying a patched signal, a pragmatic defense is to detect and reject it. Adversarial detection modules analyze feature activations for anomalies characteristic of patches:

• High activation magnitude in a localized region
• Out-of-distribution feature statistics in intermediate layers
• Inconsistency between local and global predictions When a patch is flagged, the system can fall back to alternative sensors or request retransmission, maintaining operational integrity even if the classifier is fooled.

The adversarial patch operates under a distinct threat model from Lp-bounded perturbations. The adversarial budget is defined by the patch's physical size and location, not by pixel-level distortion limits. Key assumptions include:

• The adversary can place a patch anywhere in the scene
• The patch can be arbitrarily conspicuous
• The patch must survive real-world imaging conditions This model is realistic for physical sabotage of autonomous systems but assumes the attacker cannot modify the entire signal.

Patches exhibit strong transferability between independently trained classifiers. A patch optimized on a white-box surrogate model often fools a black-box target deployed in the field. This is because patches exploit fundamental architectural vulnerabilities—such as the localized receptive fields of convolutional layers—rather than model-specific quirks. This property makes patches especially dangerous: an attacker needs no internal knowledge of the deployed system to craft an effective physical attack.