Adversarial Patch

The defining characteristic of an adversarial patch is its ability to survive the domain gap between digital generation and physical deployment. Patches are optimized to remain effective under varying real-world conditions.

• Viewpoint Invariance: Effective across a wide range of angles and distances.
• Lighting Robustness: Designed to work under diverse illumination conditions.
• Printability: Perturbations are constrained to colors reproducible by standard printers during the optimization process.

Unlike classic adversarial examples that apply an imperceptible perturbation across an entire image, a patch concentrates the attack signal into a small, contiguous region. This is formalized using a masking operation during generation.

• The attacker defines a binary mask specifying the patch's location and shape.
• The optimization focuses exclusively on pixels within this mask.
• This allows the patch to be printed and placed strategically in a scene to suppress or alter object detection.

To achieve physical robustness, patches are trained using Expectation over Transformation (EoT). This technique averages the adversarial loss over a distribution of random transformations applied during each optimization step.

• Transformations include: random scaling, rotation, translation, and additive noise.
• Color and contrast shifts simulate different printing and lighting conditions.
• EoT prevents the patch from overfitting to a single digital viewpoint, ensuring it generalizes to the physical world.

Adversarial patches are most commonly used for targeted attacks against object detectors. The goal is not just to cause a misclassification, but to achieve a specific, attacker-chosen outcome.

• Object Vanishing: The patch causes a detector to completely ignore a salient object (e.g., making a person invisible to a surveillance camera).
• Object Creation: A patch can be optimized to be detected as a specific, non-existent object with high confidence.
• Class Manipulation: A patch placed on a 'Stop' sign can cause it to be consistently classified as a 'Speed Limit' sign.

Patches are typically generated using white-box optimization algorithms that leverage access to the target model's gradients. The standard approach is a variant of Projected Gradient Descent (PGD).

• The algorithm maximizes the loss of the target model with respect to the patch pixels.
• Total Variation (TV) loss is often added as a regularizer to ensure the patch has smooth, printable color transitions.
• The resulting pattern is often a psychedelic, high-contrast image that exploits specific feature activations in the neural network.

A patch generated against a known source model (e.g., YOLOv3) often retains significant efficacy against unknown target models (e.g., Faster R-CNN). This black-box transferability makes patches a practical threat.

• Patches exploit fundamental features common across different convolutional architectures.
• An attacker can generate a patch using a publicly available model and deploy it against a proprietary system.
• Defenses must therefore be robust to attacks not seen during their own training.

A maliciously perturbed input designed to cause a model to make a mistake while appearing unmodified to human observers. Unlike adversarial patches, which are localized and conspicuous, traditional adversarial examples apply imperceptible perturbations across the entire input. These are typically crafted using gradient-based methods like FGSM or PGD and exploit the linear behavior of neural networks in high-dimensional spaces.

An attack that modifies input data at test time to cause misclassification without altering the underlying model. The adversarial patch is a specific subclass of evasion attack designed for the physical world. Key characteristics:

• Test-time only: No access to training pipeline
• Physical realizability: Patches are printed and placed in scenes
• Targeted or untargeted: Can force specific misclassifications or simply cause any error

A defensive technique that augments training data with adversarial examples to improve model robustness. For patch attacks, specialized adversarial training involves:

• Generating patches on-the-fly during training
• Applying random patch transformations (rotation, scaling, translation)
• Using EOT (Expectation Over Transformation) to handle physical-world variations This remains one of the most effective empirical defenses against patch-based attacks.

A formal guarantee that a model's prediction remains constant for all inputs within a mathematically defined perturbation bound. For adversarial patches, certification is challenging due to the large, contiguous perturbation region. Techniques include:

• Interval bound propagation with patch-specific constraints
• Randomized smoothing adapted for spatially contiguous noise
• Clipped BagNet architectures that limit receptive fields Certified defenses provide provable safety but often at significant clean accuracy cost.

An attack designed to remain effective when deployed in the physical environment, accounting for real-world variations. Adversarial patches are the canonical physical-world attack because they:

• Survive changes in lighting, angle, and distance
• Remain effective when printed and photographed
• Exploit the model's strongest features rather than subtle perturbations Related physical attacks include adversarial eyeglasses for facial recognition evasion and adversarial clothing for person detection.