Adversarial Patch

Unlike global perturbations that modify every pixel, an adversarial patch concentrates the attack signal into a contiguous, bounded region of the image. This spatial locality is the defining architectural constraint. The patch is optimized to act as a visual 'universal key' that, when detected, suppresses all other features in the scene. The attack's success is independent of the patch's position, scale, or orientation relative to the target object, making it robust to real-world camera perspectives.

The core threat model assumes the attacker cannot digitally modify pixels post-capture. Instead, the patch is printed on physical media (paper, fabric, stickers) and introduced into the environment. This requires the optimization process to account for the printer's color gamut and non-differentiable image capture pipelines. Successful patches survive varying lighting conditions, camera noise, motion blur, and slight deformations, bridging the gap between digital gradient descent and physical manifestation.

The optimization loss function is explicitly designed to cause the model to ignore all contextual evidence outside the patch. The attacker trains the patch to produce a targeted misclassification with high confidence regardless of the background. This is achieved by training the patch over a distribution of backgrounds, scales, and translations, forcing the network to learn a feature representation that acts as an overpowering salient signal that drowns out the true object's activations in the feature hierarchy.

To achieve robustness to real-world capture conditions, patch optimization employs Expectation over Transformation. During training, a random distribution of geometric and photometric transformations is applied to the patch before compositing it onto the background image. This includes:

• Random rotation, scaling, and translation
• Additive brightness and contrast jitter
• Perspective warping and projective transforms This ensures the optimized pattern remains adversarial across the stochasticity of physical imaging.

Adversarial patches are most dangerous when executing a targeted attack. The attacker optimizes the patch to force the classifier to output a specific, attacker-chosen label (e.g., classifying a stop sign as a speed limit sign). This is distinct from untargeted attacks that merely cause any misclassification. The targeted variant requires the patch to encode a class-specific feature template that maximally activates the target class's logits while suppressing the true class, effectively acting as a visual backdoor trigger in the physical world.

Defending against patches requires different strategies than standard adversarial training. Effective defenses include local gradient smoothing and digital watermarking detection. One prominent approach is the 'defensive paste' or patch-based adversarial training, where models are explicitly trained on images containing random patches. Another is attention-thresholding, where high-activation regions are masked and re-evaluated. Because patches create extreme feature map activations, anomaly detectors monitoring intermediate layer statistics can flag and reject patched inputs before final classification.

The foundational concept underlying patches. A perturbation is any carefully crafted modification to input data designed to cause misclassification. Unlike digital perturbations, adversarial patches are physically realizable and must survive real-world variations in lighting, angle, and scale. They exploit a model's spatial sensitivity by concentrating a high-magnitude perturbation in a localized region, overwhelming the classifier's global feature extraction.

The core optimization framework for generating robust physical-world patches. EOT computes the adversarial loss over a distribution of random transformations—rotations, translations, scaling, and lighting changes—ensuring the patch remains effective when printed and viewed from different angles. This technique directly addresses the domain gap between digital optimization and physical deployment.

Adversarial patches belong to a class of attacks distinguished by their threat model. Key dimensions include:

• White-box vs. Black-box: Whether the attacker has full access to model weights and gradients
• Targeted vs. Untargeted: Whether the goal is a specific misclassification or any incorrect output
• Perceptibility: Patches are overt and visible, unlike imperceptible Lp-bounded perturbations
• Material constraints: Must be printable and robust to printer color gamut limitations

A defensive methodology that augments training data with patch-augmented examples to build resilience. Unlike standard adversarial training, patch-specific defenses often employ randomized patch placement and adversarial patch generation during training. This forces the model to learn features from unoccluded regions of the image rather than relying on the presence of a clean, unobstructed input.

A critical property where patches optimized on one model architecture successfully fool others. Transferability is amplified in physical patches because the EOT framework inherently produces more robust perturbations. This means patches crafted against a surrogate model can often deceive black-box commercial APIs and deployed systems without direct access to the target model's internals.

Emerging formal verification methods that provide mathematical guarantees against patch attacks. Techniques like interval bound propagation and randomized ablation can certify that a model's prediction remains correct regardless of any adversarial patch within a specified size bound. These defenses offer provable robustness, contrasting with empirical defenses that may fail against adaptive attackers.