Adversarial Patch Training

Unlike traditional adversarial attacks that spread imperceptible noise across an entire image, patch attacks concentrate high-magnitude perturbations into a confined region. This mimics real-world threats where an attacker places a printed sticker or physical object in the camera's field of view.

• Perturbations are spatially constrained to a small contiguous region
• Magnitude is unbounded within the patch area, making it highly visible
• The rest of the image remains unmodified and clean
• Defends against attacks that bypass global perturbation defenses

Patch training incorporates Expectation over Transformation to ensure robustness across varied physical conditions. During training, patches are subjected to random transformations before being composited onto images.

• Random rotations simulate different camera angles
• Scale variations account for distance changes
• Lighting and contrast shifts model real-world illumination
• Perspective warping handles non-planar surfaces
• The model learns to recognize adversarial intent regardless of patch orientation or placement

Training patches are dynamically generated or randomly sampled rather than using a single fixed pattern. This prevents the model from overfitting to a specific adversarial texture and encourages learning generalizable robustness.

• Patches are randomly initialized and optimized per batch
• Shapes can be circular, rectangular, or irregular polygons
• Colors and patterns vary widely across training iterations
• Placement coordinates are randomized on each image
• The model develops invariance to patch appearance rather than memorizing specific patterns

During each training iteration, the patch itself is optimized via gradient ascent to maximize the model's loss while the model weights are updated via gradient descent to minimize it. This creates a min-max game.

• The patch is treated as a learnable parameter during the forward pass
• Gradients flow through the patch region to update pixel values
• The adversary (patch) and defender (model) co-evolve
• This mirrors the Projected Gradient Descent (PGD) framework adapted for spatial constraints
• Results in patches that exploit the model's current weaknesses

Patch training is critical for object detection models where an attacker can cause a person or vehicle to become invisible to the detector by placing a patch nearby. Training specifically targets detection head robustness.

• Patches are placed on or near target objects during training
• The model learns to maintain bounding box accuracy despite occlusion
• Defends against disappearance attacks where objects are not detected
• Also mitigates misclassification attacks where objects are labeled incorrectly
• Essential for autonomous vehicle and surveillance system security

A central challenge in patch training is maintaining high performance on clean, unmodified images while gaining robustness. Overly aggressive adversarial training can degrade standard accuracy.

• Training typically uses a mixed batch strategy: 50% clean, 50% patched
• Loss functions balance natural accuracy and adversarial robustness
• Techniques like TRADES can be adapted for patch-specific trade-offs
• Validation is performed on both clean and patched test sets
• The goal is Pareto-optimal performance across both distributions

The critical optimization framework for generating physical-world adversarial patches. EoT optimizes a perturbation over a distribution of transformations—including rotation, scaling, translation, and lighting changes—ensuring the patch remains effective when printed and photographed from different angles. This directly addresses the challenge of maintaining attack efficacy across varying real-world conditions.

The foundational defensive technique where a model is trained on a mixture of clean and adversarially perturbed examples. For patch attacks, this involves injecting images containing localized, high-intensity patches into the training set with correct labels. This forces the model to learn features that are invariant to the presence of salient visual anomalies, directly reducing its susceptibility to occlusion-based attacks.

A powerful white-box attack considered the gold standard for evaluating empirical robustness. PGD iteratively takes small steps in the gradient direction and projects the perturbation back onto an L-infinity ball. While standard PGD creates diffuse perturbations, constrained variants can be used to generate localized patch-like attacks for diagnostic robustness testing.

A dangerous false security phenomenon where a defense produces obfuscated or shattered gradients, causing gradient-based attacks like PGD to fail. A model relying on gradient masking may appear robust against white-box attacks but remains trivially vulnerable to black-box transfer attacks or decision-based attacks. True adversarial patch robustness requires avoiding this pitfall.

Unlike empirical defenses, certified robustness provides a mathematical guarantee that a model's prediction will not change for any input within a defined perturbation radius. Techniques like randomized smoothing can provide probabilistic certificates against patch attacks by aggregating predictions over many noised or masked versions of the input, offering provable safety bounds.