Defense against small image patches using occlusions.
problem Vulnerability of deep learning to small adversarial patches.
method Partially occlude image around each patch location.
result Certified security against patch attacks of a certain size.
On-device research index
arXiv research
A locally-built, LLM-digested index of recent arXiv papers in quant finance, geometry/topology, and statistical ML — keyword search served straight from SQLite on this machine.
168,694 papers · 148 categories
Trend · papers per month
48 results for “patch attacks”
Paper presents certified defenses against adversarial patch attacks.
problem Certified defenses against adversarial patch attacks are needed.
method Proposes the first certified defense and faster training methods.
result Demonstrates robustness transfer across different patch shapes.
Patch adversarial attacks on images, in which the attacker can distort pixels within a region of bounded size, are an important threat model since they provide a quantitative model for physical adversarial attacks. In this paper, we introduce a certifiable defense against patch attacks that guarantees for a given image…
MAT combines meta-learning and adversarial training to defend against universal patches.
problem Defending against universal patches that fool models in various contexts.
method Meta adversarial training (MAT) integrates meta-learning with adversarial training.
result MAT increases robustness against universal patch attacks on image classification and traffic-light detection.
In this paper, we demonstrate a physical adversarial patch attack against object detectors, notably the YOLOv3 detector. Unlike previous work on physical object detection attacks, which required the patch to overlap with the objects being misclassified or avoiding detection, we show that a properly designed patch can s…
Trojans can be inserted into deep neural networks without altering training data.
problem Inserting malicious code into deep learning models without changing training data.
method Patches model parameters in memory to achieve desired behavior on specific inputs.
result Efficient patches can induce trojan behavior with minimal risk of detection.
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
Sparse-RS framework efficiently attacks models with sparse perturbations.
problem Efficiently attacking models with sparse perturbations in the black-box setting.
method Random search-based Sparse-RS framework for score-based attacks.
result Sparse-RS achieves state-of-the-art success rate and query efficiency.
We consider universal adversarial patches for faces -- small visual elements whose addition to a face image reliably destroys the performance of face detectors. Unlike previous work that mostly focused on the algorithmic design of adversarial examples in terms of improving the success rate as an attacker, in this work …
In this paper we propose a new augmentation technique, called patch augmentation, that, in our experiments, improves model accuracy and makes networks more robust to adversarial attacks. In brief, this data-independent approach creates new image data based on image/label pairs, where a patch from one of the two images …
3D adversarial logos can fool object detectors in real-world settings.
problem Creating robust adversarial attacks in 3D rendering views.
method Constructing 3D adversarial logos via texture mapping and differentiable rendering.
result 3D adversarial logos are more versatile and robust than traditional adversarial patches.
PatchGuard defends against localized adversarial patches with provable robustness.
problem Localized adversarial patches induce misclassification in machine learning models.
method PatchGuard uses CNNs with small receptive fields and robust masking to detect and mask corrupted features.
result PatchGuard achieves state-of-the-art provable robust accuracy and clean accuracy.
New security patch for object tracking in self-driving cars mitigates vulnerabilities.
problem Vulnerability of object tracking in self-driving cars, especially Kalman Filter-based trackers.
method Adaptive strategy to balance focus on observations and predictions based on deviation anomaly index.
result Certified effectiveness against a generalized hijacking attack model.
Neural networks are prone to adversarial attacks. In general, such attacks deteriorate the quality of the input by either slightly modifying most of its pixels, or by occluding it with a patch. In this paper, we propose a method that keeps the image unchanged and only adds an adversarial framing on the border of the im…
FRA-Attack improves adversarial transferability for closed-source MLLMs by aligning visual focus across models.
problem Improving adversarial transferability for closed-source MLLMs, especially with high accuracy.
method Unified frequency-domain regularization approach: high-pass DCT objective for feature alignment and Frequency-domain Gradient Regularization (FGR) for gradient optimization.
result FRA-Attack achieves superior cross-model transferability, especially on GPT-5.4, Claude-Opus-4.6, and Gemini-3-flash.
Many optimization methods for generating black-box adversarial examples have been proposed, but the aspect of initializing said optimizers has not been considered in much detail. We show that the choice of starting points is indeed crucial, and that the performance of state-of-the-art attacks depends on it. First, we d…
Deep neural networks (DNN) are known to be vulnerable to adversarial attacks. Numerous efforts either try to patch weaknesses in trained models, or try to make it difficult or costly to compute adversarial examples that exploit them. In our work, we explore a new "honeypot" approach to protect DNN models. We intentiona…
Recent studies have demonstrated that machine learning approaches like deep neural networks (DNNs) are easily fooled by adversarial attacks. Subtle and imperceptible perturbations of the data are able to change the result of deep neural networks. Leveraging vulnerable machine learning methods raises many concerns espec…
Paper proposes privacy-preserving learning for images, making them imperceptible to humans but recognizable by machines.
problem Conflict between developing AI systems and protecting sensitive training data.
method Encryption strategies (random shuffling and sub-patch mixing) followed by minimal adaptation to vision transformer.
result Achieves comparable accuracy to competitive methods while ensuring human-imperceptibility of encrypted images.
We give a new algorithm for approximating the Discrete Fourier transform of an approximately sparse signal that has been corrupted by worst-case noise, namely a bounded number of coordinates of the signal have been corrupted arbitrarily. Our techniques generalize to a wide range of linear transformations that are…
In adversarial attacks intended to confound deep learning models, most studies have focused on limiting the magnitude of the modification so that humans do not notice the attack. On the other hand, during an attack against autonomous cars, for example, most drivers would not find it strange if a small insect image were…
Deep neural networks (DNNs) are known for their vulnerability to adversarial examples. These are examples that have undergone small, carefully crafted perturbations, and which can easily fool a DNN into making misclassifications at test time. Thus far, the field of adversarial research has mainly focused on image model…
Highly expressive models such as deep neural networks (DNNs) have been widely applied to various applications. However, recent studies show that DNNs are vulnerable to adversarial examples, which are carefully crafted inputs aiming to mislead the predictions. Currently, the majority of these studies have focused on per…
Adversarial audio attacks can be considered as a small perturbation unperceptive to human ears that is intentionally added to the audio signal and causes a machine learning model to make mistakes. This poses a security concern about the safety of machine learning models since the adversarial attacks can fool such model…
Proposes a new approach to time series representation learning by embedding patches independently.
problem Capturing dependencies between time series patches is not optimal for representation learning.
method 1) Patch reconstruction task, 2) Patch-wise MLP, 3) Complementary contrastive learning.
result Improves time series forecasting and classification performance compared to state-of-the-art models.
In this report we investigate fundamental requirements for the application of classifier patching on neural networks. Neural network patching is an approach for adapting neural network models to handle concept drift in nonstationary environments. Instead of creating or updating the existing network to accommodate conce…
New method makes neural networks more resilient to location-optimized adversarial patches.
problem Neural networks' vulnerability to adversarial patches that are visible but still effective.
method Developed a practical approach to optimize patch locations and applied adversarial training.
result Significantly improved robustness against adversarial patches on CIFAR10 and GTSRB.
Reinforcement Patching optimizes dynamic sequence patching for efficient time series forecasting.
problem Efficiently learning data-adaptive representations for long-horizon sequence data, especially continuous sequences.
method Reinforcement Patching (ReinPatch) uses reinforcement learning to optimize dynamic patching policies and sequence backbones.
result ReinPatch achieves compelling performance in time-series forecasting compared to state-of-the-art methods.
Analytic patch trees reveal new geometric structures and dimension fields.
problem Understanding the geometric and analytical properties of surface patch trees.
method Developed analytic surface patch trees and introduced interface curves to transmit state.
result Surface patch trees have natural foliations with one-dimensional curve trees and dimension fields.
Patch priors have become an important component of image restoration. A powerful approach in this category of restoration algorithms is the popular Expected Patch Log-Likelihood (EPLL) algorithm. EPLL uses a Gaussian mixture model (GMM) prior learned on clean image patches as a way to regularize degraded patches. In th…
A random walk on image patchesphysics.data-an
In this paper we address the problem of understanding the success of algorithms that organize patches according to graph-based metrics. Algorithms that analyze patches extracted from images or time series have led to state-of-the art techniques for classification, denoising, and the study of nonlinear dynamics. The mai…
The main ob jective of this research is to find the different types of elliptic triangulations for planar discs and spheres. We begin in Chapter 1 with the mandatory introduction. In the second chapter we define and study the notion of a patch, that is, a triangulation of a planar disc. By introducing a suitable notion…
Ano-SuPs: Multi-size anomaly detection for manufactured products by identifying suspected patchesstat.ML
Ano-SuPs detects anomalies in images of manufactured products by identifying suspected patches.
problem Challenges in detecting anomalies in image-based manufacturing systems, including complexity of background and various anomaly patterns.
method Two-stage strategy anomaly detection method: first, remove suspected patches; second, refine anomaly identification using normal patches.
result Demonstrated effectiveness through simulation and case studies, identifying key parameters and steps impacting model performance and efficiency.
Patients initially diagnosed with early mild cognitive impairment (eMCI) are known to be a clinically heterogeneous group with very subtle patterns of brain atrophy. To examine the boarders between normal controls (NC) and eMCI, Magnetic Resonance Imaging (MRI) was extensively used as a non-invasive imaging modality to…
Patch Learningcs.LG
There have been different strategies to improve the performance of a machine learning model, e.g., increasing the depth, width, and/or nonlinearity of the model, and using ensemble learning to aggregate multiple base/weak learners in parallel or in series. This paper proposes a novel strategy called patch learning (PL)…
Efficiently processes high res images by selecting relevant patches.
problem High memory and compute requirements for processing large images.
method Differentiable Top-K operator to select relevant patches.
result End-to-end trainable model using backpropagation.
Perturbation of the Eigenvectors of the Graph Laplacian: Application to Image Denoisingphysics.data-an
The original contributions of this paper are twofold: a new understanding of the influence of noise on the eigenvectors of the graph Laplacian of a set of image patches, and an algorithm to estimate a denoised set of patches from a noisy image. The algorithm relies on the following two observations: (1) the low-index e…
Model patching closes subgroup performance gaps in skin cancer classification.
problem Inconsistent model performance on specific subgroups of a class.
method Two-stage framework that models subgroup features and learns semantic transformations, followed by data augmentation.
result Reductions in robust error of up to 33% relative to best baseline on benchmark datasets.
New projection operators for multipatch spaces with stable properties.
problem Problems with non-matching interfaces in multipatch spaces.
method Construction of commuting projection operators on de Rham sequences of multipatch spaces with local tensor-product parametrization.
result Local and stable projection operators in any norm for shape-regular spline patches with different mappings and local refinements.
Researchers construct explicit bundles for ALF metrics, revealing rational patching matrices for gravitational instantons.
problem Constructing explicit toric Ricci-flat metrics and their associated bundles.
method Explicit construction of patching matrices for ALF metrics and gravitational instantons.
result Rational form of patching matrices for gravitational instantons in the Chen--Teo family.
Chronic obstructive pulmonary disease (COPD) is a lung disease where early detection benefits the survival rate. COPD can be quantified by classifying patches of computed tomography images, and combining patch labels into an overall diagnosis for the image. As labeled patches are often not available, image labels are p…
Improved CNN model accuracy and generalizability through data pre-processing.
problem Enhancing accuracy and generalizability of CNN-based LULC classification.
method Trials of different data preparation methods, including patch selection, size, and augmentations.
result Combining multiple grids and rotations of patches improved model accuracy and generalizability.
SaliencyMix augments images with salient patches to improve model generalization.
problem Improving deep learning model generalization through better data augmentation.
method Carefully selects salient patches from images and mixes them with the target image.
result Achieves state-of-the-art top-1 error rates and robustness against adversarial attacks.
PatchGT uses non-trainable graph patches to improve graph representation learning.
problem Learning high-level information in graph tasks with direct Transformer models.
method PatchGT segments graphs into non-trainable patches, uses GNN for patch-level learning, and Transformer for graph-level learning.
result PatchGT achieves higher expressiveness and competitive performance on benchmark datasets.
We introduce an algorithm for the segmentation of a class of regime switching processes. The segmentation algorithm is a non parametric statistical method able to identify the regimes (patches) of the time series. The process is composed of consecutive patches of variable length, each patch being described by a station…
New image restoration method using localized patches and external databases.
problem Image restoration challenges.
method Localized structured prediction and non-linear multi-task learning for optimizing a penalized energy function.
result Strong statistical guarantees and practical effectiveness demonstrated on various image restoration problems.
Deep neural network models used for medical image segmentation are large because they are trained with high-resolution three-dimensional (3D) images. Graphics processing units (GPUs) are widely used to accelerate the trainings. However, the memory on a GPU is not large enough to train the models. A popular approach to …
We give the first provably efficient algorithm for learning a one hidden layer convolutional network with respect to a general class of (potentially overlapping) patches. Additionally, our algorithm requires only mild conditions on the underlying distribution. We prove that our framework captures commonly used schemes …