PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Training against Location-Optimized Adversarial Patches

Sukrut Rao, David Stutz, Bernt Schiele

arXiv:2005.02313v2cs.CVcs.CRcs.LGstat.ML

TL;DR

Robustness against visible adversarial patches remains poorly understood, despite their physical-world applicability. This paper optimizes patch locations and trains on the resulting patches, improving robustness on CIFAR10 and GTSRB without reducing clean accuracy.

  • Problem

    Robustness against adversarial patches is poorly understood, even though visible patches can be printed and applied in the physical world.

    Source: §1 · p. 2

  • Method

    The paper heuristically optimizes adversarial patch location and content, then adversarially trains models on location-optimized patches.

    Source: §1 · p. 2

  • Results

    On CIFAR10 and GTSRB, location-optimized adversarial training improves patch robustness without reducing clean accuracy.

    Source: §1 · p. 2, §4.2 · p. 12, §5 · p. 14

  • Takeaways & Limitations

    Visualized locations suggest adversarially trained models reduce the image area vulnerable to adversarial patches.

    Source: §5 · p. 14

    Location optimization increases computational cost, and the one-extra-forward-pass approach may miss opportunities to improve patch location.

    Source: §3.2 · p. 8, §4.2 · p. 12

Abstract

from arXiv · show

Deep neural networks have been shown to be susceptible to adversarial examples -- small, imperceptible changes constructed to cause mis-classification in otherwise highly accurate image classifiers. As a practical alternative, recent work proposed so-called adversarial patches: clearly visible, but adversarially crafted rectangular patches in images. These patches can easily be printed and applied in the physical world. While defenses against imperceptible adversarial examples have been studied extensively, robustness against adversarial patches is poorly understood. In this work, we first devise a practical approach to obtain adversarial patches while actively optimizing their location within the image. Then, we apply adversarial training on these location-optimized adversarial patches and demonstrate significantly improved robustness on CIFAR10 and GTSRB. Additionally, in contrast to adversarial training on imperceptible adversarial examples, our adversarial patch training does not reduce accuracy.

1 Introduction

Visible adversarial patches can be used in the physical world, yet robustness against them remains poorly understood. The paper jointly optimizes patch location and content, then adversarially trains models to improve patch robustness without reducing clean accuracy.

1 Introduction

  • Visible attacks can be printed and applied physically, posing a practical threat to applications such as autonomous driving.The introduction contrasts these attacks with imperceptible adversarial examples.Source: §1 · pp. 1–2
  • Robustness against adversarial patches remains poorly understood, despite extensive attention to defenses against imperceptible adversarial examples.Existing patch defenses have limitations, and respectable robustness remains an open problem.Source: §1 · pp. 1–2
  • Location-optimized adversarial patch training improves robustness on CIFAR10 and GTSRB without reducing clean accuracy.The authors also report that their approach outperforms, which they found ineffective against their patch attack.Source: §1 · pp. 2–3
  • The paper jointly optimizes patch location and content, then applies adversarial training against the resulting patches.The location-optimization heuristic is evaluated with various strategies.Source: §1 · p. 2

2 Related Work

Related work covers defenses for nearly imperceptible attacks as well as methods that introduce visible image changes. Existing patch defenses have limitations, and this paper differs from the closest cited approach by jointly optimizing patch values and location and evaluating untargeted, image-specific patches.

Adversarial Examples

  • Adversarial training is described as effective against Lp-constrained attacks, although robustness remains challenging and clean-accuracy drops have motivated variants.Many proposed defenses have been shown ineffective against advanced attacks.Source: §2 · p. 3

Adversarial Patches

  • Visible adversarial changes include transformations, color or filters, generated semantic examples, and patches.Some patches are universal and use fixed or random locations, and patches can be printed and embedded in the real world.Source: §2 · pp. 3–4
  • Prior patch defenses include sparse Fourier transformation, certified interval-bound propagation, in-painting, and Defense against Occlusion Attacks.Unlike, this work jointly optimizes patch values and location and evaluates untargeted, image-specific patches, which have been shown stronger than universal patches used to evaluate DOA.Source: §2 · p. 4

3 Adversarial Training against Location-Optimized Adversarial Patches

The section develops image-specific, untargeted adversarial patches and a heuristic for moving them toward locations that increase attack loss, then trains classifiers on both patched and clean images. It also reports that patch training does not increase clean test error compared with normal training.

3.1 Adversarial Patches

  • Image-specific, untargeted patches combine a perturbation and square mask, and projected gradient ascent maximizes cross-entropy against the true label.The mask avoids the center region; patch values are clipped to [0, 1].Source: §3.1 · pp. 5–6

3.2 Location Optimization

  • The location heuristic shifts the patch by a fixed stride toward a candidate direction that increases cross-entropy, leaving it in place if none does.The patch is kept outside the center region, and its mask and perturbation move together.Source: §3.2 · pp. 7–8
  • Full location optimization tests four directions at added computational cost, while random-direction search uses one extra forward pass but may miss opportunities to improve location.Fixed and random placement can leave vulnerable locations untested during adversarial training.Source: §3.2 · pp. 7–8

3.3 Adversarial Patch Training

  • Adversarial patch training does not increase clean test error compared with normal training.The comparison is reported for CIFAR10 and GTSRB.Source: Table 1 · p. 8
  • Training splits each batch evenly between clean images and adversarial patches, balancing their cross-entropy losses.The method is designed to maintain clean-image accuracy while training on patches.Source: §3.3 · p. 8

4 Experiments

Experiments on CIFAR10 and GTSRB evaluate location-optimized patch attacks and adversarial training, which improves robustness without reducing clean accuracy. Results also show that attack strength, compute budget, and dataset affect the measured benefits.

4 Experiments

  • Experiments used CIFAR10 and GTSRB with 8 × 8 patches, four location strategies, and robust test error measured over 33 restarts.The patch was constrained to a border region, leaving the 10 × 10 center unchanged; evaluation used the per-example worst case across default attacks.Source: §4 · pp. 9–11

4.2 Results

  • 45.1% RErr against AP-FullLO made AT-FullLO the most robust CIFAR10 model, while AT-RandLO reduced GTSRB RErr by 88.4% versus Normal.Across the reported comparisons, location-optimized adversarial patch training improved robustness and outperformed the baselines.Source: Table 4 · p. 10, §4.2 · p. 12

4.1 Ablation

  • An 8 × 8 patch is near CIFAR10’s RErr saturation point, while the 10 × 10 center region was needed to prevent occlusion-related accuracy loss.RErr generally increased with patch size, though GTSRB showed a slight drop at 11 × 11.Source: §4.1 · p. 11
  • Increasing attack iterations and restarts raised RErr, while limited-cost attacks remained effective against Normal and Occlusion but had lower RErr against adversarially trained models.The default attacks used T = 1000 with r = 3 or T = 100 with r = 30; the limited-cost CIFAR10 comparison used T = 50 and r = 3.Source: Table 3 · p. 9, §4.1 · p. 11, §4.2 · p. 12

4.2 Results

  • Adversarial patch training did not increase clean test error and might improve CIFAR10 accuracy.The authors suggest the patches may be far enough from clean examples not to affect generalization, with a possible regularizing effect.Source: §4.2 · p. 12
  • Location optimization required 2× or 5× more forward passes for random or full optimization, and under a 50-pass budget its benefits varied by dataset.AT-Rand50 had lower RErr than the location-optimized alternatives on CIFAR10, whereas AT-RandLO50 had lower RErr than AT-Rand50 and AT-FullLO50 on GTSRB.Source: Table 5 · p. 12, §4.2 · p. 13
  • Sparse Fourier transformation did not improve robustness against the location-optimized attacks and was outperformed by adversarial patch training.The comparison covered CIFAR10 and GTSRB.Source: §4.2 · p. 13, Table 6 · p. 13
  • Location heatmaps showed that patches often needed specific locations to fool adversarially trained models, and some converged locations did not cause misclassification.None of the 1,000 AP-FullLO restarts succeeded against AT-FullLO.Source: §4.2 · p. 14, Figure 4 · p. 14

5 Conclusion

The paper combines heuristic patch-location optimization with adversarial training to improve robustness on CIFAR10 and GTSRB. It reports reduced vulnerable image regions, preserved accuracy, and improved robustness to universal patches.

5 Conclusion

  • Location optimization generally improves adversarial-training robustness and strengthens the patch attack on CIFAR10 and GTSRB.Source: §5 · p. 14
  • Heatmaps show adversarially trained models reduce the image area vulnerable to adversarial patches.Source: §5 · p. 14
  • The patch training outperforms while preserving accuracy, unlike adversarial training on imperceptible examples, which usually reduces accuracy.Source: §5 · p. 14
  • Adversarial patch training also improves robustness against universal adversarial patches.Source: §5 · p. 14

Related papers

Loading 2005.02313v2…