PatchGuard++: Efficient Provable Attack Detection against Adversarial Patches

Understand

An adversarial patch can arbitrarily manipulate image pixels within a restricted region to induce model misclassification.

• The threat of this localized attack has gained significant attention because the adversary can mount a physically-realizable attack by attaching patches to the victim object.
• Recent provably robust defenses generally follow the PatchGuard framework by using CNNs with small receptive fields and secure feature aggregation for robust model predictions.
• In this paper, we extend PatchGuard to PatchGuard++ for provably detecting the adversarial patch attack to boost both provable robust accuracy and clean accuracy.