Jujutsu: A Two-stage Defense against Adversarial Patch Attacks on Deep Neural Networks

Understand

Adversarial patch attacks create adversarial examples by injecting arbitrary distortions within a bounded region of the input to fool deep neural networks (DNNs).

• These attacks are robust (i.e., physically-realizable) and universally malicious, and hence represent a severe security threat to real-world DNN-based systems.
• We propose Jujutsu, a two-stage technique to detect and mitigate robust and universal adversarial patch attacks.
• We first observe that adversarial patches are crafted as localized features that yield large influence on the prediction output, and continue to dominate the prediction on any input.