RAPID: Robust multi-pAtch masker using channel-wise Pooled varIance with two-stage patch Detection

• Published in: Journal of King Saud University. Computer and information sciences 2024-10, Vol.36 (8), p.102188, Article 102188
• Main Authors: Kim, Heemin, Kim, Byeong-Chan, Lee, Sumi, Kang, Minjung, Nam, Hyunjee, Park, Sunghwan, Kwak, Il-Youp, Lee, Jaewoo
• Format: Article
• Language: English
• Subjects: Adversarial attack; Adversarial patch defense; Object detection; Pre-processing defense; Robust detection
• ISSN: 1319-1578
• DOI: 10.1016/j.jksuci.2024.102188

Recently, adversarial patches have become frequently used in adversarial attacks in real-world settings, evolving into various shapes and numbers. However, existing defense methods often exhibit limitations in addressing specific attacks, datasets, or conditions. This underscores the demand for versatile and robust defenses capable of operating across diverse scenarios. In this paper, we propose the RAPID (Robust multi-pAtch masker using channel-wise Pooled varIance with two-stage patch Detection) framework, a stable solution to restore detection efficacy in the presence of multiple patches. The RAPID framework excels in defending against attacks regardless of patch number or shape, offering a versatile defense adaptable to diverse adversarial scenarios. RAPID employs a two-stage strategy to identify and mask coordinates associated with patch attacks. In the first stage, we propose the ‘channel-wise pooled variance’ to detect candidate patch regions. In the second step, upon detecting these regions, we identify dense areas as patches and mask them accordingly. This framework easily integrates into the preprocessing stage of any object detection model due to its independent structure, requiring no modifications to the model itself. Evaluation indicates that RAPID enhances robustness by up to 60% compared to other defenses. RAPID achieves mAP50 and mAP@50-95 values of 0.696 and 0.479, respectively. •We developed a novel defense against physical patch attacks on object detection models.•It offers robust defense against adversarial attacks, regardless of patch number or shape.•Our method applies to any object detection models without extra model training.