English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Patch-based adversarial attacks introduce a perceptible but localized changeto the input that induces misclassification. While progress has been made indefending against imperceptible attacks, it remains unclear how patch-basedattacks can be resisted. In this work, we study two different approaches fordefending against black-box patch attacks. First, we show that adversarialtraining, which is successful against imperceptible attacks, has limitedeffectiveness against state-of-the-art location-optimized patch attacks.Second, we find that compositional deep networks, which have part-basedrepresentations that lead to innate robustness to natural occlusion, are robustto patch attacks on PASCAL3D+ and the German Traffic Sign RecognitionBenchmark, without adversarial training. Moreover, the robustness ofcompositional models outperforms that of adversarially trained standard modelsby a large margin. However, on GTSRB, we observe that they have problemsdiscriminating between similar traffic signs with fine-grained differences. Weovercome this limitation by introducing part-based finetuning, which improvesfine-grained recognition. By leveraging compositional representations, this isthe first work that defends against black-box patch attacks without expensiveadversarial training. This defense is more robust than adversarial training andmore interpretable because it can locate and ignore adversarial patches.

Robustness Out of the Box: Compositional Representations Naturally Defend Against Black-Box Patch Attacks