Object detection plays a key role in many security-critical systems. Adversarial patch attacks, which are easy to implement in the physical world, pose a serious threat to state-of-the-art object detectors. Developing reliable defenses for object detectors against patch attacks is critical but severely understudied. In this paper, we propose Segment and Complete defense (SAC), a general framework for defending object detectors against patch attacks through detecting and removing adversarial patches. We first train a patch segmenter that outputs patch masks that provide pixel-level localization of adversarial patches. We then propose a self adversarial training algorithm to robustify the patch segmenter. In addition, we design a robust shape completion algorithm, which is guaranteed to remove the entire patch from the images given the outputs of the patch segmenter are within a certain Hamming distance of the ground-truth patch masks. Our experiments on COCO and xView datasets demonstrate that SAC achieves superior robustness even under strong adaptive attacks with no performance drop on clean images, and generalizes well to unseen patch shapes, attack budgets, and unseen attack methods. Furthermore, we present the APRICOT-Mask dataset, which augments the APRICOT dataset with pixel-level annotations of adversarial patches. We show SAC can significantly reduce the targeted attack success rate of physical patch attacks.

本文提出了一种名为Segment and Complete defense的通用框架，通过检测和移除对抗性贴片来防御物体探测器中的对抗性攻击，并设计了一个鲁棒的形状恢复算法，该算法能够保证将对抗贴片完全从图像中移除。作者在COCO和xView数据集上的实验证明，SAC能够在高强度自适应攻击下实现优异的鲁棒性，并且对未知的贴片形状、攻击预算和攻击方法具有良好的泛化能力。另外，作者提出了一个增强版的数据集APRICOT-Mask，用于对抗性贴片的像素级标注。

分割与完成：针对对抗性贴片攻击的物体检测器防御方法和鲁棒贴片检测方法