Adversarial Patch Attacks
A one-pixel attack hides a change in a single location. An adversarial patch takes the opposite approach: it concentrates a large, visible pattern in one region and trains that pattern to dominate the model's prediction.
A patch uses gradients more directly than a one-pixel search. During training, part of each image is replaced with the patch. The loss is backpropagated into the patch pixels, and the patch is updated across many images.
Why Random Transformations Matter
A patch that works at one digital location may fail when it is printed, rotated, moved, resized, shadowed, or viewed from another angle. Training across random positions, rotations, scales, lighting conditions, and camera distances teaches the patch to survive those transformations. This idea is often called expectation over transformation.
Physical Consequences
A sticker can change a road-sign prediction. A printed texture can make a 3D turtle look like a rifle to a classifier across several viewing angles. A patterned garment or camouflage covering can reduce object-detection performance. The model receives pixels from a camera, so an attacker can manipulate the scene instead of the software.
Why train an adversarial patch at many positions, rotations, and scales?