Breaking Rigidity in Adversarial Patch Attacks

Adversarial patch attacks that aim to fool deep neural network models in the real world prove effective in ‘every’ possible network type, including vision-language models (VLMs). Surprisingly, most of the existing adversarial patch generation algorithms develop patches of fixed shape (presumably rectangular or circular in a few instances). Due to such biases toward the shape of an adversarial patch, existing adversarial patch detectors, including VLMs, which yield high accuracy, provide a false sense of security. Our extensive experiments equivalently showcase the bias towards the fixed shape of adversarial patches and their high detection, which might leave a hole in adversarial patch defense against adaptive patches. In response, we have first proposed a novel deformable adversarial patch generation algorithm with multifold aims: (i) to highlight the vulnerabilities of state-of-the-art (SOTA) image classification algorithms and (ii) to help provide a strong foundation for developing a universal adversarial patch detector. Introducing smooth and deformable patches that significantly increase practical threats in real-world scenarios. Using the proposed algorithm, we developed large-scale adversarial patch detection datasets comprising 140,000 adversarial patch images for rigorous robustness evaluation and generalizable adversarial detection. The proposed deformable patches effectively fool several SOTA image classification models. While the defense is not the primary focus, our preliminary study highlights that detecting the proposed deformable patches is hard. Still, they can enhance security against various patch shapes, including fixed and deformable patches.