Pith. sign in

REVIEW 3 major objections 3 minor 45 references

PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches

T0 review · 3 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PatchDEMUX splits multi-label classifiers into per-class binary tasks, wraps each in a single-label certified patch defense, and proves precision and recall bounds that tighten when the attacker has just one patch.

desk verdict A sound and useful extension of patch certification to multi-label classification; the main stress-test concern about non-realizable location-aware bounds does not hold up, and the fixes needed are mostly presentational. read the letter →

arxiv 2505.24703 v1 pith:IDHW5N2V submitted 2025-05-30 cs.CR cs.CVcs.LG

Dennis Jacob , Chong Xiang , Prateek Mittal This is my paper · ORCID
classification cs.CRcs.CVcs.LG
keywords adversarialpatchesmulti-labelclassificationcertifiedrobustnesscertifiabledefensepatchthreatmodellocation-awarecertificationprovableguaranteesCleanser
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PatchDEMUX addresses a gap in certified machine learning: single-label classifiers now have provable defenses against adversarial patches, while multi-label classifiers have essentially none. The paper's claim is that any multi-label classifier can be defended by splitting its label vector into per-class binary classifiers and wrapping each one in any existing single-label certifiable defense, which yields provable lower bounds on precision and recall under all patch attacks (Theorem 1). A second, location-aware certification procedure exploits the fact that a single patch occupies only one location: by tracking which classes are vulnerable at which locations and taking the maximum over the summed vulnerability arrays, the framework certifies that some failing classes must actually survive (Theorem 2). Instantiated with PatchCleanser, the framework reports 85.276% clean average precision and 44.902% certified robust average precision on MS-COCO, and 92.593% clean with 56.030% certified on PASCAL VOC, against 91.146% and 96.140% for the undefended models.

What carries the argument

The load-bearing object is the demultiplexing of the multi-label classifier $F: X \to \{0,1\}^c$ into isolated binary classifiers $F[i](x) = F(x)[i]$, each protected by a single-label certifiable defense against patch attacks (CDPA) with inference procedure SL-INFER and certification procedure SL-CERT. The mechanism behind the second theorem is the vulnerability status array, a per-location certificate $\lambda \in \{0,1\}^{|R|}$ indicating at which patch locations a class is guaranteed safe; for the PatchCleanser backbone this array is expressed over R-covering masks rather than raw locations, with each mask's status valid for all patch locations it covers. The key identity: for $k$ false-negative classes, the vector sum of the inverted arrays reaches a maximum $v_{\mathrm{opt}}$ at some location, bounding the number of classes a single patch can flip by $v_{\mathrm{opt}}$, so the remaining $k - v_{\mathrm{opt}}$ classes are certified true positives; a symmetric construction tracks false positives.

What would settle it

Construct an image whose false-negative classes are vulnerable at disjoint patch locations, certify it with Algorithm 2, then mount a single-patch attack with optimized content at each vulnerable location in turn; if any one patch flips more classes than the maximum of the summed inverted vulnerability arrays, the Algorithm 3 bound is false. As a separate check, two small patches placed at the two disjoint vulnerable locations should defeat the location-aware certificate even though every single-patch attack fails to, isolating the single-patch restriction as the load-bearing assumption.

Watch

Extended reading notes

Core claim

PatchDEMUX's central claim is that certified patch robustness transfers from single-label to multi-label classification through 'demultiplexing': treat the label vector $y \in \{0,1\}^c$ as $c$ independent binary problems, define the isolated classifier $F[i](x) = F(x)[i]$ for each class, run the single-label CDPA's inference and certification procedures on each $F[i]$, and pool the results into certified counts of true positives, false positives, and false negatives. From those counts the paper defines certified precision and certified recall as guaranteed lower bounds regardless of patch content. For the single-patch setting it proves a stronger bound: if each failing class returns a vulnerability status array $\lambda$ over patch locations, then the maximum over locations of the summed inverted arrays $1-\lambda$ is the largest number of false negatives any one patch can force, so every other failing class is guaranteed to be predicted correctly. The proof identifies the worst patch location as the argmax of the summed arrays and shows that at that location some classes are provably invulnerable, upgrading them from false negatives to certified true positives.

Load-bearing premise

The tighter location-aware guarantee assumes the attacker can place exactly one patch, because its proof relies on the patch being unable to occupy two vulnerable locations at once; with two or more patches the improved bounds collapse and only the weaker baseline certification remains.

Editorial extensions

If this is right

  • Any existing or future single-label certifiable defense plugs into the framework, so multi-label certified robustness improves automatically whenever single-label CDPAs improve.
  • Certified precision and recall are valid against every possible patch attack, so evaluating specific multi-label attack vectors is unnecessary for the guarantee.
  • Location-aware certification raises certified average precision from 41.763% to 44.902% on MS-COCO and from 54.904% to 56.030% on PASCAL VOC, and the gain persists across defense fine-tuning choices.
  • If the backbone single-label defense supports multiple patches, the baseline Algorithm 2 bounds inherit that capability; the tighter location-aware bound is restricted to a single patch.
  • An implementation optimization that reuses the backbone's masked-image evaluations keeps multi-label inference at roughly 2-4 times the single-label cost instead of the naive c-fold blowup (80 classes on MS-COCO).
  • None

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A two-patch attacker would break the location-aware bound's core reasoning, so safety-critical deployments facing multiple physical patches should rely on the baseline certification until a multi-patch-aware location refinement exists.
  • The demultiplex-and-maximize recipe is not specific to multi-label classification: object detection and semantic segmentation already have certifiable components with spatial structure, and a vulnerability-location union argument could tighten their patch certificates in the same way.
  • Because the reported location-aware bounds use a worst-case attacker whose false-negative and false-positive locations need not coincide, the headline certified AP values are provably safe but conservative: the true achievable worst case is at least as good as reported.
  • The certified curves bend differently on the two datasets (convex on MS-COCO, concave on PASCAL VOC), suggesting the bound is dominated by images with many small, easily occluded objects; a testable prediction is that location-aware gains concentrate on that subset.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper proposes PatchDEMUX, a framework that extends any single-label certifiable defense against adversarial patches to multi-label classification. The key idea is to treat each class of a multi-label classifier as an isolated binary classifier and apply the single-label defense independently per class, yielding certified lower bounds on precision and recall (Algorithm 2, Theorem 1). A second procedure, location-aware certification (Algorithm 3, Theorem 2), is proposed for the single-patch threat model: by tracking per-location vulnerability status arrays for the classes that fail baseline certification, the method derives tighter per-objective bounds on false negatives (and analogously false positives). Experiments with PatchCleanser as the backbone on MS-COCO and PASCAL VOC report high clean performance and non-trivial certified robustness, with a headline 'Location-aware robust' average precision of 44.902% on MS-COCO.

Significance. The modular 'demultiplexing' idea is genuinely useful: it provides a clean interface for lifting the growing library of single-label patch defenses to the multi-label setting, and the baseline certification (Algorithm 2) is simple, sound, and directly actionable. The paper ships source code and the core correctness proofs are short and checkable. The location-aware refinement is creative and, when restricted to a single objective (FN-only or FP-only), is a valid tightening. However, the headline empirical claims for the location-aware setting are not valid certificates as presented: the reported precision--recall pairs and AP combine worst-case guarantees from two different patch locations, which need not be simultaneously realizable by any single attacker. This makes the central 'location-aware robust' evaluation misleading and requires correction.

major comments (3)
  1. [Sec. 4.2, Table 1; Supplementary Sec. E] The 'Location-aware robust' precision--recall pairs and the headline 44.902% certified robust AP are not valid certificates under the stated single-patch threat model. Supplementary Sec. E states that the reported 'worst case' evaluation chooses the worst location for false negatives and the worst location for false positives independently, and explicitly notes that these locations need not coincide and the resulting performance is not necessarily realizable. Certified precision at a given recall is computed with FP_upper from one location, while certified recall is computed with FN_upper from a different location; no single attacker is actually bounded by the reported (precision, recall) point. The paper should either report FN-only and FP-only location-aware curves separately, or compute a genuinely realizable joint bound by, for example, minimizing over patch locations a combined objective that yields a single certified precision--recall envelope.
  2. [Supplementary Sec. A.2, Theorem 2 proof] The proof of Theorem 2 contains an invalid step: it states 'Because the patch must be placed at the optimal location ropt,' implying the attacker is forced to choose the worst location. The attacker is free to choose any location in R. The bound F_Nnew = max(fnTotal) is nevertheless correct, since for every location r the number of vulnerable FN classes is at most max(fnTotal); the proof should be rewritten as a per-location counting argument rather than relying on the attacker selecting ropt. The analogous issue applies to the FP version of Algorithm 3.
  3. [Sec. 3.4.2, Algorithm 3] The improved location-aware bounds are only claimed for the single-patch setting, and the paper does present this as the primary threat model. However, the headline comparison in Table 1 and Figure 3 features the location-aware numbers as the main 'robust' results, while the multi-patch capability is relegated to the baseline. The manuscript should state prominently, in the main text and in every table/figure where location-aware numbers appear, that these tighter bounds do not extend to multiple patches, since a reader could otherwise infer a stronger guarantee than the method provides.
minor comments (3)
  1. [Sec. C.2] The reported 'average precision' is the area under the precision--recall curve from 25% to 100% recall, normalized by 0.75, rather than the standard AP over the full recall range. This is disclosed, but the term 'AP' should be explicitly qualified as 'truncated AP' in the tables and text to avoid confusion with standard definitions.
  2. [Sec. 4.2, Table 1] The table would benefit from a footnote or caption clarification that the 'Location-aware robust' values are not standalone certificates for a single attacker unless the FN-only or FP-only interpretations are intended; as written, the table mixes the non-realizable worst-case combination with the two realizable per-objective bounds.
  3. [Sec. 3.4.1, Definition 3] The vulnerability status array lambda is defined over patch locations R, but for PatchCleanser it is computed over masks M (Supplementary Sec. B.3). Lemma 2 correctly establishes that this is a conservative abstraction, but the notation switch from R to M is easy to miss; a short note in Sec. 3.4.1 or in the integration section would improve clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the certified bounds follow from the per-class CDPA reduction and the imported PatchCleanser soundness theorem is prior independent work.

full rationale

PatchDEMUX's derivation chain is not circular. Theorem 1 is proved directly from Definition 2: any class with SL-CERT returning 1 is guaranteed recovered by SL-INFER for all patch attacks, so the counts TPlower, FPupper, and Fnupper in Algorithm 2 are valid by construction of the isolation argument. Theorem 2 and Lemma 1 are proved from the vulnerability status array (Definition 3); the location-aware bound is per-objective (FN-only or FP-only) and is mathematically sound. The only imported result is PatchCleanser's double-masking soundness (supplementary Theorem 3, cited to Xiang et al. [33]). Though two PatchDEMUX authors are also PatchCleanser authors, PatchCleanser is a previously peer-reviewed, published defense used as a black box; the present paper's contribution is the multi-label reduction, which is independent of PatchCleanser's correctness. The one in-scope caveat is empirical, not circular: Sec. E discloses that the 'Location-aware robust' curve combines worst-FN and worst-FP patch locations that 'do not have to be identical' and that this 'worst case' performance 'is not necessarily realizable.' That is a claim-validity concern about the headline AP, not a case where a prediction reduces to its input, so it does not raise the circularity score.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The framework introduces no fitted parameters; the two defense parameters (mask count and patch size) are inherited from PatchCleanser defaults, and the empirical results are conditioned on them. The AP normalization choice is a reporting parameter. The proofs rely on standard math plus the assumed soundness of PatchCleanser's certification and the R-covering property of its mask set. The vulnerability status array is a new formal construct, but it is computable and its validity is proven.

free parameters (3)
  • Mask count (k1 x k2) = 6 x 6
    Security parameter inherited from PatchCleanser defaults; controls computational budget and mask sizes. The certified and clean AP values in Section 5.1 depend on it, but it is not fitted to this paper's data.
  • Estimated patch size p = 2% of image area
    Security parameter defining the assumed threat level; larger p sharply reduces certified robustness as shown in Section 5.2. Chosen as a standard default, not fitted.
  • AP leftmost recall for normalization = 25% recall
    The AUC is computed from 25% to 100% recall and normalized by 0.75 (Supplementary C.2). This reporting choice affects every reported AP value and is not standard practice across the literature.
assumptions (4)
  • domain assumption The multi-label classifier's per-class predictions can be isolated into independent binary classifiers F[i](x) = F(x)[i].
    Invoked in Section 3.1; true for models with factorized per-class output heads such as the ASL-trained Query2Label and ResNet models used in the experiments.
  • domain assumption PatchCleanser's certification is sound: if all double-mask predictions are the true label, the double-masking inference returns the true label for any patch attack.
    Imported from prior work (Theorem 3 in Xiang et al. 2022) and relied upon in Supplementary B.3 for all per-class bounds. The present paper does not re-derive this result.
  • domain assumption The mask set M generated by PatchCleanser is R-covering, so every patch location is covered by at least one mask.
    Invoked in Definition 4 and Lemma 2 (Supplementary B); required for the mask-indexed vulnerability array to represent location-level vulnerability.
  • standard math Standard counting and set-theoretic arguments used in the proofs of Theorems 1 and 2.
    The proofs rely only on elementary reasoning about lower and upper bounds, sums, and max over patch locations.
invented entities (1)
  • Vulnerability status array lambda (Definition 3) independent evidence
    purpose: New formal construct encoding whether a single-label CDPA certifies robustness for each patch location; enables the location-aware aggregation in Algorithm 3.
    It is computable for PatchCleanser via Algorithm 5, and its validity is proven in Lemma 2. It introduces no new physical degrees of freedom, only a formal bookkeeping device.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches." pith.science (2026). https://pith.science/paper/IDHW5N2V

@misc{pith2026250524703,
  author       = {Pith},
  title        = {Pith review of: PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IDHW5N2V}},
  note         = {Machine review of arXiv:2505.24703}
}
read the original abstract

Deep learning techniques have enabled vast improvements in computer vision technologies. Nevertheless, these models are vulnerable to adversarial patch attacks which catastrophically impair performance. The physically realizable nature of these attacks calls for certifiable defenses, which feature provable guarantees on robustness. While certifiable defenses have been successfully applied to single-label classification, limited work has been done for multi-label classification. In this work, we present PatchDEMUX, a certifiably robust framework for multi-label classifiers against adversarial patches. Our approach is a generalizable method which can extend any existing certifiable defense for single-label classification; this is done by considering the multi-label classification task as a series of isolated binary classification problems to provably guarantee robustness. Furthermore, in the scenario where an attacker is limited to a single patch we propose an additional certification procedure that can provide tighter robustness bounds. Using the current state-of-the-art (SOTA) single-label certifiable defense PatchCleanser as a backbone, we find that PatchDEMUX can achieve non-trivial robustness on the MS-COCO and PASCAL VOC datasets while maintaining high clean performance

Figures

Figures reproduced from arXiv: 2505.24703 by the authors.

Figure 1
Figure 1. A diagram which illustrates the defense framework from PatchDEMUX. In the input stage, the (potentially attacked) image is preprocessed. In the demultiplexing stage, the SL-INFER inference procedure from a single-label CDPA is applied to each individual class in the multi￾classification task. This is done by considering the multi-label classifier F as a series of isolated binary classifiers F[i] for i∈{1,2,...,c}. F… view at source ↗
Figure 2
Figure 2. A diagram which illustrates the key intuition for the location-aware approach. In the sample image we assume all three objects (i.e., “dog”, “bicycle”, “people”) are false negatives. Thus, for each FN we extract the vulnerability status over all patch locations (orange means vulnerable) and accumulate them to find the most vulnerable patch location; this happens to be in the bottom left corner of the image. However,… view at source ↗
Figure 3
Figure 3. PatchDEMUX precision-recall curves with ViT architecture over the MS-COCO 2014 validation dataset. We consider the clean and certified robust evaluation settings. We assume the patch attack is at most 2% of the image area and use a computational budget of 6×6 masks. features precision-recall plots, while AP values are present in Tab. 1. Because the ViT architecture outperforms the Resnet architecture (see Supplement… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The impact of varying PatchCleanser security parameters on PatchDEMUX performance. Experiments performed on MS-COCO 2014 validation dataset. We compute clean AP for the clean setting evaluations, and certified AP for the certified robust setting evaluations. 5.1. Impac…
Figure 5
Figure 5. Figure 5: PatchDEMUX precision-recall curves with Resnet architecture over the MS-COCO 2014 validation dataset. We consider the clean and certified robust evaluation settings. We assume the patch attack is at most 2% of the image area and use a computational budget of 6×6 masks.…
Figure 6
Figure 6. Figure 6: ViT-based PatchDEMUX precision-recall curves with dif￾ferent location-aware attackers. Experiments performed on the MS￾COCO 2014 validation dataset. The baseline certified robust evaluation setting is included for comparison. We assume the patch attack is at most 2% of…
Figure 7
Figure 7. Figure 7: PatchDEMUX precision-recall curves with ViT architecture over the MS-COCO 2014 validation dataset when using different defense fine-tuning techniques. We consider each of the four evaluation settings in separate plots. We assume the patch attack is at most 2% of the im…
Figure 8
Figure 8. Figure 8: Plot of PatchDEMUX runtime as a function of mask number. We report median per-sample inference time (in milliseconds) across a random sample of 2000 datapoints from the MS-COCO 2014 validation dataset. We assume the patch attack is at most 2% of the image area. In this…
Figure 9
Figure 9. Figure 9: PatchDEMUX precision-recall curves with ViT architecture over the PASCAL VOC 2007 test dataset. We consider the clean and certified robust evaluation settings. We assume the patch attack is at most 2% of the image area and use a computational budget of 6×6 masks. in Fi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 35 canonical work pages

  1. [1]

    Krishnamurthy, M

    Abhishek Aich, Calvin-Khang Ta, Akash Gupta, Chengyu Song, Srikanth V . Krishnamurthy, M. Salman Asif, and Amit K. Roy- Chowdhury. GAMA: Generative Adversarial Multi-Object Scene Attacks. InNeurIPS 2022. arXiv, 2022. 5

    work page 2022

  2. [2]

    Salman Asif, Srikanth V

    Abhishek Aich, Shasha Li, Chengyu Song, M. Salman Asif, Srikanth V . Krishnamurthy, and Amit K. Roy-Chowdhury. Lever- aging Local Patch Differences in Multi-Object Scenes for Gen- erative Adversarial Attacks. InWACV 2023, pages 1308–1318, Waikoloa, HI, USA, 2023. IEEE. 5

    work page 2023

  3. [3]

    Asymmet- ric Loss For Multi-Label Classification

    Emanuel Ben-Baruch, Tal Ridnik, Nadav Zamir, Asaf Noy, Ita- mar Friedman, Matan Protter, and Lihi Zelnik-Manor. Asymmet- ric Loss For Multi-Label Classification. InICCV 2021. arXiv,

    work page 2021

  4. [4]

    Brown, Dandelion Man´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer

    Tom B. Brown, Dandelion Man´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial Patch. InNeurIPS 2017 W orkshops. arXiv, 2018. arXiv:1712.09665 [cs]. 1, 2

    arXiv 2017

  5. [5]

    Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

    Nicholas Carlini and David Wagner. Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods. InCCS 2017 W orkshop on Artificial Intelligence and Security (AISec 2017), pages 3–14, Dallas Texas USA, 2017. ACM. 1

    work page 2017

  6. [6]

    Certified Defenses for Adversarial Patches

    Ping-Y eh Chiang, Renkun Ni, Ahmed Abdelkader, Chen Zhu, Christoph Studer, and Tom Goldstein. Certified Defenses for Ad- versarial Patches. InICLR 2020. arXiv, 2020. arXiv:2003.06693 [cs, stat]. 1, 2, 3, 5, 8

    work page Pith review arXiv 2020

  7. [7]

    Cohen, Elan Rosenfeld, and J

    Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified Adversarial Robustness via Randomized Smoothing. InICML

    work page

  8. [8]

    Terrance DeVries and Graham W. Taylor. Improved Regular- ization of Convolutional Neural Networks with Cutout, 2017. arXiv:1708.04552 [cs]. 6, 7

    arXiv 2017

Show all 45 references
  1. [9]

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa De- hghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An Image is Worth 16x16 Words: Transformers for Image Recognition ...

    2021 arXiv

  2. [10]

    Mul- tiClass Object Classification in Video Surveillance Systems - Experimental Study

    Mohamed Elhoseiny, Amr Bakry, and Ahmed Elgammal. Mul- tiClass Object Classification in Video Surveillance Systems - Experimental Study. InCVPR 2013 W orkshops (CVPRW 2013), pages 788–793, OR, USA, 2013. IEEE. 1

    2013

  3. [11]

    Mark Everingham, Luc V an Gool, Christopher K. I. Williams, John Winn, and Andrew Zisserman. The Pascal Visual Object Classes (VOC) Challenge.International Journal of Computer V ision, 88(2):303–338, 2010. 6

    2010

  4. [12]

    Robust Physical-World Attacks on Deep Learning Visual Classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust Physical-World Attacks on Deep Learning Visual Classification. InCVPR 2018, pages 1625–1634, Salt Lake City, UT, USA, 2018. IEEE. 1, 2

    2018

  5. [13]

    Recognizing Prod- ucts: A Per-exemplar Multi-label Image Classification Approach

    Marian George and Christian Floerkemeier. Recognizing Prod- ucts: A Per-exemplar Multi-label Image Classification Approach. InECCV 2014, pages 440–455. Springer International Publishing,

    2014

  6. [14]

    On Visible Adversarial Perturbations & Digital Watermarking

    Jamie Hayes. On Visible Adversarial Perturbations & Digital Watermarking. InCVPR 2018 W orkshops (CVPRW 2018), pages 1678–16787, Salt Lake City, UT, USA, 2018. IEEE. 1

    2018

  7. [15]

    MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples

    Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong. MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples. InNeurIPS 2022. arXiv, 2022. arXiv:2210.01111 [cs]. 8

    2022 arXiv

  8. [16]

    Action-Slot: Visual Action-Centric Representations for Multi- Label Atomic Activity Recognition in Traffic Scenes

    Chi-Hsi Kung, Shu-Wei Lu, Yi-Hsuan Tsai, and YiTing Chen. Action-Slot: Visual Action-Centric Representations for Multi- Label Atomic Activity Recognition in Traffic Scenes. InCVPR 2024, pages 18451–18461, Seattle, W A, USA, 2024. IEEE. 1

    2024

  9. [17]

    (De)Randomized Smoothing for Certifiable Defense against Patch Attacks

    Alexander Levine and Soheil Feizi. (De)Randomized Smoothing for Certifiable Defense against Patch Attacks. InNeurIPS 2020. arXiv, 2021. arXiv:2002.10733 [cs, stat]. 1, 2, 3, 5, 8

    2020 arXiv

  10. [18]

    A Survey of Convolutional Neural Networks: Analysis, Appli- cations, and Prospects.IEEE Transactions on Neural Networks and Learning Systems, 33(12):6999–7019, 2022

    Zewen Li, Fan Liu, Wenjie Y ang, Shouheng Peng, and Jun Zhou. A Survey of Convolutional Neural Networks: Analysis, Appli- cations, and Prospects.IEEE Transactions on Neural Networks and Learning Systems, 33(12):6999–7019, 2022. 1

    2022

  11. [19]

    Lawrence Zitnick, and Piotr Doll ´ar

    Tsung-Yi Lin, Michael Maire, Serge Belongie, Lubomir Bour- dev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Doll ´ar. Microsoft COCO: Common Objects in Context. InECCV 2014. arXiv, 2015. arXiv:1405.0312 [cs]. 6, 7

    2014 arXiv

  12. [20]

    Query2Label: A Simple Transformer Way to Multi-Label Classi- fication, 2021

    Shilong Liu, Lei Zhang, Xiao Y ang, Hang Su, and Jun Zhu. Query2Label: A Simple Transformer Way to Multi-Label Classi- fication, 2021. arXiv:2107.10834 [cs]. 6

    2021 arXiv

  13. [21]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dim- itris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. InICLR 2018. arXiv, 2019. arXiv:1706.06083 [cs, stat]. 2

    2018 arXiv

  14. [22]

    Semantic-Aware Multi- Label Adversarial Attacks

    Hassan Mahmood and Ehsan Elhamifar. Semantic-Aware Multi- Label Adversarial Attacks. InCVPR 2024, pages 24251–24262, Seattle, W A, USA, 2024. IEEE. 5

    2024

  15. [23]

    Do- main Knowledge Alleviates Adversarial Attacks in Multi-Label Classifiers.IEEE Transactions on P attern Analysis and Machine Intelligence, 44(12):9944–9959, 2022

    Stefano Melacci, Gabriele Ciravegna, Angelo Sotgiu, Ambra Demontis, Battista Biggio, Marco Gori, and Fabio Roli. Do- main Knowledge Alleviates Adversarial Attacks in Multi-Label Classifiers.IEEE Transactions on P attern Analysis and Machine Intelligence, 44(12):9944–9959, 2022. 5

    2022

  16. [24]

    Efficient Certified Defenses Against Patch Attacks on Image Classifiers

    Jan Hendrik Metzen and Maksym Y atsura. Efficient Certified Defenses Against Patch Attacks on Image Classifiers. InICLR

  17. [25]

    Khan, and Fatih Porikli

    Muzammal Naseer, Salman H. Khan, and Fatih Porikli. Lo- cal Gradients Smoothing: Defense against localized adversarial attacks. InWACV 2019. arXiv, 2018. arXiv:1807.01216 [cs]. 1

    2019 arXiv

  18. [26]

    Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real- World Adversarial Patch Attacks

    Federico Nesti, Giulio Rossolini, Saasha Nair, Alessandro Biondi, and Giorgio Buttazzo. Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real- World Adversarial Patch Attacks. InWACV 2022. arXiv, 2021. arXiv:2108.06179 [cs]. 1, 2

    2022 arXiv

  19. [27]

    arXiv:2102.04154 [cs, stat]

    arXiv, 2021. arXiv:2102.04154 [cs, stat]. 1, 2, 3, 5, 8

    2021 arXiv

  20. [28]

    Revisiting Im- age Classifier Training for Improved Certified Robust Defense 9 against Adversarial Patches.Transactions on Machine Learning Research, 2023

    Aniruddha Saha, Shuhua Y u, Mohammad Sadegh Norouzzadeh, Wan-Yi Lin, and Chaithanya Kumar Mummadi. Revisiting Im- age Classifier Training for Improved Certified Robust Defense 9 against Adversarial Patches.Transactions on Machine Learning Research, 2023. 6, 7

    2023

  21. [29]

    Certified Patch Robustness via Smoothed Vision Transformers

    Hadi Salman, Saachi Jain, Eric Wong, and Aleksander Madry. Certified Patch Robustness via Smoothed Vision Transformers. InCVPR 2022, pages 15116–15126, New Orleans, LA, USA,

    2022

  22. [30]

    ML-Decoder: Scalable and V ersatile Classification Head

    Tal Ridnik, Gilad Sharir, Avi Ben-Cohen, Emanuel Ben-Baruch, and Asaf Noy. ML-Decoder: Scalable and V ersatile Classification Head. InWACV 2023, pages 32–41, Waikoloa, HI, USA, 2023. IEEE. 6

    2023

  23. [31]

    PatchGuard++: Efficient Prov- able Attack Detection against Adversarial Patches

    Chong Xiang and Prateek Mittal. PatchGuard++: Efficient Prov- able Attack Detection against Adversarial Patches. InICLR 2021 W orkshop on Security and Safety in Machine Learning Systems. arXiv, 2021. arXiv:2104.12609 [cs]. 1, 2, 3, 5, 8

    2021 arXiv

  24. [32]

    PatchGuard: A Provably Robust Defense against Ad- versarial Patches via Small Receptive Fields and Masking

    Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. PatchGuard: A Provably Robust Defense against Ad- versarial Patches via Small Receptive Fields and Masking. In USENIX Security 2021. arXiv, 2021. arXiv:2005.10884 [cs, stat]. 3, 8

    2021 arXiv

  25. [33]

    In- triguing properties of neural networks, 2014

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks, 2014. arXiv:1312.6199 [cs]. 1

    2014 arXiv

  26. [34]

    ObjectSeeker: Certifiably Robust Object Detec- tion against Patch Hiding Attacks via Patch-agnostic Masking

    Chong Xiang, Alexander V altchanov, Saeed Mahloujifar, and Prateek Mittal. ObjectSeeker: Certifiably Robust Object Detec- tion against Patch Hiding Attacks via Patch-agnostic Masking. InIEEE Symposium on Security and Privacy 2023. arXiv, 2022. arXiv:2202.01811 [cs]. 8

    2023 arXiv

  27. [35]

    PatchCURE: Improving Certifiable Robust- ness, Model Utility, and Computation Efficiency of Adversar- ial Patch Defenses

    Chong Xiang, Tong Wu, Sihui Dai, Jonathan Petit, Suman Jana, and Prateek Mittal. PatchCURE: Improving Certifiable Robust- ness, Model Utility, and Computation Efficiency of Adversar- ial Patch Defenses. InUSENIX Security 2024. arXiv, 2024. arXiv:2310.13076 [cs]. 1, 2, 3, 5

    2024 arXiv

  28. [36]

    Patch- Cleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier

    Chong Xiang, Saeed Mahloujifar, and Prateek Mittal. Patch- Cleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier. InUSENIX Security 2022. arXiv, 2022. arXiv:2108.09135 [cs]. 2, 3, 5, 6, 7, 8

    2022 arXiv

  29. [37]

    Grace Hua, Matthias Hein, and Jan Hendrik Metzen

    Maksym Y atsura, Kaspar Sakmann, N. Grace Hua, Matthias Hein, and Jan Hendrik Metzen. Certified Defences Against Adversarial Patch Attacks on Semantic Segmentation. InICLR 2023. arXiv,

    2023

  30. [38]

    A Review on Multi-Label Learning Algorithms.IEEE Transactions on Knowledge and Data Engineering, 26(8):1819–1837, 2014

    Min-Ling Zhang and Zhi-Hua Zhou. A Review on Multi-Label Learning Algorithms.IEEE Transactions on Knowledge and Data Engineering, 26(8):1819–1837, 2014. 2, 5, 6 10 PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches Supplementary ...

    2014

  31. [39]

    Open V ocabulary Multi-Label Classification with Dual-Modal Decoder on Aligned Visual-Textual Features, 2023

    Shichao Xu, Yikang Li, Jenhao Hsiao, Chiuman Ho, and Zhu Qi. Open V ocabulary Multi-Label Classification with Dual-Modal Decoder on Aligned Visual-Textual Features, 2023. arXiv:2208.09562 [cs]. 6

    2023 arXiv

  32. [43]

    Consider an arbitrary such classi∗ ∈{1,2,...,c}. Because the fnCertF ailsvalue for this class at patch locationropt is 0, on line10we must have forλ:=SL-CERT [F[i∗],σ](x,y[i∗],R) λ[ropt]=1 As per Definition 3, this means that we will have SL-INF ER[F[i∗],σ](ropt◦x+(1−r opt)◦x′...

  33. [44]

    disagreer

    is outlined in Algorithm 4. It works by running up to two rounds of masking on the input imagex∈X . In each round, the single-label classifierFs :X → {1,2,...,c}is queried on copies ofxwhich have been augmented by masksm∈M[33]. • First-round masking:The classifier runsFs(m◦x) ...

    2014

  34. [45]

    The former works by placing two square masks at random locations on training images, with each mask covering at most25% of the image area [8, 33]

    andGreedy Cutout[28]. The former works by placing two square masks at random locations on training images, with each mask covering at most25% of the image area [8, 33]. Xiang et al.[33]found that Random Cutout fine-tuning provides signif- icant boosts to the robustness of Patc...

    2014

  35. [2019]

    arXiv:1902.02918 [cs, stat]

    arXiv, 2019. arXiv:1902.02918 [cs, stat]. 8

    2019 arXiv

  36. [2021]

    2, 6, 4, 8

    arXiv:2009.14119 [cs]. 2, 6, 4, 8

    2009 arXiv

  37. [2023]

    arXiv:2209.05980 [cs]. 1, 2, 8

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.