{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/patchguard-provable-defense-against","title":"PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking","arxiv_id":"2005.10884","date":"2020-05-17","proceeding":null,"authors":["Chong Xiang","Arjun Nitin Bhagoji","Vikash Sehwag","Prateek Mittal"],"abstract":"Localized adversarial patches aim to induce misclassification in machine learning models by arbitrarily modifying pixels within a restricted region of an image. Such attacks can be realized in the physical world by attaching the adversarial patch to the object to be misclassified, and defending against such attacks is an unsolved/open problem. In this paper, we propose a general defense framework called PatchGuard that can achieve high provable robustness while maintaining high clean accuracy against localized adversarial patches. The cornerstone of PatchGuard involves the use of CNNs with small receptive fields to impose a bound on the number of features corrupted by an adversarial patch. Given a bounded number of corrupted features, the problem of designing an adversarial patch defense reduces to that of designing a secure feature aggregation mechanism. Towards this end, we present our robust masking defense that robustly detects and masks corrupted features to recover the correct prediction. Notably, we can prove the robustness of our defense against any adversary within our threat model. Our extensive evaluation on ImageNet, ImageNette (a 10-class subset of ImageNet), and CIFAR-10 datasets demonstrates that our defense achieves state-of-the-art performance in terms of both provable robust accuracy and clean accuracy.","url_abs":"https://arxiv.org/abs/2005.10884v5","url_pdf":"https://arxiv.org/pdf/2005.10884v5.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"patchguard-provable-defense-against","repo_url":"https://github.com/inspire-group/PatchGuard","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"patchguard-provable-defense-against","repo_url":"https://github.com/nicksum107/thesiswork","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2005.10884","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2005.10884"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/nicksum107/thesiswork","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/inspire-group/PatchGuard","reach":null}],"summary":{"unverified":6},"by_repo_kind":{"listed":{"samples":6,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d384839c16c7bc00","entry":"bagnet17","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"nets/bagnet.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/nets/bagnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d384839c16c7bc00"}},{"code_sha256_prefix":"56a41202ec153a3a","entry":"bagnet33","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"nets/bagnet.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/nets/bagnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"56a41202ec153a3a"}},{"code_sha256_prefix":"2815f7239255f9f0","entry":"bagnet9","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"nets/bagnet.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/nets/bagnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2815f7239255f9f0"}},{"code_sha256_prefix":"a449b45fba80d282","entry":"fill","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"displayim.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/displayim.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a449b45fba80d282"}},{"code_sha256_prefix":"24f67888855f479b","entry":"scale_logits","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"displayim.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/displayim.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"24f67888855f479b"}},{"code_sha256_prefix":"a4f5d26dba8dfb80","entry":"size_convert","repo":"nicksum107/thesiswork","repo_kind":"listed","path":"eval_defense_cifar.py","file_url":"https://github.com/nicksum107/thesiswork/blob/HEAD/eval_defense_cifar.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a4f5d26dba8dfb80"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}