用概念解释识别并压制干扰，无需知道攻击位置大小
Concept-Based Masking: A Patch-Agnostic Defense Against Adversarial Patch Attacks
- 通过概念激活向量定位干扰，不依赖攻击位置或尺寸
- 在Imagenette上干净准确率和鲁棒准确率均优于PatchCleanser
- 适合需要通用防御的部署场景，尤其对抗物理世界攻击
对抗性补丁攻击通过局部扰动对深度学习模型造成定向误分类，常在现实世界中实现。现有防御方法通常需预先知晓补丁大小或位置，限制了适用性。本文提出一种补丁无关的防御方法，利用概念解释识别并抑制最具影响力的概念激活向量，从而在不显式检测补丁的情况下消除其影响。在ResNet-50和Imagenette上的评估显示，该方法在干净准确率与鲁棒准确率上均优于当前最优的PatchCleanser，且对不同大小和位置的补丁保持强鲁棒性。结果表明，将可解释性与鲁棒性结合具有前景，概念驱动的防御是应对对抗性补丁攻击的可扩展策略。
原文摘要 · Abstract (English)
Adversarial patch attacks pose a practical threat to deep learning models by forcing targeted misclassifications through localized perturbations, often realized in the physical world. Existing defenses typically assume prior knowledge of patch size or location, limiting their applicability. In this work, we propose a patch-agnostic defense that leverages concept-based explanations to identify and suppress the most influential concept activation vectors, thereby neutralizing patch effects without explicit detection. Evaluated on Imagenette with a ResNet-50, our method achieves higher robust and clean accuracy than the state-of-the-art PatchCleanser, while maintaining strong performance across varying patch sizes and locations. Our results highlight the promise of combining interpretability with robustness and suggest concept-driven defenses as a scalable strategy for securing machine learning models against adversarial patch attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。