Title: SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches
Primary area: applications to computer vision, audio, language, and other modalities
Keywords: Adversarial Robustness, Adversarial Patches, Image Purification, Super-Resolution GANs, Computer Vision Robustness, Real-Time Inference

Abstract: As vision-based machine learning models are increasingly integrated into autonomous and cyber-physical systems, concerns about (physical) adversarial patch attacks are growing. While state-of-the-art defenses can achieve certified robustness with minimal impact on utility against highly concentrated localized patch attacks, they fall short in two important areas: (i) they are vulnerable to low-noise distributed patches, where perturbations are subtly dispersed to evade detection or masking, as shown recently by the DorPatch attack; and (ii) they are extremely time- and resource-consuming, making them impractical for latency-sensitive applications.

To address these challenges, we propose SuperPure, a defense that combines pixel-wise adversarial masking with GAN-based super-resolution. Specifically, we measure SuperPure’s robustness against three attack families—distributed, localized, and natural patches—and verify its plug-and-play effectiveness on three distinct backbones (ResNet, ViT, and EfficientNet) across multiple patch sizes. Extensive ImageNet evaluations show that SuperPure: (i) boosts robustness against localized patches by over 20% and clean accuracy by approximately 10%; (ii) achieves 59% robustness against distributed patches and 43.2% against natural patches while preserving clean utility; and (iii) runs over 10× faster than state-of-the-art defenses on a Jetson Orin Nano. Code will be released upon
acceptance.