{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,22]],"date-time":"2025-10-22T10:47:46Z","timestamp":1761130066797,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":58,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,4,24]],"date-time":"2023-04-24T00:00:00Z","timestamp":1682294400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,4,26]]},"DOI":"10.1145\/3579988.3585054","type":"proceedings-article","created":{"date-parts":[[2023,4,13]],"date-time":"2023-04-13T22:05:32Z","timestamp":1681423532000},"page":"23-32","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Vulnerability of CNNs against Multi-Patch Attacks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4592-2928","authenticated-orcid":false,"given":"Abhijith","family":"Sharma","sequence":"first","affiliation":[{"name":"University of British Columbia, Kelowna, BC, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5926-7100","authenticated-orcid":false,"given":"Yijun","family":"Bian","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China, Hefei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5255-4724","authenticated-orcid":false,"given":"Vatsal","family":"Nanda","sequence":"additional","affiliation":[{"name":"Thapar Institute of Engineering and Technology, Patiala, India"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1219-2480","authenticated-orcid":false,"given":"Phil","family":"Munz","sequence":"additional","affiliation":[{"name":"TrojAI Inc., Saint John, NB, Canada"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7203-8698","authenticated-orcid":false,"given":"Apurva","family":"Narayan","sequence":"additional","affiliation":[{"name":"Western University, London, ON, Canada"}]}],"member":"320","published-online":{"date-parts":[[2023,4,24]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"International conference on machine learning. PMLR, 284--293","author":"Athalye Anish","year":"2018","unstructured":"Anish Athalye , Logan Engstrom , Andrew Ilyas , and Kevin Kwok . 2018 . Synthesizing robust adversarial examples . In International conference on machine learning. PMLR, 284--293 . Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. 2018. Synthesizing robust adversarial examples. In International conference on machine learning. PMLR, 284--293."},{"key":"e_1_3_2_1_2_1","unstructured":"Tom B Brown Dandelion Man\u00e9 Aurko Roy Mart\u00edn Abadi and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665.  Tom B Brown Dandelion Man\u00e9 Aurko Roy Mart\u00edn Abadi and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665."},{"volume-title":"Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp)","author":"Carlini Nicholas","key":"e_1_3_2_1_3_1","unstructured":"Nicholas Carlini and David Wagner . 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) . IEEE , 39--57. Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). IEEE, 39--57."},{"key":"e_1_3_2_1_4_1","unstructured":"Zitao Chen Pritam Dash and Karthik Pattabiraman. 2021. Turning your strength against you: detecting and mitigating robust and universal adversarial patch attack. arXiv preprint arXiv:2108.05075.  Zitao Chen Pritam Dash and Karthik Pattabiraman. 2021. Turning your strength against you: detecting and mitigating robust and universal adversarial patch attack. arXiv preprint arXiv:2108.05075."},{"key":"e_1_3_2_1_5_1","unstructured":"Ping-yeh Chiang Renkun Ni Ahmed Abdelkader Chen Zhu Christoph Studer and Tom Goldstein. 2020. Certified defenses for adversarial patches. arXiv preprint arXiv:2003.06693.  Ping-yeh Chiang Renkun Ni Ahmed Abdelkader Chen Zhu Christoph Studer and Tom Goldstein. 2020. Certified defenses for adversarial patches. arXiv preprint arXiv:2003.06693."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIEVicIVPR48672.2020.9306675"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Richard den Hollander etal 2020. Adversarial patch camouflage against aerial detection. In Artificial Intelligence and Machine Learning in Defense Applications II. Vol. 11543. International Society for Optics and Photonics 115430F.  Richard den Hollander et al. 2020. Adversarial patch camouflage against aerial detection. In Artificial Intelligence and Machine Learning in Defense Applications II. Vol. 11543. International Society for Optics and Photonics 115430F.","DOI":"10.1117\/12.2575907"},{"key":"e_1_3_2_1_9_1","volume-title":"Proceedings of the IEEE conference on computer vision and pattern recognition, 1625--1634","author":"Eykholt Kevin","year":"2018","unstructured":"Kevin Eykholt , Ivan Evtimov , Earlence Fernandes , Bo Li , Amir Rahmati , Chaowei Xiao , Atul Prakash , Tadayoshi Kohno , and Dawn Song . 2018 . Robust physicalworld attacks on deep learning visual classification . In Proceedings of the IEEE conference on computer vision and pattern recognition, 1625--1634 . Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physicalworld attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, 1625--1634."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-017-9189-6"},{"key":"e_1_3_2_1_11_1","unstructured":"Thomas Gittings Steve Schneider and John Collomosse. 2019. Robust synthesis of adversarial visual examples using a deep image prior. arXiv preprint arXiv:1907.01996.  Thomas Gittings Steve Schneider and John Collomosse. 2019. Robust synthesis of adversarial visual examples using a deep image prior. arXiv preprint arXiv:1907.01996."},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of the Asian Conference on Computer Vision.","author":"Gittings Thomas","year":"2020","unstructured":"Thomas Gittings , Steve Schneider , and John Collomosse . 2020 . Vax-a-net: training-time defence against adversarial patch attacks . In Proceedings of the Asian Conference on Computer Vision. Thomas Gittings, Steve Schneider, and John Collomosse. 2020. Vax-a-net: training-time defence against adversarial patch attacks. In Proceedings of the Asian Conference on Computer Vision."},{"key":"e_1_3_2_1_13_1","unstructured":"Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572.  Ian J Goodfellow Jonathon Shlens and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00210"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSTARS.2019.2918242"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/IGARSS.2018.8519248"},{"key":"e_1_3_2_1_18_1","unstructured":"Andrew G Howard Menglong Zhu Bo Chen Dmitry Kalenichenko Weijun Wang TobiasWeyand Marco Andreetto and Hartwig Adam. 2017. Mobilenets: efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861.  Andrew G Howard Menglong Zhu Bo Chen Dmitry Kalenichenko Weijun Wang TobiasWeyand Marco Andreetto and Hartwig Adam. 2017. Mobilenets: efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICME51207.2021.9428443"},{"key":"e_1_3_2_1_20_1","unstructured":"Yuheng Huang and Yuanchun Li. 2021. Zero-shot certified defense against adversarial patches with vision transformers. arXiv preprint arXiv:2111.10481.  Yuheng Huang and Yuanchun Li. 2021. Zero-shot certified defense against adversarial patches with vision transformers. arXiv preprint arXiv:2111.10481."},{"key":"e_1_3_2_1_21_1","volume-title":"International Conference on Machine Learning. PMLR, 2507--2515","author":"Karmon Danny","year":"2018","unstructured":"Danny Karmon , Daniel Zoran , and Yoav Goldberg . 2018 . Lavan: localized and visible adversarial noise . In International Conference on Machine Learning. PMLR, 2507--2515 . Danny Karmon, Daniel Zoran, and Yoav Goldberg. 2018. Lavan: localized and visible adversarial noise. In International Conference on Machine Learning. PMLR, 2507--2515."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Asifullah Khan Anabia Sohail Umme Zahoora and Aqsa Saeed Qureshi. 2020. A survey of the recent architectures of deep convolutional neural networks. Artificial intelligence review 53 8 5455--5516.  Asifullah Khan Anabia Sohail Umme Zahoora and Aqsa Saeed Qureshi. 2020. A survey of the recent architectures of deep convolutional neural networks. Artificial intelligence review 53 8 5455--5516.","DOI":"10.1007\/s10462-020-09825-6"},{"key":"e_1_3_2_1_23_1","unstructured":"Alex Krizhevsky Geoffrey Hinton etal 2009. Learning multiple layers of features from tiny images.  Alex Krizhevsky Geoffrey Hinton et al. 2009. Learning multiple layers of features from tiny images."},{"key":"e_1_3_2_1_24_1","unstructured":"Alex Krizhevsky Ilya Sutskever and Geoffrey E Hinton. 2012. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems 25.  Alex Krizhevsky Ilya Sutskever and Geoffrey E Hinton. 2012. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems 25."},{"key":"e_1_3_2_1_25_1","unstructured":"Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533.  Alexey Kurakin Ian Goodfellow and Samy Bengio. 2016. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2020.3023430"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"e_1_3_2_1_29_1","unstructured":"Xin Liu Huanrui Yang Ziwei Liu Linghao Song Hai Li and Yiran Chen. 2018. Dpatch: an adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299.  Xin Liu Huanrui Yang Ziwei Liu Linghao Song Hai Li and Yiran Chen. 2018. Dpatch: an adversarial patch attack on object detectors. arXiv preprint arXiv:1806.02299."},{"key":"e_1_3_2_1_30_1","unstructured":"Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770.  Yanpei Liu Xinyun Chen Chang Liu and Dawn Song. 2016. Delving into transferable adversarial examples and black-box attacks. arXiv preprint arXiv:1611.02770."},{"key":"e_1_3_2_1_31_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.  Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-61638-0_31"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2019.00143"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00288"},{"key":"e_1_3_2_1_35_1","volume-title":"Lenka Krpalkova, Daniel Riordan, and Joseph Walsh.","author":"O'Mahony Niall","year":"2019","unstructured":"Niall O'Mahony , Sean Campbell , Anderson Carvalho , Suman Harapanahalli , Gustavo Velasco Hernandez , Lenka Krpalkova, Daniel Riordan, and Joseph Walsh. 2019 . Deep learning vs. traditional computer vision. In Science and information conference. Springer , 128--144. Niall O'Mahony, Sean Campbell, Anderson Carvalho, Suman Harapanahalli, Gustavo Velasco Hernandez, Lenka Krpalkova, Daniel Riordan, and Joseph Walsh. 2019. Deep learning vs. traditional computer vision. In Science and information conference. Springer, 128--144."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00249"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-68238-5_32"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Waseem Rawat and Zenghui Wang. 2017. Deep convolutional neural networks for image classification: a comprehensive review. Neural computation 29 9 2352--2449.  Waseem Rawat and Zenghui Wang. 2017. Deep convolutional neural networks for image classification: a comprehensive review. Neural computation 29 9 2352--2449.","DOI":"10.1162\/neco_a_00990"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Olga Russakovsky et al. 2015. Imagenet large scale visual recognition challenge. International journal of computer vision 115 3 211--252.  Olga Russakovsky et al. 2015. Imagenet large scale visual recognition challenge. International journal of computer vision 115 3 211--252.","DOI":"10.1007\/s11263-015-0816-y"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Hadi Salman Saachi Jain Eric Wong and Aleksander Mdry. 2021. Certified patch robustness via smoothed vision transformers. arXiv preprint arXiv:2110.07719.  Hadi Salman Saachi Jain Eric Wong and Aleksander Mdry. 2021. Certified patch robustness via smoothed vision transformers. arXiv preprint arXiv:2110.07719.","DOI":"10.1109\/CVPR52688.2022.01471"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"crossref","unstructured":"Abhijith Sharma Yijun Bian Phil Munz and Apurva Narayan. 2022. Adversarial patch attacks and defences in vision-based tasks: a survey. arXiv preprint arXiv:2206.08304.  Abhijith Sharma Yijun Bian Phil Munz and Apurva Narayan. 2022. Adversarial patch attacks and defences in vision-based tasks: a survey. arXiv preprint arXiv:2206.08304.","DOI":"10.36227\/techrxiv.20085902.v1"},{"key":"e_1_3_2_1_44_1","unstructured":"Karen Simonyan Andrea Vedaldi and Andrew Zisserman. 2013. Deep inside convolutional networks: visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034.  Karen Simonyan Andrea Vedaldi and Andrew Zisserman. 2013. Deep inside convolutional networks: visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034."},{"key":"e_1_3_2_1_45_1","unstructured":"Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199.  Christian Szegedy Wojciech Zaremba Ilya Sutskever Joan Bruna Dumitru Erhan Ian Goodfellow and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"e_1_3_2_1_47_1","volume-title":"Deep learning for computer vision: a brief review. Computational intelligence and neuroscience","author":"Voulodimos Athanasios","year":"2018","unstructured":"Athanasios Voulodimos , Nikolaos Doulamis , Anastasios Doulamis , and Eftychios Protopapadakis . 2018. Deep learning for computer vision: a brief review. Computational intelligence and neuroscience , 2018 . Athanasios Voulodimos, Nikolaos Doulamis, Anastasios Doulamis, and Eftychios Protopapadakis. 2018. Deep learning for computer vision: a brief review. Computational intelligence and neuroscience, 2018."},{"key":"e_1_3_2_1_48_1","volume-title":"USENIX Security Symposium, 2237--2254","author":"Xiang Chong","year":"2021","unstructured":"Chong Xiang , Arjun Nitin Bhagoji , Vikash Sehwag , and Prateek Mittal . 2021 . Patchguard: a provably robust defense against adversarial patches via small receptive fields and masking . In USENIX Security Symposium, 2237--2254 . Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. 2021. Patchguard: a provably robust defense against adversarial patches via small receptive fields and masking. In USENIX Security Symposium, 2237--2254."},{"key":"e_1_3_2_1_49_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Xiang Chong","year":"2022","unstructured":"Chong Xiang , Saeed Mahloujifar , and Prateek Mittal . 2022 . {Patchcleanser}: certifiably robust defense against adversarial patches for any image classifier . In 31st USENIX Security Symposium (USENIX Security 22) , 2065--2082. Chong Xiang, Saeed Mahloujifar, and Prateek Mittal. 2022. {Patchcleanser}: certifiably robust defense against adversarial patches for any image classifier. In 31st USENIX Security Symposium (USENIX Security 22), 2065--2082."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484757"},{"key":"e_1_3_2_1_51_1","unstructured":"Chong Xiang and Prateek Mittal. 2021. Patchguard: efficient provable attack detection against adversarial patches. arXiv preprint arXiv:2104.12609.  Chong Xiang and Prateek Mittal. 2021. Patchguard: efficient provable attack detection against adversarial patches. arXiv preprint arXiv:2104.12609."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3027372"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/JAS.2021.1004261"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11431-020-1582-8"},{"key":"e_1_3_2_1_55_1","unstructured":"Guoping Zhao Mingyu Zhang Jiajun Liu Yaxian Li and Ji-Rong Wen. 2020. Ap-gan: adversarial patch attack on content-based image retrieval systems. GeoInformatica 1--31.  Guoping Zhao Mingyu Zhang Jiajun Liu Yaxian Li and Ji-Rong Wen. 2020. Ap-gan: adversarial patch attack on content-based image retrieval systems. GeoInformatica 1--31."},{"volume-title":"A review of object detection based on convolutional neural network. In 2017 36th Chinese control conference (CCC)","author":"Zhiqiang Wang","key":"e_1_3_2_1_56_1","unstructured":"Wang Zhiqiang and Liu Jun . 2017. A review of object detection based on convolutional neural network. In 2017 36th Chinese control conference (CCC) . IEEE , 11104--11109. Wang Zhiqiang and Liu Jun. 2017. A review of object detection based on convolutional neural network. In 2017 36th Chinese control conference (CCC). IEEE, 11104--11109."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/3339308"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00138-021-01194-6"}],"event":{"name":"CODASPY '23: Thirteenth ACM Conference on Data and Application Security and Privacy","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Charlotte NC USA","acronym":"CODASPY '23"},"container-title":["Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3579988.3585054","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3579988.3585054","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T18:08:18Z","timestamp":1750183698000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3579988.3585054"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,24]]},"references-count":58,"alternative-id":["10.1145\/3579988.3585054","10.1145\/3579988"],"URL":"https:\/\/doi.org\/10.1145\/3579988.3585054","relation":{},"subject":[],"published":{"date-parts":[[2023,4,24]]},"assertion":[{"value":"2023-04-24","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}