{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:08:28Z","timestamp":1790294908121,"version":"4.1.0"},"reference-count":77,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2025,9,15]],"date-time":"2025-09-15T00:00:00Z","timestamp":1757894400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation (NSF)","doi-asserted-by":"publisher","award":["2137753"],"award-info":[{"award-number":["2137753"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J. Imaging"],"abstract":"<jats:p>Object detection is used to automatically identify and locate specific objects within images or videos for applications like autonomous driving, security surveillance, and medical imaging. Protecting object detection models against adversarial attacks, particularly malicious patches, is crucial to ensure reliable and safe performance in safety-critical applications, where misdetections can lead to severe consequences. Existing defenses against patch attacks are primarily designed for stationary scenes and struggle against adversarial image patches that vary in scale, position, and orientation in dynamic environments.In this paper, we introduce SAR, a patch-agnostic defense scheme based on image preprocessing that does not require additional model training. By integration of the patch-agnostic detection frontend with an additional broken pixel restoration backend, Segment and Recover (SAR) is developed for the large-mask-covered object-hiding attack. Our approach breaks the limitation of the patch scale, shape, and location, accurately localizes the adversarial patch on the frontend, and restores the broken pixel on the backend. Our evaluations of the clean performance demonstrate that SAR is compatible with a variety of pretrained object detectors. Moreover, SAR exhibits notable resilience improvements over state-of-the-art methods evaluated in this paper. Our comprehensive evaluation studies involve diverse patch types, such as localized-noise, printable, visible, and adaptive adversarial patches.<\/jats:p>","DOI":"10.3390\/jimaging11090316","type":"journal-article","created":{"date-parts":[[2025,9,15]],"date-time":"2025-09-15T16:27:33Z","timestamp":1757953653000},"page":"316","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Segment and Recover: Defending Object Detectors Against Adversarial Patch Attacks"],"prefix":"10.3390","volume":"11","author":[{"given":"Haotian","family":"Gu","sequence":"first","affiliation":[{"name":"Department of Mechanical Engineering, Stevens Institute of Technology, Hoboken, NJ 07030, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8489-005X","authenticated-orcid":false,"given":"Hamidreza","family":"Jafarnejadsani","sequence":"additional","affiliation":[{"name":"Department of Mechanical Engineering, Stevens Institute of Technology, Hoboken, NJ 07030, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,9,15]]},"reference":[{"key":"ref_1","unstructured":"Liu, X., Yang, H., Liu, Z., Song, L., Li, H., and Chen, Y. (2018). Dpatch: An adversarial patch attack on object detectors. arXiv."},{"key":"ref_2","unstructured":"Song, D., Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Tramer, F., Prakash, A., and Kohno, T. (2018, January 13\u201314). Physical adversarial examples for object detectors. Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT 18), Baltimore, MD, USA."},{"key":"ref_3","unstructured":"Wu, S., Dai, T., and Xia, S. (2010). Dpattack: Diffused patch attacks against universal object detection. arXiv."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Huang, H., Wang, Y., Chen, Z., Tang, Z., Zhang, W., and Ma, K.K. (2021, January 5\u20139). Rpattack: Refined patch attack on general object detectors. Proceedings of the 2021 IEEE International Conference on Multimedia and Expo (ICME), Shenzhen, China.","DOI":"10.1109\/ICME51207.2021.9428443"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Adhikari, A., Hollander, R.d., Tolios, I., van Bekkum, M., Bal, A., Hendriks, S., Kruithof, M., Gross, D., Jansen, N., and P\u00e9rez, G. (2020). Adversarial patch camouflage against aerial detection. arXiv.","DOI":"10.1117\/12.2575907"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Lu, M., Li, Q., Chen, L., and Li, H. (2021). Scale-adaptive adversarial patch attack for remote sensing image aircraft detection. Remote Sens., 13.","DOI":"10.3390\/rs13204078"},{"key":"ref_7","unstructured":"Zhao, Y., Yan, H., and Wei, X. (2020). Object hider: Adversarial patch attack against object detectors. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Chen, S.T., Cornelius, C., Martin, J., and Chau, D.H. (2019). Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. Machine Learning and Knowledge Discovery in Databases, Proceedings of the European Conference, ECML PKDD 2018, Dublin, Ireland, 10\u201314 September 2018, Springer. Proceedings, Part I 18.","DOI":"10.1007\/978-3-030-10925-7_4"},{"key":"ref_9","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., and Gilmer, J. (2017). Adversarial patch. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Evtimov, I., Eykholt, K., Fernandes, E., Kohno, T., Li, B., Prakash, A., Rahmati, A., and Song, D. (2017). Robust physical-world attacks on machine learning models. arXiv.","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref_11","unstructured":"Karmon, D., Zoran, D., and Goldberg, Y. (2018, January 10\u201315). Lavan: Localized and visible adversarial noise. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Chindaudom, A., Siritanawan, P., Sumongkayothin, K., and Kotani, K. (2020, January 26\u201329). AdversarialQR: An adversarial patch in QR code format. Proceedings of the Joint 9th International Conference on Informatics, Electronics & Vision (ICIEV) and 4th International Conference on Imaging, Vision & Pattern Recognition (icIVPR), Kitakyushu, Japan.","DOI":"10.1109\/ICIEVicIVPR48672.2020.9306675"},{"key":"ref_13","unstructured":"Liu, A., Liu, X., Fan, J., Ma, Y., Zhang, A., Xie, H., and Tao, D. (February, January 27). Perceptual-sensitive gan for generating adversarial patches. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1007\/s00138-021-01194-6","article-title":"A data independent approach to generate adversarial patches","volume":"32","author":"Zhou","year":"2021","journal-title":"Mach. Vis. Appl."},{"key":"ref_15","unstructured":"Li, J., Schmidt, F., and Kolter, Z. (2019, January 9\u201315). Adversarial camera stickers: A physical camera-based attack on deep learning systems. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA."},{"key":"ref_16","unstructured":"Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018, January 10\u201315). Synthesizing robust adversarial examples. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Hayes, J. (2018, January 18\u201322). On visible adversarial perturbations & digital watermarking. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, Salt Lake City, UT, USA.","DOI":"10.1109\/CVPRW.2018.00210"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Chou, E., Tramer, F., and Pellegrino, G. (2020, January 21). Sentinet: Detecting localized universal attacks against deep learning systems. Proceedings of the IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Liu, J., Levine, A., Lau, C.P., Chellappa, R., and Feizi, S. (2022, January 21\u201324). Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.01455"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Jing, L., Wang, R., Ren, W., Dong, X., and Zou, C. (2024, January 17\u201321). Pad: Patch-agnostic defense against adversarial patch attacks. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.","DOI":"10.1109\/CVPR52733.2024.02310"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Xu, K., Xiao, Y., Zheng, Z., Cai, K., and Nevatia, R. (2023, January 2\u20137). Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch. Proceedings of the IEEE\/CVF Winter Conference on Applications of Computer Vision, Waikoloa, HI, USA.","DOI":"10.1109\/WACV56688.2023.00461"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Xiang, C., Valtchanov, A., Mahloujifar, S., and Mittal, P. (2023, January 22\u201325). Objectseeker: Certifiably robust object detection against patch hiding attacks via patch-agnostic masking. Proceedings of the IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46215.2023.10179319"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"McCoyd, M., Park, W., Chen, S., Shah, N., Roggenkemper, R., Hwang, M., Liu, J.X., and Wagner, D. (2020, January 22\u201325). Minority reports defense: Defending against adversarial patches. Proceedings of the International Conference on Applied Cryptography and Network Security, Rome, Italy.","DOI":"10.1007\/978-3-030-61638-0_31"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Naseer, M., Khan, S., and Porikli, F. (2019, January 7\u201311). Local gradients smoothing: Defense against localized adversarial attacks. Proceedings of the 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), Waikoloa Village, HI, USA.","DOI":"10.1109\/WACV.2019.00143"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Chen, Z., Dash, P., and Pattabiraman, K. (2023, January 5\u20139). Jujutsu: A two-stage defense against adversarial patch attacks on deep neural networks. Proceedings of the ACM Asia Conference on Computer and Communications Security, Melbourne, Australia.","DOI":"10.1145\/3579856.3582816"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Chattopadhyay, N., Guesmi, A., and Shafique, M. (2024, January 27\u201330). Anomaly unveiled: Securing image classification against adversarial patch attacks. Proceedings of the IEEE International Conference on Image Processing (ICIP), Abu Dhabi, United Arab Emirates.","DOI":"10.1109\/ICIP51287.2024.10648223"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Bunzel, N., Frick, R.A., Klause, G., Schwarte, A., and Honermann, J. (2024, January 2). Signals Are All You Need: Detecting and Mitigating Digital and Real-World Adversarial Patches Using Signal-Based Features. Proceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems, Singapore.","DOI":"10.1145\/3665451.3665530"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Tarchoun, B., Ben Khalifa, A., Mahjoub, M.A., Abu-Ghazaleh, N., and Alouani, I. (2023, January 17\u201324). Jedi: Entropy-based localization and removal of adversarial patches. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.00398"},{"key":"ref_29","unstructured":"Chen, J., and Wei, X. (2023). Defending Adversarial Patches via Joint Region Localizing and Inpainting. arXiv."},{"key":"ref_30","unstructured":"Huang, Y., and Li, Y. (2021). Zero-shot certified defense against adversarial patches with vision transformers. arXiv."},{"key":"ref_31","unstructured":"Metzen, J.H., and Yatsura, M. (2021). Efficient certified defenses against patch attacks on image classifiers. arXiv."},{"key":"ref_32","unstructured":"Brendel, W., and Bethge, M. (2019). Approximating cnns with bag-of-local-features models works surprisingly well on imagenet. arXiv."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Yuan, B., McCoyd, M., and Wagner, D. (2020, January 21). Clipped bagnet: Defending against sticker attacks with clipped bag-of-features. Proceedings of the 2020 IEEE Security and Privacy Workshops (SPW), Francisco, CA, USA.","DOI":"10.1109\/SPW50608.2020.00026"},{"key":"ref_34","unstructured":"Xiang, C., Bhagoji, A.N., Sehwag, V., and Mittal, P. (2021, January 11\u201313). {PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Vancouver, BC, Canada."},{"key":"ref_35","unstructured":"Xiang, C., and Mittal, P. (2021). Patchguard++: Efficient provable attack detection against adversarial patches. arXiv."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Xiang, C., and Mittal, P. (2021, January 15\u201319). Detectorguard: Provably securing object detectors against localized patch hiding attacks. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual.","DOI":"10.1145\/3460120.3484757"},{"key":"ref_37","first-page":"6465","article-title":"(De) randomized smoothing for certifiable defense against patch attacks","volume":"33","author":"Levine","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. (2019, January 23). Certified robustness to adversarial examples with differential privacy. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2019.00044"},{"key":"ref_39","unstructured":"Lin, W.Y., Sheikholeslami, F., Shi, J., Rice, L., and Kolter, J.Z. (2021, January 5). Certified robustness against physically-realizable patch attack via randomized cropping. Proceedings of the ICLR 2021 Conference Blind Submission, Virtual."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Redmon, J., Divvala, S., Girshick, R., and Farhadi, A. (2016, January 27\u201330). You only look once: Unified, real-time object detection. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"1137","DOI":"10.1109\/TPAMI.2016.2577031","article-title":"Faster R-CNN: Towards real-time object detection with region proposal networks","volume":"39","author":"Ren","year":"2016","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Carion, N., Massa, F., Synnaeve, G., Usunier, N., Kirillov, A., and Zagoruyko, S. (2020, January 23\u201328). End-to-end object detection with transformers. Proceedings of the European Conference on Computer Vision, Glasgow, UK.","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., and Wojna, Z. (2016, January 27\u201330). Rethinking the inception architecture for computer vision. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Chollet, F. (2017, January 21\u201326). Xception: Deep learning with depthwise separable convolutions. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.195"},{"key":"ref_46","unstructured":"Simonyan, K., and Zisserman, A. (2014). Very deep convolutional networks for large-scale image recognition. arXiv."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Thys, S., Van Ranst, W., and Goedem\u00e9, T. (2019, January 16\u201320). Fooling automated surveillance cameras: Adversarial patches to attack person detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition Workshops, Long Beach, CA, USA.","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Shrestha, S., Pathak, S., and Viegas, E.K. (2023, January 1\u20135). Towards a robust adversarial patch attack against unmanned aerial vehicles object detection. Proceedings of the 2023 IEEE\/RSJ International Conference on Intelligent Robots and Systems (IROS), Detroit, MI, USA.","DOI":"10.1109\/IROS55552.2023.10342460"},{"key":"ref_49","unstructured":"Saha, A., Subramanya, A., Patil, K., and Pirsiavash, H. (2019). Adversarial patches exploiting contextual reasoning in object detection. arXiv."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Zolfi, A., Kravchik, M., Elovici, Y., and Shabtai, A. (2021, January 20\u201325). The translucent patch: A physical and universal attack on object detectors. Proceedings of the IEEE\/CVF Conference On Computer Vision and Pattern Recognition, Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.01498"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Rao, S., Stutz, D., and Schiele, B. (2020, January 23\u201328). Adversarial training against location-optimized adversarial patches. Proceedings of the European Conference on Computer Vision, Glasgow, UK.","DOI":"10.1007\/978-3-030-68238-5_32"},{"key":"ref_52","unstructured":"Papernot, N., McDaniel, P., Sinha, A., and Wellman, M. (2016). Towards the science of security and privacy in machine learning. arXiv."},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Zhao, H., Shi, J., Qi, X., Wang, X., and Jia, J. (2017, January 21\u201326). Pyramid scene parsing network. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.660"},{"key":"ref_54","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Girshick, R. (2015, January 7\u201313). Fast R-CNN. Proceedings of the IEEE International Conference on Computer Vision, Santiago, Chile.","DOI":"10.1109\/ICCV.2015.169"},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"142","DOI":"10.1109\/TPAMI.2015.2437384","article-title":"Region-based convolutional networks for accurate object detection and segmentation","volume":"38","author":"Girshick","year":"2015","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_57","doi-asserted-by":"crossref","first-page":"1904","DOI":"10.1109\/TPAMI.2015.2389824","article-title":"Spatial pyramid pooling in deep convolutional networks for visual recognition","volume":"37","author":"He","year":"2015","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_58","first-page":"379","article-title":"R-fcn: Object detection via region-based fully convolutional networks","volume":"29","author":"Dai","year":"2016","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"He, K., Gkioxari, G., Doll\u00e1r, P., and Girshick, R. (2017, January 22\u201329). Mask r-cnn. Proceedings of the IEEE International Conference on Computer Vision, Venice, Italy.","DOI":"10.1109\/ICCV.2017.322"},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Li, H., Zhang, S., Li, X., Su, L., Huang, H., Jin, D., Chen, L., Huang, J., and Yoo, J. (2021, January 2\u20135). Detectornet: Transformer-enhanced spatial temporal graph neural network for traffic prediction. Proceedings of the 29th International Conference on Advances in Geographic Information Systems, Beijing, China.","DOI":"10.1145\/3474717.3483920"},{"key":"ref_61","unstructured":"Sermanet, P., Eigen, D., Zhang, X., Mathieu, M., Fergus, R., and LeCun, Y. (2013). Overfeat: Integrated recognition, localization and detection using convolutional networks. arXiv."},{"key":"ref_62","doi-asserted-by":"crossref","unstructured":"Barbier, J., Filiol, \u00c9., and Mayoura, K. (2006, January 8\u201310). Universal JPEG steganalysis in the compressed frequency domain. Proceedings of the International Workshop on Digital Watermarking, Jeju Island, Republic of Korea.","DOI":"10.1007\/11922841_21"},{"key":"ref_63","unstructured":"Zhao, X., Ding, W., An, Y., Du, Y., Yu, T., Li, M., Tang, M., and Wang, J. (2023). Fast segment anything. arXiv."},{"key":"ref_64","unstructured":"Zhu, M. (2004). Recall, Precision and Average Precision, Department of Statistics and Actuarial Science, University of Waterloo."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"127","DOI":"10.4103\/0972-6748.62274","article-title":"Hypothesis testing, type I and type II errors","volume":"18","author":"Banerjee","year":"2009","journal-title":"Ind. Psychiatry J."},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Oksuz, K., Cam, B.C., Akbas, E., and Kalkan, S. (2018, January 8\u201314). Localization recall precision (LRP): A new performance metric for object detection. Proceedings of the European Conference on Computer Vision (ECCV), Munich, Germany.","DOI":"10.1007\/978-3-030-01234-2_31"},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"7380","DOI":"10.1109\/TPAMI.2021.3119563","article-title":"Detection and tracking meet drones challenge","volume":"44","author":"Zhu","year":"2021","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_68","doi-asserted-by":"crossref","unstructured":"Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Doll\u00e1r, P., and Zitnick, C.L. (2014). Microsoft coco: Common objects in context. Computer Vision\u2013ECCV 2014, Proceedings of the 13th European Conference, Zurich, Switzerland, 6\u201312 September 2014, Springer. Proceedings, Part v 13.","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref_69","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1007\/s11263-009-0275-4","article-title":"The pascal visual object classes (voc) challenge","volume":"88","author":"Everingham","year":"2010","journal-title":"Int. J. Comput. Vis."},{"key":"ref_70","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","article-title":"Imagenet large scale visual recognition challenge","volume":"115","author":"Russakovsky","year":"2015","journal-title":"Int. J. Comput. Vis."},{"key":"ref_71","unstructured":"Dalal, N., and Triggs, B. (2005, January 20\u201326). Histograms of oriented gradients for human detection. Proceedings of the 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR\u201905), San Diego, CA, USA."},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Shah, S., Dey, D., Lovett, C., and Kapoor, A. (2017). Airsim: High-fidelity visual and physical simulation for autonomous vehicles. Field and Service Robotics: Results of the 11th International Conference, Springer.","DOI":"10.1007\/978-3-319-67361-5_40"},{"key":"ref_73","unstructured":"Lee, M., and Kolter, Z. (2019). On physical adversarial patches for object detection. arXiv."},{"key":"ref_74","unstructured":"Hoory, S., Shapira, T., Shabtai, A., and Elovici, Y. (2020). Dynamic adversarial patch for evading object detection models. arXiv."},{"key":"ref_75","doi-asserted-by":"crossref","first-page":"459","DOI":"10.1016\/j.ins.2020.08.087","article-title":"Towards a physical-world adversarial patch for blinding object detection models","volume":"556","author":"Wang","year":"2021","journal-title":"Inf. Sci."},{"key":"ref_76","unstructured":"Shack, J., Petrovic, K., and Saukh, O. (2024). Breaking the Illusion: Real-world Challenges for Adversarial Patches in Object Detection. arXiv."},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"Hu, Y.C.T., Kung, B.H., Tan, D.S., Chen, J.C., Hua, K.L., and Cheng, W.H. (2021, January 11\u201317). Naturalistic physical adversarial patch for object detectors. Proceedings of the IEEE\/CVF International Conference on Computer Vision, Montreal, BC, Canada.","DOI":"10.1109\/ICCV48922.2021.00775"}],"container-title":["Journal of Imaging"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/9\/316\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:46:03Z","timestamp":1760035563000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2313-433X\/11\/9\/316"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,15]]},"references-count":77,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["jimaging11090316"],"URL":"https:\/\/doi.org\/10.3390\/jimaging11090316","relation":{},"ISSN":["2313-433X"],"issn-type":[{"value":"2313-433X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,15]]}}}