SpaNN: Detecting multiple adversarial patches on CNNs by crossing saliency thresholds

Researchers propose the detector SpaNN, which can detect multiple adversarial patches on CNNs, with computational complexity independent of the number of adversarial patches. The method applies multiple sets of saliency thresholds to the neural activations of the victim model's first convolutional layer, clusters the binarized feature maps, and feeds them into a classifier to determine attacks; it does not rely on a fixed threshold and remains robust to white-box attacks. On four commonly used object detection and image classification datasets, SpaNN leads state-of-the-art defenses by up to 11 and 27 percentage points, respectively.