Adversarial patch training uses location-optimized adversarial patches during training to obtain robustness against adversarial patches at various locations within the image. For location-optimization various random and greedy heuristics are used. As result, adversarial patch training allows to obtain considerable robustness while not sacrificing accuracy.

The code for adversarial patch training is now available on GitHub:

The corresponding paper is available on ArXiv; also check out the project page maintained by Sukrut Rao:

@article{Rao2020ARXIV,
    author    = {Sukrut Rao and David Stutz and Bernt Schiele},
    title     = {Adversarial Training against Location-Optimized Adversarial Patches},
    journal   = {CoRR},
    volume    = {abs/1910.06259},
    year      = {2019}
}