# Efficient Certified Defenses Against Patch Attacks on Image Classifiers Source: [Efficient Certified Defenses Against Patch Attacks on Image Classifiers]() Collection index: [llms.txt]() Data updated: 2025-10-25T22:55:51.498Z Authors: Jan Hendrik Metzen, Maksym Yatsura Published: 2021-02-08T12:11:41.000Z ## Abstract Adversarial patches pose a realistic threat model for physical world attacks on autonomous systems via their perception component. Autonomous systems in safety-critical domains such as automated driving should thus contain a fail-safe fallback component that combines certifiable robustness against patches with efficient inference while maintaining high performance on clean inputs. We propose BagCert, a novel combination of model architecture and certification procedure that allows efficient certification. We derive a loss that enables end-to-end optimization of certified robustness against patches of different sizes and locations. On CIFAR10, BagCert certifies 10.000 examples in 43 seconds on a single GPU and obtains 86% clean and 60% certified accuracy against 5x5 patches. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Image Classification on CIFAR10 (test) (Clean & Certified Accuracy)](): Image Classification; CIFAR10 (test); Clean Accuracy: 86. - [Image Classification on ILSVRC 2012 (test) with Certified Accuracy](): Image Classification; ILSVRC 2012 (test); Clean Accuracy: 46. ## Original sources and implementation [Original paper]() [PDF]()