Concept-Based Masking
Research intern, AI4Sec Lab
An adversarial patch is a sticker you can print and put on a stop sign to make a classifier see something else. Most defenses need to know roughly how big the patch is or where it will land, which you don't get in the real world.
Our idea was to skip finding the patch. We use concept activation vectors to work out which concepts are driving the prediction, mask the ones the patch is leaning on, and let the model decide again. On ImageNette with ResNet-50 that cut misclassifications by 57.7% compared to PatchCleanser.
- 57.7% fewer misclassifications than PatchCleanser on ImageNette
- Works across patch sizes and positions with no patch detector
- NeurIPS 2025: Reliable ML from Unreliable Data
- With Ayushi Mehrotra, Dipkamal Bhusal and Prof. Nidhi Rastogi
PyTorch · ResNet-50 · Concept activation vectors