Machine learning models today remain vulnerable to adversarial examples [11, 27, 1, 2, 9, 10, 29], where perturbed inputs lead to unexpected model outputs. Such adversarial examples take a variety of forms, including digital attacks [11, 27] and physical [9, 2, 10] attacks, where the attack can be physically-realized in the real-world in the form of printed stickers [9, 10] or 3D objects [2]. Thus, the patch attack has been of increasing interest due to its ability to practically inject an attack via the insertion of a printed physical patch into the scene. A variety of patch attacks defenses have thus been proposed, including several certified [15, 5, 33, 32, 34, 19] and empirical [35, 20, 16, 37, 28, 4] defenses, with many of these defenses designed around the operation of identifying and then removing the patch. Such defenses rely on being able to accurately identify the patch attack without false positives and remove the effects of identified patches with a variety of techniques, including blacking them out [20] or setting it to the image's mean color [35]. Our first key contribution is that we unify these types of defenses under a general framework called OODSmoother (Section 3), as shown in Figure 1.

Adversarial patch attacks mislead neural networks by injecting adversarial pixels within a local region. Patch attacks can be highly effective in a variety of tasks and physically realizable via attachment (e.g. a sticker) to the real-world objects. Despite the diversity in attack patterns, adversarial patches tend to be highly textured and different in appearance from natural images. We exploit this property and present PatchZero, a general defense pipeline against white-box adversarial patches without retraining the downstream classifier or detector. Specifically, our defense detects adversaries at the pixel-level and "zeros out" the patch region by repainting with mean pixel values. We further design a two-stage adversarial training scheme to defend against the stronger adaptive attacks. PatchZero achieves SOTA defense performance on the image classification (ImageNet, RESISC45), object detection (PASCAL VOC), and video classification (UCF101) tasks with little degradation in benign performance. In addition, PatchZero transfers to different patch shapes and attack types.