PatchBlock: A Lightweight Defense Against Adversarial Patches for Embedded EdgeAI Devices

TL;DR

PatchBlock addresses patch-based adversarial threats in EdgeAI by introducing a CPU-side pre-processing stage that sits between sensors and downstream models. It combines chunking, a targeted-cut isolation forest, and dimensionality reduction (SVD) to localize and neutralize adversarial patches without retraining, preserving throughput by overlapping with GPU inference. The method is model- and patch-agnostic and demonstrates up to 77.9% robust accuracy across architectures and devices, while outperforming several defenses in efficiency. This work offers a practical, portable solution for on-device robustness in resource-constrained edge environments, with detailed analyses of MI-based detection, runtime optimization, and hyper-parameter choices.

Abstract

Adversarial attacks pose a significant challenge to the reliable deployment of machine learning models in EdgeAI applications, such as autonomous driving and surveillance, which rely on resource-constrained devices for real-time inference. Among these, patch-based adversarial attacks, where small malicious patches (e.g., stickers) are applied to objects, can deceive neural networks into making incorrect predictions with potentially severe consequences. In this paper, we present PatchBlock, a lightweight framework designed to detect and neutralize adversarial patches in images. Leveraging outlier detection and dimensionality reduction, PatchBlock identifies regions affected by adversarial noise and suppresses their impact. It operates as a pre-processing module at the sensor level, efficiently running on CPUs in parallel with GPU inference, thus preserving system throughput while avoiding additional GPU overhead. The framework follows a three-stage pipeline: splitting the input into chunks (Chunking), detecting anomalous regions via a redesigned isolation forest with targeted cuts for faster convergence (Separating), and applying dimensionality reduction on the identified outliers (Mitigating). PatchBlock is both model- and patch-agnostic, can be retrofitted to existing pipelines, and integrates seamlessly between sensor inputs and downstream models. Evaluations across multiple neural architectures, benchmark datasets, attack types, and diverse edge devices demonstrate that PatchBlock consistently improves robustness, recovering up to 77% of model accuracy under strong patch attacks such as the Google Adversarial Patch, while maintaining high portability and minimal clean accuracy loss. Additionally, PatchBlock outperforms the state-of-the-art defenses in efficiency, in terms of computation time and energy consumption per sample, making it suitable for EdgeAI applications.

Figures (5)

• Figure 1: PatchBlock in action: detecting and mitigating adversarial patches in real time. Example shows object detection on YOLOv4 yolov4 under AdvYOLO thys2019 attack on INRIA dataset inria.
• Figure 2: Key insight behind PatchBlock: adversarial patches exhibit distinct statistical distributions, captured via localized Mutual Information analysis.
• Figure 3: Overview of the PatchBlock defense pipeline, deployed between sensor inputs and downstream inference engines in embedded EdgeAI devices.
• Figure 4: PatchBlock Pipeline: The three processes of Chunking (using moving window to obtain kernels, converted to vectors), Separating (using Mutual Information and Fast Isolation Forests with targeted cuts by gradient splitting) and Mitigating (using Singular Value Decomposition).
• Figure 5: PatchBlock performance across Image Classification and Person Detection tasks under adversarial patch attacks. Results show clean accuracy, adversarial accuracy (with GAP or AdvYOLO patches), and robust accuracy obtained after applying PatchBlock as a pre-processing defense. PatchBlock consistently restores accuracy across models, datasets, and devices, demonstrating its portability and effectiveness.