Do Adversarial Patches Survive Real-World Image Degradations? A Large-Scale ImageNet Study

Computer vision systems are increasingly deployed in fully autonomous settings, making the real-world application of adversarial patches highly relevant. Previous research has focused on the effect of real-world image degradations on computer vision systems and the efficacy of adversarial patches; however, it remains unclear to what extent an adversarial patch can maintain its efficacy under real-world image degradations. This study investigates adversarial patch performance under real-world image degradations in a large-scale ImageNet-1k study across two architecture types, using six of the currently most relevant backbones and fifteen ImageNet-C-based degradation types. The results show that patches are able to retain substantial efficacy even when degraded; with considerable variability both in terms of patch source architecture and degradation type. Conceptually, this highlights the difference between adversarial and degradation robustness and suggests that patches encode characteristics of the source architecture. Practically, it underscores the importance of degradation-specific adversarial evaluation as well as the role of architecture choice in robustness.