PyTorch implementation of adversarial patch
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
1978_859_adversarial.png initial release Feb 6, 2018
1981_859_adversarial.png circle patch Feb 6, 2018 Update Feb 7, 2018 circle init --> square init Mar 12, 2018 initial release Feb 6, 2018


PyTorch implementation of adversarial patch

This is an implementation of the Adversarial Patch paper. Not official and likely to have bugs/errors.

How to run:

Data set-up:

Run attack:

  • python --cuda --netClassifier inceptionv3 --max_count 500 --image_size 299 --patch_type circle --outf log


Using patch shapes of both circles and squares gave good results (both achieved 100% success on the training set and eventually > 90% success on test set)

I managed to recreate the toaster example in the original paper. It looks slightly different but it is evidently a toaster.

Alt text This is a toaster

Square patches are a little more homogenous due to that I only rotate by multiples of 90 degrees.

Alt text This is also a toaster


  • Cannot make a perfect circle with numpy/pytorch. The hack I came up with makes the boundary slightly hexagonal.

  • Rather slow if max_count and conf_target are large.

  • Probably lots of redundant calls and variables.