DEF-spann

DEF-spann — SpaNN: Multi-Patch Spatial Neural Networks for Adversarial Patch Defense

Part of the ANIMA Perception Suite by Robot Flow Labs.

Paper

SpaNN: Detecting Multiple Adversarial Patches on CNNs (arXiv:2506.18591) SaTML 2025 gerkbyrd et al.

Architecture

SpaNN detects adversarial patch attacks by analyzing ensemble saliency-threshold attribute vectors extracted from victim model feature maps. The attack detector (AtkDetCNNRaw) is a lightweight 1D-CNN (417K params) that classifies threshold-swept clustering features as clean or adversarial.

Core Pipeline:

1. Extract feature maps from victim detector (YOLO, Faster R-CNN, etc.)
2. Sweep binarization thresholds β ∈ [0, 1) → DBSCAN cluster at each threshold
3. Extract 4 attributes per threshold: n_clusters, avg_intra_dist, std_intra_dist, n_important_neurons
4. Stack into curve → normalize → feed into AtkDetCNNRaw
5. Score ≥ 0.5 → attack detected

Results

Training Data: 6,746 samples (INRIA + CIFAR + ImageNet + COCO DINOv2)

Exported Formats

Usage

import torch
from def_spann.models import AtkDetCNNRaw

model = AtkDetCNNRaw(in_feats=4)
ckpt = torch.load("pytorch/DEF-spann_v1.pth", map_location="cpu")
model.load_state_dict(ckpt["model"])
model.eval()

# Input: (batch, 4_features, 20_thresholds)
x = torch.randn(1, 4, 20)
score = model(x)  # → (1, 1), value in [0, 1]
is_attack = score >= 0.5

CUDA Kernels

Two compiled CUDA kernels available in shared infrastructure:

• local_entropy — Compute local entropy map for spatial anomaly detection
• patch_inpaint — Zero-fill detected adversarial patch regions

Training

• Hardware: NVIDIA L4 (GPU 1)
• Framework: PyTorch 2.6.0, CUDA 12.8
• Optimizer: Adam, lr=0.0001
• Scheduler: Warmup + Cosine decay
• Early Stopping: patience=200
• Config: See configs/training.toml
• Training time: ~2.5 minutes (250 epochs × 0.6s)

Docker Serving

docker compose -f docker-compose.serve.yml --profile serve up -d
curl http://localhost:8080/health

License

Apache 2.0 — Robot Flow Labs / AIFLOW LABS LIMITED