Turning Your Strength against You: Detecting and Mitigating Robust and
  Universal Adversarial Patch Attacks
  Adversarial patch attacks against image classification deep neural networks
(DNNs), which inject arbitrary distortions within a bounded region of an image,
can generate adversarial perturbations that are robust (i.e., remain
adversarial in physical world) and universal (i.e., remain adversarial on any
input). Such attacks can lead to severe consequences in real-world DNN-based
systems.
  This work proposes Jujutsu, a technique to detect and mitigate robust and
universal adversarial patch attacks. For detection, Jujutsu exploits the
attacks' universal property - Jujutsu first locates the region of the potential
adversarial patch, and then strategically transfers it to a dedicated region in
a new image to determine whether it is truly malicious. For attack mitigation,
Jujutsu leverages the attacks' localized nature via image inpainting to
synthesize the semantic contents in the pixels that are corrupted by the
attacks, and reconstruct the ``clean'' image.
  We evaluate Jujutsu on four diverse datasets (ImageNet, ImageNette, CelebA
and Place365), and show that Jujutsu achieves superior performance and
significantly outperforms existing techniques. We find that Jujutsu can further
defend against different variants of the basic attack, including 1)
physical-world attack; 2) attacks that target diverse classes; 3) attacks that
construct patches in different shapes and 4) adaptive attacks.
