Patch attacks have become a serious threat for object detectors in the physical world. Developing and evaluating defenses against physical patch attacks require physical-patch datasets which are costly to create. To the best of our knowledge, APRICOT [1] is the only publicly available dataset of physical adversarial attacks on object detection. However, APRICOT only provides bounding box annotations for each patch without pixel-level annotations. This hinders the development and evaluation of patch detection and removal techniques like SAC [2]. To facilitate research in this direction, we create the APRICOT-Mask dataset, which provides segmentation masks and more accurate bounding boxes for adversarial patches in APRICOT.

Dataset Partitions:

The APRICOT-Mask dataset has the same partitions as APRICOT, with a development partition (dev) and a testing partition (test). The dev set contains 138 images from 6 patches and the test set contains 873 images from 54 patches.

Dataset Descriptions:

The dataset is stored in “.pt” files. Each file contains the following fields:

• Image: the adversarial image.
• Mask:binary segmentation mask of the physical adversarial patch.
• Annotations: annotations from the APRICOT dataset including labels and bounding boxes for both COCO objects and physical adversarial patches. The bounding boxes of adversarial patch are revised according to the segmentation mask.

Dataset Downloads:

The APRICOT-Mask Dataset is distributed under an Apache License Version 2.0. If you use this dataset in your research, please cite our SAC paper [2].

Link: ftp://ftp.cis.jhu.edu/pub/apricot-mask

[1] Braunegg, A., et al. “Apricot: A dataset of physical adversarial attacks on object detection.” European Conference on Computer Vision. Springer, Cham, 2020.

[2] Liu, Jiang, et al. “Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detection.” arXiv preprint arXiv:2112.04532 (2021).