Adversarial Defense via Clean-Sample Guided Adaptive Overlapping Patch for Traffic Sign Recognition Systems

Adversarial attacks induce misclassification in deep neural networks through imperceptible perturbations to human vision. Traffic sign images exhibit intrinsic structural vulnerabilities in decision boundaries due to their characteristic features—high-saturation color distributions and standardized geometric shapes. To address these vulnerabilities, this paper proposes a clean-sample guided adaptive overlapping patch defense method specifically designed for traffic sign recognition systems. Diverging from conventional perturbation-elimination paradigms, our approach constructs defense mechanism by exploiting the visual indistinguishability between adversarial and clean samples. A clean sample repository is established through K-means and Histogram of Oriented Gradients feature modeling, with rapid input-to-repository matching achieved via dual metrics of “structural similarity” and “perceptual hashing” joint similarity. Guided defense patches are dynamically generated based on the nearest clean samples. Experimental results on the GTSRB dataset show that our method maintains an original classification accuracy of 0.9838, merely 0.01 lower than the baseline model, while achieving a defensive accuracy of 0.7240 against PGD attacks, comparable to current state-of-the-art defense methods. Compared to the average 0.19 accuracy degradation of traditional methods, our approach effectively mitigates the trade-off conflict between model robustness and classification accuracy.