Abstract
Adversarial patch attacks pose a tangible physical-world threat to traffic sign recognition in autonomous driving systems. Current state-of-the-art defenses based on image reconstruction require dual-model deployment and add per-frame inference latency, making them impractical for resource-constrained embedded platforms such as mass-produced ADAS systems and aftermarket dashcams. This paper proposes a two-component defense that separates detection from mitigation. PatchGuard-Freq leverages frequency-domain analysis to detect attacked images with high accuracy, while adversarial fine-tuning enables the detector to recover most of its detection performance under attack without adding any inference module or architectural change. Experimental results show that the approach is effective in the latency regime targeted by this study: on the evaluated stop-sign and nine-class LISA benchmarks, under the evaluated detection placement (a fresh 110×110 patch at a uniformly random position), the detector achieves AUC = 1.0 with zero false positives across all four dataset configurations and all combined frequency variants, while the frequency-only arm of the ablation separates the data only where the patch covers almost the entire input, and adversarial fine-tuning recovers attacked mAP@0.5 on the COCO stop-sign test set from 19.4% to 68.4% on the 110×110-patch configuration while degrading clean mAP by only about 0.7 points. We further show that PatchGuard-Freq is vulnerable to adaptive (defense-aware) attacks and introduce defense-aware training that restores detection of such attacks to 100% without increasing false alarms. This work characterizes the complementary relationship between reconstruction-based and robustness-based paradigms in the accuracy–efficiency design space under the evaluated conditions: the former suits compute-unconstrained scenarios while the latter serves latency-constrained deployments. All quantitative results were obtained on desktop-grade GPUs; embedded-platform latency, memory, and energy were not measured, and the embedded discussion is limited to hardware-independent parameter and FLOP counts.