Naseer et al. propose to smooth local gradients as defense against adversarial patches. In particular, as illustrated in Figure 1, the local image gradient is computed through convolution. Then, in local, overlapping windows, the gradients are set to zero if the total sum of absolute gradient values exceeds a specific threshold. The remaining gradient map is supposed to indicate regions where it is likely that adversarial patches can be found. Using this gradient map, the image is smoothed, i.e., blurred, afterwards. In experiments, the authors show that this reduces the impact of adversarial patches.

Also find this summary at [davidstutz.de](https://davidstutz.de/category/reading/).