A computer implementation method for determining an output
signal (y) that characterizes a first classification (c) of an input image (x) as a category from a plurality of categories, wherein the output
signal (y) further characterizes a second classification (r) of the robustness of the first classification (c) against attacks with adversarial patches, wherein determining the output
signal (y) comprises the following steps: - determining a plurality of first
score maps (M), wherein the first
score maps correspond to categories from the plurality of categories and include a plurality of region classifications, wherein each region classification characterizes whether a region belongs to the category for a region in a plurality of regions of the image; - determining a plurality of first category scores, wherein each first category
score from the plurality of first category scores corresponds to a category from the plurality of categories, and is determined by aggregating the region classifications that characterize the classification as the category from the first score maps corresponding to the categories; - determining a second category score, wherein the second category score is determined when adversarial patches are applied to the input image to change the corresponding category. - The minimum category score obtainable in the case of region classification of the first score map corresponding to the first category with the maximum first category score; - Determine a plurality of third category scores, wherein the third category scores correspond to categories different from the first category, and are the maximum category scores obtainable in the case of region classification of the first score map of the first category when adversarial patches are applied to the input image (x) to change the category; - If the second category score is greater than or equal to all third category scores, determine the output signal (y) such that it characterizes the first category (c) of the input
image based on the plurality of first category scores, and it characterizes the second category (r) of the first category as robust to the adversarial patch; - If the second category score is less than at least one third category score, determine the output signal (y) such that it characterizes the first category (c) of the input
image based on the plurality of first category scores, and it characterizes the second category (r) of the first category as not robust to the adversarial patch.