Our project on large-scale adversarial patch benchmark is funded by Microsoft-BAIR Commons.