Algorithm 1 Segment and Recover (SAR)
Input:  input image x, window size $(w_x,w_y)$, matching threshold T, Base Detector BaseDetector$(·)$. Output:  robust detection ${\mathcal{D}}^{*}$, inpainted images and CAUTION
1:procedure  Sar$(x,w_x,w_y,T)$   2:$am\leftarrow$ AdvPredictor$(x,w_x,w_y,T)$   3:$pm\leftarrow$ AdvDetector$(x,am)$   4:$x^{\prime }\leftarrow$ PixelRestoration$(x,pm)$   5:$\mathcal{D}\leftarrow$ BaseDetector$\left(x^{\prime }\right)$   6:if  $a==True$  then   7:      ${\mathcal{D}}^{*}\leftarrow CAUTION$   8:else   9:      ${\mathcal{D}}^{*}\leftarrow \mathcal{D}$ 10:end if 11:return  ${\mathcal{D}}^{*}$ 12:end procedure   $$ 13:procedure  AdvPredictor$(x,w_x,w_y,T)$ 14:$fm$ ← Fe(x) 15:$X,Y,\_$ ← Shape(fm) 16:$am$ ← ZeroArray[X, Y, N + 1] 17:for each valid $(i,j)$ do 18:      $l,v\leftarrow$ Jpeg$\left(fm[i:i+w_x:j+w_y]\right)$ 19:      $am[i:i+w_x,j:j+w_y]\leftarrow am[i:i+w_x,j:j+w_y]+v$ 20:end for 21:$am$ ← Binarize(am, T, wx, wy) 22:return  $am$ 23:end procedure	▹ Adversary detection (frontend) ▹ Adversary localization ▹ Broken pixel restoration (backend) ▹ Conventional detection   ▹ Trigger a caution             ▹ Extract feature map ▹ Get the shape of fm ▹ Initialization ▹ Every window location       ▹ Binarization
24:procedure  AdvDetector$(x,am)$ 25:$seg$ ← FastSamAutomaticMaskGenerator(x) 26:$L,T,R,B$ ← Shape(seg, am) 27:$A_{box1}$ ← Area_Seg$[L_1,T_1,R_1,B_1]$ 28:$A_{box2}$ ← Area_Am$[L_2,T_2,R_2,B_2]$ 29:for each valid $A_{box1}$ do 30:      for each valid $A_{box2}$ do 31:        $A_{inter}\leftarrow (R_{inter}-L_{inter})\times (B_{inter}-T_{inter})$ 32:        $A_{union}\leftarrow A_{box1}+A_{box2}-A_{inter}$ 33:        $IoU\leftarrow {\displaystyle \frac{A_{inter}}{A_{union}}}$ 34:        if $IoU<0.9$ then 35:             return 0 36:        else 37:             $pm$ ← Binarize(am) 38:             return pm 39:        end if 40:    end for 41:end for 42:end procedure	▹ Extract segmentation layer by layer ▹Get the left, top, right, and bottom of seg ▹ Initialization area of segmentation ▹ Initialization area of adversarial patch map ▹ Every segmentation ▹ Every Am ▹ Area of intersection ▹ Area of union ▹ Calculate IoU   ▹ No overlap   ▹ Binarization ▹ Return patch map
43:procedure  PixelRestoration$(x,pm)$ 44:while  $i\le T$  and $n>0$  do 45:      ${\mathcal{C}}^{H\times {\displaystyle \frac{W}{2}}\times 2C}\leftarrow {\mathcal{R}}^{H\times W\times C}$ 46:      ${\mathcal{R}}^{H\times {\displaystyle \frac{W}{2}}\times 2C}\leftarrow {\mathcal{C}}^{H\times {\displaystyle \frac{W}{2}}\times C}$ 47:      ${\mathcal{R}}^{H\times {\displaystyle \frac{W}{2}}\times 2C}\leftarrow {\mathcal{R}}^{H\times {\displaystyle \frac{W}{2}}\times 2C}$ 48:      ${\mathcal{C}}^{H\times {\displaystyle \frac{W}{2}}\times 2C}\leftarrow {\mathcal{R}}^{H\times {\displaystyle \frac{W}{2}}\times C}$ 49:      ${\mathcal{R}}^{H\times W\times C}\leftarrow {\mathcal{C}}^{H\times {\displaystyle \frac{W}{2}}\times C}$ 50:end while 51:return  $x^{\prime }$ 52:end procedure	▹ Apply real FFT to input tensor ▹ Concatenate real and imaginary parts ▹ Apply a convolution block in the frequency domain     ▹ Apply an inverse transform to recover a spatial structure