APRICOT targeted patch 'fooling event' mAP metric

[lcadalzo]

The targeted patch "fooling event" metric, described in the APRICOT arxiv, describes how successful a patch is in causing a detector to predict a targeted class at the location of the patch.

For ex: say a patch targets class A. When computing targeted mAP, we treat the patch as an object of class A. So if the detector predicts class A at the patch's location, that's considered a true positive. Thus, higher mAP implies the patches were more successful in achieving their goal (and lower mAP implies a more robust model/defense).