Adversarial-Patch Evaluation for Computer Agriculture Weed-Detection Models Under Field-Gathered Occlusion: An Artificial Intelligence Certified-Overlap Bound for Sprayer Misclassification

Weed-detection models deployed on sprayer booms must decide, from a single frame, whether a plant is a crop or a weed, and a wrong decision releases herbicide onto a crop or withholds it from a weed. Field-gathered occlusion — soil clods, crop leaves, dust, and the shadow of the boom itself — is the ordinary condition of that decision, and an adversarial patch is the limiting case of occlusion: a bounded, high-contrast region that a model has learned to read as evidence. The bound is stated as a function of the patch's area fraction of the detection window, the model's Lipschitz behaviour on the logit margin, and a certified radius obtained by randomised smoothing. The argument is methodological and theoretical: no field trial is reported, and no observational data are claimed. The contribution is a certificate that converts a patch-area budget into a guaranteed upper bound on the probability that a sprayer misclassifies a plant, together with the design rule that follows from it — a patch whose area fraction exceeds a stated threshold cannot be certified safe for any model whose smoothed margin is below a stated value. The bound is shown to be tight in the small-patch regime and vacuous in the large-patch regime, and the transition between the two is characterised. The consequence for evaluation practice is that patch robustness should be reported as a certified area fraction rather than as a clean-set accuracy, because the two quantities diverge sharply once occlusion exceeds the certified radius.