An information processing apparatus extracts a projection area of an object from an input scene containing a projection of the object, specifies each of second areas that are included in the extracted projection area of the object and that are similar to a plurality of first areas representing a feature of each of labels in a feature space, outputs a first classification result based on each of the plurality of labels indicating a state in which a distribution of combinations of the specified second areas and the first areas that are associated with the second areas is closer than a predetermined threshold; and determines whether or not an adversarial patch is included in the object by comparing the first classification result with a second classification result that is a result of classification of the objects obtained by inputting the input scene to a predetermined object detection model.