# Adversarial Examples for Semantic Image Segmentation

arXiv: https://arxiv.org/abs/1703.01101 · HTML: https://mlsanity.com/paper/1703.01101/

## Key facts

- Cited by 33 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Mar 2017.

## Built on by (most cited first, 30 of 33)

- [SegDiff: Image Segmentation with Diffusion Probabilistic Models](https://mlsanity.com/paper/2112.00390/) (2021)
- [3DB: A Framework for Debugging Computer Vision Models](https://mlsanity.com/paper/2106.03805/) (2021)
- [TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations](https://mlsanity.com/paper/2112.09151/) (2021)
- [Proximal Splitting Adversarial Attacks for Semantic Segmentation](https://mlsanity.com/paper/2206.07179/) (2022)
- [Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models](https://mlsanity.com/paper/2404.09401/) (2024)
- [Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networks](https://mlsanity.com/paper/2212.01806/) (2022)
- [Explainable AI (XAI) in Image Segmentation in Medicine, Industry, and Beyond: A Survey](https://mlsanity.com/paper/2405.01636/) (2024)
- [Stabilized Medical Image Attacks](https://mlsanity.com/paper/2103.05232/) (2021)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation](https://mlsanity.com/paper/2312.02207/) (2023)
- [Improving Model Robustness with Latent Distribution Locally and Globally](https://mlsanity.com/paper/2107.04401/) (2021)
- [Practical Region-level Attack against Segment Anything Models](https://mlsanity.com/paper/2404.08255/) (2024)
- [IPatch: A Remote Adversarial Patch](https://mlsanity.com/paper/2105.00113/) (2021)
- [Smoothed Embeddings for Certified Few-Shot Learning](https://mlsanity.com/paper/2202.01186/) (2022)
- [Landmark Breaker: Obstructing DeepFake By Disturbing Landmark Extraction](https://mlsanity.com/paper/2102.00798/) (2021)
- [Influencer Backdoor Attack on Semantic Segmentation](https://mlsanity.com/paper/2303.12054/) (2023)
- [A Certified Radius-Guided Attack Framework to Image Segmentation Models](https://mlsanity.com/paper/2304.02693/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [Segment-Anything Models Achieve Zero-shot Robustness in Autonomous Driving](https://mlsanity.com/paper/2408.09839/) (2024)
- [Towards Adversarial Robustness of Model-Level Mixture-of-Experts Architectures for Semantic Segmentation](https://mlsanity.com/paper/2412.11608/) (2024)
- [Consistent Semantic Attacks on Optical Flow](https://mlsanity.com/paper/2111.08485/) (2021)
- [Transferable Attack for Semantic Segmentation](https://mlsanity.com/paper/2307.16572/) (2023)
- [Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses](https://mlsanity.com/paper/2210.13289/) (2022)
- [Adversarial Heart Attack: Neural Networks Fooled to Segment Heart Symbols in Chest X-Ray Images](https://mlsanity.com/paper/2104.00139/) (2021)
- [Tracklet-Switch Adversarial Attack against Pedestrian Multi-Object Tracking Trackers](https://mlsanity.com/paper/2111.08954/) (2021)
- [A Human-in-the-Middle Attack against Object Detection Systems](https://mlsanity.com/paper/2208.07174/) (2022)
- [On Evaluating the Adversarial Robustness of Semantic Segmentation Models](https://mlsanity.com/paper/2306.14217/) (2023)
- [MITS-GAN: Safeguarding Medical Imaging from Tampering with Generative Adversarial Networks](https://mlsanity.com/paper/2401.09624/) (2024)
- [Delving into Decision-based Black-box Attacks on Semantic Segmentation](https://mlsanity.com/paper/2402.01220/) (2024)
- [Evaluating the Adversarial Robustness of Semantic Segmentation: Trying Harder Pays Off](https://mlsanity.com/paper/2407.09150/) (2024)

## Abstract (arXiv)

Machine learning methods in general and Deep Neural Networks in particular have shown to be vulnerable to adversarial perturbations. So far this phenomenon has mainly been studied in the context of whole-image classification. In this contribution, we analyse how adversarial perturbations can affect the task of semantic segmentation. We show how existing adversarial attackers can be transferred to this task and that it is possible to create imperceptible adversarial perturbations that lead a deep network to misclassify almost all pixels of a chosen class while leaving network prediction nearly unchanged outside this class.