# AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation

arXiv: https://arxiv.org/abs/1910.02354 · HTML: https://mlsanity.com/paper/1910.02354/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Oct 2019.

## Built on by (most cited first, 10 of 10)

- [SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustness](https://mlsanity.com/paper/2207.12391/) (2022)
- [Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks](https://mlsanity.com/paper/2108.06179/) (2021)
- [On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving](https://mlsanity.com/paper/2201.01850/) (2022)
- [Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models](https://mlsanity.com/paper/2306.12941/) (2023)
- [Adversarial Feature Augmentation and Normalization for Visual Recognition](https://mlsanity.com/paper/2103.12171/) (2021)
- [Segment (Almost) Nothing: Prompt-Agnostic Adversarial Attacks on Segmentation Models](https://mlsanity.com/paper/2311.14450/) (2023)
- [To Make Yourself Invisible with Adversarial Semantic Contours](https://mlsanity.com/paper/2303.00284/) (2023)
- [Evaluating and Enhancing Segmentation Model Robustness with Metamorphic Testing](https://mlsanity.com/paper/2504.02335/) (2025)
- [ConSeg: Contextual Backdoor Attack Against Semantic Segmentation](https://mlsanity.com/paper/2507.19905/) (2025)
- [Adversarially Guided Diffusion for LiDAR Range Image Synthesis](https://mlsanity.com/paper/2607.09787/) (2026)

## Abstract (arXiv)

Due to the inherent robustness of segmentation models, traditional norm-bounded attack methods show limited effect on such type of models. In this paper, we focus on generating unrestricted adversarial examples for semantic segmentation models. We demonstrate a simple and effective method to generate unrestricted adversarial examples using conditional generative adversarial networks (CGAN) without any hand-crafted metric. The na"ive implementation of CGAN, however, yields inferior image quality and low attack success rate. Instead, we leverage the SPADE (Spatially-adaptive denormalization) structure with an additional loss item to generate effective adversarial attacks in a single step. We validate our approach on the popular Cityscapes and ADE20K datasets, and demonstrate that our synthetic adversarial examples are not only realistic, but also improve the attack success rate by up to 41.0% compared with the state of the art adversarial attack methods including PGD.