# Adversarial Attacks on Monocular Depth Estimation

arXiv: https://arxiv.org/abs/2003.10315 · HTML: https://mlsanity.com/paper/2003.10315/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Mar 2020.

## Built on by (most cited first, 20 of 20)

- [DepthFormer: Exploiting Long-Range Correlation and Local Information for Accurate Monocular Depth Estimation](https://mlsanity.com/paper/2203.14211/) (2022)
- [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022)
- [Evaluating Adversarial Attacks on Driving Safety in Vision-Based Autonomous Vehicles](https://mlsanity.com/paper/2108.02940/) (2021)
- [Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attacks](https://mlsanity.com/paper/2301.13487/) (2023)
- [Towards Foundation Models for 3D Vision: How Close Are We?](https://mlsanity.com/paper/2410.10799/) (2024)
- [APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation](https://mlsanity.com/paper/2303.01351/) (2023)
- [Adversarial Attacks on Monocular Pose Estimation](https://mlsanity.com/paper/2207.07032/) (2022)
- [Self-supervised Adversarial Training of Monocular Depth Estimation against Physical-World Attacks](https://mlsanity.com/paper/2406.05857/) (2024)
- [SSAP: A Shape-Sensitive Adversarial Patch for Comprehensive Disruption of Monocular Depth Estimation in Autonomous Navigation Applications](https://mlsanity.com/paper/2403.11515/) (2024)
- [On the Robustness of Language Guidance for Low-Level Vision Tasks: Findings from Depth Estimation](https://mlsanity.com/paper/2404.08540/) (2024)
- [Sensor Data Validation and Driving Safety in Autonomous Driving Systems](https://mlsanity.com/paper/2203.16130/) (2022)
- [Optical Lens Attack on Deep Learning Based Monocular Depth Estimation](https://mlsanity.com/paper/2409.17376/) (2024)
- [A Survey on Adversarial Robustness of LiDAR-based Machine Learning Perception in Autonomous Vehicles](https://mlsanity.com/paper/2411.13778/) (2024)
- [Left-right Discrepancy for Adversarial Attack on Stereo Networks](https://mlsanity.com/paper/2401.07188/) (2024)
- [Adversarial Amendment is the Only Force Capable of Transforming an Enemy into a Friend](https://mlsanity.com/paper/2305.10766/) (2023)
- [Optical Lens Attack on Monocular Depth Estimation for Autonomous Driving](https://mlsanity.com/paper/2411.00192/) (2024)
- [Guided Diffusion-based Generation of Adversarial Objects for Real-World Monocular Depth Estimation Attacks](https://mlsanity.com/paper/2512.24111/) (2025)
- [Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches](https://mlsanity.com/paper/2407.17312/) (2024)
- [BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World](https://mlsanity.com/paper/2505.16154/) (2025)
- [BiTAA: A Bi-Task Adversarial Attack for Object Detection and Depth Estimation via 3D Gaussian Splatting](https://mlsanity.com/paper/2509.19793/) (2025)

## Abstract (arXiv)

Recent advances of deep learning have brought exceptional performance on many computer vision tasks such as semantic segmentation and depth estimation. However, the vulnerability of deep neural networks towards adversarial examples have caused grave concerns for real-world deployment. In this paper, we present to the best of our knowledge the first systematic study of adversarial attacks on monocular depth estimation, an important task of 3D scene understanding in scenarios such as autonomous driving and robot navigation. In order to understand the impact of adversarial attacks on depth estimation, we first define a taxonomy of different attack scenarios for depth estimation, including non-targeted attacks, targeted attacks and universal attacks. We then adapt several state-of-the-art attack methods for classification on the field of depth estimation. Besides, multi-task attacks are introduced to further improve the attack performance for universal attacks. Experimental results show that it is possible to generate significant errors on depth estimation. In particular, we demonstrate that our methods can conduct targeted attacks on given objects (such as a car), resulting in depth estimation 3-4x away from the ground truth (e.g., from 20m to 80m).