# Adversarial Patch Attacks on Monocular Depth Estimation Networks

arXiv: https://arxiv.org/abs/2010.03072 · HTML: https://mlsanity.com/paper/2010.03072/

## Key facts

- Cited by 29 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Oct 2020.

## Built on by (most cited first, 29 of 29)

- [Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patches](https://mlsanity.com/paper/2207.04718/) (2022)
- [Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks](https://mlsanity.com/paper/2108.06179/) (2021)
- [Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving](https://mlsanity.com/paper/2403.17301/) (2024)
- [On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving](https://mlsanity.com/paper/2201.01850/) (2022)
- [Physical Adversarial Attacks For Camera-based Smart Systems: Current Trends, Categorization, Applications, Research Challenges, and Future Outlook](https://mlsanity.com/paper/2308.06173/) (2023)
- [Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey](https://mlsanity.com/paper/2206.08304/) (2022)
- [SAAM: Stealthy Adversarial Attack on Monocular Depth Estimation](https://mlsanity.com/paper/2308.03108/) (2023)
- [Visual Adversarial Attacks and Defenses in the Physical World: A Survey](https://mlsanity.com/paper/2211.01671/) (2022)
- [APARATE: Adaptive Adversarial Patch for CNN-based Monocular Depth Estimation for Autonomous Navigation](https://mlsanity.com/paper/2303.01351/) (2023)
- [CARLA-GeAR: a Dataset Generator for a Systematic Evaluation of Adversarial Robustness of Vision Models](https://mlsanity.com/paper/2206.04365/) (2022)
- [Improving Feature Stability during Upsampling -- Spectral Artifacts and the Importance of Spatial Context](https://mlsanity.com/paper/2311.17524/) (2023)
- [LiDARTouch: Monocular metric depth estimation with a few-beam LiDAR](https://mlsanity.com/paper/2109.03569/) (2021)
- [Physical Passive Patch Adversarial Attacks on Visual Odometry Systems](https://mlsanity.com/paper/2207.05729/) (2022)
- [Detection Defenses: An Empty Promise against Adversarial Patch Attacks on Optical Flow](https://mlsanity.com/paper/2310.17403/) (2023)
- [SSAP: A Shape-Sensitive Adversarial Patch for Comprehensive Disruption of Monocular Depth Estimation in Autonomous Navigation Applications](https://mlsanity.com/paper/2403.11515/) (2024)
- [Distributional Modeling for Location-Aware Adversarial Patches](https://mlsanity.com/paper/2306.16131/) (2023)
- [Optical Lens Attack on Deep Learning Based Monocular Depth Estimation](https://mlsanity.com/paper/2409.17376/) (2024)
- [Quantum-Hybrid Stereo Matching With Nonlinear Regularization and Spatial Pyramids](https://mlsanity.com/paper/2312.16118/) (2023)
- [Optical Lens Attack on Monocular Depth Estimation for Autonomous Driving](https://mlsanity.com/paper/2411.00192/) (2024)
- [Task-Agnostic Attacks Against Vision Foundation Models](https://mlsanity.com/paper/2503.03842/) (2025)
- [Adversarial Examples in Environment Perception for Automated Driving (Review)](https://mlsanity.com/paper/2504.08414/) (2025)
- [Endoscopic Depth Estimation Based on Deep Learning: A Survey](https://mlsanity.com/paper/2507.20881/) (2025)
- [Guided Diffusion-based Generation of Adversarial Objects for Real-World Monocular Depth Estimation Attacks](https://mlsanity.com/paper/2512.24111/) (2025)
- [Systematic Discovery of Semantic Attacks in Online Map Construction through Conditional Diffusion](https://mlsanity.com/paper/2605.14396/) (2026)
- [Masking and Mixing Adversarial Training](https://mlsanity.com/paper/2302.08066/) (2023)
- [Physical Adversarial Attack on Monocular Depth Estimation via Shape-Varying Patches](https://mlsanity.com/paper/2407.17312/) (2024)
- [Adversarial Manhole: Challenging Monocular Depth Estimation and Semantic Segmentation Models with Patch Attack](https://mlsanity.com/paper/2408.14879/) (2024)
- [BiTAA: A Bi-Task Adversarial Attack for Object Detection and Depth Estimation via 3D Gaussian Splatting](https://mlsanity.com/paper/2509.19793/) (2025)
- [Test-time Adversarial Takeover: A Real-time Hijacking Interface against Robotic Diffusion Policies](https://mlsanity.com/paper/2606.10371/) (2026)

## Abstract (arXiv)

Thanks to the excellent learning capability of deep convolutional neural networks (CNN), monocular depth estimation using CNNs has achieved great success in recent years. However, depth estimation from a monocular image alone is essentially an ill-posed problem, and thus, it seems that this approach would have inherent vulnerabilities. To reveal this limitation, we propose a method of adversarial patch attack on monocular depth estimation. More specifically, we generate artificial patterns (adversarial patches) that can fool the target methods into estimating an incorrect depth for the regions where the patterns are placed. Our method can be implemented in the real world by physically placing the printed patterns in real scenes. We also analyze the behavior of monocular depth estimation under attacks by visualizing the activation levels of the intermediate layers and the regions potentially affected by the adversarial attack.