mlsanityData to 7 Oct 2026

On the Feasibility and Generality of Patch-based Adversarial Attacks on Semantic Segmentation Problems

arXiv 2205.10539 ↗First posted 21 May 2022cs.CV cs.AIcited by 1

Not on the map. Why?

Abstract (arXiv)

Deep neural networks were applied with success in a myriad of applications, but in safety critical use cases adversarial attacks still pose a significant threat. These attacks were demonstrated on various classification and detection tasks and are usually considered general in a sense that arbitrary network outputs can be generated by them. In this paper we will demonstrate through simple case studies both in simulation and in real-life, that patch based attacks can be utilised to alter the output of segmentation networks. Through a few examples and the investigation of network complexity, we will also demonstrate that the number of possible output maps which can be generated via patch-based attacks of a given size is typically smaller than the area they effect or areas which should be attacked in case of practical applications. We will prove that based on these results most patch-based attacks cannot be general in practice, namely they can not generate arbitrary output maps or if they could, they are spatially limited and this limit is significantly smaller than the receptive field of the patches.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 28 of its 33 references that are in the map. First posted on arXiv 21 May 2022.

Builds on

28 of 33 references.

References · 28

  1. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Mask R-CNNcited by 7,259
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  6. 2017Squeeze-and-Excitation Networkscited by 4,763
  7. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  8. 2015Domain-Adversarial Training of Neural Networkscited by 3,023
  9. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  10. 2016CLEVR: A Diagnostic Dataset for Compositional Language and Elementary Visual Reasoningcited by 1,445
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2016Practical Black-Box Attacks against Machine Learningcited by 893
16 more
  1. 2017Adversarial Patchcited by 514
  2. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  3. 2014On the Number of Linear Regions of Deep Neural Networkscited by 378
  4. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  5. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  6. 2017Bounding and Counting Linear Regions of Deep Neural Networkscited by 161
  7. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  8. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  9. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  10. 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
  11. 2017Robust Physical-World Attacks on Deep Learning Modelscited by 70
  12. 2020On the Number of Linear Regions of Convolutional Neural Networkscited by 49
  13. 2017NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehiclescited by 48
  14. 2016Adversarial Diversity and Hard Positive Generationcited by 35
  15. 2019Indirect Local Attacks for Context-aware Semantic Segmentation Networkscited by 23
  16. 2018SPLAT: Semantic Pixel-Level Adaptation Transforms for Detectioncited by 3

Built on by

Cited by year

Citing papers per year: 2022: 1.

1 paper.

  1. 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24