# Proximal Splitting Adversarial Attacks for Semantic Segmentation

arXiv: https://arxiv.org/abs/2206.07179 · HTML: https://mlsanity.com/paper/2206.07179/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 53 references that are in the map.
- First posted on arXiv 14 Jun 2022.

## Builds on (most cited first, 26 of 26)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [The Cityscapes Dataset for Semantic Urban Scene Understanding](https://mlsanity.com/paper/1604.01685/) (2016)
- [Encoder-Decoder with Atrous Separable Convolution for Semantic Image Segmentation](https://mlsanity.com/paper/1802.02611/) (2018)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [SegFormer: Simple and Efficient Design for Semantic Segmentation with Transformers](https://mlsanity.com/paper/2105.15203/) (2021)
- [Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks](https://mlsanity.com/paper/2003.01690/) (2020)
- [Deep High-Resolution Representation Learning for Visual Recognition](https://mlsanity.com/paper/1908.07919/) (2019)
- [DeepFool: a simple and accurate method to fool deep neural networks](https://mlsanity.com/paper/1511.04599/) (2015)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack](https://mlsanity.com/paper/1907.02044/) (2019)
- [Adversarial Examples for Semantic Segmentation and Object Detection](https://mlsanity.com/paper/1703.08603/) (2017)
- [Are Transformers More Robust Than CNNs?](https://mlsanity.com/paper/2111.05464/) (2021)
- [On the Robustness of Vision Transformers to Adversarial Examples](https://mlsanity.com/paper/2104.02610/) (2021)
- [On the Robustness of Semantic Segmentation Models to Adversarial Attacks](https://mlsanity.com/paper/1711.09856/) (2017)
- [Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses](https://mlsanity.com/paper/1811.09600/) (2018)
- [Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraints](https://mlsanity.com/paper/2102.12827/) (2021)
- [Accurate, reliable and fast robustness evaluation](https://mlsanity.com/paper/1907.01003/) (2019)
- [Dynamic Divide-and-Conquer Adversarial Training for Robust Semantic Segmentation](https://mlsanity.com/paper/2003.06555/) (2020)
- [Adversarial Examples for Semantic Image Segmentation](https://mlsanity.com/paper/1703.01101/) (2017)
- [Augmented Lagrangian Adversarial Attacks](https://mlsanity.com/paper/2011.11857/) (2020)
- [Impact of Adversarial Examples on Deep Learning Models for Biomedical Image Segmentation](https://mlsanity.com/paper/1907.13124/) (2019)
- [Trust Region Based Adversarial Attack on Neural Networks](https://mlsanity.com/paper/1812.06371/) (2018)
- [PDPGD: Primal-Dual Proximal Gradient Descent Adversarial Attack](https://mlsanity.com/paper/2106.01538/) (2021)
- [Proximal Activation of Smooth Functions in Splitting Algorithms for Convex Image Recovery](https://mlsanity.com/paper/1803.02919/) (2018)

## Built on by (most cited first, 23 of 23)

- [CosPGD: an efficient white-box adversarial attack for pixel-wise prediction tasks](https://mlsanity.com/paper/2302.02213/) (2023)
- [Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models](https://mlsanity.com/paper/2306.12941/) (2023)
- [Reducing Texture Bias of Deep Neural Networks via Edge Enhancing Diffusion](https://mlsanity.com/paper/2402.09530/) (2024)
- [Adversarial Attacks on Video Object Segmentation with Hard Region Discovery](https://mlsanity.com/paper/2309.13857/) (2023)
- [Uncertainty-weighted Loss Functions for Improved Adversarial Attacks on Semantic Segmentation](https://mlsanity.com/paper/2310.17436/) (2023)
- [Practical Region-level Attack against Segment Anything Models](https://mlsanity.com/paper/2404.08255/) (2024)
- [Uncertainty-based Detection of Adversarial Attacks in Semantic Segmentation](https://mlsanity.com/paper/2305.12825/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [Segment (Almost) Nothing: Prompt-Agnostic Adversarial Attacks on Segmentation Models](https://mlsanity.com/paper/2311.14450/) (2023)
- [Bridging the Task Gap: Multi-Task Adversarial Transferability in CLIP and Its Derivatives](https://mlsanity.com/paper/2509.23917/) (2025)
- [On Evaluating the Adversarial Robustness of Semantic Segmentation Models](https://mlsanity.com/paper/2306.14217/) (2023)
- [Delving into Decision-based Black-box Attacks on Semantic Segmentation](https://mlsanity.com/paper/2402.01220/) (2024)
- [Evaluating the Adversarial Robustness of Semantic Segmentation: Trying Harder Pays Off](https://mlsanity.com/paper/2407.09150/) (2024)
- [Detecting Adversarial Attacks in Semantic Segmentation via Uncertainty Estimation: A Deep Analysis](https://mlsanity.com/paper/2408.10021/) (2024)
- [Cross-Model Transferability of Adversarial Patches in Real-time Segmentation for Autonomous Driving](https://mlsanity.com/paper/2502.16012/) (2025)
- [Adversarial Robustness of Discriminative Self-Supervised Learning in Vision](https://mlsanity.com/paper/2503.06361/) (2025)
- [Active Adversarial Noise Suppression for Image Forgery Localization](https://mlsanity.com/paper/2506.12871/) (2025)
- [Fast and Flexible Robustness Certificates for Semantic Segmentation](https://mlsanity.com/paper/2512.06010/) (2025)
- [Trainwreck: A damaging adversarial attack on image classifiers](https://mlsanity.com/paper/2311.14772/) (2023)
- [Multi-style conversion for semantic segmentation of lesions in fundus images by adversarial attacks](https://mlsanity.com/paper/2410.13822/) (2024)
- [Proxy-Embedding as an Adversarial Teacher: An Embedding-Guided Bidirectional Attack for Referring Expression Segmentation Models](https://mlsanity.com/paper/2506.16157/) (2025)
- [Adversarial Attacks on Robot Localization Systems via Deep Feature Perturbation](https://mlsanity.com/paper/2606.01892/) (2026)
- [IGME: Efficient Chained Method Ensemble for Transferable Semantic Segmentation Attacks](https://mlsanity.com/paper/2607.27465/) (2026)

## Abstract (arXiv)

Classification has been the focal point of research on adversarial attacks, but only a few works investigate methods suited to denser prediction tasks, such as semantic segmentation. The methods proposed in these works do not accurately solve the adversarial segmentation problem and, therefore, overestimate the size of the perturbations required to fool models. Here, we propose a white-box attack for these models based on a proximal splitting to produce adversarial perturbations with much smaller ℓ_∞ norms. Our attack can handle large numbers of constraints within a nonconvex minimization framework via an Augmented Lagrangian approach, coupled with adaptive constraint scaling and masking strategies. We demonstrate that our attack significantly outperforms previously proposed ones, as well as classification attacks that we adapted for segmentation, providing a first comprehensive benchmark for this dense task.