mlsanityData to 7 Oct 2026

Ensemble-based Blackbox Attacks on Dense Prediction

arXiv 2303.14304 ↗First posted 25 Mar 2023cs.CV cs.CR cs.LGcited by 16

Not on the map. Why?

Abstract (arXiv)

We propose an approach for adversarial attacks on dense prediction models (such as object detectors and segmentation). It is well known that the attacks generated by a single surrogate model do not transfer to arbitrary (blackbox) victim models. Furthermore, targeted attacks are often more challenging than the untargeted attacks. In this paper, we show that a carefully designed ensemble can create effective attacks for a number of victim models. In particular, we show that normalization of the weights for individual models plays a critical role in the success of the attacks. We then demonstrate that by adjusting the weights of the ensemble according to the victim model can further improve the performance of the attacks. We performed a number of experiments for object detectors and segmentation to highlight the significance of the our proposed methods. Our proposed ensemble-based method outperforms existing blackbox attack methods for object detection and segmentation. Finally we show that our proposed method can also generate a single perturbation that can fool multiple blackbox detection and segmentation models simultaneously. Code is available at https://github.com/CSIPlab/EBAD.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 54 of its 65 references that are in the map. First posted on arXiv 25 Mar 2023.

Builds on

54 of 65 references.

References · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  4. 2020End-to-End Object Detection with Transformerscited by 7,384
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  9. 2015You Only Look Once: Unified, Real-Time Object Detectioncited by 4,829
  10. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,427
  11. 2015SSD: Single Shot MultiBox Detectorcited by 3,125
  12. 2018YOLOv3: An Incremental Improvementcited by 2,652
38 more
  1. 2016Pyramid Scene Parsing Networkcited by 2,472
  2. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  3. 2021Pyramid Vision Transformer: A Versatile Backbone for Dense Prediction without Convolutionscited by 1,960
  4. 2016Adversarial examples in the physical worldcited by 1,762
  5. 2019FCOS: Fully Convolutional One-Stage Object Detectioncited by 1,573
  6. 2019MMDetection: Open MMLab Detection Toolbox and Benchmarkcited by 1,379
  7. 2018Unified Perceptual Parsing for Scene Understandingcited by 1,265
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  11. 2019Bridging the Gap Between Anchor-based and Anchor-free Detection via Adaptive Training Sample Selectioncited by 539
  12. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  13. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  14. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  15. 2019GCNet: Non-local Networks Meet Squeeze-Excitation Networks and Beyondcited by 331
  16. 2018Context Encoding for Semantic Segmentationcited by 289
  17. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  18. 2019Libra R-CNN: Towards Balanced Learning for Object Detectioncited by 255
  19. 2019Simple Black-box Adversarial Attackscited by 249
  20. 2019Asymmetric Non-local Neural Networks for Semantic Segmentationcited by 196
  21. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  22. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  23. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  24. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  25. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  26. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  27. 2019FreeAnchor: Learning to Match Anchors for Visual Object Detectioncited by 90
  28. 2018Grid R-CNNcited by 85
  29. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  30. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  31. 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
  32. 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
  33. 2021Meta Gradient Adversarial Attackcited by 55
  34. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  35. 2019Role of Spatial Context in Adversarial Robustness for Object Detectioncited by 35
  36. 2019Hybrid Batch Attacks: Finding Black-box Adversarial Examples with Limited Queriescited by 33
  37. 2021Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformationscited by 28
  38. 2021Context-Aware Transfer Attacks for Object Detectioncited by 18

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 5; 2025: 3; 2026: 4.

16 papers.

Sort:

By area:

  1. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  2. 2025Learning-based 3D Reconstruction in Autonomous Driving: A Comprehensive Surveycited by 9
  3. 2025SegTrans: Transferable Adversarial Examples for Segmentation Modelscited by 8
  4. 2023Improved Membership Inference Attacks Against Language Classification Modelscited by 7
  5. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  6. 2024Adversarial Training: A Surveycited by 6
  7. 2023DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generationcited by 5
  8. 2023Transferable Attack for Semantic Segmentationcited by 4
  9. 2024Red-Teaming Segment Anything Modelcited by 4
  10. 2025Adversarial Attention Perturbations for Large Object Detection Transformerscited by 4
  11. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  12. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
4 more
  1. 2026Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Drivingcited by 1
  2. 2026Corrupting Attention: Evasion-Based Adversarial Attacks on Encoder Attention in Detection Transformerscited by 0
  3. 2026Learning with Bilevel-Minimax Optimization for Efficient and Reliable Transfer Attackscited by 0
  4. 2026Anchoring Adversarial Trajectories to Data Manifolds: A Bilevel Transfer Optimization Frameworkcited by 0