mlsanityData to 7 Oct 2026

Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Models

arXiv 2306.12941 ↗First posted 22 Jun 2023cs.CV cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Adversarial robustness has been studied extensively in image classification, especially for the ℓ_∞-threat model, but significantly less so for related tasks such as object detection and semantic segmentation, where attacks turn out to be a much harder optimization problem than for image classification. We propose several problem-specific novel attacks minimizing different metrics in accuracy and mIoU. The ensemble of our attacks, SEA, shows that existing attacks severely overestimate the robustness of semantic segmentation models. Surprisingly, existing attempts of adversarial training for semantic segmentation models turn out to be weak or even completely non-robust. We investigate why previous adaptations of adversarial training to semantic segmentation failed and show how recently proposed robust ImageNet backbones can be used to obtain adversarially robust semantic segmentation models with up to six times less training time for PASCAL-VOC and the more challenging ADE20k. The associated code and robust models are available at https://github.com/nmndeep/robust-segmentation

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 44 of its 51 references that are in the map. First posted on arXiv 22 Jun 2023.

Builds on

44 of 51 references.

References · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2022A ConvNet for the 2020scited by 3,545
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Pyramid Scene Parsing Networkcited by 2,472
  10. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2018Unified Perceptual Parsing for Scene Understandingcited by 1,265
32 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  2. 2016Semantic Understanding of Scenes through the ADE20K Datasetcited by 1,063
  3. 2021Segmenter: Transformer for Semantic Segmentationcited by 855
  4. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  5. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  6. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  7. 2017Adversarial Patchcited by 514
  8. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  9. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  10. 2021Are Transformers More Robust Than CNNs?cited by 187
  11. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  12. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  13. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  14. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  15. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  16. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  17. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  18. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  19. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  20. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  21. 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
  22. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  23. 2021Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attackscited by 55
  24. 2017Houdini: Fooling Deep Structured Prediction Modelscited by 50
  25. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
  26. 2016Adversarial Perturbations Against Deep Neural Networks for Malware Classificationcited by 42
  27. 2018Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentationcited by 40
  28. 2020Dynamic Divide-and-Conquer Adversarial Training for Robust Semantic Segmentationcited by 38
  29. 2022Proximal Splitting Adversarial Attacks for Semantic Segmentationcited by 23
  30. 2019DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentationcited by 14
  31. 2019AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentationcited by 10
  32. 2020From a Fourier-Domain Perspective on Adversarial Examples to a Wiener Filter Defense for Semantic Segmentationcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 5; 2025: 3; 2026: 3.

12 papers.

  1. 2025Unlearning That Lasts: Utility-Preserving, Robust, and Almost Irreversible Forgetting in LLMscited by 9
  2. 2025PatchGuard: Adversarially Robust Anomaly Detection and Localization through Vision Transformers and Pseudo Anomaliescited by 8
  3. 2024PartImageNet++ Dataset: Scaling up Part-based Models for Robust Recognitioncited by 7
  4. 2024Segmentation-guided MRI reconstruction for meaningfully diverse reconstructionscited by 6
  5. 2023Segment (Almost) Nothing: Prompt-Agnostic Adversarial Attacks on Segmentation Modelscited by 5
  6. 2024Red-Teaming Segment Anything Modelcited by 4
  7. 2025Rethinking Semi-supervised Segmentation Beyond Accuracy: Reliability and Robustnesscited by 3
  8. 2024On the Robustness of Adversarial Training Against Uncertainty Attackscited by 2
  9. 2024Evaluating the Adversarial Robustness of Semantic Segmentation: Trying Harder Pays Offcited by 1
  10. 2026On the Adversarial Robustness of Discrete Image Tokenizerscited by 0
  11. 2026TsallisPGD: Adaptive Gradient Weighting for Adversarial Attacks on Semantic Segmentationcited by 0
  12. 2026SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentationcited by 0