mlsanityData to 14 Oct 2026

TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation

arXiv 2312.02207 ↗First posted 3 Dec 2023cs.CVcited by 10

Not on the map. Why?

Abstract (arXiv)

Transferability of adversarial examples on image classification has been systematically explored, which generates adversarial examples in black-box mode. However, the transferability of adversarial examples on semantic segmentation has been largely overlooked. In this paper, we propose an effective two-stage adversarial attack strategy to improve the transferability of adversarial examples on semantic segmentation, dubbed TranSegPGD. Specifically, at the first stage, every pixel in an input image is divided into different branches based on its adversarial property. Different branches are assigned different weights for optimization to improve the adversarial performance of all pixels.We assign high weights to the loss of the hard-to-attack pixels to misclassify all pixels. At the second stage, the pixels are divided into different branches based on their transferable property which is dependent on Kullback-Leibler divergence. Different branches are assigned different weights for optimization to improve the transferability of the adversarial examples. We assign high weights to the loss of the high-transferability pixels to improve the transferability of adversarial examples. Extensive experiments with various segmentation models are conducted on PASCAL VOC 2012 and Cityscapes datasets to demonstrate the effectiveness of the proposed method. The proposed adversarial attack method can achieve state-of-the-art performance.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Builds on 43 of its 56 references that are in the map. First posted on arXiv 3 Dec 2023.

Builds on

43 of 56 references.

References · 43

  1. 2023Segment Anythingcited by 8,234
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,859
  5. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,444
  6. 2016Pyramid Scene Parsing Networkcited by 2,479
  7. 2015Learning Deep Features for Discriminative Localizationcited by 2,436
  8. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,161
  9. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  10. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  12. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 355
31 more
  1. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  2. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  3. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  4. 2020Understanding the Failure Modes of Out-of-Distribution Generalizationcited by 146
  5. 2021On Calibration and Out-of-domain Generalizationcited by 134
  6. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  7. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  8. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  9. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  10. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  11. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  12. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  13. 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 68
  14. 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
  15. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
  16. 2018Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentationcited by 40
  17. 2020Dynamic Divide-and-Conquer Adversarial Training for Robust Semantic Segmentationcited by 38
  18. 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 37
  19. 2023Improving the Transferability of Adversarial Samples by Path-Augmented Methodcited by 36
  20. 2021Scalable Certified Segmentation via Randomized Smoothingcited by 35
  21. 2022Transferable Adversarial Attack based on Integrated Gradientscited by 35
  22. 2020Improving Query Efficiency of Black-box Adversarial Attackcited by 34
  23. 2017Adversarial Examples for Semantic Image Segmentationcited by 33
  24. 2019Cubic LSTMs for Video Predictioncited by 32
  25. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  26. 2023On the Robustness of Segment Anythingcited by 25
  27. 2021Adversarial Examples on Segmentation Models Can be Easy to Transfercited by 15
  28. 2023Reliable Evaluation of Adversarial Transferabilitycited by 13
  29. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  30. 2023Transferable Attack for Semantic Segmentationcited by 4
  31. 2021Clustering Effect of (Linearized) Adversarial Robust Modelscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 4; 2025: 4; 2026: 2.

10 papers.

  1. 2024Multi-Pair Temporal Sentence Grounding via Multi-Thread Knowledge Transfer Networkcited by 15
  2. 2024PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentationcited by 14
  3. 2025SegTrans: Transferable Adversarial Examples for Segmentation Modelscited by 8
  4. 2024Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Settingcited by 3
  5. 2024On Evaluating Adversarial Robustness of Volumetric Medical Segmentation Modelscited by 2
  6. 2025FSPGD: Rethinking Black-box Attacks on Semantic Segmentationcited by 0
  7. 2025AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant T2I Adversarial Patchescited by 0
  8. 2025Proxy-Embedding as an Adversarial Teacher: An Embedding-Guided Bidirectional Attack for Referring Expression Segmentation Modelscited by 0
  9. 2026OmniPatch: A Universal Adversarial Patch for ViT-CNN Cross-Architecture Transfer in Semantic Segmentationcited by 0
  10. 2026A Unified Spatial Alignment Framework for Highly Transferable Transformation-Based Attacks on Spatially Structured Taskscited by 0