BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Tasks
Not on the map. Why?
Abstract (arXiv)
Pixel-wise regression tasks (e.g., monocular depth estimation (MDE) and optical flow estimation (OFE)) have been widely involved in our daily life in applications like autonomous driving, augmented reality and video composition. Although certain applications are security-critical or bear societal significance, the adversarial robustness of such models are not sufficiently studied, especially in the black-box scenario. In this work, we introduce the first unified black-box adversarial patch attack framework against pixel-wise regression tasks, aiming to identify the vulnerabilities of these models under query-based black-box attacks. We propose a novel square-based adversarial patch optimization framework and employ probabilistic square sampling and score-based gradient estimation techniques to generate the patch effectively and efficiently, overcoming the scalability problem of previous black-box patch attacks. Our attack prototype, named BadPart, is evaluated on both MDE and OFE tasks, utilizing a total of 7 models. BadPart surpasses 3 baseline methods in terms of both attack performance and efficiency. We also apply BadPart on the Google online service for portrait depth estimation, causing 43.5% relative distance error with 50K queries. State-of-the-art (SOTA) countermeasures cannot defend our attack effectively.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 47 of its 65 references that are in the map. First posted on arXiv 1 Apr 2024.
Builds on
47 of 65 references.
References · 47
- 2020RAFT: Recurrent All-Pairs Field Transforms for Optical Flowcited by 2,415
- 2015FlowNet: Learning Optical Flow with Convolutional Networkscited by 1,059
- 2017PWC-Net: CNNs for Optical Flow Using Pyramid, Warping, and Cost Volumecited by 968
- 2016FlowNet 2.0: Evolution of Optical Flow Estimation with Deep Networkscited by 784
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2018BiSeNet: Bilateral Segmentation Network for Real-time Semantic Segmentationcited by 645
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
- 2017Sparsity Invariant CNNscited by 326
- 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
35 more
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
- 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
- 2022Rethinking Semantic Segmentation: A Prototype Viewcited by 140
- 2019Self-Supervised Monocular Depth Hintscited by 127
- 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
- 2021Estimating and Exploiting the Aleatoric Uncertainty in Surface Normal Estimationcited by 116
- 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
- 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
- 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 87
- 2021SG-Net: Spatial Granularity Network for One-Stage Video Instance Segmentationcited by 87
- 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
- 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
- 2019ZO-AdaMM: Zeroth-Order Adaptive Momentum Method for Black-Box Optimizationcited by 76
- 2023MagicEdit: High-Fidelity and Temporally Coherent Video Editingcited by 76
- 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
- 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
- 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
- 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
- 2020MonoRec: Semi-Supervised Dense Reconstruction in Dynamic Environments from a Single Moving Cameracited by 59
- 2022Physical Attack on Monocular Depth Estimation with Optimal Adversarial Patchescited by 57
- 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
- 2019Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimizationcited by 49
- 2019Attacking Optical Flowcited by 41
- 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 37
- 2022PlaneDepth: Self-supervised Depth Estimation via Orthogonal Planescited by 32
- 2023TransFlow: Transformer as Flow Learnercited by 32
- 2023CLUSTSEG: Clustering for Universal Segmentationcited by 32
- 2023SQLdepth: Generalizable Self-Supervised Fine-Structured Monocular Depth Estimationcited by 21
- 2019Deep Surface Normal Estimation with Hierarchical RGB-D Fusioncited by 20
- 2023Query-Efficient Decision-based Black-Box Patch Attackcited by 19
- 2022Learning Equivariant Segmentation with Instance-Unique Queryingcited by 17
- 2023Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attackscited by 17
- 2023Fusion is Not Enough: Single Modal Attacks on Fusion Models for 3D Object Detectioncited by 11
- 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8
- 2021EvoBA: An Evolution Strategy as a Strong Baseline forBlack-Box Adversarial Attackscited by 4
Built on by
Citing papers per year: 2024: 1; 2025: 1; 2026: 1.
3 papers.