Pith. sign in

REVIEW 3 major objections 4 minor 41 references

IGME shows that chaining differentiable attack components into one shared computation graph can deliver most of the transferability benefit of multi-model ensemble attacks on semantic segmentation at a fraction of the compute.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review

2026-08-01 07:28 UTC pith:5UECO7Y6

load-bearing objection The chained single-graph idea is a legitimate efficiency contribution, but with the component chain unspecified the transferability results can't be evaluated as written. the 3 major comments →

arxiv 2607.27465 v1 pith:5UECO7Y6 submitted 2026-07-29 cs.CV

IGME: Efficient Chained Method Ensemble for Transferable Semantic Segmentation Attacks

Mengqi He , Jing Zhang This is my paper
classification cs.CV
keywords transferable adversarial attackssemantic segmentationmethod ensemblechained compositionintegrated gradientsattack efficiencydense prediction robustnesssingle-source attack
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

IGME claims that transferable adversarial attacks on semantic segmentation can be made much cheaper by composing several attack heuristics into one chained computation graph that shares a single source-model forward-backward pass, instead of evaluating each heuristic separately or ensembling multiple models. To keep chained updates stable, the paper averages gradients along a straight-line path from a baseline to the current image, an integrated-gradient-style heuristic. Across Pascal VOC and Cityscapes, IGME matches or beats strong single-source attacks on several cross-architecture targets and runs roughly three to seven times faster than a model-ensemble baseline, all while accessing only one source model. If the claim holds, robustness evaluation of dense predictors becomes more affordable and more scalable.

Core claim

The central claim is that chained composition of differentiable transfer-enhancing attack components, followed by an integrated-gradient-style path-averaged sign update, produces adversarial perturbations for semantic segmentation whose cross-model transferability is competitive with single-source baselines and whose runtime is far below model-ensemble attacks. With DeepLabV3-ResNet50 as source, IGME drives target mIoU down to 0.1892 on DeepLabV3-ResNet101 and 0.2100 on FCN-VGG16, compared with 0.2610 and 0.4246 for a strong single-source NI baseline, while the model-ensemble SVRE reaches 0.2490 and 0.2856 on the same targets. On Cityscapes, IGME's runtime is 7.05 seconds per batch versus 23

What carries the argument

The load-bearing object is the chained composition T = T1∘⋯∘TN of differentiable attack components placed in a single computation graph, so the source model is evaluated once per attack iteration regardless of N. The stabilizer is the integrated-gradient-style path average: d_t = (x_t − r) ⊙ ∫₀¹ ∇J_t(r + η(x_t − r)) dη, approximated with M=2 samples at η=1/2 and η=1, then applied as sign(d_t) with L∞ clipping. This turns a multi-branch ensemble into one shared pass, reducing per-iteration cost from O(N(A+B)) to O(N A + B), plus the M path samples. The paper emphasizes that this is a heuristic composition, not a probabilistic ensemble or an algebraic approximation to averaging perturbations,

Load-bearing premise

All transferability results depend on the un-named chain T = T1∘⋯∘TN of differentiable attack components, so a reader cannot tell whether the gains come from chaining or from the particular components chosen.

What would settle it

Replace the hidden chain T with the identity operator (T(z)=z), which reduces IGME to PGD with the path-averaged direction, and rerun the Pascal VOC transfer matrix; if the transfer gains over plain PGD vanish, the improvement is attributable to the components, not to the chaining mechanism.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X LinkedIn Reddit HN

If this is right

  • Transfer-robustness evaluation for segmentation models can be run with one source model at a fraction of the cost of model ensembles, making dense-prediction robustness audits more practical.
  • The M path samples provide a tunable compute/transfer trade-off: the paper's sweep shows M=2 gives most of the gain, with M>2 offering diminishing returns.
  • Chained composition works with any differentiable attack components, so existing single-source heuristics (input diversity, translation invariance, Nesterov steps) can be combined without paying per-component model passes.
  • Preliminary results against SAM transformer backbones suggest the efficiency gain carries to vision foundation models, though the paper reports this as a qualitative study only.
  • The mixed source-target pattern indicates chaining reduces but does not eliminate architecture sensitivity, so the best transfer setting still depends on the chosen source model.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper never names which components T1,...,TN are used, so the strongest test of the central claim is reproducing the chain with published components; until then, part of the observed gain may come from the particular component choice rather than from chaining itself.
  • The IG-style path average costs M extra forward-backward passes; if a simple momentum term on the gradient yielded the same transferability at no extra cost, the path-average would be harder to justify as an efficiency measure.
  • Because IGME needs only one source model, it could be combined with other single-source improvements, such as variance tuning or scale-invariant step sizes, to push transferability further within the same compute budget.
  • The reported image quality of IGME examples is often lower than PGD's in terms of PSNR and SSIM, suggesting the chained path-average may trade perturbation invisibility for transferability; the paper does not discuss this trade-off.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes IGME, a single-source transferable adversarial attack for semantic segmentation. The method composes differentiable attack components in a chain T = T_1 ∘ ⋯ ∘ T_N so that all components share one source-model forward–backward pass, and then applies an integrated-gradient-style path average over M samples to stabilize the update direction. Experiments on Pascal VOC and Cityscapes compare IGME against single-source attacks (PGD, NI, DI, TI, IAA, SegPGD) and model-ensemble attacks (ENS, SVRE), reporting transferability via mIoU/SR and runtime in Table 5. The central claim is an improved transferability–efficiency trade-off: competitive off-diagonal transferability relative to single-source baselines and favorable runtime relative to model-ensemble attacks, using only one source model.

Significance. If the claimed trade-off holds, the paper addresses a real cost bottleneck: dense-prediction transfer attacks are expensive, and model-ensemble methods multiply the cost. The complexity accounting in §3.2 is a useful contribution, and Table 5 clearly separates the effect of chaining (3.35 s vs. 23.95 s on DeepLabV3 against SVRE) from the additional cost of the two-sample IG path average (7.05 s). The paper is also honest about the heuristic nature of the IG stabilization and about mixed gains across source–target pairs. However, the empirical core is currently not reproducible because the component chain T is never specified, and the headline transferability comparison uses twice the source-model gradient budget of the single-source baselines. The central claim is therefore not verifiable in the manuscript as written.

major comments (3)
  1. [§3.2 / Algorithm 1 / Eq. (2)] The method is defined for an arbitrary differentiable chain T=T1∘⋯∘TN, but no experiment instantiates the Ti. The text gives only examples ('input transformations, smoothing operators, gradient-shaping modules'), and all tables (1, 2, 4, 5) report 'IGME' or 'chain' without naming the components or their order. Since every transferability number depends on this configuration, the results are not reproducible and cannot be attributed to the proposed mechanism: if T happens to contain DI/TI/momentum-type modules, the gains over NI/PGD could reflect those known components plus the 2× gradient budget rather than chaining or IG averaging. Please disclose the exact chain, per-component ablations, and the order of composition.
  2. [§3.2, Tables 1–2] The default M=2 makes IGME use 20 source-model gradient evaluations per image, while the single-source baselines (PGD, NI, DI, TI, IAA) use K=10. The headline claim of 'competitive transferability compared with single-source baselines' is therefore computed at twice the source-model cost. Table 5 provides a chain-only baseline at 10 evaluations, but it does not include a single-source attack run at 20 evaluations. I request an equal-cost comparison (e.g., 20-iteration NI/PGD, or M=1 with 20 iterations) to establish whether the off-diagonal gains persist when the compute budget is matched, and recommend that the abstract and conclusion be qualified accordingly.
  3. [Table 5 / Figure 2] The runtime/transferability numbers and the cosine-similarity evidence are reported as single runs without error bars or repeated-seed statistics. Figure 2 is described as 'reported experiment' and is used to support the stabilization rationale for IG-style path averaging; without repetition counts or variance, this evidence is anecdotal. I ask for mean±std over at least three runs for Figure 2 and for the key rows of Table 5, or a clear statement that these are single illustrative runs and not the basis of the main claim.
minor comments (4)
  1. [§1, Contributions] Typo in the third bullet: 'We evaluate the on Pascal VOC' should read 'We evaluate the method on Pascal VOC'.
  2. [Table 4] The ablation strategies ('average of perturbation', 'average of loss', 'average logit', 'chain') are not precisely defined. In particular, it is unclear what set of components is being averaged or chained, and over what branches/iterations. Please define each strategy formally using the notation of §3.
  3. [§4.3 / Figure 2] The claim that IGME 'is more consistent in the reported run' should be tempered unless multiple runs are shown; one run without error bars supports only a qualitative illustration.
  4. [§4.4] The SAM experiment is described as 'preliminary' and left to the supplementary material. If the main text is not going to present quantitative SAM results, the sentence should say so explicitly to avoid the impression that a full evaluation exists.

Circularity Check

0 steps flagged

No material circularity; the one self-citation is a non-load-bearing evaluation protocol, and the undisclosed chain is a reproducibility gap rather than a circular reduction.

full rationale

IGME is a heuristic attack formulation, not a first-principles derivation, and the paper explicitly frames its IG-style path average as an empirical stabilizer rather than a proven guarantee (Section 3: 'We use this path averaging as a stabilization heuristic, rather than as a proof of optimality or guaranteed transferability'). The central transferability claims are evaluated on external benchmarks (Pascal VOC, Cityscapes) against standard, externally published attacks (NI, DI, TI, ENS, SVRE, etc.) and against the authors' own chained baseline. No equation in the paper reduces to its own input: Eq. (4) is a standard path-averaged gradient, and the update in Eq. (5) is a standard sign-projected step; the M=2 default is justified by a reported sweep framed as a runtime/transfer trade-off, not as a parameter fitted to the test set and then presented as an independent prediction. The only self-citation is [17], used to inherit an evaluation protocol and baseline adaptations; the underlying methods (NI, DI, TI, etc.) are established outside this paper, so the citation is not load-bearing for the derivation. The main weakness—the composition chain T = T_1 ∘ … ∘ T_N is never concretely instantiated—is a reproducibility/completeness problem, not a circularity, because the paper nowhere defines T in terms of the reported transferability numbers. Overall, no circular step can be exhibited from the paper's own equations or citations; the score reflects only the minor self-citation of the evaluation protocol.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

IGME is an empirical heuristic: no theorem either composes attack components or guarantees path averaging. It relies on standard threat-model assumptions, the prior benchmark protocol [17], and a series of hand-chosen or inherited design choices (black baseline, straight-line path, M samples, K iterations). The central unexamined premise is that chaining components in one graph preserves their individual transfer benefits; this is asserted rather than derived.

free parameters (5)
  • Path samples M = 2
    Default set after sweep M∈{1,2,3,4} on the same benchmarks (§4.3); balances runtime against transferability.
  • Attack iterations K = 10
    Inherited from prior protocol [17]; controls compute budget. IGME uses KM=20 gradient evaluations per image.
  • Step size α = not reported
    Appears in Eq. 5 but no value is given; presumably epsilon/K or fixed, but unstated.
  • Component chain T_1...T_N = not specified
    The central design choice; the main text never names the components chained in experiments.
  • Baseline image r = black (0)
    Chosen by hand, following integrated-gradients practice [34]; affects the path average.
axioms (4)
  • domain assumption L∞-bounded transfer attack threat model, with scalar segmentation loss as discrepancy metric
    Eq. 1 and Algorithm 1; standard in transfer attack literature, inherited from [17].
  • ad hoc to paper The chain T = T1∘...∘TN of differentiable attack components preserves or enhances transferability and can be optimized by one shared source-model backward pass
    Central method premise, §3.2-§3.3; no derivation, only heuristic and empirical evaluation.
  • domain assumption Straight-line IG path from black baseline r to current adversarial image yields a useful stabilizer
    Eq. 3-4; borrowed from [20,26,34]; used as a stabilization heuristic.
  • domain assumption Composition of differentiable components is meaningful even though complete attacks (PGD/NI/SegPGD) include non-differentiable sign/clip/state
    §3 note; needed for Eq. 2 to be differentiable w.r.t. z.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of IGME: Efficient Chained Method Ensemble for Transferable Semantic Segmentation Attacks." pith.science (2026). https://pith.science/paper/5UECO7Y6

@misc{pith2026260727465,
  author       = {Pith},
  title        = {Pith review of: IGME: Efficient Chained Method Ensemble for Transferable Semantic Segmentation Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5UECO7Y6}},
  note         = {Machine review of arXiv:2607.27465}
}
Share X LinkedIn Reddit HN
read the original abstract

Semantic segmentation models are vulnerable to transferable adversarial perturbations, yet evaluating transfer attacks on dense prediction models can be computationally expensive. Existing ensemble attacks often rely on multiple surrogate models, increasing the computation cost, even harder for segmentation. This paper studies an efficient single-source alternative for transferable attacks on semantic segmentation. We formulate transferable attack composition as a chained computation over differentiable attack components, allowing the expensive source-model gradient computation to be shared. To reduce the update instability introduced by chained composition, we further use an integrated-gradient-style path-averaged direction as an empirical stabilization heuristic. Experiments on Pascal VOC and Cityscapes evaluate the resulting transferability efficiency trade-off across CNN- and transformer-based segmentation models. IGME achieves competitive transferability compared with single-source baselines and favorable runtime compared with model-ensemble attacks, while requiring access to only one source model.

Figures

Figures reproduced from arXiv: 2607.27465 by Jing Zhang, Mengqi He.

Figure 1
Figure 1. Figure 1: Motivating source-to-target transfer example. A PGD adversarial example is generated on DeepLabV3 using a Cityscapes image and evaluated on DeepLabV3+ [4, 5, 7, 28]. The source prediction (“Noise”) is more strongly degraded than the target prediction (“Noise+”), illustrating the architecture-transfer gap. The example follows the evaluation protocol of prior transferable-segmentation work [17] and is includ… view at source ↗
Figure 2
Figure 2. Figure 2: Cosine similarity for chained component attacks with and without IG-style path averaging. Higher similarity indicates more stable update directions in this experiment; it is used as em￾pirical evidence of step-wise stabilization rather than as a formal guarantee of transferability. a scalar attack objective rather than directly with respect to the dense model output. Let T = T1 ◦ T2 ◦ · · · ◦ TN denote the… view at source ↗
Figure 3
Figure 3. Figure 3: Visualization of adversarial segmentation results on two examples. For each example, the baseline and IGME rows show predictions after 1, 5, 10, and 20 attack iterations. (a) is the input image, (b) is the clean segmentation, and (c)–(f) are the attacked predictions after the corresponding iteration counts. These qualitative examples suggest faster prediction degradation for IGME in the shown cases. crease… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 4 linked inside Pith

  1. [1]

    Arnab, O

    A. Arnab, O. Miksik, and P. H. Torr. On the robustness of semantic segmentation models to adversarial attacks. In IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR), pages 888–897, 2018. 1, 2

    2018

  2. [2]

    B. Chen, J. Yin, S. Chen, B. Chen, and X. Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability. InIEEE International Conference on Com- puter Vision (ICCV), pages 4466–4475, 2023. 2

    2023

  3. [3]

    H. Chen, Y . Zhang, Y . Dong, X. Yang, H. Su, and J. Zhu. Rethinking model ensemble in transfer-based adversarial at- tacks. InThe Twelfth International Conference on Learning Representations, 2024. 2

    2024

  4. [4]

    L. Chen, G. Papandreou, F. Schroff, and H. Adam. Re- thinking atrous convolution for semantic image segmenta- tion.CoRR, abs/1706.05587, 2017. 2, 4

    Pith/arXiv arXiv 2017

  5. [5]

    L.-C. Chen, Y . Zhu, G. Papandreou, F. Schroff, and H. Adam. Encoder-decoder with atrous separable convolution for se- mantic image segmentation. InEuropean Conference on Computer Vision (ECCV), pages 801–818, 2018. 2, 4

    2018

  6. [6]

    Cheng, I

    B. Cheng, I. Misra, A. G. Schwing, A. Kirillov, and R. Gird- har. Masked-attention mask transformer for universal image segmentation. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1290–1299, 2022. 4

    2022

  7. [7]

    Cordts, M

    M. Cordts, M. Omran, S. Ramos, T. Rehfeld, M. Enzweiler, R. Benenson, U. Franke, S. Roth, and B. Schiele. The cityscapes dataset for semantic urban scene understanding. InIEEE Conference on Computer Vision and Pattern Recog- nition (CVPR), pages 3213–3223, 2016. 2, 4

    2016

  8. [8]

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recog- nition (CVPR), pages 9185–9193, 2018. 1, 2

    2018

  9. [9]

    Y . Dong, T. Pang, H. Su, and J. Zhu. Evading defenses to transferable adversarial examples by translation-invariant at- tacks. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4312–4321, 2019. 2, 4, 5

    2019

  10. [10]

    Everingham, L

    M. Everingham, L. V . Gool, C. K. I. Williams, J. M. Winn, and A. Zisserman. The pascal visual object classes (VOC) challenge.Int. J. Comput. Vis., 88(2):303–338, 2010. 4, 5

    2010

  11. [11]

    Fischer, M

    V . Fischer, M. C. Kumar, J. H. Metzen, and T. Brox. Ad- versarial examples for semantic image segmentation. InIn- ternational Conference on Learning Representations (ICLR) Workshop, 2017. 2

    2017

  12. [12]

    Ganeshan, B

    A. Ganeshan, B. S. Vivek, and R. V . Babu. Fda: Feature dis- ruptive attack.international conference on computer vision,

  13. [13]

    Girdhar, A

    R. Girdhar, A. El-Nouby, Z. Liu, M. Singh, K. V . Alwala, A. Joulin, and I. Misra. Imagebind: One embedding space to bind them all. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 15180–15190, 2023. 6

    2023

  14. [14]

    I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. InInternational Confer- ence on Learning Representations (ICLR), 2015. 2, 4, 5

    2015

  15. [15]

    J. Gu, H. Zhao, V . Tresp, and P. H. Torr. Segpgd: An effec- tive and efficient adversarial attack for evaluating and boost- ing segmentation robustness. InEuropean Conference on Computer Vision (ECCV), pages 308–325, 2022. 2, 4, 5

    2022

  16. [16]

    J. Gu, H. Zhao, V . Tresp, and P. H. S. Torr. Adversarial examples on segmentation models can be easy to transfer. CoRR, abs/2111.11368, 2021. 2

    Pith/arXiv arXiv 2021

  17. [17]

    M. He, J. Zhang, and X. Yu. Transferable attacks for seman- tic segmentation. In T. Chen, Y . Cao, Q. V . H. Nguyen, and T. T. Nguyen, editors,Databases Theory and Applications - 35th Australasian Database Conference, ADC 2024, Gold Coast, QLD, Australia, December 16-18, 2024, Proceedings, volume 15449 ofLecture Notes in Computer Science, pages 372–388. S...

    2024

  18. [18]

    Hendrik Metzen, M

    J. Hendrik Metzen, M. Chaithanya Kumar, T. Brox, and V . Fischer. Universal adversarial perturbations against se- mantic image segmentation. InIEEE International Confer- ence on Computer Vision (ICCV), pages 2755–2764, 2017. 2

    2017

  19. [19]

    Huang, Z

    H. Huang, Z. Chen, H. Chen, Y . Wang, and K. Zhang. T- SEA: transfer-based self-ensemble attack on object detec- tion. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 20514–20523, 2023. 2

    2023

  20. [20]

    Huang and A

    Y . Huang and A. W. Kong. Transferable adversarial attack based on integrated gradients. InInternational Conference on Learning Representations (ICLR), 2022. 2, 3

    2022

  21. [21]

    Kirillov, E

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W. Lo, P. Doll´ar, and R. B. Girshick. Segment anything.CoRR, abs/2304.02643, 2023. 6

    Pith/arXiv arXiv 2023

  22. [22]

    D. Li, J. Yang, K. Kreis, A. Torralba, and S. Fidler. Seman- tic segmentation with generative models: Semi-supervised learning and strong out-of-domain generalization. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 8296–8307, 2021. 1 7

    2021

  23. [23]

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial at- tacks. InInternational Conference on Learning Representa- tions (ICLR), 2019. 2, 3, 4, 5

    2019

  24. [24]

    Y . Liu, X. Chen, C. Liu, and D. Song. Delving into trans- ferable adversarial examples and black-box attacks. InIn- ternational Conference on Learning Representations (ICLR),

  25. [25]

    J. Long, E. Shelhamer, and T. Darrell. Fully convolutional networks for semantic segmentation. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3431–3440, 2015. 4

    2015

  26. [26]

    W. Ma, Y . Li, X. Jia, and W. Xu. Transferable adversarial attack for both vision transformers and convolutional net- works via momentum integrated gradients. InProceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 4630–4639, 2023. 2

    2023

  27. [27]

    Maag and A

    K. Maag and A. Fischer. Uncertainty-weighted loss func- tions for improved adversarial attacks on semantic segmen- tation. InIEEE Winter Conference on Applications of Com- puter Vision (WACV), pages 3894–3902, 2024. 2

    2024

  28. [28]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to ad- versarial attacks. InInternational Conference on Learning Representations, 2018. 2, 4, 5

    2018

  29. [29]

    Naseer, K

    M. Naseer, K. Ranasinghe, S. Khan, F. S. Khan, and F. Porikli. On improving adversarial transferability of vision transformers.arXiv preprint arXiv:2106.04169, 2021. 2

    Pith/arXiv arXiv 2021

  30. [30]

    W. Qu, Y . Li, and B. Wang. A certified radius-guided attack framework to image segmentation models. In8th IEEE Eu- ropean Symposium on Security and Privacy, EuroS&P 2023, Delft, Netherlands, July 3-7, 2023, pages 200–220. IEEE,

    2023

  31. [31]

    Radford, J

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever. Learning transferable vi- sual models from natural language supervision. InInter- national Conference on Machine Learning (ICML), volume 139, pages 8748–8763, 2021. 6

    2021

  32. [32]

    Ranftl, A

    R. Ranftl, A. Bochkovskiy, and V . Koltun. Vision transform- ers for dense prediction. InIEEE International Conference on Computer Vision (ICCV), pages 12179–12188, 2021. 1

    2021

  33. [33]

    J. Rony, J. Pesquet, and I. B. Ayed. Proximal splitting adver- sarial attack for semantic segmentation. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 20524–20533, 2023. 2

    2023

  34. [34]

    Sundararajan, A

    M. Sundararajan, A. Taly, and Q. Yan. Axiomatic attribution for deep networks. In D. Precup and Y . W. Teh, editors,In- ternational Conference on Machine Learning (ICML), vol- ume 70 ofProceedings of Machine Learning Research, pages 3319–3328. PMLR, 2017. 2, 3

    2017

  35. [35]

    Wang and K

    X. Wang and K. He. Enhancing the transferability of adver- sarial attacks through variance tuning.computer vision and pattern recognition, 2021. 2

    2021

  36. [36]

    Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli. Image quality assessment: from error visibility to structural similarity.IEEE Transactions on Image Processing (TIP), 13(4):600–612, 2004. 4

    2004

  37. [37]

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille. Adversarial examples for semantic segmentation and object detection. InIEEE International Conference on Computer Vision (ICCV), pages 1378–1387, 2017. 1, 2, 4, 5

    2017

  38. [38]

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille. Improving transferability of adversarial exam- ples with input diversity. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2730–2739,

  39. [39]

    Xiong, J

    Y . Xiong, J. Lin, M. Zhang, J. E. Hopcroft, and K. He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 14963–14972, 2022. 1, 2, 4, 5

    2022

  40. [40]

    W. Zhou, X. Hou, Y . Chen, M. Tang, X. Huang, X. Gan, and Y . Yang. Transferable adversarial perturbations. InEuro- pean Conference on Computer Vision (ECCV), pages 452– 467, 2018. 2

    2018

  41. [41]

    Y . Zhu, J. Sun, and Z. Li. Rethinking adversarial transfer- ability from a data distribution perspective. InInternational Conference on Learning Representations (ICLR), 2022. 5 8

    2022

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.