DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation

Byungsoo Oh; Daeyoung Kim; Seungju Cho; Tae Joon Jun

REVIEW 4 major objections 5 minor 30 references

DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A denoising autoencoder placed before a segmentation model removes FGSM and I-FGSM perturbations, restoring up to 68% of the clean-image accuracy.

desk verdict A competent but non-adaptive defense evaluation; the 68% restoration only holds when the attacker ignores the denoiser. read the letter →

arxiv 1908.05195 v4 pith:7CKEE3XS submitted 2019-08-14 cs.CV

Seungju Cho , Tae Joon Jun , Byungsoo Oh , Daeyoung Kim This is my paper · ORCID

classification cs.CV

keywords adversarialattacksemanticsegmentationdenoisingautoencoderFGSMiterativeDeepLabV3PlusinputpreprocessingdefensePASCALVOC

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a deep denoising autoencoder trained on generic random noise, when placed in front of an off-the-shelf semantic segmentation model, can strip away adversarial perturbations from FGSM and iterative FGSM attacks. The defense requires no retraining of the segmentation model — the autoencoder alone purifies the input. On clean images, the autoencoder costs only about 3% of the original mIoU. On adversarial images, it recovers up to 68% of the original clean performance, where the attacked model alone retains only about 13%. The paper tests three noise distributions and reports that a bimodal noise model yields the strongest defense.

What carries the argument

The central mechanism is the denoising autoencoder architecture: five convolutional encoder layers that halve resolution via strided convolutions, five deconvolutional decoder layers that double it, symmetric skip connections (excluding the first layer) to preserve spatial detail, ELU activations, and a sigmoid output. It is trained on PASCAL VOC images corrupted with Gaussian, Uniform, or Bimodal random noise, using both clean and noisy inputs so that clean-image performance is preserved. Placed in front of the unchanged segmentation model, it serves as a generic preprocessing defense whose noise-distribution choice modulates the trade-off between clean-image fidelity and adversarial robustness.

What would settle it

Generate a new adversarial image by computing the FGSM or I-FGSM perturbation with gradients backpropagated through the full composite of DAPAS followed by DeepLab V3 Plus, then measure the resulting mIoU. If the IoU drops to a level comparable to the undefended attack (around 13% of clean performance at epsilon 0.032), the central claim is falsified for adaptive adversaries.

Watch

Extended reading notes

Core claim

The central claim is that a denoising autoencoder (DAPAS) trained on random noise drawn from Gaussian, Uniform, or Bimodal distributions can act as a learned preprocessing filter that removes adversarial perturbations from images before they reach a semantic segmentation model. Using DeepLab V3 Plus as the victim model and PASCAL VOC 2012 as the dataset, the paper shows that after an FGSM or I-FGSM attack, passing the adversarial image through the autoencoder restores the mean Intersection over Union to about 68% of the clean baseline, while the unprotected model drops to about 13%. The clean-image cost is small, with an IoU reduction ratio of roughly 97% across all noise distributions. Because the autoencoder is trained on attack-agnostic random noise, the paper contends that it can defend against a variety of attacks without retraining the segmentation model.

Load-bearing premise

The defense is only tested against non-adaptive attacks, meaning the adversary creates the perturbation for the segmentation model alone and does not take the denoising autoencoder into account; if the attacker optimizes through both the autoencoder and the segmenter, the defense may not hold.

Editorial extensions

If this is right

If the claim holds, any existing semantic segmentation model can be made more robust to gradient-based attacks without retraining, simply by prepending a trained denoising autoencoder.
The approach is attack-agnostic in principle, because the autoencoder learns to remove generic noise rather than the specific perturbation pattern of a single attack.
The clean-image cost is small enough (about 3% mIoU) that the defense could be deployed in practical pipelines such as autonomous driving perception.
The same preprocessing idea could extend to image classification and object detection, since the autoencoder operates independently of the downstream task.
The noise-distribution choice matters: bimodal noise, which matches the signed, fixed-magnitude structure of FGSM-style perturbations, gives the strongest attack recovery.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper evaluates only non-adaptive attacks, where perturbations are computed against the segmentation model alone. If an attacker computes the adversarial perturbation through the full composite (autoencoder plus segmenter), the defense could collapse because gradients can be backpropagated through the autoencoder; future adversarial-training or stochastic-smoothing variants would be needed to
The defense's effectiveness likely depends on the attack magnitude staying within the range of the noise distribution used in training; attacks with larger or more structured perturbations than the training noise may survive purification.
The reported 68% recovery for I-FGSM might understate or overstate real-world robustness, since the paper uses a single step-count schedule and does not test targeted attacks or stronger iterative methods; a broader attack suite would map the operating envelope of the defense.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. This paper is a straightforward test of an old idea—denoising autoencoder as a preprocessing defense—in a new setting, semantic segmentation. And its headline numbers (97% clean, 68% under attack) are only valid against an attacker who does not know the DAE is there. The attacks are generated against bare DeepLab V3+ and then passed through DAPAS; an adaptive attacker would compute perturbations end-to-end and likely wipe out most of that 68%.

Credit where due: the paper is clear, the experiments are plausibly run, and it appears to be one of the first defense scenarios specifically for segmentation. The relative mIoU metric is appropriate, and the clean performance drop is small across all three noise distributions. If the claim were narrowly 'a denoiser can help a segmenter in a non-adaptive threat model,' the data would support it.

The soft spots are the usual ones, and they are substantial. No adaptive attacks are tested or even discussed, despite the paper citing MagNet and Defense-GAN—both known to be bypassable by adaptive attacks. The noise distributions are also matched to the attack budget: Uniform range ±0.035 for max perturbation 0.032, Bimodal means ±0.024. That is tuning the defense to the attack, which undercuts the 'independent of attack' claim. There are no baselines (adversarial training, a denoiser trained on actual adversarial examples), no error bars, and no code. Minor production issues: Table IV has a truncated value ('50.2 64.').

None of this suggests bad faith; it reads like a typical early defense paper that underestimates the attacker. But the abstract's unqualified 'can be protected' is not supported. The correct claim would be 'partially mitigates FGSM and I-FGSM against an oblivious adversary.'

This paper is useful for a reading group or for someone new to segmentation defenses who needs a concrete example of why adaptive evaluation matters. It is not something I would cite as a robustness result. At the same time, it deserves a serious referee rather than a desk reject: the question is legitimate and the experiment is real, but the evaluation needs major revision.

My bottom line: send it to peer review, and let the reviewers ask for adaptive attacks. If that work gets done, the paper could be acceptable as a modest empirical contribution.

Referee Report

4 major / 5 minor

Summary. The paper proposes DAPAS, a denoising autoencoder placed as a fixed preprocessor in front of a semantic segmentation model (DeepLab V3+). The DAE is trained on PASCAL VOC 2012 images corrupted by random noise drawn from one of three distributions (Gaussian, Uniform, Bimodal), and is then evaluated by generating FGSM and I-FGSM adversarial examples against DeepLab V3+ alone, passing them through the DAE, and measuring mIoU relative to the clean baseline. The paper reports roughly a 3% clean-image mIoU reduction and, for the strongest attack tested, restoration to about 68% of the original mIoU, and claims that the defense is attack-independent because the DAE is trained only on random noise.

Significance. If the reported results were obtained against a realistic adversary, DAPAS would be a useful, simple, model-agnostic preprocessing defense for semantic segmentation, with the practical advantage of not retraining the segmenter. The paper also addresses a relatively underexplored task, adversarial robustness of semantic segmentation, and compares three noise distributions. However, the central claim rests on a non-adaptive threat model: adversarial examples are computed against the bare segmenter and only then passed through the DAE. Because the DAE is a differentiable convolutional network, a standard adaptive attack can optimize the perturbation through both stages, and the known failure mode of preprocessing defenses directly applies. The paper's own evidence also shows that the training noise is tuned to the tested attack budget, so the claim of independence from adversarial attacks is not supported. With no adaptive evaluation, no comparison to other defenses, and no statistical repeatability, the main conclusion is not established.

major comments (4)

[Section V-D and Section IV-C] The evaluation uses only adversarial examples generated against the original DeepLab V3+ model and then passed through DAPAS; no attack is computed against the composite system (DAE plus segmenter). Since the DAE is a deterministic, differentiable convolutional network, gradients of the segmentation loss can be backpropagated through both stages, so an I-FGSM/PGD attack can be run end-to-end. Preprocessing defenses of this kind are known to be bypassed by such adaptive attacks, and the abstract's unqualified claim that the attack 'can be protected' by a denoising autoencoder is therefore not supported by the experiments as designed.
[Section IV-B and Section V] The noise distributions are explicitly chosen to match the attack perturbation budget: the Uniform range is [-0.035, 0.035] because the maximum tested perturbation is 0.032, and the Bimodal means are at ±0.024 with the same budget in mind. This makes the defense a tuned denoiser for the tested attack magnitudes rather than a generic, attack-independent preprocessor, and the statement in Section IV-C that the random noise is 'independent of any adversarial attack' is contradicted by these parameter choices.
[Tables II-IV] All reported numbers are single mIoU values with no error bars, no multiple seeds, and no statistical significance tests. Given that the differences between the three noise distributions are often small (e.g., Table IV at epsilon=0.032 shows 53.3, 50.2, and 53.9), the claim that Bimodal is 'the best' is not established, and the absence of variance reporting makes the quantitative claims in the abstract (97% and 68%) unverifiable.
[Section V-D and Tables III-IV] There is no comparison against even simple baselines such as JPEG compression, total-variance minimization, or adversarial training, and no comparison to previously proposed preprocessing defenses such as MagNet or Defense-GAN, which are cited in the related work. Without such comparisons, the reader cannot judge whether the reported restoration is a meaningful advance or simply a side effect of smoothing that would also occur with generic denoising.

minor comments (5)

[Table IV] The last row of the Bimodal column reads '64.' with a missing digit; it should presumably be a value in the mid-60s consistent with the other columns.
[Section III-A] The FGSM equations use the absolute value of the sign of the gradient, which is incorrect; the standard formulation uses the sign function itself, since taking the absolute value would always produce a positive perturbation.
[Section III-B] The I-FGSM step-count formula 'min(epsilon + 2, 4 epsilon)' cannot be correct: for the epsilon values used in the experiments (e.g., 0.008) it returns 0.032, which is not an integer number of steps, and the expression mixes an epsilon in pixel units with an integer count.
[Section V-B] The text refers to 'Fig. 11' and 'Fig. 4-(d)' for the noisy image after the denoise autoencoder, but the surrounding text and figure numbering suggest these should be consistent references to the same displayed result; the figure numbering in the manuscript appears scrambled.
[Section V-D] The sentence 'When the epsilon is 0.008, 0.0016 and 0.0032' appears to contain typos; the table uses 0.001, 0.002, 0.004, 0.008, 0.016, and 0.032, so the text should be corrected to match the table.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DAPAS is an empirical defense evaluated against external FGSM/I-FGSM attacks; no prediction reduces to fitted input or self-citation.

full rationale

The paper contains no self-citation chain: all references to prior segmentation-attack results (e.g., [1]) are external. The central result—that a denoising autoencoder trained on synthetic Gaussian/Uniform/Bimodal noise restores mIoU after FGSM/I-FGSM attacks on DeepLab V3+—is an empirical measurement, not a derivation. The training noise parameters are chosen with the attack budget in mind (Uniform range -0.035 to 0.035 matches the max perturbation 0.032), but that is hyperparameter selection; the reported 68% robust IoU ratio is obtained by running real attacks and measuring mIoU, and the paper also reports the unprotected attack ratios (down to 13%), so the result is not forced by construction. The absence of adaptive attacks that differentiate through the DAE is an evaluation limitation, not a circularity: it concerns threat-model coverage, not equivalence of output to input. No equations in the paper reduce to their inputs, and no cited 'uniqueness' or prior-work claim is load-bearing. Therefore no circular step is established by the quoted text.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on several hand-chosen noise distribution parameters that are tuned to the attack budget, and on the unflagged assumption of a non-adaptive attacker. No new entities are introduced.

free parameters (5)

Gaussian noise standard deviation = 0.004
Chosen by hand to be small and to cover the tested attack perturbation magnitudes up to 0.032 (Section IV-B, V).
Uniform noise range = [-0.035, 0.035]
Chosen to cover the maximum attack epsilon of 0.032 (Section V).
Bimodal Gaussian means and standard deviation = means -0.024 and 0.024; std 0.004
Chosen to mimic the sign-based FGSM/I-FGSM perturbation pattern, which adds or subtracts a fixed magnitude (Section IV-B, V-D).
I-FGSM step count formula and alpha = step count min(epsilon+2, 4epsilon) or min(epsilon+4, 1.24epsilon); alpha=0.25
Non-standard iteration count formula and alpha value chosen without justification (Section III-B).
DAE architecture hyperparameters = 5 conv / 5 deconv layers, ELU activation, skip connections, learning rate 5e-4
No ablation or justification for these choices (Section IV-A, IV-B).

assumptions (3)

domain assumption A denoising autoencoder trained on random noise generalizes to removing structured adversarial perturbations.
Central premise of the method, not proven. This assumption is known to be fragile for preprocessing defenses, and the paper does not cite or address the adaptive-attack literature.
domain assumption The adversarial attack is generated against the original segmentation model only, not against the full defense pipeline.
The entire evaluation assumes the attacker ignores DAPAS. This is the weakest premise, and it is unflagged; see Section V-D where adversarial examples are generated for DeepLab V3 Plus alone.
domain assumption The PASCAL VOC validation set with SBD annotations is representative of general segmentation scenes.
Standard benchmark, but the defense is claimed to be general without evaluation on other datasets (Section V-A).

how reviews work

0 comments

Cite this review

Pith. "Pith review of DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation." pith.science (2026). https://pith.science/paper/7CKEE3XS

@misc{pith2026190805195,
  author       = {Pith},
  title        = {Pith review of: DAPAS : Denoising Autoencoder to Prevent Adversarial attack in Semantic Segmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7CKEE3XS}},
  note         = {Machine review of arXiv:1908.05195}
}

read the original abstract

Nowadays, Deep learning techniques show dramatic performance on computer vision area, and they even outperform human. But it is also vulnerable to some small perturbation called an adversarial attack. This is a problem combined with the safety of artificial intelligence, which has recently been studied a lot. These attacks have shown that they can fool models of image classification, semantic segmentation, and object detection. We point out this attack can be protected by denoise autoencoder, which is used for denoising the perturbation and restoring the original images. We experiment with various noise distributions and verify the effect of denoise autoencoder against adversarial attack in semantic segmentation.

Figures

Figures reproduced from arXiv: 1908.05195 by the authors.

**Figure 2.** The architecture of the denoise autoencoder [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Overall flow of DAPAS B. Training We trained with PASCAL VOC 2012 data which is widely used for the task of semantic segmentation. There are a total of 1464 training images and 1449 validation data. The pixel value with a value from 0 to 255 was re-scaled to change from 0 to 1. And the resolution of the image was fixed to 553 × 553. We use Adam optimizer for gradient descent algorithm, and use 5× 10−4 for the learni… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Effects of denoise autoencoder C. Evaluation metric The mean Intersection over Union (mIoU) is widely used for evaluating the performance of semantic segmentation [7]. And we adapt relative metric IoU Ratio for measuring the robustness [1]. The IoU ratio on the attack …

**Figure 5.** Figure 5: Bimodal distribution using two Gaussian distributions [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 6.** Figure 6: Images from adversarial attack by using FGSM and I-FGSM, images after DAPAS , and outputs for each. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: IoU ratio of attack on FGSM [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 23 canonical work pages

[1]

Arnab, O

A. Arnab, O. Miksik, and P. H. Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 888– 897, 2018

work page 2018
[2]

Carlini and D

N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 39–57. IEEE, 2017

work page 2017
[3]

L.-C. Chen, G. Papandreou, I. Kokkinos, K. Murphy, and A. L. Yuille. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs. IEEE transactions on pattern analysis and machine intelligence , 40(4):834–848, 2017

2017
[4]

L.-C. Chen, Y . Zhu, G. Papandreou, F. Schroff, and H. Adam. Encoder- decoder with atrous separable convolution for semantic image segmen- tation. In Proceedings of the European conference on computer vision (ECCV), pages 801–818, 2018

work page 2018
[5]

Cisse, P

M. Cisse, P. Bojanowski, E. Grave, Y . Dauphin, and N. Usunier. Parseval networks: Improving robustness to adversarial examples. In Proceedings of the 34th International Conference on Machine Learning-V olume 70 , pages 854–863. JMLR. org, 2017

work page 2017
[6]

Elsayed, D

G. Elsayed, D. Krishnan, H. Mobahi, K. Regan, and S. Bengio. Large margin deep networks for classiﬁcation. In Advances in neural infor- mation processing systems , pages 842–852, 2018

work page 2018
[7]

Everingham, L

M. Everingham, L. Van Gool, C. K. Williams, J. Winn, and A. Zisser- man. The pascal visual object classes (voc) challenge. International journal of computer vision , 88(2):303–338, 2010

work page 2010
[8]

Eykholt, I

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song. Robust physical-world attacks on deep learning visual classiﬁcation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 1625– 1634, 2018

work page 2018

Show all 30 references

[9]

Eykholt, I

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song. Robust physical-world attacks on deep learning visual classiﬁcation. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , June 2018

2018
[10]

S. G. Finlayson, H. W. Chung, I. S. Kohane, and A. L. Beam. Ad- versarial attacks against medical deep learning systems. arXiv preprint 7 IJCNN 2020. International Joint Conference on Neural Networks. Glasgow, UK. 19-24 July 2020 arXiv:1804.05296, 2018

2020 arXiv
[11]

Goodfellow, J

I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Repre- sentations, 2015

2015
[12]

Hariharan, P

B. Hariharan, P. Arbel ´aez, L. Bourdev, S. Maji, and J. Malik. Semantic contours from inverse detectors. In 2011 International Conference on Computer Vision, pages 991–998. IEEE, 2011

2011
[13]

Kurakin, I

A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 , 2016

2016 arXiv
[14]

Kurakin, I

A. Kurakin, I. Goodfellow, S. Bengio, Y . Dong, F. Liao, M. Liang, T. Pang, J. Zhu, X. Hu, C. Xie, et al. Adversarial attacks and defences competition. In The NIPS’17 Competition: Building Intelligent Systems , pages 195–231. Springer, 2018

2018
[15]

Meng and H

D. Meng and H. Chen. Magnet: a two-pronged defense against adversar- ial examples. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages 135–147. ACM, 2017

2017
[16]

J. H. Metzen, M. C. Kumar, T. Brox, and V . Fischer. Universal adversarial perturbations against semantic image segmentation. In 2017 IEEE International Conference on Computer Vision (ICCV) , pages 2774–2783, Oct 2017

2017
[17]

Moosavi-Dezfooli, A

S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2574–2582, 2016

2016
[18]

Papernot, P

N. Papernot, P. McDaniel, and I. Goodfellow. Transferability in ma- chine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277 , 2016

2016 arXiv
[19]

Papernot, P

N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security , pages 506–519, 2017

2017
[20]

Papernot, P

N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) , pages 372–387. IEEE, 2016

2016
[21]

Papernot, P

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium on Security and Privacy (SP) , pages 582–597. IEEE, 2016

2016
[22]

Samangouei, M

P. Samangouei, M. Kabkab, and R. Chellappa. Defense-gan: Protecting classiﬁers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018

2018 arXiv
[23]

Sitawarin, A

C. Sitawarin, A. N. Bhagoji, A. Mosenia, M. Chiang, and P. Mittal. Darts: Deceiving autonomous cars with toxic signs. arXiv preprint arXiv:1802.06430, 2018

2018 arXiv
[24]

J. Su, D. V . Vargas, and K. Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation , 23(5):828–841, 2019

2019
[25]

Szegedy, W

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations , 2014

2014
[26]

S. Thys, W. Van Ranst, and T. Goedem ´e. Fooling automated surveillance cameras: adversarial patches to attack person detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 0–0, 2019

2019
[27]

Tram `er, A

F. Tram `er, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:1705.07204, 2017

2017 arXiv
[28]

Vincent, H

P. Vincent, H. Larochelle, I. Lajoie, Y . Bengio, and P.-A. Manzagol. Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion. Journal of machine learning research, 11(Dec):3371–3408, 2010

2010
[29]

C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille. Adversarial examples for semantic segmentation and object detection. In Proceed- ings of the IEEE International Conference on Computer Vision , pages 1369–1378, 2017

2017
[30]

H. Zhao, J. Shi, X. Qi, X. Wang, and J. Jia. Pyramid scene parsing network. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2881–2890, 2017. 8

2017

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Arnab, O

A. Arnab, O. Miksik, and P. H. Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 888– 897, 2018

work page 2018

[2] [2]

Carlini and D

N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP) , pages 39–57. IEEE, 2017

work page 2017

[3] [3]

L.-C. Chen, G. Papandreou, I. Kokkinos, K. Murphy, and A. L. Yuille. Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs. IEEE transactions on pattern analysis and machine intelligence , 40(4):834–848, 2017

2017

[4] [4]

L.-C. Chen, Y . Zhu, G. Papandreou, F. Schroff, and H. Adam. Encoder- decoder with atrous separable convolution for semantic image segmen- tation. In Proceedings of the European conference on computer vision (ECCV), pages 801–818, 2018

work page 2018

[5] [5]

Cisse, P

M. Cisse, P. Bojanowski, E. Grave, Y . Dauphin, and N. Usunier. Parseval networks: Improving robustness to adversarial examples. In Proceedings of the 34th International Conference on Machine Learning-V olume 70 , pages 854–863. JMLR. org, 2017

work page 2017

[6] [6]

Elsayed, D

G. Elsayed, D. Krishnan, H. Mobahi, K. Regan, and S. Bengio. Large margin deep networks for classiﬁcation. In Advances in neural infor- mation processing systems , pages 842–852, 2018

work page 2018

[7] [7]

Everingham, L

M. Everingham, L. Van Gool, C. K. Williams, J. Winn, and A. Zisser- man. The pascal visual object classes (voc) challenge. International journal of computer vision , 88(2):303–338, 2010

work page 2010

[8] [8]

Eykholt, I

K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song. Robust physical-world attacks on deep learning visual classiﬁcation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 1625– 1634, 2018

work page 2018