Pith. sign in

REVIEW 3 major objections 6 minor 38 references

Guiding a LiDAR diffusion model with a segmentation loss produces realistic range images that degrade semantic segmenters on demand.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 15:43 UTC pith:FGOOZBTR

load-bearing objection Solid first application of training-free adversarial diffusion guidance to 2-D LiDAR range-image segmentation; controllable trade-off is real, absolute numbers are modest. the 3 major comments →

arxiv 2607.09787 v1 pith:FGOOZBTR submitted 2026-07-08 cs.CV cs.LG

Adversarially Guided Diffusion for LiDAR Range Image Synthesis

Stavros Bouras , Antonios Makris , Alexandros Gkillas , Aris S. Lalos , Konstantinos Tserpes This is my paper
classification cs.CV cs.LG
keywords adversarial diffusion samplingLiDAR diffusion modelunrestricted adversarial examplesrange imagesemantic segmentationSemanticKITTIDDIM guidance
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that unrestricted adversarial examples for LiDAR range-image semantic segmentation can be synthesized by steering a pretrained conditional latent diffusion model with the gradient of a dense segmentation loss during reverse sampling. Instead of adding a small bounded perturbation to a fixed scan, the method generates new range images that stay near the learned LiDAR data manifold while still causing large, spatially structured prediction errors. On SemanticKITTI, guidance scale and start fraction give continuous control over relative mIoU drops, reaching roughly 64 percent white-box and 58 percent transfer degradation at the strongest setting, with Fréchet Range Image Distance remaining competitive with clean generated baselines. Relative to FGSM and SegPGD, the samples avoid high-frequency noise, preserve smoother scene geometry, and in some regimes transfer more strongly across architectures. A reader who cares about autonomous-driving perception would note that range-image segmenters are a common, efficiency-driven design choice; if manifold-preserving generative attacks work and transfer, defenses that only reject small pixel-budget noise are incomplete.

Core claim

The authors establish that injecting the gradient of a per-pixel segmentation loss into the deterministic DDIM reverse trajectory of a semantic-map-conditioned latent diffusion model yields unrestricted adversarial LiDAR range images. These images remain statistically and visually close to real SemanticKITTI scans while inducing controllable white-box and transfer degradation of frozen segmenters (RangeNet++ and CENet).

What carries the argument

Adversarially guided DDIM sampling: after a chosen start fraction of the reverse process, an L2-normalized gradient of an untargeted or targeted dense cross-entropy is added to the current latent; the gradient is obtained by decoding through a differentiable path and evaluating a frozen surrogate segmenter.

Load-bearing premise

The method assumes a segmenter trained only on clean real scans still supplies a useful, stable gradient when evaluated on partially denoised reconstructions of latent samples.

What would settle it

Replace the clean-trained surrogate with one trained also on noisy or partially denoised range images; if white-box mIoU drop at the same guidance scale and start fraction collapses to near zero, the attack signal was an artifact of distribution shift rather than a genuine vulnerability of the segmenter.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Guidance scale and start fraction become practical knobs that trade attack strength against distributional realism (FRID, Chamfer distance).
  • The same generative prior can produce both untargeted scene-wide failures and targeted class flips such as road to sidewalk.
  • Transfer drops of 40 percent or more at moderate realism indicate architecture-agnostic weaknesses in range-image segmenters.
  • High-budget norm-bounded post-hoc attacks remain a different regime; they introduce high-frequency noise that the diffusion method largely avoids.
  • Defenses that only purify small ℓp noise may be insufficient against manifold-preserving generative attacks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because the attack rewrites geometry rather than adding high-frequency noise, purification defenses trained on additive perturbations may fail against it.
  • The same guidance recipe could be applied to other dense prediction tasks on range or depth images without retraining the diffusion prior.
  • Controllable semantic-structure attacks raise the bar for certification methods that currently assume small input balls around a fixed scan.
  • Training a noise-aware surrogate, as the authors themselves suggest, would likely extend the usable guidance window earlier in the reverse trajectory.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes the first diffusion-based unrestricted adversarial attack on LiDAR semantic segmentation in 2D range-image space. A pretrained conditional latent diffusion model (sem2lidar) is steered during deterministic DDIM sampling by the L2-normalized gradient of a dense per-pixel segmentation loss from a frozen surrogate (RangeNet++ or CENet), applied only after a start fraction τ★ of the reverse trajectory (Algorithm 1, Eq. 1–3). On SemanticKITTI sequence 08, the method reports controllable white-box and transfer mIoU drops (up to 64.2% / 58.4% at s=10) while keeping FRID near the clean generated baseline at moderate guidance (Table 1), with structured per-class degradation (Tables 2–3), a targeted road→sidewalk example (Fig. 3), and a surrogate-swap check. Norm-bounded FGSM and SegPGD serve as reference baselines under a different (post-hoc, ℓ∞) regime.

Significance. If the results hold, the work fills a clear gap: unrestricted, manifold-preserving adversarial examples for range-image segmentation, complementary to existing 3D point-cloud diffusion attacks and to norm-bounded 2D attacks. The controllable effectiveness–realism trade-off via s and τ★, the transfer results, and the explicit paired clean/adversarial generation from the same z_T are useful for robustness evaluation of automotive perception. Strengths include a transparent TFG formulation, multi-architecture evaluation without fine-tuning on generated data, FRID with a non-surrogate feature extractor, and an ablation of the start fraction. The contribution is incremental methodologically (TFG + segmentation loss) but novel in domain and practically relevant for LiDAR perception security.

major comments (3)
  1. [§4.1, Table 1] §4.1 and Table 1: Absolute mIoU on clean generated samples is very low (CENet 9.19, RangeNet++ 18.91). Relative drops therefore start from a weak baseline, which weakens claims about practical, safety-critical degradation even though relative metrics fairly isolate the guidance effect. Tables 2–3 show that dominant classes retain non-trivial clean IoU, but the paper should either (i) quantify how much of the mIoU gap is generator–segmenter domain shift versus true scene difficulty, or (ii) bound safety claims more carefully and, if possible, report absolute mIoU on real scans under a comparable threat model (e.g., inversion or injection).
  2. [§3.2] §3.2: Guidance is computed through a “differentiable decode that sidesteps quantization” of the VQ-VAE, while final samples use the true decoder. The mismatch between the path used for ∇z L_adv and the path that produces x_adv is load-bearing for gradient fidelity, yet no reconstruction error, gradient cosine similarity, or ablation comparing quantized vs. continuous decode is reported. A short quantitative check would substantiate that the adversarial nudge remains meaningful under the actual generation pipeline.
  3. [§4.1–4.2, Table 1] §4.1–4.2, Table 1: All attack effectiveness is measured on diffusion-generated range images (clean vs. guided from the same z_T and c), never on real SemanticKITTI scans. For an autonomous-driving threat narrative, this leaves open whether the attack can be realized against real sensor inputs. At minimum, discuss latent inversion / editing of real scans or physical realizability as a limitation; ideally add one inversion-based experiment on sequence 08 to show the guidance signal is not an artifact of the generative prior alone.
minor comments (6)
  1. [§1–2] Throughout the manuscript (especially §1–2) many words are concatenated without spaces (e.g., “automotivedomainspecifically”, “segmentationnetworksmustprocesslivedatasourced”). This appears to be a systematic formatting issue and should be fixed for readability.
  2. [Algorithm 1, §3.2] Algorithm 1 and §3.2: Specify the default τ★ used in the main Table 1 results (the complementary section implies 0.5) and list all fixed hyperparameters (latent resolution, guidance normalization details, which pixels enter Ω_valid) in one place for reproducibility.
  3. [Figure 2] Figure 2: Add a colorbar or intensity scale for range values and, if possible, a zoomed inset so that the claimed absence of high-frequency noise versus FGSM/SegPGD is easier to verify visually.
  4. [§4.1] §4.1 Baselines: State clearly that FGSM/SegPGD are applied to the same clean generated images used as the UAE baseline, so that the comparison is paired; also report wall-clock cost of guided sampling vs. SegPGD iterations for fairness of the “efficiency” narrative.
  5. [§2.4] Related work §2.4: Briefly contrast with AdvSPADE [26] (GAN-based unrestricted attacks for camera segmentation) beyond a single sentence, to sharpen the novelty claim for diffusion + LiDAR range images.
  6. [Eq. (1)] Eq. (1): For the targeted objective, the leading minus sign on CE toward ỹ is correct for gradient ascent on target likelihood, but a one-line note that L_targeted is maximized (or equivalently that the guidance uses −∇ of CE to the target) would avoid sign confusion for readers.

Circularity Check

0 steps flagged

No significant circularity; empirical TFG attack with fair relative evaluation against clean generated baseline and held-out transfer architecture.

full rationale

This is an empirical methods paper that applies training-free guidance (TFG) of a pretrained conditional latent diffusion model by the gradient of a dense segmentation loss (Eq. 1, Algorithm 1). There is no derivation of a first-principles quantity, no fitted parameter later re-presented as a prediction, no uniqueness theorem, and no load-bearing self-citation chain. Effectiveness is reported as relative mIoU drop from a paired clean generated baseline produced by the identical DDIM trajectory with guidance disabled, which isolates the adversarial nudge rather than circularly reusing the same quantity. Realism (FRID) is measured with an independent feature extractor different from the surrogate, and transfer is evaluated on a second architecture never used for gradients. The τ★ and s ablations simply trade effectiveness against distributional distance; none of these steps reduce by construction to their inputs. The paper is self-contained against external SemanticKITTI benchmarks and standard FGSM/SegPGD baselines.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 0 invented entities

The central claim rests on a pretrained latent diffusion model, two frozen segmenters, a hand-chosen guidance schedule, and the modeling assumption that a clean-trained surrogate still yields useful gradients on intermediate denoised latents. No new physical entities are postulated; free parameters are the usual attack knobs.

free parameters (3)
  • guidance scale s
    Hand-chosen magnitude of the L2-normalized adversarial nudge; values 3, 6, 10 are swept to trade strength for realism.
  • start fraction τ★
    Fraction of the reverse trajectory after which guidance is activated; default 0.5, ablated at 0.25 and 0.75.
  • DDIM steps T and η
    Fixed to T=50, η=0 for deterministic paired sampling; not fitted but chosen by the authors.
axioms (3)
  • domain assumption A pretrained conditional latent diffusion model (sem2lidar) already captures the LiDAR range-image manifold well enough that guided samples remain realistic.
    Invoked throughout §3 and §4; the model is taken from prior work [25] and never re-trained.
  • ad hoc to paper A surrogate segmenter trained only on clean real scans supplies a usable gradient when evaluated on partially denoised latent reconstructions.
    Core of the TFG construction in §3.2; the paper itself notes that the surrogate is not noise-aware and therefore delays guidance until τ★.
  • domain assumption Relative mIoU drop from a clean generated baseline isolates the effect of adversarial guidance.
    Stated in §4.1 as the primary effectiveness metric because absolute mIoU on generated images is already low.

pith-pipeline@v1.1.0-grok45 · 17835 in / 2826 out tokens · 25798 ms · 2026-07-14T15:43:26.045250+00:00 · methodology

0 comments
read the original abstract

LiDAR semantic segmentation is a key perception task in autonomous driving, where false predictions can affect downstream planning and safety-critical decision-making. Although adversarial attacks, and specifically adversarial examples, have been widely studied for image classification and 3D point cloud segmentation, unrestricted adversarial examples remain largely unexplored in the space of 2D range images, which are projections of 3D point clouds. The proposed method is, to the best of our knowledge, the first diffusion-based unrestricted adversarial attack against 2D range-image segmentation, using adversarial guidance from a segmentation loss. By applying guidance directly during sampling, the method produces unrestricted adversarial examples that remain close to the learned LiDAR data manifold while inducing structured segmentation errors. Experiments on the SemanticKITTI dataset using RangeNet++ and CENet segmentation networks demonstrate that the attack provides adjustable degradation across guidance strengths and transfers across segmentation architectures. Compared with norm-bounded FGSM and SegPGD baselines, the proposed attack offers a distinct effectiveness-realism trade-off, achieving controllable white-box and transfer degradation while maintaining competitive distributional and visual realism.

Figures

Figures reproduced from arXiv: 2607.09787 by Alexandros Gkillas, Antonios Makris, Aris S. Lalos, Konstantinos Tserpes, Stavros Bouras.

Figure 1
Figure 1. Figure 1: Overview of the proposed attack. Algorithm 1 Conditional Adversarial DDIM Sampling Require: pretrained conditional latent diffusion ϵθ (frozen); frozen surrogate seg￾menter gψ; conditioning c with dense labels y; DDIM steps T; guidance scale s; start fraction τ ⋆ ; terminal latent zT ∼ N (0, I) Ensure: adversarial range image xadv 1: for t = T, T − 1, . . . , 1 do 2: ˆϵt ← ϵθ(zt, t, c) ▷ noise prediction (… view at source ↗
Figure 2
Figure 2. Figure 2: Range-image comparison for a single scene. From top to bottom: the clean generated range image, and three attacks at their high-strength settings (Ours s = 10, FGSM ϵ = 0.120, SegPGD ϵ = 0.120). The norm-bounded baselines exhibit high￾frequency noise across the range image, whereas the guided generation preserves smooth, scene-consistent structure [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Targeted attack example: Top row: clean / adversarial range images. Middle row: clean / adversarial segmentations. Bottom row: the conditioning semantic map and a per-pixel outcome map for the source (road) region. Outcome map: Green: road pixels reclassified as the target class sidewalk, Yellow:road pixels reassigned to other classes, Grey: road pixels that remain road, Red: collateral changes on non-sour… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 10 linked inside Pith

  1. [1]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Arnab, A., Miksik, O., Torr, P.H.: On the robustness of semantic segmentation models to adversarial attacks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 888–897 (2018)

    2018

  2. [2]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Behley, J., Garbade, M., Milioto, A., Quenzel, J., Behnke, S., Stachniss, C., Gall, J.: Semantickitti: A dataset for semantic scene understanding of lidar sequences. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 9297–9307 (2019)

    2019

  3. [3]

    In: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security

    Cao, Y., Xiao, C., Cyr, B., Zhou, Y., Park, W., Rampazzi, S., Chen, Q.A., Fu, K., Mao, Z.M.: Adversarial sensor attack on lidar-based perception in autonomous driving. In: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security. pp. 2267–2281 (2019)

    2019

  4. [4]

    In: 2017 ieee symposium on security and privacy (sp)

    Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 ieee symposium on security and privacy (sp). pp. 39–57. Ieee (2017)

    2017

  5. [5]

    IEEE Transactions on Pattern Analysis and Machine Intelligence47(2), 961–977 (2024)

    Chen, J., Chen, H., Chen, K., Zhang, Y., Zou, Z., Shi, Z.: Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence47(2), 961–977 (2024)

    2024

  6. [6]

    In: Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision

    Chen, X., Gao, X., Zhao, J., Ye, K., Xu, C.Z.: Advdiffuser: Natural adversarial example synthesis with diffusion models. In: Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision. pp. 4562–4572 (2023) Adversarially Guided Diffusion for LiDAR Range Image Synthesis 15

    2023

  7. [7]

    In: 2022 IEEE international con- ference on multimedia and expo (ICME)

    Cheng, H.X., Han, X.F., Xiao, G.Q.: Cenet: Toward concise and efficient lidar semantic segmentation for autonomous driving. In: 2022 IEEE international con- ference on multimedia and expo (ICME). pp. 01–06. IEEE (2022)

    2022

  8. [8]

    In: European Conference on Computer Vision

    Dai, X., Liang, K., Xiao, B.: Advdiff: Generating unrestricted adversarial examples using diffusion models. In: European Conference on Computer Vision. pp. 93–109. Springer (2024)

    2024

  9. [9]

    Advances in neural information processing systems34, 8780–8794 (2021)

    Dhariwal, P., Nichol, A.: Diffusion models beat gans on image synthesis. Advances in neural information processing systems34, 8780–8794 (2021)

    2021

  10. [10]

    IEEE Transactions on Intelligent Transportation Systems22(3), 1341–1360 (2020)

    Feng, D., Haase-Schütz, C., Rosenbaum, L., Hertlein, H., Glaeser, C., Timm, F., Wiesbeck, W., Dietmayer, K.: Deep multi-modal object detection and semantic segmentation for autonomous driving: Datasets, methods, and challenges. IEEE Transactions on Intelligent Transportation Systems22(3), 1341–1360 (2020)

    2020

  11. [11]

    Communications of the ACM63(11), 139–144 (2020)

    Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial networks. Communications of the ACM63(11), 139–144 (2020)

    2020

  12. [12]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    Pith/arXiv arXiv 2014

  13. [13]

    In: European Conference on Computer Vision

    Gu, J., Zhao, H., Tresp, V., Torr, P.H.: Segpgd: An effective and efficient adver- sarial attack for evaluating and boosting segmentation robustness. In: European Conference on Computer Vision. pp. 308–325. Springer (2022)

    2022

  14. [14]

    International journal of multimedia information retrieval 7(2), 87–93 (2018)

    Guo, Y., Liu, Y., Georgiou, T., Lew, M.S.: A review of semantic segmentation using deep neural networks. International journal of multimedia information retrieval 7(2), 87–93 (2018)

    2018

  15. [15]

    In: German conference on pattern recognition

    Gupta, P., Rahtu, E.: Mlattack: Fooling semantic segmentation networks by multi- layer attacks. In: German conference on pattern recognition. pp. 401–413. Springer (2019)

    2019

  16. [16]

    Advances in neural information processing systems30(2017)

    Heusel,M.,Ramsauer,H.,Unterthiner,T.,Nessler,B.,Hochreiter,S.:Ganstrained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems30(2017)

    2017

  17. [17]

    Advances in neural information processing systems33, 6840–6851 (2020)

    Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. Advances in neural information processing systems33, 6840–6851 (2020)

    2020

  18. [18]

    arXiv preprint arXiv:2207.12598 (2022)

    Ho, J., Salimans, T.: Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598 (2022)

    Pith/arXiv arXiv 2022

  19. [19]

    In: Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Hu, Q., Yang, B., Xie, L., Rosa, S., Guo, Y., Wang, Z., Trigoni, N., Markham, A.: Randla-net: Efficient semantic segmentation of large-scale point clouds. In: Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 11108–11117 (2020)

    2020

  20. [20]

    arXiv preprint arXiv:2510.21890 (2025)

    Lai, C.H., Song, Y., Kim, D., Mitsufuji, Y., Ermon, S.: The principles of diffusion models. arXiv preprint arXiv:2510.21890 (2025)

    Pith/arXiv arXiv 2025

  21. [21]

    arXiv preprint arXiv:1706.06083 (2017)

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

    Pith/arXiv arXiv 2017

  22. [22]

    In: 2019 IEEE/RSJ international conference on in- telligent robots and systems (IROS)

    Milioto, A., Vizzo, I., Behley, J., Stachniss, C.: Rangenet++: Fast and accurate lidar semantic segmentation. In: 2019 IEEE/RSJ international conference on in- telligent robots and systems (IROS). pp. 4213–4220. IEEE (2019)

    2019

  23. [23]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Naseer, M., Khan, S., Hayat, M., Khan, F.S., Porikli, F.: A self-supervised ap- proach for adversarial robustness. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 262–271 (2020)

    2020

  24. [24]

    arXiv preprint arXiv:2205.07460 (2022) 16 S

    Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., Anandkumar, A.: Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460 (2022) 16 S. Bouras et al

    Pith/arXiv arXiv 2022

  25. [25]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2024)

    Ran, H., Guizilini, V., Wang, Y.: Towards realistic scene generation with lidar dif- fusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2024)

    2024

  26. [26]

    arXiv preprint arXiv:1910.02354 (2019)

    Shen, G., Mao, C., Yang, J., Ray, B.: Advspade: Realistic unrestricted attacks for semantic segmentation. arXiv preprint arXiv:1910.02354 (2019)

    Pith/arXiv arXiv 1910

  27. [27]

    arXiv preprint arXiv:2010.02502 (2020)

    Song, J., Meng, C., Ermon, S.: Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 (2020)

    Pith/arXiv arXiv 2010

  28. [28]

    Advances in neural information processing systems31(2018)

    Song, Y., Shu, R., Kushman, N., Ermon, S.: Constructing unrestricted adversar- ial examples with generative models. Advances in neural information processing systems31(2018)

    2018

  29. [29]

    arXiv preprint arXiv:2011.13456 (2020)

    Song, Y., Sohl-Dickstein, J., Kingma, D.P., Kumar, A., Ermon, S., Poole, B.: Score- based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456 (2020)

    Pith/arXiv arXiv 2011

  30. [30]

    arXiv preprint arXiv:1312.6199 (2013)

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fer- gus, R.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)

    Pith/arXiv arXiv 2013

  31. [31]

    Advances in neural information processing systems30(2017)

    Van Den Oord, A., Vinyals, O., et al.: Neural discrete representation learning. Advances in neural information processing systems30(2017)

    2017

  32. [32]

    IEEE Transactions on Consumer Electronics (2026)

    Wang, Y., Wu, L., Zhang, Z., Huo, L., Feng, J., Wang, J., Jin, J.: Transferable adversarial attacks on 3d point cloud semantic segmentation via diffusion models in autonomous driving. IEEE Transactions on Consumer Electronics (2026)

    2026

  33. [33]

    arXiv preprint arXiv:1801.02610 (2018)

    Xiao, C., Li, B., Zhu, J.Y., He, W., Liu, M., Song, D.: Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02610 (2018)

    Pith/arXiv arXiv 2018

  34. [34]

    In: Proceedings of the IEEE in- ternational conference on computer vision

    Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., Yuille, A.: Adversarial examples for semantic segmentation and object detection. In: Proceedings of the IEEE in- ternational conference on computer vision. pp. 1369–1378 (2017)

    2017

  35. [35]

    In: European Conference on Computer Vision

    Xu, C., Wu, B., Wang, Z., Zhan, W., Vajda, P., Keutzer, K., Tomizuka, M.: Squeezesegv3: Spatially-adaptive convolution for efficient point-cloud segmenta- tion. In: European Conference on Computer Vision. pp. 1–19. Springer (2020)

    2020

  36. [36]

    Advances in Neural Information Processing Systems37, 22370–22417 (2024)

    Ye, H., Lin, H., Han, J., Xu, M., Liu, S., Liang, Y., Ma, J., Zou, J., Ermon, S.: Tfg: Unified training-free guidance for diffusion models. Advances in Neural Information Processing Systems37, 22370–22417 (2024)

    2024

  37. [37]

    IEEE access7, 179118–179133 (2019)

    Zhang, J., Zhao, X., Chen, Z., Lu, Z.: A review of deep learning-based semantic segmentation for point cloud. IEEE access7, 179118–179133 (2019)

    2019

  38. [38]

    In: Proceedings of the 19th ACM conference on embedded networked sensor systems

    Zhu, Y., Miao, C., Hajiaghajani, F., Huai, M., Su, L., Qiao, C.: Adversarial attacks against lidar semantic segmentation in autonomous driving. In: Proceedings of the 19th ACM conference on embedded networked sensor systems. pp. 329–342 (2021)

    2021