SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation

Boseung Seo; DaeYun GO; Dongsu Song; Jay Hoon Jung

REVIEW 3 major objections 6 minor 44 references

SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SegPAR, a decision-based black-box sparse attack that explores class by class and rewards only new misclassifications, achieves the strongest black-box sparse-attack results on segmentation and remains competitive with white-box sparse…

desk verdict Solid first decision-based sparse attack for semantic segmentation; class-centric exploration plus discrepancy reward are effective, but the proxy-to-MIoU alignment and missing error bars need attention. read the letter →

arxiv 2608.11285 v1 pith:XC6VNCQJ submitted 2026-08-11 cs.CV cs.AIcs.CRcs.LG

Dongsu Song , DaeYun GO , Boseung Seo , Jay Hoon Jung This is my paper · ORCID

classification cs.CVcs.AIcs.CRcs.LG

keywords black-boxattacksemanticsegmentationsparsedecision-basedreinforcementlearningclass-centricexplorationdiscrepancyrewardqueryefficiency

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that sparse decision-based black-box attacks, where the attacker only sees the model's hard label output and may alter a small fraction of pixels, can be made practical for semantic segmentation. Its proposal, SegPAR, attacks one predicted class region at a time and rewards only the growth of pixels whose prediction differs from the original image. If the claims hold, segmentation models used in autonomous driving and dense perception are vulnerable to targeted sparse perturbations mounted with a few hundred label queries, and this vulnerability remains largely present at lower resolutions even after adversarial training.

What carries the argument

The two load-bearing mechanisms are class-centric exploration and the discrepancy reward. Class-centric exploration fixes binary masks $M^k_{i,j}=\mathbb{I}[f(x)_{i,j}=k]$ from the initial prediction, builds a tight bounding box around each predicted class, and uses a masked softmax distribution over that box so sampled perturbations stay inside the class region. The discrepancy mask tracks attack success relative to the original prediction, $d^{(t)}_{i,j}=\mathbb{I}[y^{(t)}_{i,j}\neq y^{(0)}_{i,j}]$, and the class-wise reward $R_d^k=\frac{1}{o^2 n}\sum_{i,j} M^k_{i,j}\,(\hat{d}^{(t)}_{i,j}-d^{(t)}_{i,j})$ gives positive feedback only to newly misclassified pixels, zero to maintained or fluctuating ones, and negative feedback to reversions. This reward removes the misleading signal that standard transition-based rewards give to pixels that revert to the original class or oscillate between wrong classes.

What would settle it

On an imbalanced segmentation benchmark, count how many perturbed pixels flip from the original prediction to a wrong class versus from one wrong class to another, and measure each subset's contribution to per-class IoU; if the discrepancy objective keeps rising while the second subset dominates or while MIoU stagnates, the proxy is not aligned with the claimed metric.

Watch

Extended reading notes

Core claim

The central claim is that image-centric pixel accumulation is the wrong unit of search for segmentation, because an image contains many heterogeneous, class-specific decision boundaries. SegPAR therefore runs the search per predicted class: it derives fixed per-class masks from the victim's initial prediction, crops the agent state to each class's bounding box, and samples perturbed pixel locations inside the class mask from a learned masked-softmax probability map. On top of this, SegPAR changes what is rewarded: instead of rewarding any prediction change between consecutive steps, a discrepancy reward scores only the marginal increase in pixels that differ from the initial prediction. The paper reports that with these two changes it achieves the best black-box sparse-attack results on Cityscapes, ADE20K, and Pascal VOC2012 across CNN and Transformer segmentation models, while remaining competitive with gradient-based white-box sparse attacks under matched budgets.

Load-bearing premise

Everything rests on the proxy that maximizing the fraction of pixels whose predicted label changes from the original prediction faithfully tracks reducing mean IoU; if most flipped pixels lie within already-wrong regions or are label swaps that do not touch per-class IoU, the claimed gains would not follow.

Editorial extensions

If this is right

Decision-only attackers can push segmentation models to low MIoU values at roughly 2.4 to 4.0 percent pixel sparsity within a 1,000-query budget, so realistic black-box robustness evaluation should include sparse attacks.
Attacking class regions separately lets the attacker degrade safety-critical classes such as traffic signs, traffic lights, persons, and riders much earlier than image-centric exploration does.
Replacing the standard transition reward with the discrepancy reward suppresses pixel reversion and wasted queries, and the same reward can be plugged into other accumulation-based sparse attackers, improving their MIoU reduction at equal or lower sparsity.
A black-box sparse attack built this way is competitive with white-box sparse baselines, outperforming PGD0 and narrowing the gap to sPGD under equal query-versus-update budgets.
Adversarially trained segmentation models offer meaningful protection against sparse attacks on high-resolution images, but that protection appears substantially weaker at lower resolutions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The discrepancy reward is defined against the original prediction rather than against per-class ground truth, so the same cumulative-reward logic could transfer to other dense prediction tasks, including instance-level object detection, where reversion and fluctuation also waste queries during accumulation.
The class-centric decomposition suggests a natural prioritization scheme: allocate more queries to safety-critical or small-area classes instead of treating all predicted classes equally, which could produce even larger practical disruption per query.
One testable extension is to make class masks adaptive during an episode rather than fixed from the initial prediction; because the discrepancy reward is anchored to the initial prediction, refreshing masks after stable flips might accelerate convergence.
Because the attack needs only hard labels and no ground truth, it could serve as a low-cost auditing tool for deployed segmentation systems, exposing a failure profile different from that of dense perturbation attacks.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

SegPAR is the first decision-based sparse attack designed for semantic segmentation, and the core ideas hold up. The authors shift from image-centric to class-centric exploration, sampling perturbations within each predicted class region, and introduce a discrepancy reward that only rewards pixels whose state changes relative to the initial prediction. The decomposition of pixel transitions into maintain/revert/new/fluctuate is correct, and the ablations show each component earns its keep. The empirical sweep is broad: four architectures, three datasets, two adversarially trained variants, plus comparisons against adapted classification sparse attacks and white-box sparse attacks. Code is provided. That is a solid package for an underexplored setting.

The soft spots are real but not disqualifying. First, the proxy in Eq. (1) maximizes pixel flips relative to the original prediction, not MIoU. A pixel that is initially wrong and gets corrected to its true class earns a positive reward even though it improves the model. The paper never quantifies how often such "repair" flips occur, nor shows that the optimized reward correlates with MIoU damage. Given the strong final numbers, the proxy is probably aligned on average, but the lack of analysis leaves the central mechanism under-justified. A referee should ask for a per-step or per-pixel correlation between Rd and ground-truth MIoU. Second, all results come from a fixed 100-image subset per dataset, with no error bars or multiple seeds. That makes the "significantly outperforms" claims less secure. Third, the white-box budget comparison equates one forward query with one gradient update, which is a useful first cut, but those are not equivalent computations; the paper should be clearer about what a fixed FLOP budget would say.

These are addressable. The class-centric insight is plausible and the empirical gains are large, so I'd send this to peer review rather than desk reject. If I were refereeing, I'd ask for the correlation analysis and repeated runs before accepting.

Referee Report

3 major / 6 minor

Summary. The paper studies decision-based black-box sparse attacks on semantic segmentation, a setting the authors argue is underexplored. The proposed method, SegPAR, adapts the authors' prior RL-based attack RFPAR to a class-centric paradigm: fixed per-class masks are extracted from the initial prediction, a masked softmax action sampler restricts perturbations to each predicted class region, and a new discrepancy reward is defined as the change in the number of pixels whose prediction differs from the initial prediction. The method is evaluated against Pointwise, SparseEvo, RFPAR, Pixle, and Sparse-RS on Cityscapes, ADE20K, and VOC2012 with four segmentation architectures, plus adversarially trained models, and is compared with the white-box attacks PGD0 and sPGD. The central claims are that SegPAR with the discrepancy reward achieves the strongest black-box performance in sparsity efficiency and MIoU reduction and is competitive with white-box sparse attacks.

Significance. If the results hold, the paper would provide a useful benchmark and a practical black-box attack for dense prediction, an area where sparse decision-based attacks have received little attention. The paper's strengths include a clear formulation of the class-centric exploration idea, a mathematically clean decomposition of the standard reward into four pixel-transition cases, a new reward that correctly assigns zero reward to fluctuations and negative reward to reversion, public code, and ablations that isolate the contributions of class-centric design and the discrepancy reward. The claimed gains are large and consistent across multiple architectures and datasets. However, the evaluation rests on a single random subset per dataset without variance estimates, and the optimized proxy is not shown to be aligned with the final MIoU objective on imperfectly segmented inputs. These issues are addressable and do not invalidate the approach, but they need to be resolved before the central claims can be accepted.

major comments (3)

[Section 2, Eq. (1); Section 4.2, Eq. (10)] The optimized objective maximizes the number of pixels whose prediction changes relative to the initial prediction f(x), and the discrepancy reward uses the same initial prediction as the reference. Because the victim models are imperfect (e.g., DeepLabV3 on Cityscapes has initial MIoU 0.798 in Table 1, so over 20% of pixels are initially wrong), the proxy gives positive reward to transitions that can increase MIoU, such as correcting an initially wrong pixel to its true class, and to wrong-to-wrong transitions that do not change per-class IoU. The paper should demonstrate empirically that positive proxy reward correlates with ground-truth MIoU decrease, for example by reporting attack performance separately on initially-correct and initially-incorrect pixels, or by plotting proxy reward against MIoU reduction over training steps. Without such evidence, the reported MIoU gains may partly reflect reward gaming rather than genuine damage.
[Tables 1–3 and Section 5.1] All quantitative claims are based on a single fixed subset of 100 randomly sampled validation images per dataset, with no error bars, confidence intervals, or statistical significance tests. The abstract and Section 5 state that SegPAR 'significantly outperforms' baselines, but this is not supported by the reported numbers. The authors should provide means and standard deviations over multiple random subsets or training seeds, and ideally a paired significance test against the strongest baseline, to substantiate the superiority claim.
[Section 5.5] The white-box comparison equates one black-box forward query with one white-box gradient update, where a gradient update includes both forward and backward passes. This is an ad-hoc cost model and is load-bearing for the claim that SegPAR is 'competitive with white-box sparse attacks.' The paper should justify this equivalence, for example by reporting wall-clock time or FLOPs, or at least by acknowledging that the comparison is under a nonstandard budget and showing sensitivity to the chosen equivalence factor.

minor comments (6)

[Figure 2 caption] The caption contains garbled mathematical notation (e.g., 'd(0)', 'x(0)', and unreadable subscript expressions) that should be cleaned up for clarity.
[Section 4.1, Eq. (3) and action sampling] The notation 'MultinomialNR(pk; n)' and the description of sampling n locations without replacement are unclear; the exact sampling procedure should be stated explicitly, including how the number of locations n is chosen relative to the class mask size.
[Table 3] The layout of Table 3 is confusing: the 'Standard' and 'Discrepancy' subheaders alternate with model names, and the row 'DiscrepancyRFPAR' is not aligned with the model column. Please restructure the table so that each model, objective, and attack combination is unambiguous.
[Section 5.4] The observation that applying the discrepancy reward to RFPAR on Cityscapes yields a smaller MIoU drop than the standard reward (Table 3) is attributed to sparse reward events, but the paper does not quantify how often informative reward events occur. A brief analysis of reward density would make the explanation more concrete.
[General] The paper relies heavily on the supplementary material for experimental details such as RL training hyperparameters, reward scaling, convergence thresholds, and baseline adaptation. At least the key hyperparameters and the exact adaptation of RFPAR to segmentation should be described in the main text to make the benchmark reproducible.
[Figure 1 caption] The phrase 'fatal semantic disruptions' is unnecessarily strong and unsupported by the reported metric; consider replacing it with a neutral description such as 'large MIoU reduction.'

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: SegPAR's contribution is an empirically evaluated attack method whose proxy objective is explicit and not disguised as a prediction.

full rationale

The paper does not derive MIoU reduction from its proxy; it explicitly states that MIoU is non-smooth and inaccessible in the black-box setting and therefore uses the fraction of changed pixels as a proxy objective (Eq. 1). The discrepancy reward (Eq. 10) is the per-class marginal gain of that same proxy, so the optimization is self-consistent rather than circular: the reward is not fitted to the measured R.MIoU values, and no fitted parameter is renamed as a prediction. The central claim is empirical, supported by evaluations against independent black-box baselines (Pointwise, SparseEvo, Pixle, Sparse-RS) and white-box methods (PGD0, sPGD) across Cityscapes, ADE20K, VOC2012, and four architectures. Self-citations to RFPAR [29] and to the boundary-geometry result [19] supply algorithmic ancestry and context; they are not invoked as uniqueness theorems or as the sole evidence for performance. The paper also self-reports a limitation (Sec. 5.4: applying R_d to RFPAR on Cityscapes yields lower sparsity but a smaller MIoU drop), which is inconsistent with a circularly forced success. The skeptic's proxy-alignment concern is a legitimate correctness risk, not circularity: it questions whether the proxy correlates with MIoU, but it does not show that the output reproduces its input. Consequently, no circular step is exhibited. The score reflects only the benign self-citation to the authors' prior RFPAR framework, which is used as the base method and as a baseline but does not carry the central claim by itself.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method rests on a handful of hand-set hyperparameters and domain assumptions about the proxy objective and class-mask validity. No new physical entities are introduced.

free parameters (5)

per-class sparsity cap = 5% of each predicted class region
Chosen to align with the overall 5% sparsity target; it constrains the action space but is not fitted to data.
reward scaling factor o = 5
Inherited from RFPAR [29] and used to normalize rewards in Eq. 4 and Eq. 10; hand-set hyperparameter.
number of sampled locations n per class step
Stated as 'as in our implementation' in Sec 4.1; this controls perturbation density and query cost but is left unspecified.
convergence thresholds and patience = patience 1-2, thresholds in [1e-2, 3e-2]
Sec 5.1; used to stop each step; values are chosen, not derived.
maximum steps per image = 100
Sec 4.2; caps query count; arbitrary budget choice.

assumptions (4)

domain assumption The proxy of maximizing the fraction of changed pixels relative to the initial prediction is a valid surrogate for MIoU reduction.
Eq. 1 sets this proxy because MIoU is non-smooth. The paper does not prove alignment with per-class IoU or handle initially mispredicted pixels.
domain assumption Fixed class masks from the initial prediction provide a suitable partition for per-class exploration.
Eq. 2 and Sec 4.1 freeze masks from f(x). If the model's initial prediction is inaccurate, class regions are mis-specified and attacking them may not target true classes.
ad hoc to paper One black-box forward query has the same cost as one white-box gradient update in the white-box comparison.
Sec 5.5 equates a black-box forward pass to a white-box gradient update (forward plus backward) to align budgets; this is an arbitrary accounting choice favoring the black-box method.
domain assumption REINFORCE with the proposed rewards converges within the 100-step budget to a perturbation that improves the objective.
The paper relies on RL training converging per image; there is no theoretical guarantee, only empirical evidence.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation." pith.science (2026). https://pith.science/paper/XC6VNCQJ

@misc{pith2026260811285,
  author       = {Pith},
  title        = {Pith review of: SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XC6VNCQJ}},
  note         = {Machine review of arXiv:2608.11285}
}

read the original abstract

Despite the practical relevance of sparse decision-based black-box threats, they have received limited attention in semantic segmentation. To bridge this gap, we adapt the most representative decision-based black-box sparse attacks from the classification domain to serve as baselines, establishing a rigorous benchmark for this underexplored setting. In this context, we demonstrate that one of the existing methods suffers from severe query inefficiency due to its image-centric pixel accumulation, which rapidly exhausts query budgets across the vast image space. To overcome this, we propose SegPAR, a novel decision-based framework that shifts to a class-centric exploration paradigm. Furthermore, to eliminate the misleading feedback generated by standard decision rewards during pixel accumulation, we introduce a novel discrepancy reward. Extensive experiments show that SegPAR significantly outperforms black-box baselines in sparsity efficiency and MIoU reduction, while remaining competitive with white-box sparse attacks. Code is available at \href{https://github.com/KAU-QuantumAILab/SegPAR}{https://github.com/KAU-QuantumAILab/SegPAR}.

Figures

Figures reproduced from arXiv: 2608.11285 by the authors.

**Figure 2.** SegPAR Framework. At initialization, SegPAR extracts fixed per-class masks {Mk } from the initial prediction y (0) and keeps them throughout the episode. At each step t, class-wise inputs are constructed by cropping the current image, x (t) c = Crop(x (t) , bk ), where b k is the crop box for class k. Conditioned on the class and cropped input, the RL agent outputs sparse pixel perturbations to generate xˆ (t) , whi… view at source ↗

**Figure 3.** Comparison of the standard reward and the discrepancy reward. Standard Reward Inefficiency. We analyze the inherent limitations of the standard reward function in the context of cumulative attack frameworks. Specifically, we investigate the inefficiencies that arise in tasks involving multiple target instances, such as object detection and semantic segmentation, where the agent must handle a significantly large… view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Class-wise attack efficiency. Comparison of MIoU degradation across individual classes in DeepLabV3. SegPAR demonstrates significantly faster and more effective attacks than RFPAR across all categories. VOC2012 covers 20 common object categories, and Cityscapes focuse…

**Figure 5.** Figure 5: Reduction of Reversion. Our discrepancy reward effectively suppresses reversion, resolving a major hurdle in agent training caused by the standard reward. underscores that our method is not only numerically superior in attack performance, but also sufficiently powerf…

**Figure 6.** Figure 6: Comparison of MIoU vs. Sparsity with White-box sparse Attacks. [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 20 canonical work pages

[1]

CoRRabs/2303.08774(2023).https://doi.org/10.48550/arxiv.2303.08774 1

Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: GPT-4 Technical Report. CoRRabs/2303.08774(2023).https://doi.org/10.48550/arxiv.2303.08774 1

arXiv doi:10.48550/arxiv.2303.08774 2023
[2]

IEEE Access6, 14410–14430 (2018).https://doi.org/ 10.1109/ACCESS.2018.28073852

Akhtar, N., Mian, A.S.: Threat of Adversarial Attacks on Deep Learning in Com- puter Vision: A Survey. IEEE Access6, 14410–14430 (2018).https://doi.org/ 10.1109/ACCESS.2018.28073852

arXiv 2018
[3]

CoRRabs/1912.01667(2019).https://doi.org/ 10.48550/arxiv.1912.016671

Bhambri, S., Muku, S., Tulasi, A., Buduru, A.B.: A Study of Black Box Adversarial Attacks in Computer Vision. CoRRabs/1912.01667(2019).https://doi.org/ 10.48550/arxiv.1912.016671

arXiv doi:10.48550/arxiv.1912.01667 2019
[4]

In: Machine LearningandKnowledgeDiscoveryinDatabases(ECMLPKDD).LNCS,vol.8190, pp

Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G., Roli, F.: Evasion Attacks against Machine Learning at Test Time. In: Machine LearningandKnowledgeDiscoveryinDatabases(ECMLPKDD).LNCS,vol.8190, pp. 387–402. Springer (2013).https://doi.org/10.1007/978-3-642-40994-3_25 1

doi:10.1007/978-3-642-40994-3_25 2013
[5]

Song et al

Carion, N., Gustafson, L., Hu, Y., Debnath, S., Hu, R., Suris, D., Ryali, C., Alwala, K.V., Khedr, H., Huang, A., Lei, J., Ma, T., Guo, B., Kalla, A., Marks, M., Greer, J., Wang, M., Sun, P., Rädle, R., Afouras, T., Mavroudi, E., Xu, K., Wu, T., Zhou, Y., Momeni, L., Hazra, R., Ding, S., Vaze, S., Porcher, F., Li, F., Li, S., Kamath, 16 D. Song et al. A.,...

arXiv doi:10.48550/arxiv.2511.16719 2025
[6]

In: IEEE Symposium on Security and Privacy (S&P)

Carlini, N., Wagner, D.A.: Towards Evaluating the Robustness of Neural Networks. In: IEEE Symposium on Security and Privacy (S&P). pp. 39–57 (2017).https: //doi.org/10.1109/SP.2017.491, 5

work page doi:10.1109/sp.2017.491 2017
[7]

CoRRabs/1706.05587(2017).https://doi

Chen, L.C., Papandreou, G., Schroff, F., Adam, H.: Rethinking atrous convolution for semantic image segmentation. CoRRabs/1706.05587(2017).https://doi. org/10.48550/arxiv.1706.0558710

arXiv doi:10.48550/arxiv.1706.05587 2017
[8]

In: ECCV

Chen, W., Zhang, Z., Hu, X., Wu, B.: Boosting Decision-Based Black-Box Adver- sarial Attacks with Random Sign Flip. In: ECCV. LNCS, vol. 12360, pp. 276–293. Springer (2020).https://doi.org/10.1007/978-3-030-58555-6_171

work page doi:10.1007/978-3-030-58555-6_171 2020

Show all 44 references

[9]

CoRR abs/2402.01220(2024).https://doi.org/10.48550/ARXIV.2402.012202

Chen, Z., Shan, Z., Chang, J., Jiang, K., Yang, D., Cheng, Y., Zhang, W.: Delving into decision-based black-box attacks on semantic segmentation. CoRR abs/2402.01220(2024).https://doi.org/10.48550/ARXIV.2402.012202

2024 doi arXiv
[10]

In: NeurIPS

Cheng, S., Dong, Y., Pang, T., Su, H., Zhu, J.: Improving Black-box Adversarial Attacks with a Transfer-based Prior. In: NeurIPS. vol. 32, pp. 10932–10942 (2019). https://doi.org/10.48550/arxiv.1906.069191

2019 doi arXiv
[11]

In: CVPR

Cordts, M., Omran, M., Ramos, S., Rehfeld, T., Enzweiler, M., Benenson, R., Franke, U., Roth, S., Schiele, B.: The Cityscapes Dataset for Semantic Urban Scene Understanding. In: CVPR. pp. 3213–3223 (2016).https://doi.org/10. 1109/CVPR.2016.35010

2016
[12]

In: AAAI

Croce, F., Andriushchenko, M., Singh, N.D., Flammarion, N., Hein, M.: Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks. In: AAAI. pp. 6437–6445 (2022).https://doi.org/10.1609/AAAI.V36I6.20595 2, 5, 13

2022 doi
[13]

In: ICCV

Croce, F., Hein, M.: Sparse and imperceivable adversarial attacks. In: ICCV. pp. 4724–4732 (2019).https://doi.org/10.1109/ICCV.2019.004825, 14

2019
[14]

In: ECCV

Croce, F., Singh, N.D., Hein, M.: Towards reliable evaluation and fast training of robust semantic segmentation models. In: ECCV. vol. 15087, pp. 180–197. Springer (2024).https://doi.org/10.1007/978-3-031-72986-7_112

2024 doi
[15]

In: NeurIPS

Deng, Y., Wu, W., Zhang, J., Zheng, Z.: Blurred-Dilated Method for Adver- sarial Attacks. In: NeurIPS. vol. 36, pp. 48939–48950 (2023),http://papers. nips.cc/paper_files/paper/2023/hash/b6fa3ed9624c184bd73e435123bd576a- Abstract-Conference.html2

2023
[16]

In: NeurIPS

Dong, X., Chen, D., Bao, J., Qin, C., Yuan, L., Zhang, W., Yu, N., Chen, D.: GreedyFool: Distortion-Aware Sparse Adversarial Attack. In: NeurIPS. vol. 33, pp. 11226–11235 (2020).https://doi.org/10.48550/arxiv.2010.137732

2020 doi arXiv
[17]

IJCV88(2), 303–338 (2010)

Everingham, M., Gool, L.V., Williams, C.K.I., Winn, J., Zisserman, A.: The PASCAL Visual Object Classes (VOC) Challenge. IJCV88(2), 303–338 (2010). https://doi.org/10.1007/s11263-009-0275-410

2010 doi
[18]

In: ICLR (2015).https://doi.org/10.48550/arxiv.1412.65721

Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and Harnessing Adversarial Examples. In: ICLR (2015).https://doi.org/10.48550/arxiv.1412.65721

2015 doi
[19]

In: 2020 25th International Conference on Pattern Recognition (ICPR)

Jung, J.H., Kwon, Y.: Boundaries of single-class regions in the input space of piece- wise linear neural networks. In: 2020 25th International Conference on Pattern Recognition (ICPR). pp. 6027–6034. IEEE (2021).https://doi.org/10.1109/ ICPR48806.2021.94119655

2021
[20]

In: ICLR (2017).https://doi.org/10.48550/arxiv.1611.0123612 SegPAR: Class-Centric Sparse Attack 17

Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial machine learning at scale. In: ICLR (2017).https://doi.org/10.48550/arxiv.1611.0123612 SegPAR: Class-Centric Sparse Attack 17

2017 doi arXiv
[21]

CoRRabs/2406.06978(2024).https://doi

Li, Z., Li, K., Wang, S., Lan, S., Yu, Z., Ji, Y., Li, Z., Zhu, Z., Kautz, J., Wu, Z., Jiang, Y., Álvarez, J.M.: Hydra-MDP: End-to-end Multimodal Planning with Multi-target Hydra-Distillation. CoRRabs/2406.06978(2024).https://doi. org/10.48550/arxiv.2406.069781

2024 doi arXiv
[22]

In: ICLR (2018).https://doi.org/ 10.48550/arxiv.1706.060831

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards Deep Learn- ing Models Resistant to Adversarial Attacks. In: ICLR (2018).https://doi.org/ 10.48550/arxiv.1706.060831

2018 doi arXiv
[23]

In: CVPR

Modas, A., Moosavi-Dezfooli, S., Frossard, P.: SparseFool: A Few Pixels Make a Big Difference. In: CVPR. pp. 9087–9096 (2019).https://doi.org/10.1109/ CVPR.2019.009302, 5

2019
[24]

In: Proc

Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: Proc. IEEE EuroS&P. pp. 372–387 (2016).https://doi.org/10.1109/EuroSP.2016.365

2016 doi
[25]

In: Proc

Papernot, N., McDaniel, P.D., Goodfellow, I.J., Jha, S., Celik, Z.B., Swami, A.: Practical Black-Box Attacks against Machine Learning. In: Proc. AsiaCCS. pp. 506–519 (2017).https://doi.org/10.1145/3052973.30530092

2017
[26]

IEEE Access11,11298–11306(2023).https://doi.org/10.1109/ACCESS.2023.3241360 2, 5, 13

Pomponi, J., Dántoni, D., Nicolosi, A., Scardapane, S.: Rearranging Pixels is a Powerful Black-Box Attack for RGB and Infrared Deep Learning Models. IEEE Access11,11298–11306(2023).https://doi.org/10.1109/ACCESS.2023.3241360 2, 5, 13

2023
[27]

In: ICLR (2019).https://doi.org/10

Schott, L., Rauber, J., Bethge, M., Brendel, W.: Towards the first adversarially robust neural network model on MNIST. In: ICLR (2019).https://doi.org/10. 48550/arxiv.1805.091904, 10

2019 doi arXiv
[28]

In: CVPR

Shi, Y., Wang, S., Han, Y.: Curls & Whey: Boosting Black-Box Adversarial At- tacks. In: CVPR. pp. 6519–6527 (2019).https://doi.org/10.1109/CVPR.2019. 006681

2019 doi
[29]

In: NeurIPS

Song, D., Ko, D., Jung, J.: Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection. In: NeurIPS. vol. 37, pp. 40284–40305 (2024).https://doi.org/10.52202/079017-27662, 3, 5, 9, 10

2024 doi
[30]

IEEE Trans

Su, J., Vargas, D.V., Sakurai, K.: One Pixel Attack for Fooling Deep Neural Net- works. IEEE Trans. Evol. Comput.23(5), 828–841 (2019).https://doi.org/10. 1109/TEVC.2019.28908582, 5

2019
[31]

In: CVPR

Sun, P., Kretzschmar, H., Dotiwalla, X., Chouard, A., Patnaik, V., Tsui, P., Guo, J., Zhou, Y., Chai, Y., Caine, B., Vasudevan, V., Han, W., Ngiam, J., Zhao, H., Timofeev, A., Ettinger, S., Krivokon, M., Gao, A., Joshi, A., Zhang, Y., Shlens, J., Chen, Z., Anguelov, D.: Scalab...

2020
[32]

In: ICLR (2014).https:// doi.org/10.48550/arxiv.1312.61991

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. In: ICLR (2014).https:// doi.org/10.48550/arxiv.1312.61991

2014 doi
[33]

CoRR abs/2507.06261(2025).https://doi.org/10.48550/arxiv.2507.062611

Team, G.: Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Mul- timodality, Long Context, and Next Generation Agentic Capabilities. CoRR abs/2507.06261(2025).https://doi.org/10.48550/arxiv.2507.062611

2025 doi arXiv
[34]

In: ICLR (2022).https://doi

Vo, V.Q., Abbasnejad, E., Ranasinghe, D.: Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Models. In: ICLR (2022).https://doi. org/10.48550/arxiv.2202.000914, 10

2022 doi arXiv
[35]

JMLR15(1), 949–980 (2014).https://doi.org/10

Wierstra, D., Schaul, T., Glasmachers, T., Sun, Y., Peters, J., Schmidhuber, J.: Natural evolution strategies. JMLR15(1), 949–980 (2014).https://doi.org/10. 48550/arxiv.1106.44872 18 D. Song et al

2014 doi
[36]

Machine learning8(3), 229–256 (1992).https://doi.org/ 10.1007/BF009926969

Williams, R.J.: Simple statistical gradient-following algorithms for connectionist reinforcement learning. Machine learning8(3), 229–256 (1992).https://doi.org/ 10.1007/BF009926969

1992 doi
[37]

In: ICLR (2020).https://doi.org/10.48550/arxiv.2001.039941

Wong, E., Rice, L., Kolter, J.Z.: Fast is better than free: Revisiting adversarial training. In: ICLR (2020).https://doi.org/10.48550/arxiv.2001.039941

2020 doi arXiv
[38]

NeurIPS 34, 12077–12090 (2021).https://doi.org/10.48550/arxiv.2105.1520310

Xie, E., Wang, W., Yu, Z., Anandkumar, A., Alvarez, J.M., Luo, P.: SegFormer: Simple and efficient design for semantic segmentation with transformers. NeurIPS 34, 12077–12090 (2021).https://doi.org/10.48550/arxiv.2105.1520310

2021 doi arXiv
[39]

Xu, H., Ma, Y., Liu, H., Deb, D., Liu, H., Tang, J., Jain, A.K.: Adversarial Attacks and Defenses in Images, Graphs and Text: A Review. Int. J. Autom. Comput. 17(2), 151–178 (2020).https://doi.org/10.1007/S11633-019-1211-X2

2020 doi
[40]

In: ICCV

Xu, X., Zhao, H., Jia, J.: Dynamic divide-and-conquer adversarial training for robust semantic segmentation. In: ICCV. pp. 7466–7475. IEEE (2021).https: //doi.org/10.1109/ICCV48922.2021.0073912

2021
[41]

In: CVPR

Zhao, H., Shi, J., Qi, X., Wang, X., Jia, J.: Pyramid Scene Parsing Network. In: CVPR. pp. 2881–2890 (2017).https://doi.org/10.1109/CVPR.2017.66010

2017
[42]

In: CVPR

Zheng, S., Lu, J., Zhao, H., Zhu, X., Luo, Z., Wang, Y., Fu, Y., Feng, J., Xiang, T., Torr, P.H., et al.: Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers. In: CVPR. pp. 6881–6890 (2021).https://doi. org/10.1109/CVPR46437.2021.0068110

2021
[43]

In: ICML

Zhong,X.,Huang,Y.,Liu,C.:TowardsEfficientTrainingandEvaluationofRobust Models againstL0 Bounded Adversarial Perturbations. In: ICML. PMLR, vol. 235, pp. 61708–61726 (2024).https://doi.org/10.48550/arxiv.2405.133245, 14

2024 doi arXiv
[44]

In: CVPR

Zhou, B., Zhao, H., Puig, X., Fidler, S., Barriuso, A., Torralba, A.: Scene parsing through ADE20K dataset. In: CVPR. pp. 633–641 (2017).https://doi.org/10. 1109/CVPR.2017.7410

2017

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

CoRRabs/2303.08774(2023).https://doi.org/10.48550/arxiv.2303.08774 1

Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: GPT-4 Technical Report. CoRRabs/2303.08774(2023).https://doi.org/10.48550/arxiv.2303.08774 1

arXiv doi:10.48550/arxiv.2303.08774 2023

[2] [2]

IEEE Access6, 14410–14430 (2018).https://doi.org/ 10.1109/ACCESS.2018.28073852

Akhtar, N., Mian, A.S.: Threat of Adversarial Attacks on Deep Learning in Com- puter Vision: A Survey. IEEE Access6, 14410–14430 (2018).https://doi.org/ 10.1109/ACCESS.2018.28073852

arXiv 2018

[3] [3]

CoRRabs/1912.01667(2019).https://doi.org/ 10.48550/arxiv.1912.016671

Bhambri, S., Muku, S., Tulasi, A., Buduru, A.B.: A Study of Black Box Adversarial Attacks in Computer Vision. CoRRabs/1912.01667(2019).https://doi.org/ 10.48550/arxiv.1912.016671

arXiv doi:10.48550/arxiv.1912.01667 2019

[4] [4]

In: Machine LearningandKnowledgeDiscoveryinDatabases(ECMLPKDD).LNCS,vol.8190, pp

Biggio, B., Corona, I., Maiorca, D., Nelson, B., Srndic, N., Laskov, P., Giacinto, G., Roli, F.: Evasion Attacks against Machine Learning at Test Time. In: Machine LearningandKnowledgeDiscoveryinDatabases(ECMLPKDD).LNCS,vol.8190, pp. 387–402. Springer (2013).https://doi.org/10.1007/978-3-642-40994-3_25 1

doi:10.1007/978-3-642-40994-3_25 2013

[5] [5]

Song et al

Carion, N., Gustafson, L., Hu, Y., Debnath, S., Hu, R., Suris, D., Ryali, C., Alwala, K.V., Khedr, H., Huang, A., Lei, J., Ma, T., Guo, B., Kalla, A., Marks, M., Greer, J., Wang, M., Sun, P., Rädle, R., Afouras, T., Mavroudi, E., Xu, K., Wu, T., Zhou, Y., Momeni, L., Hazra, R., Ding, S., Vaze, S., Porcher, F., Li, F., Li, S., Kamath, 16 D. Song et al. A.,...

arXiv doi:10.48550/arxiv.2511.16719 2025

[6] [6]

In: IEEE Symposium on Security and Privacy (S&P)

Carlini, N., Wagner, D.A.: Towards Evaluating the Robustness of Neural Networks. In: IEEE Symposium on Security and Privacy (S&P). pp. 39–57 (2017).https: //doi.org/10.1109/SP.2017.491, 5

work page doi:10.1109/sp.2017.491 2017

[7] [7]

CoRRabs/1706.05587(2017).https://doi

Chen, L.C., Papandreou, G., Schroff, F., Adam, H.: Rethinking atrous convolution for semantic image segmentation. CoRRabs/1706.05587(2017).https://doi. org/10.48550/arxiv.1706.0558710

arXiv doi:10.48550/arxiv.1706.05587 2017

[8] [8]

In: ECCV

Chen, W., Zhang, Z., Hu, X., Wu, B.: Boosting Decision-Based Black-Box Adver- sarial Attacks with Random Sign Flip. In: ECCV. LNCS, vol. 12360, pp. 276–293. Springer (2020).https://doi.org/10.1007/978-3-030-58555-6_171

work page doi:10.1007/978-3-030-58555-6_171 2020