Pith. sign in

REVIEW 2 major objections 5 minor 60 references

FSPGD: Rethinking Black-box Attacks on Semantic Segmentation

T0 review · 2 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Breaking same-class feature links in intermediate layers makes segmentation attacks transfer to unseen models.

desk verdict A genuinely new loss combination for segmentation attacks, but the headline transferability claim is weakened by target-aware hyperparameter selection. read the letter →

arxiv 2502.01262 v2 pith:XU4HQSTG submitted 2025-02-03 cs.CV

Eun-Sol Park , MiSo Park , Seung Park , Yong-Goo Shin This is my paper · ORCID
classification cs.CV
keywords adversarialattacksemanticsegmentationblack-boxtransferabilityintermediatefeatureprojectedgradientdescentcosinesimilaritymask
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that black-box attacks on semantic segmentation transfer poorly because existing methods only disturb output predictions, leaving the internal feature patterns of same-class objects intact. It introduces FSPGD, a projected-gradient attack that computes gradients from intermediate-layer features instead of predictions, maximizing two cosine-based losses: similarity between clean and adversarial features, and similarity among pixels that the clean image marks as belonging to the same kind of object. Across PASCAL VOC 2012 and Cityscapes, attacking mid-encoder features with this combined loss drives target-model mIoU far below that achieved by PGD, SegPGD, CosPGD, DAG, NI, DI, and TI, including on transformer-based models. If correct, the paper establishes intermediate-feature attacks as a viable route for segmentation and shifts the design target from output disruption to the disruption of spatial feature consistency.

What carries the argument

The load-bearing object is the composite loss $L = \lambda_t L_{\mathrm{ex}} + (1-\lambda_t) L_{\mathrm{in}}$ over an intermediate feature map, with $L_{\mathrm{ex}}$ as the external cosine-similarity term between clean and adversarial features and $L_{\mathrm{in}}$ as the internal term that makes same-class pixels dissimilar. The internal term is masked by $M_B$, a binarized version of the clean feature Gram matrix, so the attack only pushes apart pixel pairs whose clean features already look alike; $K$ normalizes by mask size and the factor $1/2$ corrects for symmetry. The schedule $\lambda_t = t/T$ is what lets the attack spend early iterations dismantling within-image class coherence and later iterations maximizing the clean-versus-adversarial feature gap. Ablations show that this layered, masked, and scheduled loss, applied at middle encoder stages such as Conv3_x in ResNet and early transformer blocks, is what transfers.

What would settle it

Take FSPGD and randomly permute the mask $M_B$ while keeping the number of selected pixel pairs identical; if the target-model mIoU stays as low as with the true mask, the same-class-pair selection is not what causes transferability.

Watch

Extended reading notes

Core claim

FSPGD's central claim is that transferable segmentation attacks can be built by maximizing two cosine dissimilarities in an intermediate feature map $f \in \mathbb{R}^{c \times N}$: $L_{\mathrm{ex}} = \frac{1}{N} \sum_i \big(\frac{f_x(i)}{|f_x(i)|}\big)^T \frac{f_a(i)}{|f_a(i)|}$, which pushes adversarial features away from clean features pointwise, and $L_{\mathrm{in}} = \frac{1}{2K} \sum_{p,q} M_B(p,q) \otimes S(p,q)$, where $S$ is the Gram matrix of $f_a$ and $M_B$ is a binarized mask built from clean-feature cosine similarity with threshold $\tau = \cos(\pi/3)$. The mask's premise is that same-class pixels have similar features, so making those pairs dissimilar should break the contextual structure that segmentation relies on. A time-dependent weight $\lambda_t = t/T$ applies $L_{\mathrm{in}}$ early and $L_{\mathrm{ex}}$ late. The paper reports that this first intermediate-feature attack for semantic segmentation lowers mIoU on unseen target models dramatically, for example from 56.35 for PGD to 16.57 for FSPGD when attacking DeepLabv3-ResNet101 with a DeepLabv3-ResNet50 source on VOC, and that mid-encoder layers give the best transfer while final layers overfit the source model.

Load-bearing premise

The method hinges on the assumption that the clean image's feature cosine mask reliably picks out pixel pairs belonging to the same object class, and that forcing those pairs apart in the source model's intermediate features will degrade unseen target models; the paper supports this with qualitative feature-similarity maps and ablations rather than with a proof or a direct measure of mask accuracy.

Editorial extensions

If this is right

  • On PASCAL VOC 2012 and Cityscapes, FSPGD reports target-model mIoU several points to tens of points below the strongest compared baselines, across ResNet-based and transformer-based architectures.
  • Intermediate-feature attacks, previously developed for image classification, are claimed for the first time to work for semantic segmentation.
  • Attacking middle encoder layers gives the best transfer, whereas late layers give strong source-model attack but weak transfer.
  • The dynamic $\lambda_t$ schedule, with the internal loss dominating early and the external loss late, outperforms using either loss alone or any fixed-weight combination.
  • Same-class feature dissimilarity transfers to target models whose encoder families differ from the source, including from CNN to transformer models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An untested extension of the paper's mechanism is that the same masked internal-dissimilarity loss would boost transferability in object detection and instance segmentation, where multiple same-class instances also share features.
  • Because the mask $M_B$ is built from clean-image features rather than labels, the method could run without a label map; the paper does not test how mask noise affects transfer.
  • The fixed threshold $\tau = \cos(\pi/3)$ could be replaced by a per-image quantile of clean feature similarities, a variant the paper leaves for future automatic parameter selection.
  • The mechanism implies a testable prediction: transfer gains should be largest for target models whose clean-image features already show strong same-class similarity, since those are the features $L_{\mathrm{in}}$ disrupts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes FSPGD, a transfer-based black-box attack for semantic segmentation that computes gradients from intermediate-layer features rather than output predictions. The loss has two terms: Lex, which minimizes cosine similarity between clean and adversarial feature maps pixel-wise (Eq. 4), and Lin, which reduces cosine similarity between pairs of pixels whose clean-feature similarity exceeds a threshold, i.e., pixels assumed to belong to similar objects (Eqs. 5-8). The two terms are combined with a time-dependent weight lambda_t = t/T in Eq. 9. Experiments on PASCAL VOC 2012 and Cityscapes compare FSPGD with PGD, SegPGD, CosPGD, DAG, NI, DI, and TI across four source and up to six target models, including transformer-based ones; the paper reports substantially lower mIoU on target models and claims state-of-the-art transferability, supported by ablations over tau, lambda, and feature layer. The supplementary material contains extended results and layer-wise analyses.

Significance. Intermediate-feature attacks are a well-established tool for transferability in image classification but have received little attention in semantic segmentation, so the core idea—maximizing external and internal feature dissimilarity at a middle layer—is timely and potentially of practical value. The paper is unusually thorough on the experimental side: four source models, several CNN and transformer targets, two datasets, and ablations over tau, the loss combination, and the attack layer. The code release is a plus. However, because the free parameters were tuned on the very target models used in the headline comparison, the quantitative significance is currently conditional on a re-evaluation under a fair transferability protocol.

major comments (2)
  1. [Section 4.3; Supplementary D.3; Eq. (7); Algorithm 1] The headline transferability comparison is not controlled because the method's free parameters—tau, the lambda_t schedule, and the attack layer—are selected using the same target models and datasets that are later reported in Tables 1 and 2. For example, Supplementary Table 7 shows that for PSPRes50 the layer 3_2 was chosen because it gives DV3Res101 target mIoU 16.84, whereas layer 4_2 gives 72.03 on the same target, and Section 4.3 selects tau = cos(pi/3) because it yields the lowest average mIoU on these targets. Baselines such as PGD, SegPGD, and CosPGD have no analogous per-source, target-aware layer/threshold choice, so part of the observed margin may be a selection artifact rather than evidence of transferability. The authors should fix tau, lambda_t, and the layer using source-model-only criteria or a disjoint development set of target models, or alternatively report the full layer/tau grids for all methods and show that FSPGD dominates across the grid; without one of these, the state-of-the-art claim is not yet established.
  2. [Algorithm 1, line 1; Tables 1-2] All reported mIoU values are single numbers, despite the fact that Algorithm 1 initializes the adversarial example with uniform random noise U(-epsilon, epsilon). The authors should report the mean and standard deviation over at least several random seeds (and ideally over multiple validation subsets), because the phrase 'significantly lower mIoU' in Section 4.2 requires evidence that the reported margins are stable under the random initialization and are not driven by a single run.
minor comments (5)
  1. [Section 4.2, Table 2] The statement that FSPGD 'shows high attack performance on the source model compared to conventional methods, excluding CosPGD' is not supported for the transformer sources in Cityscapes: for Mask2Former-Swin-S, FSPGD has source mIoU 2.20 while PGD, SegPGD, and NI give 0.45, 0.30, and 0.17, respectively; for SegFormer-MiT-B0, SegPGD gives 0.38 versus FSPGD's 1.33. Please qualify the claim.
  2. [Section 3.2, Eqs. (6)-(8)] The claim that the binarized clean-feature similarity mask M_B identifies pixel pairs belonging to the same object class is supported only by the qualitative visualizations in Fig. 1; a quantitative check (e.g., agreement between M_B and ground-truth class labels, or an ablation replacing M_B with a ground-truth mask or a random mask) would make the mechanism more convincing.
  3. [Section 4.3; Eq. (9)] The text writes the dynamic combination as 'lambda_t Lex + (lambda_t - 1) Lin', which contradicts Eq. (9)'s 'lambda_t Lex + (1 - lambda_t) Lin'; please correct the typo.
  4. [Fig. 4 and Fig. 5] Figure 4's caption says 'loss terms' although the figure reports tau values, and Figure 5 contains a Korean legend label ('계열4'); both should be fixed.
  5. [Supplementary Table 9] In the Mask2Former-Swin-S row for 'layers-2-blocks-0', the PSPRes101 and DV3Res101 target columns appear to be swapped relative to the main Table 2 (24.29 and 18.00), so the table should be cross-checked.

Circularity Check

1 steps flagged · score 4.0 of 10

Headline SOTA comparison is partly an in-sample artifact: tau and the attack layer are selected using the same target models and datasets later reported in Tables 1-2; the loss construction itself is not circular.

  1. fitted input called prediction [Section 4.3 (tau selection) and Supplementary D.3 (layer selection); Tables 1-2 report the resulting mIoU]
    "To select the τ value that maximizes transferability, we conduct experiments with all other variables fixed by setting τ to cos(π/3), cos(π/4), and cos(π/6) and Fig. 4 presents the results. Since the average mIoU value was the lowest when τ was set to cos(π/3), we selected cos(π/3) in our study."

    The quantity used to pick tau is the average mIoU over the exact target models and dataset that then populate Tables 1-2 as evidence of state-of-the-art transferability. Choosing tau to minimize those target mIoU scores and then reporting the resulting scores as the benchmark means the headline 'prediction' is an in-sample selection outcome, not an independent transferability forecast. The layer choice is equally target-informed (D.3: later layers give 'poor performance on the target models', middle layers 'high transferability'), so the layer used in Tables 1-2 is selected by inspecting the same target models. Baselines have no analogous per-source target-aware layer/tau selection, so the comparison is uncontrolled.

full rationale

The proposed loss is not circular: Lex and Lin (Eqs. 4-9) are defined on source-model intermediate features and the clean-image feature similarity mask MB (Eqs. 6-7), and none of these definitions presupposes the target models or the mIoU metric used for evaluation. There is no load-bearing self-citation chain, uniqueness theorem, or ansatz imported by citation; the paper's self-citations are unrelated GAN papers. The central circularity-adjacent issue is evaluation leakage: tau, the lambda_t schedule, and the attack layer are ablated and tuned on the same Pascal VOC and Cityscapes target models whose mIoU is then reported as the SOTA comparison (Sec. 4.3, Suppl. D.3), so the reported transferability margin is partly a selection artifact. This is a test-set selection-bias problem rather than an equation-level equivalence, and the method retains independent content because it outperforms baselines for every tau value tested. Score 4 reflects partial circularity in the headline empirical claim, not a fully circular derivation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or mathematical entity. Its burden rests on two empirical design choices: the cosine-similarity mask that defines same-class pixel pairs, and the per-architecture layer where features are attacked. Both are tuned on the evaluation benchmarks rather than derived from first principles.

free parameters (3)
  • tau = cos(pi/3) = 0.5
    Threshold for binarizing the clean-feature Gram matrix M; selected via ablation on VOC and Cityscapes (Section 4.3, Fig. 4).
  • lambda_t schedule = lambda_t = t/T
    Dynamic balance between external and internal losses; the dynamic schedule was chosen after ablating fixed and dynamic weightings (Section 4.3, Fig. 5).
  • attack layer per architecture = layer 3_2 (ResNet50), 3_10 (ResNet101), block-1-0 (MiT-B0), layers-2-blocks-0 (Swin-S)
    Layer choice is selected per architecture by running transferability ablations on the same datasets used for final evaluation (Supplement D.3).
assumptions (4)
  • domain assumption Cosine similarity between feature vectors is a faithful measure of semantic similarity between image regions.
    Motivation for Lex and Lin in Section 3.1; supported only by qualitative feature-similarity maps (Fig. 1).
  • ad hoc to paper The clean-feature Gram matrix M and its binarization MB correctly identify pixel pairs belonging to similar objects, and threshold tau is appropriate.
    Eq. 6-7; the threshold is chosen via ablation with no theoretical justification.
  • domain assumption Reducing internal feature similarity in an intermediate layer of the source model transfers to other models better than output-space attacks.
    Central hypothesis in Section 3.1; no formal argument, only empirical results.
  • standard math PGD with sign gradients and an l-infinity ball is a suitable optimizer and baseline.
    Section 2, Eq. 3; standard in the adversarial attack literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FSPGD: Rethinking Black-box Attacks on Semantic Segmentation." pith.science (2026). https://pith.science/paper/XU4HQSTG

@misc{pith2026250201262,
  author       = {Pith},
  title        = {Pith review of: FSPGD: Rethinking Black-box Attacks on Semantic Segmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XU4HQSTG}},
  note         = {Machine review of arXiv:2502.01262}
}
read the original abstract

Transferability, the ability of adversarial examples crafted for one model to deceive other models, is crucial for black-box attacks. Despite advancements in attack methods for semantic segmentation, transferability remains limited, reducing their effectiveness in real-world applications. To address this, we introduce the Feature Similarity Projected Gradient Descent (FSPGD) attack, a novel black-box approach that enhances both attack performance and transferability. Unlike conventional segmentation attacks that rely on output predictions for gradient calculation, FSPGD computes gradients from intermediate layer features. Specifically, our method introduces a loss function that targets local information by comparing features between clean images and adversarial examples, while also disrupting contextual information by accounting for spatial relationships between objects. Experiments on Pascal VOC 2012 and Cityscapes datasets demonstrate that FSPGD achieves superior transferability and attack performance, establishing a new state-of-the-art benchmark. Code is available at https://github.com/KU-AIVS/FSPGD.

Figures

Figures reproduced from arXiv: 2502.01262 by the authors.

Figure 1
Figure 1. Visualization of the feature similarity. We show a feature similarity map using the features of the bicycle wheels area (red box) [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Overall framework of FSPGD. FSPGD employs a loss function with two components: external and internal feature similarity loss. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Visualization of experimental results. DV3Res50 is used as the source model and images of first column are clean images and [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: mIoU performance across different loss terms. (S) and [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 1
Figure 1. Figure 1: Visualization of the feature similarity on Pascal VOC 2012 dataset. Red boxes indicate the reference features, while yellow and [PITH_FULL_IMAGE:figures/full_fig_p009_1.png]
Figure 2
Figure 2. Figure 2: Visualization of the feature similarity on Pascal VOC 2012 dataset. Red boxes indicate the reference features, while yellow and [PITH_FULL_IMAGE:figures/full_fig_p010_2.png]
Figure 3
Figure 3. Figure 3: Visualization of the feature similarity on Cityscapes dataset. Red boxes indicate the reference features, while yellow and blue [PITH_FULL_IMAGE:figures/full_fig_p011_3.png]
Figure 4
Figure 4. Figure 4: Visualization of the feature similarity on Cityscapes dataset. Red boxes indicate the reference features, while yellow and blue [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Visualization of clean image, attacked images, and output predictions on Pascal VOC 2012. Deeplabv3-Res50 is used as the [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Visualization of clean image, attacked images, and output predictions on Pascal VOC 2012. Deeplabv3-Res50 is used as the [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Visualization of clean image, attacked images, and output predictions on Cityscapes. Deeplabv3-Res101 is used as the source [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Visualization of clean image, attacked images, and output predictions on Cityscapes. Deeplabv3-Res101 is used as the source [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 53 canonical work pages

  1. [22]

    Transferable Attack for Semantic Segmentation

    Mengqi He, Jing Zhang, Zhaoyuan Yang, Mingyi He, Nick Barnes, and Yuchao Dai. Transferable attack for semantic segmentation. arXiv preprint arXiv:2307.16572, 2023. 2

    work page Pith review arXiv 2023

  2. [1]

    Cospgd: an efficient white-box adversarial attack for pixel-wise prediction tasks

    Shashank Agnihotri, Steffen Jung, and Margret Keuper. Cospgd: an efficient white-box adversarial attack for pixel-wise prediction tasks. In Forty-first International Conference on Machine Learning, 2024. 1, 2, 3, 5, 6, 7, 4, 8

    work page 2024

  3. [2]

    Understanding and improving fast adversarial training

    Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Neural Information Processing Systems, 33:16048–16059, 2020. 2

    work page 2020

  4. [3]

    On the robustness of semantic segmentation models to adversarial attacks

    Anurag Arnab, Ondrej Miksik, and Philip HS Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 888–897, 2018. 2

    work page 2018

  5. [4]

    An adaptive model ensemble adversarial attack for boosting adversarial transferability

    Bin Chen, Jiali Yin, Shukai Chen, Bohao Chen, and Ximeng Liu. An adaptive model ensemble adversarial attack for boosting adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4489–4498, 2023. 1, 2

    work page 2023

  6. [5]

    Rethinking model ensemble in transfer-based adversarial attacks

    Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. arXiv preprint arXiv:2303.09105, 2023. 1, 2

    arXiv 2023

  7. [6]

    Rethinking atrous convolution for semantic image segmentation

    Liang-Chieh Chen. Rethinking atrous convolution for semantic image segmentation. arXiv preprint arXiv:1706.05587, 2017. 1, 2, 6

    arXiv 2017

  8. [7]

    Encoder-decoder with atrous separable convolution for semantic image segmentation

    Liang-Chieh Chen, Yukun Zhu, George Papandreou, Florian Schroff, and Hartwig Adam. Encoder-decoder with atrous separable convolution for semantic image segmentation. In Proceedings of the European conference on computer vision (ECCV), pages 801– 818, 2018. 1

    work page 2018

Show all 60 references
  1. [8]

    Masked-attention mask transformer for universal image segmentation

    Bowen Cheng, Ishan Misra, Alexander G Schwing, Alexander Kirillov, and Rohit Girdhar. Masked-attention mask transformer for universal image segmentation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 1290–1299, 2022. 2, 6

    2022

  2. [9]

    The cityscapes dataset for semantic urban scene understanding

    Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In Proceedings of the IEEE conference on computer vision and pattern reco...

    2016

  3. [10]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018. 1, 2

    2018

  4. [11]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4312–4321, 2019. 1, 5, 6

    2019

  5. [12]

    Everingham, L

    M. Everingham, L. Van Gool, C. K. I. Williams, J. Winn, and A. Zisserman. The PASCAL Visual Object Classes Challenge 2012 (VOC2012) Results. http://www.pascal-network.org/challenges/VOC/voc2012/workshop/index.html. 5

    2012

  6. [13]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognit...

    2018

  7. [14]

    Generative adversarial networks

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139–144, 2020. 1

    2020

  8. [15]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 2

    2014 arXiv

  9. [16]

    Effective and efficient vote attack on capsule networks

    Jindong Gu, Baoyuan Wu, and V olker Tresp. Effective and efficient vote attack on capsule networks. arXiv preprint arXiv:2102.10055, 2021. 2

    2021 arXiv

  10. [17]

    Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness

    Jindong Gu, Hengshuang Zhao, V olker Tresp, and Philip HS Torr. Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. In European Conference on Computer Vision, pages 308–325. Springer, 2022. 1, 2, 3, 5, 6, 7, 4, 8

    2022

  11. [18]

    Lgv: Boosting adversarial example transferability from large geometric vicinity

    Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In European Conference on Computer Vision, pages 603–618. Springer, 2022. 1

    2022

  12. [19]

    Backpropagating linearly improves transferability of adversarial examples

    Yiwen Guo, Qizhang Li, and Hao Chen. Backpropagating linearly improves transferability of adversarial examples. Advances in neural information processing systems, 33:85–95, 2020. 1

    2020

  13. [20]

    Hypercolumns for object segmentation and fine-grained localization

    Bharath Hariharan, Pablo Arbeláez, Ross Girshick, and Jitendra Malik. Hypercolumns for object segmentation and fine-grained localization. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 447–456, 2015. 5

    2015

  14. [21]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 1, 6

    2016

  15. [23]

    Densely connected convolutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 1

    2017

  16. [24]

    T-sea: Transfer-based self-ensemble attack on object detection

    Hao Huang, Ziyan Chen, Huanran Chen, Yongtao Wang, and Kevin Zhang. T-sea: Transfer-based self-ensemble attack on object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 20514–20523, 2023. 2

    2023

  17. [25]

    Enhancing adversarial example transferability with an intermediate level attack

    Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Belongie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4733–4742,

  18. [26]

    Transegpgd: Improving transferability of adversarial examples on semantic segmentation

    Xiaojun Jia, Jindong Gu, Yihao Huang, Simeng Qin, Qing Guo, Yang Liu, and Xiaochun Cao. Transegpgd: Improving transferability of adversarial examples on semantic segmentation. arXiv preprint arXiv:2312.02207, 2023. 1, 2

    2023 arXiv

  19. [27]

    Pearl: Preprocessing enhanced adversarial robust learning of image deraining for semantic segmentation

    Xianghao Jiao, Yaohua Liu, Jiaxin Gao, Xinyuan Chu, Xin Fan, and Risheng Liu. Pearl: Preprocessing enhanced adversarial robust learning of image deraining for semantic segmentation. In Proceedings of the 31st ACM International Conference on Multimedia , pages 8185–8194, 2023. 1

    2023

  20. [28]

    Yet another intermediate-level attack

    Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-level attack. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XVI 16, pages 241–257. Springer, 2020. 1

    2020

  21. [29]

    Making substitute models more bayesian can enhance transferability of adversarial examples

    Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Making substitute models more bayesian can enhance transferability of adversarial examples. In International Conference on Learning Representations (ICLR), 2023. 1

    2023

  22. [30]

    Improving adversarial transferability via intermediate-level perturbation decay

    Qizhang Li, Yiwen Guo, Wangmeng Zuo, and Hao Chen. Improving adversarial transferability via intermediate-level perturbation decay. Advances in Neural Information Processing Systems, 36, 2024. 1

    2024

  23. [31]

    Styless: boosting the transferability of adversarial examples

    Kaisheng Liang and Bin Xiao. Styless: boosting the transferability of adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8163–8172, 2023. 1

    2023

  24. [32]

    Nesterov accelerated gradient and scale invariance for adversarial attacks

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.06281, 2019. 1, 5, 6

    1908 arXiv

  25. [33]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision , pages 10012–10022, 2021. 6

    2021

  26. [34]

    Fully convolutional networks for semantic segmentation

    Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for semantic segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3431–3440, 2015. 1, 6

    2015

  27. [35]

    On the convergence of an adaptive momentum method for adversarial attacks

    Sheng Long, Wei Tao, LI Shuohao, Jun Lei, and Jun Zhang. On the convergence of an adaptive momentum method for adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 14132–14140, 2024. 1

    2024

  28. [36]

    Towards deep learning models resistant to adversarial attacks

    Aleksander M ˛ adry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. stat, 1050(9), 2017. 1, 2, 3, 5, 6, 7, 4, 8

    2017

  29. [37]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574–2582, 2016. 2

    2016

  30. [38]

    Trackpgd: A white-box attack using binary masks against robust transformer trackers

    Fatemeh Nourilenjan Nokabadi, Yann Batiste Pequignot, Jean-François Lalonde, and Christian Gagné. Trackpgd: A white-box attack using binary masks against robust transformer trackers. arXiv preprint arXiv:2407.03946, 2024. 2

    2024 arXiv

  31. [39]

    A novel generator with auxiliary branch for improving gan performance

    Seung Park and Yong-Goo Shin. A novel generator with auxiliary branch for improving gan performance. IEEE Transactions on Neural Networks and Learning Systems, 2024. 1

    2024

  32. [40]

    Rethinking image skip connections in stylegan2

    Seung Park and Yong-Goo Shin. Rethinking image skip connections in stylegan2. arXiv preprint arXiv:2407.05527, 2024

    2024 arXiv

  33. [41]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 10684–10695, 2022

    2022

  34. [42]

    Conditional convolution projecting latent vectors on condition- specific space

    Min-Cheol Sagong, Yoon-Jae Yeo, Yong-Goo Shin, and Sung-Jea Ko. Conditional convolution projecting latent vectors on condition- specific space. IEEE Transactions on Neural Networks and Learning Systems, 35(1):1386–1393, 2022. 1

    2022

  35. [43]

    Low-rank adversarial pgd attack

    Dayana Savostianova, Emanuele Zangrando, and Francesco Tudisco. Low-rank adversarial pgd attack. arXiv preprint arXiv:2410.12607, 2024. 2

    2024 arXiv

  36. [44]

    Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize to a crime: Real and stealthy attacks on state- of-the-art face recognition. In Proceedings of the 2016 acm sigsac conference on computer and communications security , pages 1528–1540, 2016. 1

    2016

  37. [45]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. 1

    2014 arXiv

  38. [46]

    Going deeper with convolutions

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015. 1

    2015

  39. [47]

    Enhancing adversarial text attacks on bert models with projected gradient descent

    Hetvi Waghela, Jaydip Sen, and Sneha Rakshit. Enhancing adversarial text attacks on bert models with projected gradient descent. arXiv preprint arXiv:2407.21073, 2024. 2

    2024 arXiv

  40. [48]

    Boosting adversarial transferability by block shuffle and rotation

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24336–24346, 2024. 1

    2024

  41. [49]

    Admix: Enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceed- ings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021. 1

    2021

  42. [50]

    Feature importance-aware transferable adversarial attacks

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transferable adversarial attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7639–7648, 2021. 1

    2021

  43. [51]

    Boosting adversarial transferability via fusing logits of top-1 decomposed feature

    Juanjuan Weng, Zhiming Luo, Dazhen Lin, Shaozi Li, and Zhun Zhong. Boosting adversarial transferability via fusing logits of top-1 decomposed feature. arXiv preprint arXiv:2305.01361, 2023. 1

    2023 arXiv

  44. [52]

    Rethinking the backward propagation for adversarial transferability

    Wang Xiaosen, Kangheng Tong, and Kun He. Rethinking the backward propagation for adversarial transferability. Advances in Neural Information Processing Systems, 36:1905–1922, 2023. 1

    1905

  45. [53]

    Adversarial examples for semantic segmentation and object detection

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE international conference on computer vision, pages 1369–1378, 2017. 1, 2, 5, 6

    2017

  46. [54]

    Improving transferability of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2730–2739, 2019. 1, 5, 6

    2019

  47. [55]

    Segformer: Simple and efficient design for semantic segmentation with transformers

    Enze Xie, Wenhai Wang, Zhiding Yu, Anima Anandkumar, Jose M Alvarez, and Ping Luo. Segformer: Simple and efficient design for semantic segmentation with transformers. Advances in neural information processing systems, 34:12077–12090, 2021. 2, 6

    2021

  48. [56]

    Improving adversarial transferability via neuron attribution-based attacks

    Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, and Michael R Lyu. Improving adversarial transferability via neuron attribution-based attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14993–1500...

    2022

  49. [57]

    Improving the transferability of adversarial samples by path-augmented method

    Jianping Zhang, Jen-tse Huang, Wenxuan Wang, Yichen Li, Weibin Wu, Xiaosen Wang, Yuxin Su, and Michael R Lyu. Improving the transferability of adversarial samples by path-augmented method. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pa...

    2023

  50. [58]

    Pyramid scene parsing network

    Hengshuang Zhao, Jianping Shi, Xiaojuan Qi, Xiaogang Wang, and Jiaya Jia. Pyramid scene parsing network. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2881–2890, 2017. 1, 2, 6

    2017

  51. [59]

    Rethinking adversarial transferability from a data distribution perspective

    Yao Zhu, Jiacheng Sun, and Zhenguo Li. Rethinking adversarial transferability from a data distribution perspective. In International Conference on Learning Representations, 2021. 1

    2021

  52. [60]

    Toward understanding and boosting adversarial transferability from a distribution perspective

    Yao Zhu, Yuefeng Chen, Xiaodan Li, Kejiang Chen, Yuan He, Xiang Tian, Bolun Zheng, Yaowu Chen, and Qingming Huang. Toward understanding and boosting adversarial transferability from a distribution perspective. IEEE Transactions on Image Processing, 31: 6487–6501, 2022. 1

    2022

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.