Universal Adversarial Perturbations Against Semantic Image Segmentation

By Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, Volker Fischer. 2017

309 citations recorded by the source corpus.

While deep learning is remarkably successful on perceptual tasks, it was also shown to be vulnerable to adversarial perturbations of the input. These perturbations denote noise added to the input that was generated specifically to fool the system while being quasi-imperceptible for humans. More severely, there even exist universal perturbations that are input-agnostic but fool the network on the majority of inputs. While recent work has focused on image classification, this work proposes attacks against semantic image segmentation: we present an approach for generating (universal) adversarial perturbations that make the network yield a desired target segmentation as output. We show empirically that there exist barely perceptible universal noise patterns which result in nearly the same predicted segmentation for arbitrary inputs. Furthermore, we also show the existence of universal noise which removes a target class (e.g., all pedestrians) from the segmentation while leaving the segmentation mostly unchanged otherwise.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack (2018, background): “In addition to image classification, attacks to other DNN-powered tasks have also been actively investigated, such as visual question answering [43, 1], image captioning [10], semantic segmentation [31, 1] and etc [12, 8, 39].”
Adversarial Examples for Semantic Segmentation and Object Detection (2017, background): “There are two concurrent works [9] and [22] that studied adversarial examples in semantic segmentation on the Cityscapes dataset [4], where [9] showed the existence of adversarial examples, and [22] showed the existence of universal perturbations.”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “Since each perturbation is responsible for at least one-pixel segmentation, this makes the space of perturbations for segmentation much smaller than that for image classification [103].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[67] showed the existence of image-agnostic quasi-imperceptible perturbations that can fool a deep neural network into significantly corrupting the predicted segmentation of the images.”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “Typical examples include semantic segmentation and object detection [21, 22, 23, 24, 25], image captioning [26], and visual QA [27].”
Generative Adversarial Perturbations (2017, methodology): “A method for generating targeted universal adversarial perturbations for semantic segmentation models is presented in [34].”
Clean-Label Backdoor Attacks on Video Recognition Models (2020, background): “Different to universal adversarial perturbation [19, 20] crafted to fool DNN models at test time (eg.”
On the Robustness of Semantic Segmentation Models to Adversarial Attacks (2017, background): “[44] have thoroughly evaluated the transferability of adversarial examples generated on one network and tested on another unknown model, i.e . only as “black-box” attacks [61, 54, 50, 51].”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, background): “Researchers also explore to produce universal adversarial perturbations by different methods [27, 39] or on different tasks [24, 42].”
A Survey On Universal Adversarial Attack (2021, background): “explores how to exploit universal adversarial perturbations against semantic segmentation [Hendrik Metzen et al., 2017].”
Universal Adversarial Training (2018, background): “In addition to classification tasks, universal perturbations are also shown to exist for semantic segmentation [18].”
Robust Physical-World Attacks on Deep Learning Visual Classification (2018, methodology): “Attacking detectors are out of the scope of this paper, though recent work has generated digital adversarial examples against detection/segmentation algorithms [6,20,38], and our recent work has extended RP 2 to attack the YOLO detector [7].”
Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors (2019, background): “demonstrate that nearly imperceptible adversarial perturbations can fool segmentation models to produce incorrect outputs [24].”
Fooling Vision and Language Models Despite Localization and Attention Mechanism (2017, background): “Note that existing works [24, 70] have demonstrated that an object detection/segmentation model can be fooled by adversarial examples.”
A Geometric Perspective on the Transferability of Adversarial Directions (2018, background): “While there has been a signiﬁcant amount of work on designing adversarial attacks (Grosse et al., 2016; Moosavi Dezfooli et al., 2016; Mopuri et al., 2017; Hendrik Metzen et al., 2017; Papernot et al., 2016) and defenses against these attacks (Madry et al., 2017; Sinha et al., 2017), theoretical pro”
Adversarially Robust Neural Architectures (2020, unknown): “Besides classification, adversarial attacks have been applied to other tasks, such as detection and segmentation [38, 39].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, methodology): “x Y = {y1, y2, · · · , yN} x yi There are also studies on semantic segmentation and object detection models in computer vision[124, 125].”