On the Robustness of Semantic Segmentation Models to Adversarial Attacks

By Anurag Arnab, Ondrej Miksik, Philip H. S. Torr. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2017

339 citations recorded by the source corpus.

Deep Neural Networks (DNNs) have been demonstrated to perform exceptionally well on most recognition tasks such as image classification and segmentation. However, they have also been shown to be vulnerable to adversarial examples. This phenomenon has recently attracted a lot of attention but it has not been extensively studied on multiple, large-scale datasets and complex tasks such as semantic segmentation which often require more specialised networks with additional components such as CRFs, dilated convolutions, skip-connections and multiscale processing. In this paper, we present what to our knowledge is the first rigorous evaluation of adversarial attacks on modern semantic segmentation models, using two large-scale datasets. We analyse the effect of different network architectures, model capacity and multiscale processing, and show that many observations made on the task of classification do not always transfer to this more complex task. Furthermore, we show how mean-field inference in deep structured models and multiscale processing naturally implement recently proposed adversarial defenses. Our observations will aid future efforts in understanding and defending against adversarial examples. Moreover, in the shorter term, we show which segmentation models should currently be preferred in safety-critical applications due to their inherent robustness.

Subfields: Artificial Intelligence, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/8067d5d3fc80abb010b239bbe012b50bae8e6611

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “semantic segmentation [23], [24]; object detection [25], [26]; and object tracking [27], [28].”
Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples (2019, methodology): “This paper’s focus is evasion attacks which have been proposed against supervised ML algorithms used for image classification [13, 18, 24, 45, 97, 114], object detection [26, 83, 127], image segmentation [6, 41], speech recognition [19, 133] as well as other tasks [27, 48, 65, 129]; generative model”
Generative Adversarial Perturbations (2017, background): “[2] evaluates the robustness of segmentation models against common attacks.”
Kornia: an Open Source Differentiable Computer Vision Library for PyTorch (2019, background): “There are series of works showing that CNNbased solution of classification [1], segmentation [4], object detection [11], and image retrieval [32] tasks are all prone to such attacks.”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “Existing work on adversarial examples has focused largely on the space of images, be it image classification [125], generative models on images [64], image segmentation [2], face detection [115], or reinforcement learning by manipulating the images the RL agent sees [8, 49].”
Adversarially Robust Generalization Requires More Data (2018, background): “More recently, researchers have demonstrated the phenomenon under the name of adversarial examples in image classification [21, 51], question answering [28], voice recognition [12, 13, 49, 62], and other domains (for instance, see [2, 4, 14, 22, 25, 26, 32, 60]).”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[51] also evaluated FGSM [23] based adversarial attacks for semantic segmenta-”
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks (2019, background): “As adversarial examples can help identify the robustness of models (Arnab et al., 2018), as well as improve the robustness of models by adversarial training (Goodfellow et al., 2014), learning how to generate adversarial examples with high transferability is important and has gained increasing…”
Hover-Net: Simultaneous segmentation and classification of nuclei in multi-tissue histology images (2018, methodology): “The feature extraction component of the network is inspired by the pre-activated residual network with 50 layers [36] (Preact-ResNet50), due to its excellent performance in recent computer vision tasks [37] and robustness against input perturbation [38].”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “on-based methods [20]. In addition to image classiﬁcation, attacks to other CNN-related tasks have also been actively investigated. Typical examples include semantic segmentation and object detection [21, 22, 23, 24, 25], image captioning [26], and visual QA [27]. Besides, recent studies have also c”
Exact Adversarial Attack to Image Captioning via Structured Output Learning With Latent Variables (2019, background): “, object detection and semantic segmentation, is also studied in [8, 22, 34] and [34, 8, 2], respectively.”
Improving Transferability of Adversarial Examples With Input Diversity (2018, background): “robustness of different models [1] and understand the insufficiency of current training algorithms [10, 16, 36].”
Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectors (2019, background): “also show that segmentation models are vulnerable to attacks [1], and claim that adversarial perturbations fail to transfer across network architectures.”
Towards Robust CNN-based Object Detection through Augmentation with Synthetic Rain Variations (2019, methodology): “[25] used adversarial attacks to perform a robustness evaluation on neural networks.”