arXiv Computer Vision

RePAIR: Inverting Backdoor Attacks in Semantic Segmentation

RePAIR is a post‑hoc, label‑free defense for semantic segmentation models that counters backdoor attacks by inferring victim‑target relationships from unlabeled images and correcting predictions in feature space and output space. It localizes suspicious pixels by comparing classifier head outputs with internal semantic evidence, applying conservative constraints to avoid harming clean predictions. Experiments demonstrate that RePAIR significantly reduces attack success across various segmentation architectures while largely preserving clean performance.

arXiv Computer Vision

Sep 7

FSPGD: Rethinking Black-box Attacks on Semantic Segmentation

FSPGD introduces a feature-space black-box attack for semantic segmentation that targets intermediate representations rather than just output logits. The method uses a dual loss: an external loss to disrupt cross-model feature alignment and an internal loss to reduce consistency among same-class instances. Experiments on Pascal VOC 2012 and Cityscapes show that FSPGD outperforms existing logit-level and segmentation-specific attacks across CNN and Transformer backbones, and its adversarial examples improve robustness when used for training.

By Eun-Sol Park, MiSo Park, Yong-Goo Shin

llms computer-vision benchmarks safety

arXiv Computer Vision

Oct 8

Detecting Adversarial Images through Response Profiles of Vision-Language Models

arXiv:2610.10436v1 Announce Type: new Abstract: Adversarial perturbations can alter the predictions of frozen vision-language models (VLMs) while leaving their confidence and image--text similarity p...

By Arash Vashagh, Roozbeh Razavi-Far

llms rag multimodal safety

arXiv Machine Learning

Jun 3

BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attacks

arXiv:2606. 02947v1 Announce Type: new Abstract: Supervised fine-tuning is the predominant approach for adapting autoregressive vision-language models to downstream tasks.

By Ivan Saboli\'c, Marin Or\v{s}i\'c, Josip \v{S}ari\'c, Sven Lon\v{c}ari\'c

llms fine-tuning multimodal

arXiv AI

Aug 18

Statistical Adversaries: Natural Backdoor-like Adversarial Features in Clean Vision Datasets

arXiv:2607. 05516v2 Announce Type: replace-cross Abstract: Model-specific adversarial attacks have been extensively studied.

By Paul K. Mandal, Pavan Reddy, Tristan Malatynski

safety

arXiv Computer Vision

Sep 2

Adversarial Attack and Disturbance Detection by Hadamard-Coded Output Representations for Object Detection and Semantic Segmentation

arXiv:2606.09536v2 Announce Type: replace Abstract: Conventional one-hot encodings often yield poorly calibrated models, being overconfident under attack, and letting entropy-based detection algorith...

By Lucas G\"ornhardt, Timo Bartels, Niklas Schwarz, Tim Fingscheidt

computer-vision benchmarks safety

arXiv Computer Vision

Sep 24

ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus

arXiv:2609.28239v1 Announce Type: new Abstract: With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulne...

By Li Zeng, Mingcheng Duan, Longfei Fan, Hangtao Zhang, Xianlong Wang, Yanchun Li, Xia Wen, Leo Yu Zhang

agents computer-vision robotics

arXiv Computer Vision

Sep 4

Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems

The paper evaluates six preprocessing defenses against adversarial attacks on depthwise‑separable CNNs, the dominant architecture in edge vision systems, and finds that these defenses consistently fail to recover clean predictions for such models, whereas a residual architecture shows partial recovery. The study reveals that the same preprocessing steps that break clean predictions leave adversarial predictions largely intact, creating a measurable asymmetry that can be exploited for detection without retraining or architectural changes. It also demonstrates that common image quality metrics do not reliably indicate defense effectiveness, highlighting a methodological gap in current evaluation practices.

By Jannatul Masruk Mukta, Rifa Sanjida, Adrita Rahman Tory, Md. Saifur Rahman, Khondokar Fida Hasan

benchmarks safety

Hugging Face Trending Papers

Sep 23

ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus

With the development of applications like autonomous driving, object detection has gained significant attention, while also highlighting critical vulnerabilities like backdoor attacks that severely co...

agents computer-vision robotics

arXiv AI

Jul 8

Statistical Adversaries: Natural Backdoor-like Features in Vision Datasets

arXiv:2607. 05516v1 Announce Type: cross Abstract: Model-specific adversarial attacks have been extensively studied.

By Paul K. Mandal, Pavan Reddy, Tristan Malatynski

safety

arXiv Computer Vision

Oct 19

SemPurify: Semantics-Aware Data Purification for Black-box Backdoor Defense

arXiv:2610.23589v1 Announce Type: new Abstract: Backdoor attacks have emerged as a critical security threat in machine learning, where adversaries embed triggers within poisoned training samples to m...

By Jiawei Yu, Syed Irfan Ali Meerza, Yi Wu, Amir Sadovnik, Jian Liu

rag diffusion

arXiv AI

Jun 24

PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models

arXiv:2606. 24388v1 Announce Type: new Abstract: We introduce a large-scale, open-source dataset of pre-generated adversarial attacks for vision-language models (VLMs).

By Simone Gallivanone, Hossein Khodadadi, Mauro Dore, Mauro Medda, Nicola Franco

llms fine-tuning multimodal benchmarks safety

Hugging Face Trending Papers

Sep 3

Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems

The paper examines how preprocessing defenses, commonly used to protect edge vision systems, perform on depthwise‑separable CNNs versus residual architectures. Six preprocessing methods were tested against adversarial attacks, revealing that depthwise‑separable models consistently fail to recover from perturbations while residual models show partial recovery. Interestingly, the same preprocessing that hinders clean predictions leaves adversarial predictions largely intact, offering a measurable detection signal, and the study also finds that typical image‑quality metrics do not reliably indicate defense success.

benchmarks safety

Related stories