← Back to all news
arXiv Computer Vision

FSPGD: Rethinking Black-box Attacks on Semantic Segmentation

FSPGD introduces a feature-space black-box attack for semantic segmentation that targets intermediate representations rather than just output logits. The method uses a dual loss: an external loss to disrupt cross-model feature alignment and an internal loss to reduce consistency among same-class instances. Experiments on Pascal VOC 2012 and Cityscapes show that FSPGD outperforms existing logit-level and segmentation-specific attacks across CNN and Transformer backbones, and its adversarial examples improve robustness when used for training.

Related stories

arXiv Machine Learning
Oct 23

MIG-COW: Transferable Adversarial Attacks on Deepfake Detectors via Gradient Decomposition

MIG‑COW is a new adversarial attack framework that uses momentum‑integrated gradients and a consensus‑orthogonal decomposition to create highly generalizable, visually imperceptible perturbations against deepfake detectors. It achieves a 99.96% white‑box attack success rate on the AADD‑2025 Challenge benchmarks while maintaining high perceptual similarity (SSIM). In black‑box settings, its success rate drops to 7.16%, and adding low‑performing but diverse models to the ensemble can reduce attack effectiveness, highlighting the importance of careful surrogate model selection.

By Wonjune Seo, Joonhyuk Baek, Yeseong Jung, Saerom Park
multimodalbenchmarkssafety
More like this →
arXiv Computer Vision
2d ago

RePAIR: Inverting Backdoor Attacks in Semantic Segmentation

RePAIR is a post‑hoc, label‑free defense for semantic segmentation models that counters backdoor attacks by inferring victim‑target relationships from unlabeled images and correcting predictions in feature space and output space. It localizes suspicious pixels by comparing classifier head outputs with internal semantic evidence, applying conservative constraints to avoid harming clean predictions. Experiments demonstrate that RePAIR significantly reduces attack success across various segmentation architectures while largely preserving clean performance.

By Arnold Brosch, Kira Maag
computer-visionsafety
More like this →
arXiv Computer Vision
Sep 4

Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers

The paper introduces TRIM, a black‑box defense for backdoor attacks in computer vision models. TRIM identifies and removes malicious trigger regions at inference time using region‑based segmentation, adaptive trigger discovery via inpainting and diffusion, and selective purification, without needing model internals, training data, or clean samples. Experiments on various datasets and trigger types show TRIM reduces attack success rates to as low as 1.16% while maintaining high clean accuracy.

By Ahmed Abdelnaby, Mohamed Elmahallawy
ragdiffusioncomputer-visionmultimodal
More like this →
arXiv Machine Learning
2d ago

Attack logics, not outputs: Concept-based Property Attacks for Shortcut Elimination in Neural Networks

The paper introduces concept-based property attacks, which target logical inconsistencies in human‑interpretable concepts (e.g., “red ∧ octagonal → stop_sign”) rather than merely flipping final class labels. It formalizes these properties, proves that attacking them reduces the search space compared to class‑level attacks, and implements them using concept‑based explainable AI techniques. Empirical results across vision and code‑processing models show that retraining with these attacks preserves robustness gains while better eliminating semantic biases.

By Raik Dankworth, Felix M\"achtle, Thomas Eisenbarth, Gesina Schwalbe
computer-visionsafety
More like this →