Pith. sign in

REVIEW 3 major objections 5 minor 89 references

A Generative Victim Model for Segmentation

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Diffusion scores replace the segmentation victim model in attacks

desk verdict A genuinely novel construction for segmentation attacks without a segmentation victim model, with a real gap in the score-evaluation step that needs closing before the central claim is established. read the letter →

arxiv 2412.07274 v1 pith:TLMYC4Z3 submitted 2024-12-10 cs.CV

Aixuan Li , Jing Zhang , Jiawei Shi , Yiran Zhong , Yuchao Dai This is my paper · ORCID
classification cs.CV
keywords adversarialattacksemanticsegmentationdiffusionmodelscoreestimationtransferabilitycamouflagedobjectdetectionblack-boxgenerativevictim
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

For segmentation attacks, the paper's central claim is that you do not need a segmentation victim model at all: the score of a conditional diffusion model, combined with its unconditional score, gives the gradient direction that lowers the likelihood of the true segmentation under an attacked image. Since the conditional segmentation score can be written as the difference between a conditional and an unconditional image-generation score, a generative model trained for image generation can serve as the victim model for adversarial attack generation. This removes the usual prerequisite of a trained, gradient-accessible segmentation network. The paper demonstrates the attack on camouflaged-object detection and semantic segmentation, with transfer across different backbones and an optional query mode that uses very few queries. A sympathetic reader would care because it reframes adversarial attacks as a problem of estimating data-distribution gradients rather than exploiting a particular model's loss surface.

What carries the argument

The load-bearing object is Eq. (8), $s(y|x^{\mathrm{adv}}) = \omega\big(s_\theta(x^{\mathrm{adv}}|y) - s_\theta(x^{\mathrm{adv}})\big)$, the weighted difference of conditional and unconditional diffusion scores, mirroring classifier-free guidance. The diffusion model is trained as a noise estimator, so the negative of its output approximates the gradient of log data density; the unconditional branch is obtained by setting the conditioning variable to empty during training. Eq. (10) then turns that score difference into a per-step perturbation, and Eq. (11) adds noise to the pseudo-adversarial sample so the diffusion score is evaluated on inputs that resemble its training distribution. The same machinery supplies both the transfer attack and the optional query refinement, and $\omega$ absorbs the gap between the true score and the estimated score.

What would settle it

Run the paper's attack with the diffusion timestep explicitly fixed to each value from 0 to 1000 and measure transfer attack success on a fixed victim set; if no fixed timestep reproduces the reported effectiveness, the claim is not pinned to a well-defined score evaluation. Alternatively, estimate $\nabla \log p(y|x^{\mathrm{adv}})$ by finite differences on a real segmentation model and compare its cosine similarity with the paper's score difference; near-zero similarity would falsify the derivation.

Watch

Extended reading notes

Core claim

The paper's core discovery is that the log-likelihood of a label map $y$ given a perturbed image $x^{\mathrm{adv}}$ decomposes by Bayes' rule, so minimizing $\log p(y|x^{\mathrm{adv}})$ is equivalent to minimizing $\log p(x^{\mathrm{adv}},y) - \log p(x^{\mathrm{adv}})$. Taking gradients, the conditional segmentation score equals a conditional image-generation score minus an unconditional image-generation score. Approximating those scores with a jointly trained conditional/unconditional diffusion model, and weighing their difference by a hyper-parameter $\omega$ as in Eq. (8), yields a step direction that the paper uses exactly where PGD would use the victim segmentation model's loss gradient. The resulting attack is image-dependent and sample-dependent, transfers across architectures because it follows density rather than a surrogate's decision boundary, and can optionally query the victim to select the best accumulated perturbation. The paper states this as the first derivation of a victim model for segmentation from image-generation principles.

Load-bearing premise

The diffusion model's score, evaluated on an attacked image without specifying which noise level the model was trained for, still points in the direction that genuinely lowers the likelihood of the true label.

Editorial extensions

If this is right

  • Segmentation attacks can be launched without training or querying any segmentation surrogate; the same conditional diffusion model serves every target architecture.
  • Because the perturbation follows the data-distribution gradient, transfer across different backbones (ViT, ResNet, Swin, VGG, PVTv2) is a direct consequence rather than a side effect.
  • The attack degrades gracefully when querying is allowed: with a small number of queries it selects the best accumulated step, matching or beating query-based attacks that need thousands of queries.
  • The same recipe transfers to other dense prediction tasks with binary maps, as shown by experiments on salient object detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the score difference is truly a density direction, the method should extend to conditional generation tasks beyond segmentation, such as depth estimation or edge detection, whenever a conditional diffusion model can be trained on paired data.
  • The undefined diffusion timestep at attack time means the reported attack is really one member of a family indexed by $t$; fixing $t$ explicitly could yield a tuning knob for transferability versus perceptibility that the paper leaves implicit.
  • The $\omega$ parameter behaves like a guidance scale, so attack strength and transferability may trade off against each other in a way that mirrors classifier-free guidance rather than being an arbitrary robustness fix.
  • A direct comparison on the same victim models between the score-based direction and the surrogate gradient would separate how much of the transfer gain comes from density descent versus from the diffusion model's implicit smoothing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes an adversarial attack method for segmentation that replaces the conventional victim segmentation model with a conditional diffusion model. The authors use Bayes' rule to express the gradient of the conditional segmentation log-likelihood log p(y|x) as the difference between a conditional and an unconditional image-generation score, and then construct an iterative attack that evaluates these scores on pseudo-adversarial images. Experiments on camouflaged object detection (COD) and semantic segmentation compare the method with transfer-based and query-based black-box attacks, and an optional querying mechanism is introduced.

Significance. If the theoretical connection is made rigorous, the paper offers a novel and potentially influential perspective: generative models can act as surrogate victims for segmentation attacks, avoiding the need for a pre-trained segmentation network. The COD results in Tables I and II are strong, showing competitive or better transferability than established transfer-based attacks, and the optional query strategy in Table IV achieves competitive performance with very few queries. This is a creative and practically motivated contribution. However, the semantic segmentation results are weak, and the core derivation does not currently connect to the algorithm due to an unspecified noise-level/timestep in the score evaluation.

major comments (3)
  1. [Section III-C, Eq. (10)-(11), Algorithm 1] The attack procedure never specifies the diffusion timestep t at which the score network s_theta is evaluated. In Eq. (10), s_theta(x^adv_m | y) and s_theta(x^adv_m) are treated as gradients of the data log-likelihood, but the network was trained as a function of (x_t, t) over a 1000-step noise schedule. Saying that alpha_m denotes the noise schedule in Eq. (9) is insufficient because the score is only meaningful at a specified noise level. Moreover, even if a t were supplied, the update in Eq. (11) injects an adversarial-sign perturbation delta_m rather than Gaussian noise, so x^adv_m is not a sample from the diffusion marginal p_t used in training. The ablation in Section IV-B3 explicitly calls this an "emulation" of noise addition, which is a heuristic, not a derivation. This gap is load-bearing for the central claim that the update minimizes log p(y|x^adv); the authors should either state the timestep and justify the off-manifold evaluation, or explicitly present Eqs. (8)-(12) as a heuristic motivated by the score identity.
  2. [Section III-C, Algorithm 1] The attack requires the ground-truth segmentation mask y as a conditioning input at attack time (see Eq. (10), s_theta(x^adv_m | y), and the algorithm input "Image x and corresponding ground truth y"). The paper never discusses how y is obtained in a black-box scenario. In standard threat models for segmentation, the attacker does not have pixel-level ground-truth annotations for test images. This substantially narrows the "without task-specific victim model" claim: the method still assumes access to task annotations, which is a significant practical restriction. The authors should discuss this assumption and, if possible, evaluate a variant that uses an estimated y or operates unconditionally.
  3. [Section IV-A, Table III] The semantic segmentation results do not support the unqualified claim of "effective adversarial attacks with good transferability." With either surrogate (PSPR50 or DL3Mob), the proposed method is consistently among the weakest transfer attacks; for example, with PSPR50 as surrogate and PSPR50 as victim, Ours achieves mIoU 0.520 and ACC 0.848, whereas RAP achieves mIoU 0.371, DI2-FGSM achieves 0.356, and PGD achieves 0.159. The same pattern holds for cross-model transfers. The paper acknowledges this as a "multi-peak problem" in Section IV-A.1, but the abstract and conclusion still claim effectiveness for segmentation in general. Since the paper is specifically about segmentation attacks, this scope limitation should be stated prominently in the abstract and conclusion rather than as a passing remark.
minor comments (5)
  1. [Eq. (9)-(11), Eq. (15)-(16)] The notation for the noise schedule is ambiguous: Eq. (9) defines a per-step transition with alpha_t, while the training losses in Eqs. (15)-(16) use sqrt(1 - \bar{alpha}_t). It is not clear whether alpha_m in Eqs. (10)-(11) is the per-step coefficient or the cumulative product, nor how m is mapped to the 1000-step schedule. Please clarify.
  2. [Section III-B, Eq. (8)] The weighting hyperparameter omega is set to 90 empirically and described as canceling the gap between the actual and estimated scores, but no derivation or measurement of that gap is given. Table V shows the results are fairly stable to omega, so this is acceptable as an empirical choice; however, it should be presented as an experimentally tuned scale factor rather than as part of the theoretical derivation.
  3. [Table IV] Several cells in Table IV appear to have formatting errors, such as "10.7.155" in the Bandit row and the query/time columns. Please reformat the table for readability.
  4. [Related Work, Section II-C] The phrase "for the first time" is used in Sections I and II-C, but diffusion-based attacks already exist (e.g., [23], [56], [57]). Please clarify the specific novel contribution relative to these works and avoid a blanket "first time" claim.
  5. [References] Reference [33] appears to be misattributed: the sentence in Section II-A says "Arnab et al. [33] introduced a generalized perturbation," but [33] is the universal perturbation paper by Metzen et al. Please correct the citation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the derivation is a Bayes-rule identity applied to an independently trained diffusion model, with external victim-model evaluation.

full rationale

The paper's central derivation (Eqs. 4–8) expresses the gradient of log p(y|x) as the difference of conditional and unconditional image-generation scores via Bayes' rule. This is a mathematical identity, not a construction that presupposes the attack result. The conditional and unconditional diffusion scores are obtained from a generative model trained on segmentation datasets independently of the victim segmentation models; attack effectiveness is then measured against held-out victim models with different architectures and, for the main transfer experiments, different training data. Thus the central claim is externally falsifiable and does not reduce to its inputs. The scalar hyperparameter ω is set to 90 after a robustness study (Table V) and is not fitted to encode the evaluation outcome; the paper reports that performance is stable across a wide range of ω. The paper's own stated limitations (Sec. IV-A: inability to search the most vulnerable misclassification errors in multi-class tasks; Sec. V: implicit correlation between classification error and score estimation) and the unspecified diffusion timestep in Eq. (10) are correctness or validation concerns, not circularity. The self-citations used ([63] for the NC4K dataset, [70] for a decoder structure) are data/architecture references and are not load-bearing for the derivation. No fitted parameter, self-citation chain, or definitional equivalence is used to force the claimed result.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The method rests on standard score-based diffusion assumptions plus one ad-hoc assumption about evaluating scores at arbitrary perturbed images. The only free parameter is ω. No new physical or conceptual entities are introduced.

free parameters (1)
  • omega = 90
    Scale factor in Eq. (8) balancing the difference between conditional and unconditional scores; empirically set in Section IV-B2 and Table V.
assumptions (3)
  • standard math Score-based diffusion models accurately estimate the gradient of the log data distribution.
    The derivation of the attack gradient relies on the score model sθ approximating ∇log p(x|y) and ∇log p(x). This is the standard assumption of score-based generative models (cite [21]).
  • domain assumption The classifier-free guidance combination ω(sθ(x|y) − sθ(x)) approximates the conditional score ∇log p(y|x).
    Eq. (8) assumes the weighted difference of conditional and unconditional image scores cancels the bias between estimated and true scores, following [58]. This is an assumption about the calibration of the two score estimates.
  • ad hoc to paper The score model can be evaluated at adversarial images xadv_m without an explicit noise level t and still give a useful gradient.
    Eq. (10) feeds xadv_m directly to sθ; the paper does not specify the timestep. This is not justified by the diffusion training objective and is the weakest assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Generative Victim Model for Segmentation." pith.science (2026). https://pith.science/paper/TLMYC4Z3

@misc{pith2026241207274,
  author       = {Pith},
  title        = {Pith review of: A Generative Victim Model for Segmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TLMYC4Z3}},
  note         = {Machine review of arXiv:2412.07274}
}
read the original abstract

We find that the well-trained victim models (VMs), against which the attacks are generated, serve as fundamental prerequisites for adversarial attacks, i.e. a segmentation VM is needed to generate attacks for segmentation. In this context, the victim model is assumed to be robust to achieve effective adversarial perturbation generation. Instead of focusing on improving the robustness of the task-specific victim models, we shift our attention to image generation. From an image generation perspective, we derive a novel VM for segmentation, aiming to generate adversarial perturbations for segmentation tasks without requiring models explicitly designed for image segmentation. Our approach to adversarial attack generation diverges from conventional white-box or black-box attacks, offering a fresh outlook on adversarial attack strategies. Experiments show that our attack method is able to generate effective adversarial attacks with good transferability.

Figures

Figures reproduced from arXiv: 2412.07274 by the authors.

Figure 1
Figure 1. Adversarial attacks comparison. GA is Gradient-accessible, GI is Gradient-inaccessible, and DDE denotes Data Distribution Estimation Model. fv and fs denote the victim model and the local surrogate model, respectively. As shown in (d), our method can choose whether to query the victim model or not, which is quite flexible. corresponding one-hot encoded label as y. The objective of adversarial attacks [29], [2], [4],… view at source ↗
Figure 2
Figure 2. Visual comparison of transfer-based black-box attacks on COD task with ViT as the surrogate model backbone. The first column represents the clean [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Visual comparison of transfer-based black-box attacks on semantic segmentation task with DL3Mob as the surrogate model backbone. The first column [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visual comparison of transfer-based black-box attacks on semantic segmentation task with PSPR50 as the surrogate model backbone. The first column [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Visual comparison with query-based black-box attacks on COD task, where each paired lines depict the adversarial samples (top) and the predictions [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

89 extracted references · 70 canonical work pages

  1. [1]

    Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness,

    J. Gu, H. Zhao, V . Tresp, and P. H. Torr, “Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness,” in European Conference on Computer Vision (ECCV), 2022, pp. 308–325

    2022

  2. [2]

    Explaining and harnessing adversarial examples,

    I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Repre- sentations (ICLR), 2015

    2015

  3. [3]

    On the robustness of semantic segmentation models to adversarial attacks,

    A. Arnab, O. Miksik, and P. H. Torr, “On the robustness of semantic segmentation models to adversarial attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2018, pp. 888–897

    2018

  4. [4]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in International Conference on Learning Representations (ICLR) , 2018

    2018

  5. [5]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in ACM on Asia Conference on Computer and Communications Security (ASIACCS), 2017, pp. 506–519

    2017

  6. [6]

    Dast: Data-free substitute training for adversarial attacks,

    M. Zhou, J. Wu, Y . Liu, S. Liu, and C. Zhu, “Dast: Data-free substitute training for adversarial attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 234–243

    2020

  7. [7]

    Square attack: a query-efficient black-box adversarial attack via random search,

    M. Andriushchenko, F. Croce, N. Flammarion, and M. Hein, “Square attack: a query-efficient black-box adversarial attack via random search,” in European Conference on Computer Vision (ECCV) , 2020, pp. 484– 501

    2020

  8. [8]

    Simple black-box adversarial attacks,

    C. Guo, J. Gardner, Y . You, A. G. Wilson, and K. Weinberger, “Simple black-box adversarial attacks,” in International Conference on Machine Learning (ICML), 2019, pp. 2484–2493

    2019

Show all 89 references
  1. [9]

    Sign bits are all you need for black- box attacks,

    A. Al-Dujaili and U.-M. O’Reilly, “Sign bits are all you need for black- box attacks,” in International Conference on Learning Representations (ICLR), 2019

    2019

  2. [10]

    Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,

    W. Brendel, J. Rauber, and M. Bethge, “Decision-based adversarial attacks: Reliable attacks against black-box machine learning models,” in International Conference on Learning Representations (ICLR) , 2018

    2018

  3. [11]

    Black-box adversarial at- tacks with limited queries and information,

    A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial at- tacks with limited queries and information,” in International Conference on Machine Learning (ICML) , 2018, pp. 2137–2146

    2018

  4. [12]

    Adversarial risk and the dangers of evaluating against weak attacks,

    J. Uesato, B. O’donoghue, P. Kohli, and A. Oord, “Adversarial risk and the dangers of evaluating against weak attacks,” in International Conference on Machine Learning (ICML) , 2018, pp. 5025–5034

    2018

  5. [13]

    Adversarial examples for semantic segmentation and object detection,

    C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” in Interna- tional Conference on Computer Vision (ICCV) , 2017, pp. 1369–1378

    2017

  6. [14]

    Skip connec- tions matter: On the transferability of adversarial examples generated with resnets,

    D. Wu, Y . Wang, S.-T. Xia, J. Bailey, and X. Ma, “Skip connec- tions matter: On the transferability of adversarial examples generated with resnets,” in International Conference on Learning Representations (ICLR), 2020

    2020

  7. [15]

    Gen- erating transferable adversarial examples against vision transformers,

    Y . Wang, J. Wang, Z. Yin, R. Gong, J. Wang, A. Liu, and X. Liu, “Gen- erating transferable adversarial examples against vision transformers,” in ACM Multimedia Conference (ACM MM) , 2022, pp. 5181–5190

    2022

  8. [16]

    Diverse generative perturbations on attention space for transferable adversarial attacks,

    W. J. Kim, S. Hong, and S.-E. Yoon, “Diverse generative perturbations on attention space for transferable adversarial attacks,” in IEEE Inter- national Conference on Image Processing (ICIP) , 2022, pp. 281–285

    2022

  9. [17]

    Transferable adversarial attacks on vision transformers with token gradient regularization,

    J. Zhang, Y . Huang, W. Wu, and M. R. Lyu, “Transferable adversarial attacks on vision transformers with token gradient regularization,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2023, pp. 16 415–16 424

    2023

  10. [18]

    Transferable adversarial attack for both vision transformers and convolutional networks via momentum integrated gradients,

    W. Ma, Y . Li, X. Jia, and W. Xu, “Transferable adversarial attack for both vision transformers and convolutional networks via momentum integrated gradients,” in International Conference on Computer Vision (ICCV), 2023, pp. 4630–4639

    2023

  11. [19]

    Deep unsupervised learning using nonequilibrium thermodynamics,

    J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli, “Deep unsupervised learning using nonequilibrium thermodynamics,” in International Conference on Machine Learning (ICML) , 2015, pp. 2256–2265

    2015

  12. [20]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Conference on Neural Information Processing Systems (NeurIPS) , 2020, pp. 6840–6851

    2020

  13. [21]

    Generative modeling by estimating gradients of the data distribution,

    Y . Song and S. Ermon, “Generative modeling by estimating gradients of the data distribution,” in Conference on Neural Information Processing Systems (NeurIPS), 2019

    2019

  14. [22]

    Rethinking adversarial transferability from a data distribution perspective,

    Y . Zhu, J. Sun, and Z. Li, “Rethinking adversarial transferability from a data distribution perspective,” in International Conference on Learning Representations (ICLR), 2021

    2021

  15. [23]

    Advdiffuser: Natural adversarial example synthesis with diffusion models,

    X. Chen, X. Gao, J. Zhao, K. Ye, and C.-Z. Xu, “Advdiffuser: Natural adversarial example synthesis with diffusion models,” in International Conference on Computer Vision (ICCV) , 2023, pp. 4562–4572

    2023

  16. [24]

    Revisiting graph adversarial attack and defense from a data distribution perspective,

    K. Li, Y . Liu, X. Ao, and Q. He, “Revisiting graph adversarial attack and defense from a data distribution perspective,” in International Conference on Learning Representations (ICLR) , 2022

    2022

  17. [25]

    Robust evaluation of diffusion-based adversarial purification,

    M. Lee and D. Kim, “Robust evaluation of diffusion-based adversarial purification,” in International Conference on Computer Vision (ICCV) , 2023, pp. 134–144

    2023

  18. [26]

    Diffusion models for adversarial purification,

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, and A. Anandkumar, “Diffusion models for adversarial purification,” in International Confer- ence on Machine Learning (ICML) , 2022, pp. 16 805–16 827

    2022

  19. [27]

    Guided diffusion model for adversarial purification,

    J. Wang, Z. Lyu, D. Lin, B. Dai, and H. Fu, “Guided diffusion model for adversarial purification,” arXiv preprint arXiv:2205.14969 , 2022

    2022 arXiv

  20. [28]

    Grad-cam: Visual explanations from deep networks via 11 gradient-based localization,

    R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via 11 gradient-based localization,” in International Conference on Computer Vision (ICCV), 2017, pp. 618–626

    2017

  21. [29]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations (ICLR) , 2014

    2014

  22. [30]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP) , 2017, pp. 39–57

    2017

  23. [31]

    Impact of adversarial examples on deep learning models for biomedical image segmentation,

    U. Ozbulak, A. Van Messem, and W. De Neve, “Impact of adversarial examples on deep learning models for biomedical image segmentation,” in International Conference on Medical Image Computing and Computer Assisted Intervention (MICCAI) , 2019, pp. 300–308

    2019

  24. [32]

    Fashion-guided adversarial attack on person segmentation,

    M. Treu, T.-N. Le, H. H. Nguyen, J. Yamagishi, and I. Echizen, “Fashion-guided adversarial attack on person segmentation,” in Con- ference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 943–952

    2021

  25. [33]

    Universal adversarial perturbations against semantic image segmenta- tion,

    J. Hendrik Metzen, M. Chaithanya Kumar, T. Brox, and V . Fischer, “Universal adversarial perturbations against semantic image segmenta- tion,” in International Conference on Computer Vision (ICCV) , 2017, pp. 2755–2764

    2017

  26. [34]

    Data-free universal adversarial perturbation and black-box attack,

    C. Zhang, P. Benz, A. Karjauv, and I. S. Kweon, “Data-free universal adversarial perturbation and black-box attack,” in International Confer- ence on Computer Vision (ICCV) , 2021, pp. 7868–7877

    2021

  27. [35]

    Query-based black-box attack against medical image segmentation model,

    S. Li, G. Huang, X. Xu, and H. Lu, “Query-based black-box attack against medical image segmentation model,” Future Generation Com- puter Systems (FGCS) , vol. 133, pp. 331–337, 2022

    2022

  28. [36]

    Surfree: a fast surrogate- free black-box attack,

    T. Maho, T. Furon, and E. Le Merrer, “Surfree: a fast surrogate- free black-box attack,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 10 430–10 439

    2021

  29. [37]

    Simulating unknown target models for query-efficient black-box attacks,

    C. Ma, L. Chen, and J.-H. Yong, “Simulating unknown target models for query-efficient black-box attacks,” inConference on Computer Vision and Pattern Recognition (CVPR) , 2021, pp. 11 835–11 844

    2021

  30. [38]

    Diversity can be transferred: Output diversification for white-and black-box attacks,

    Y . Tashiro, Y . Song, and S. Ermon, “Diversity can be transferred: Output diversification for white-and black-box attacks,” inConference on Neural Information Processing Systems (NeurIPS) , 2020, pp. 4536–4548

    2020

  31. [39]

    Geoda: a geometric framework for black-box adversarial attacks,

    A. Rahmati, S.-M. Moosavi-Dezfooli, P. Frossard, and H. Dai, “Geoda: a geometric framework for black-box adversarial attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2020, pp. 8446– 8455

    2020

  32. [40]

    Boosting black-box attack with partially transferred conditional adversarial distribution,

    Y . Feng, B. Wu, Y . Fan, L. Liu, Z. Li, and S.-T. Xia, “Boosting black-box attack with partially transferred conditional adversarial distribution,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 15 095–15 104

    2022

  33. [41]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” in Proceedings of ACM workshop on Artificial Intelligence and Security (AIsec) , 2017, pp. 15–26

    2017

  34. [42]

    Parallel rectangle flip attack: A query-based black-box attack against object detection,

    S. Liang, B. Wu, Y . Fan, X. Wei, and X. Cao, “Parallel rectangle flip attack: A query-based black-box attack against object detection,” in International Conference on Computer Vision (ICCV) , 2021, pp. 7677– 7687

    2021

  35. [43]

    Boost- ing the transferability of adversarial attacks with reverse adversarial perturbation,

    Z. Qin, Y . Fan, Y . Liu, L. Shen, Y . Zhang, J. Wang, and B. Wu, “Boost- ing the transferability of adversarial attacks with reverse adversarial perturbation,” in Conference on Neural Information Processing Systems (NeurIPS), 2022, pp. 29 845–29 858

    2022

  36. [44]

    Frequency domain model augmentation for adversarial attack,

    Y . Long, Q. Zhang, B. Zeng, L. Gao, X. Liu, J. Zhang, and J. Song, “Frequency domain model augmentation for adversarial attack,” in European Conference on Computer Vision (ECCV) , 2022, pp. 549–566

    2022

  37. [45]

    Transferable adversarial perturbations,

    W. Zhou, X. Hou, Y . Chen, M. Tang, X. Huang, X. Gan, and Y . Yang, “Transferable adversarial perturbations,” in European Conference on Computer Vision (ECCV) , 2018, pp. 452–467

    2018

  38. [46]

    Fda: Feature disruptive attack,

    A. Ganeshan, V . BS, and R. V . Babu, “Fda: Feature disruptive attack,” in International Conference on Computer Vision (ICCV) , 2019, pp. 8069– 8079

    2019

  39. [47]

    Feature importance-aware transferable adversarial attacks,

    Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” inInternational Con- ference on Computer Vision (ICCV) , 2021, pp. 7639–7648

    2021

  40. [48]

    Boosting the transferability of adversarial samples via attention,

    W. Wu, Y . Su, X. Chen, S. Zhao, I. King, M. R. Lyu, and Y .-W. Tai, “Boosting the transferability of adversarial samples via attention,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 1161–1170

    2020

  41. [49]

    Nesterov accelerated gradient and scale invariance for adversarial attacks,

    J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” in International Conference on Learning Representations (ICLR) , 2020

    2020

  42. [50]

    Enhancing the transferability of adversarial attacks through variance tuning,

    X. Wang and K. He, “Enhancing the transferability of adversarial attacks through variance tuning,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 1924–1933

    2021

  43. [51]

    Stochastic variance reduced ensemble adversarial attack for boosting the adver- sarial transferability,

    Y . Xiong, J. Lin, M. Zhang, J. E. Hopcroft, and K. He, “Stochastic variance reduced ensemble adversarial attack for boosting the adver- sarial transferability,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 14 983–14 992

    2022

  44. [52]

    Toward understanding and boosting adversarial trans- ferability from a distribution perspective,

    Y . Zhu, Y . Chen, X. Li, K. Chen, Y . He, X. Tian, B. Zheng, Y . Chen, and Q. Huang, “Toward understanding and boosting adversarial trans- ferability from a distribution perspective,” IEEE Transactions on Image Processing (IEEE TIP) , vol. 31, pp. 6487–6501, 2022

    2022

  45. [53]

    Admix: Enhancing the transfer- ability of adversarial attacks,

    X. Wang, X. He, J. Wang, and K. He, “Admix: Enhancing the transfer- ability of adversarial attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 16 158–16 167

    2021

  46. [54]

    Evading defenses to transferable adversarial examples by translation-invariant attacks,

    Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2019, pp. 4312– 4321

    2019

  47. [55]

    Improving the transferability of adversarial samples with adversarial transformations,

    W. Wu, Y . Su, M. R. Lyu, and I. King, “Improving the transferability of adversarial samples with adversarial transformations,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2021, pp. 9024– 9033

    2021

  48. [56]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability,

    H. Xue, A. Araujo, B. Hu, and Y . Chen, “Diffusion-based adversarial sample generation for improved stealthiness and controllability,” Con- ference on Neural Information Processing Systems (NeurIPS) , vol. 36, 2024

    2024

  49. [57]

    Diffusion models for imperceptible and transferable adversarial attack,

    J. Chen, H. Chen, K. Chen, Y . Zhang, Z. Zou, and Z. Shi, “Diffusion models for imperceptible and transferable adversarial attack,” arXiv preprint arXiv:2305.08192, 2023

    2023 arXiv

  50. [58]

    Classifier-free diffusion guidance,

    J. Ho and T. Salimans, “Classifier-free diffusion guidance,” in NeurIPS Workshop (NeurIPSW), 2021

    2021

  51. [59]

    Auto-encoding variational bayes,

    D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” in International Conference on Learning Representations (ICLR) , 2014

    2014

  52. [60]

    Variational inference with normalizing flows,

    D. Rezende and S. Mohamed, “Variational inference with normalizing flows,” in International Conference on Machine Learning (ICML), 2015, pp. 1530–1538

    2015

  53. [61]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” arXiv preprint arXiv:2010.02502 , 2020

    2010 arXiv

  54. [62]

    Camouflaged object detection,

    D.-P. Fan, G.-P. Ji, G. Sun, M.-M. Cheng, J. Shen, and L. Shao, “Camouflaged object detection,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 2777–2787

    2020

  55. [63]

    Simultaneously localize, segment and rank the camouflaged objects,

    Y . Lv, J. Zhang, Y . Dai, A. Li, B. Liu, N. Barnes, and D.-P. Fan, “Simultaneously localize, segment and rank the camouflaged objects,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2021, pp. 11 586–11 596

    2021

  56. [64]

    The pascal visual object classes (voc) challenge,

    M. Everingham, L. Van Gool, C. K. Williams, J. Winn, and A. Zisser- man, “The pascal visual object classes (voc) challenge,” International Journal of Computer Vision (IJCV) , vol. 88, pp. 303–338, 2010

    2010

  57. [65]

    Vision transformers for dense prediction,

    R. Ranftl, A. Bochkovskiy, and V . Koltun, “Vision transformers for dense prediction,” in International Conference on Computer Vision (ICCV) , 2021, pp. 12 179–12 188

    2021

  58. [66]

    Pvt v2: Improved baselines with pyramid vision transformer,

    W. Wang, E. Xie, X. Li, D.-P. Fan, K. Song, D. Liang, T. Lu, P. Luo, and L. Shao, “Pvt v2: Improved baselines with pyramid vision transformer,” Computational Visual Media , vol. 8, no. 3, pp. 415–424, 2022

    2022

  59. [67]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  60. [68]

    Swin transformer: Hierarchical vision transformer using shifted windows,

    Z. Liu, Y . Lin, Y . Cao, H. Hu, Y . Wei, Z. Zhang, S. Lin, and B. Guo, “Swin transformer: Hierarchical vision transformer using shifted windows,” in International Conference on Computer Vision (ICCV) , 2021, pp. 10 012–10 022

    2021

  61. [69]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in International Conference on Learning Representations (ICLR), Y . Bengio and Y . LeCun, Eds., 2015

    2015

  62. [70]

    Generative transformer for accurate and reliable salient object detection,

    Y . Mao, J. Zhang, Z. Wan, Y . Dai, A. Li, Y . Lv, X. Tian, D.-P. Fan, and N. Barnes, “Generative transformer for accurate and reliable salient object detection,” arXiv preprint arXiv:2104.10127 , 2021

    2021 arXiv

  63. [71]

    Encoder- decoder with atrous separable convolution for semantic image segmen- tation,

    L.-C. Chen, Y . Zhu, G. Papandreou, F. Schroff, and H. Adam, “Encoder- decoder with atrous separable convolution for semantic image segmen- tation,” in European Conference on Computer Vision (ECCV), 2018, pp. 801–818

    2018

  64. [72]

    Mobilenets: Efficient convo- lutional neural networks for mobile vision applications,

    A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “Mobilenets: Efficient convo- lutional neural networks for mobile vision applications,” arXiv preprint arXiv:1704.04861, 2017

    2017 arXiv

  65. [73]

    Pyramid scene parsing network,

    H. Zhao, J. Shi, X. Qi, X. Wang, and J. Jia, “Pyramid scene parsing network,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 2881–2890. 12

    2017

  66. [74]

    Fully convolutional networks for semantic segmentation,

    J. Long, E. Shelhamer, and T. Darrell, “Fully convolutional networks for semantic segmentation,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2015, pp. 3431–3440

    2015

  67. [75]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2018, pp. 9185–9193

    2018

  68. [76]

    Improving transferability of adversarial examples with input diversity,

    C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2019, pp. 2730–2739

    2019

  69. [77]

    Enhancing adversarial example transferability with an intermediate level attack,

    Q. Huang, I. Katsman, H. He, Z. Gu, S. Belongie, and S.-N. Lim, “Enhancing adversarial example transferability with an intermediate level attack,” in International Conference on Computer Vision (ICCV) , 2019, pp. 4733–4742

    2019

  70. [78]

    Improving adversarial transferability via neuron attribution-based attacks,

    J. Zhang, W. Wu, J.-t. Huang, Y . Huang, W. Wang, Y . Su, and M. R. Lyu, “Improving adversarial transferability via neuron attribution-based attacks,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 14 993–15 002

    2022

  71. [79]

    Enhanced-alignment measure for binary foreground map evaluation,

    D.-P. Fan, C. Gong, Y . Cao, B. Ren, M.-M. Cheng, and A. Borji, “Enhanced-alignment measure for binary foreground map evaluation,” in International Joint Conference on Artificial Intelligence (IJCAI) , 2018

    2018

  72. [80]

    Structure-measure: A new way to evaluate foreground maps,

    D.-P. Fan, M.-M. Cheng, Y . Liu, T. Li, and A. Borji, “Structure-measure: A new way to evaluate foreground maps,” in International Conference on Computer Vision (ICCV) , 2017, pp. 4548–4557

    2017

  73. [81]

    Adversarial examples on segmen- tation models can be easy to transfer,

    J. Gu, H. Zhao, V . Tresp, and P. Torr, “Adversarial examples on segmen- tation models can be easy to transfer,” arXiv preprint arXiv:2111.11368, 2021

    2021 arXiv

  74. [82]

    Prior convictions: Black-box adversarial attacks with bandits and priors,

    A. Ilyas, L. Engstrom, and A. Madry, “Prior convictions: Black-box adversarial attacks with bandits and priors,” in International Conference on Learning Representations (ICLR) , 2018

    2018

  75. [83]

    Ensemble adversarial training: Attacks and defenses,

    F. Tram `er, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204 , 2017

    2017 arXiv

  76. [84]

    Learning to detect salient objects with image-level supervision,

    L. Wang, H. Lu, Y . Wang, M. Feng, D. Wang, B. Yin, and X. Ruan, “Learning to detect salient objects with image-level supervision,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 136–145

    2017

  77. [85]

    Design and perceptual validation of per- formance measures for salient object segmentation,

    V . Movahedi and J. H. Elder, “Design and perceptual validation of per- formance measures for salient object segmentation,” inCVPR Workshops (CVPRW), 2010, pp. 49–56

    2010

  78. [86]

    Saliency detection via graph-based manifold ranking,

    C. Yang, L. Zhang, H. Lu, X. Ruan, and M.-H. Yang, “Saliency detection via graph-based manifold ranking,” in Conference on Computer Vision and Pattern Recognition (CVPR) , 2013, pp. 3166–3173

    2013

  79. [87]

    Hierarchical saliency detection,

    Q. Yan, L. Xu, J. Shi, and J. Jia, “Hierarchical saliency detection,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2013, pp. 1155–1162

    2013

  80. [88]

    The secrets of salient object segmentation,

    Y . Li, X. Hou, C. Koch, J. M. Rehg, and A. L. Yuille, “The secrets of salient object segmentation,” in Conference on Computer Vision and Pattern Recognition (CVPR), 2014, pp. 280–287

    2014

  81. [89]

    Salient objects in clutter: Bringing salient object detection to the foreground,

    D.-P. Fan, M.-M. Cheng, J.-J. Liu, S.-H. Gao, Q. Hou, and A. Borji, “Salient objects in clutter: Bringing salient object detection to the foreground,” in European Conference on Computer Vision (ECCV) , 2018

    2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.