Pith. sign in

REVIEW 3 major objections 5 minor 38 references

PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PB-UAP claims one imperceptible universal perturbation can drive semantic segmentation models' mIoU from roughly 53-72 percent down to 3.17-18.77 percent on PASCAL VOC and Cityscapes, while transferring across architectures.

desk verdict Strong empirical attack with a mischaracterized frequency module; worth engaging but needs major revision. read the letter →

arxiv 2412.16651 v2 pith:PNDINX27 submitted 2024-12-21 cs.CV cs.AI

Yufei Song , Ziqi Zhou , Minghui Li , Xianlong Wang , Hangtao Zhang , Menghao Deng , Wei Wan , Shengshan Hu
show 1 more author
Leo Yu Zhang
This is my paper · ORCID
classification cs.CVcs.AI
keywords universaladversarialperturbationsemanticsegmentationattacklow-frequencyscatteringdiscretewavelettransforminter-classcorrelationintra-classtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PB-UAP is a universal adversarial perturbation for semantic segmentation: one fixed, imperceptible noise pattern that, when added to any input image, makes segmentation models produce largely wrong pixel labels. The paper's central claim is that this single perturbation can reduce segmentation quality far more than prior universal attacks, because it attacks semantic correlations in both the pixel domain and the frequency domain rather than merely maximizing classification loss. In experiments on PSPNet, Deeplabv1, and Deeplabv3+ across PASCAL VOC and Cityscapes, the attack lowers mean intersection-over-union from roughly 53-72 percent on clean images to 3.17-18.77 percent on attacked images, and the same perturbation transfers across models. If the claim holds, it matters because semantic segmentation underpins high-stakes perception systems, where a single reusable perturbation would be a practical and cheap threat.

What carries the argument

The argument is carried by a composite loss over a single perturbation $\delta$, with the spatial branch and the frequency branch playing distinct roles. The spatial branch uses a binary mask to weight pixels the attack has already fooled differently from pixels it has not, and adds negative mean-square error between the adversarial and clean final-layer features, which is meant to break inter-class semantic correlations. The frequency branch applies a discrete wavelet transform with low-pass filter $L$, reconstructs a low-frequency image $\varphi(x) = L^{T}(L x L^{T}) L$, and maximizes the mean-square error between $\varphi(x+\delta)$ and $\varphi(x)$, which is meant to break intra-class pixel correlations. This hybrid objective is what lets a single perturbation disable segmentation output rather than just flip individual labels.

What would settle it

Run PB-UAP with the low-frequency scattering term redirected to the high-frequency DWT subbands, keeping the loss magnitude equal; if mIoU remains comparably low, then low-frequency correlation disruption is not the operative mechanism, and the paper's stated explanation would be contradicted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that segmentation models share a common vulnerability that can be exploited with one hybrid perturbation that separates features in two complementary senses. The method maximizes a composite objective $J_{\mathrm{total}} = J_{\mathrm{pd}} + J_{\mathrm{fd}} + k J_{\mathrm{ls}}$, where the pixel-level deception loss $J_{\mathrm{pd}}$ re-weights correctly and incorrectly attacked pixels, the feature distortion loss $J_{\mathrm{fd}}$ maximizes the mean-square error between adversarial and benign final-layer features, and the low-frequency scattering loss $J_{\mathrm{ls}}$ maximizes the mean-square error between DWT-reconstructed low-frequency versions of adversarial and clean images. Under a perturbation bound of $10/255$, PB-UAP drives mIoU down to between 3.17 and 18.77 percent on both datasets across all six model-backbone combinations, and transfer experiments show perturbations generated on one model remain potent on the others.

Load-bearing premise

The method assumes that the low-frequency band extracted by a single DWT low-pass filter is the carrier of intra-class semantic correlations, so maximizing the low-frequency difference between clean and adversarial images breaks those correlations; this assumption is not validated independently of the final attack mIoU.

Editorial extensions

If this is right

  • The same universal perturbation, capped at $10/255$, can reduce a segmentation model's mIoU to below 19 percent on PASCAL VOC and to as low as 3.17 percent on Cityscapes across all tested model-backbone pairs.
  • Perturbations produced on a proxy model transfer to other segmentation architectures, with cross-model mIoU values in the same low range as white-box attacks on both datasets.
  • Each of the three loss terms contributes independently: ablation results show that dropping the pixel-level deception, feature distortion, or low-frequency scattering term raises mIoU relative to the full method.
  • The attack is not fragile to budget reduction: it retains strong performance at an $8/255$ budget, with mIoU still far below benign levels, so it does not rely on the maximum allowed distortion.
  • Because the attack works across two datasets and three architectures, it points to a shared failure mode in segmentation models rather than an overfit to one network.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An untested consequence is that defenses enforcing low-frequency consistency between clean and perturbed inputs, or regularizing intra-class feature coherence, may blunt this attack more than standard adversarial training; the paper does not evaluate defenses.
  • The frequency-scattering mechanism could be tested in isolation by measuring same-class pixel feature similarity before and after the perturbation; if that similarity does not drop, the stated mechanism is not the operative one.
  • Because the perturbation is universal and transferable, one leaked perturbation could degrade an entire segmentation-based perception stack, making PB-UAP a fixed-cost threat in deployed settings.
  • The same dual-separation idea may extend to other dense prediction tasks such as depth estimation or instance segmentation, where inter- and intra-class correlations play a similar role; the paper does not explore these tasks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PB-UAP, a universal adversarial perturbation method for semantic segmentation models. The method combines a spatial attack, based on a dual feature deviation loss (pixel-level cross-entropy with a success/failure weighting and a feature-space MSE term), with a frequency attack, based on a low-frequency scattering loss computed via DWT and IDWT. Experiments are reported on PSPNet, DeepLabv1, and DeepLabv3+ with MobileNet and ResNet50 backbones on PASCAL VOC and Cityscapes. The paper reports mIoU drops to between 3.17% and 18.77%, and a comparison study against UAPGD, FFF, Hashemi, SegPGD, and TranSegPGD shows substantially lower mIoU for PB-UAP. Transferability across models is also claimed based on Fig. 3.

Significance. If the empirical results are correct, PB-UAP would be a notably strong universal attack against semantic segmentation, outperforming existing UAP methods by a large margin in all six model/dataset settings. The evaluation spans multiple architectures, backbones, and datasets, and includes comparisons with five baselines plus an ablation study. However, the paper's central explanatory mechanism for the frequency module is not supported by the mathematics of the implemented loss, and the experimental description lacks key details needed for reproducibility. The attack numbers are plausible, but the claimed mechanism and the strength of the evidence are currently conditional.

major comments (3)
  1. [§III-B, §III-C, Eqs. (7)-(8)] The low-frequency scattering loss is image-independent and therefore cannot implement the stated intra-class correlation mechanism. Since the DWT/IDWT operator in Eq. (7) is linear, ϕ(x+δ)−ϕ(x)=ϕ(δ), and consequently Jls = −MSE(ϕ(x+δ), ϕ(x)) = −MSE(ϕ(δ), 0). This loss and its gradient do not depend on the input image x or on any semantic class layout. It is a fixed spectral regularizer that penalizes low-frequency energy of the perturbation, not a mechanism that 'separates the low-frequency components of adversarial examples from original examples' or disrupts intra-class semantic correlations as claimed in Challenge II of §III-B. The improvement of 'Ours' over 'w/o ls' in Fig. 5(a) (12.19 vs 13.71 mIoU) is thus attributable to a generic low-frequency prior, not to destroying same-class spatial correlations. The authors should either redesign the loss to be image- and class-dependent (for example, by using segmentation masks or image-specific low-frequency statistics) or substantially revise the claimed mechanism and novelty.
  2. [§IV-A and Tables I-II] The experimental setup is insufficiently specified for reproducibility. The paper does not state the optimizer, learning rate, number of training iterations/epochs, number of images used to generate the UAP, the DWT wavelet type and filter coefficients for L, or how the mask M in Eqs. (3)-(5) is obtained. The caption of Fig. 5 additionally mentions 'fake mask' without defining this term. These details are necessary to reproduce the reported mIoU values and to ensure that the comparison with baselines in Table II is conducted under controlled, fair conditions.
  3. [§IV-B, Tables I-II, Fig. 3] All reported attack mIoU values are single numbers with no variance, number of runs, or seeds. Given that the central claim is a large improvement over prior methods (Table II) and strong transferability (Fig. 3), the absence of any stability measure makes it difficult to assess whether the differences are robust. The authors should report at least mean ± std over multiple runs or over multiple randomly initialized UAPs.
minor comments (5)
  1. [Fig. 3 caption] The caption contains a typo ('modles') and does not explain how the bar colors correspond to the proxy model used to generate the UAP. A legend or an explicit description of rows versus columns would clarify the transferability results.
  2. [§IV-E heading] The heading 'Abaltion Study' should be corrected to 'Ablation Study'.
  3. [Eqs. (3)-(5)] The naming of Jsuc and Jfail is confusing: the text states that M=1 for correctly classified pixels, but the subscripts suggest 'success' and 'failure' of the attack. Please clarify which convention is used and align the notation with the text.
  4. [Fig. 5(b) caption] The caption says 'attack strength in fake mask' but the x-axis is labeled as perturbation budget ε. Please replace 'fake mask' with the intended term and clarify the caption.
  5. [§IV-D, Table II] For DeepLabv1 with ResNet50, the FFF baseline reports mIoU = 58.90, identical to the benign mIoU, which suggests that the baseline had no effect in that setting. A brief explanation of this anomaly would strengthen the comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: PB-UAP's attack losses are constructed directly from model outputs and a fixed DWT operator, and its central results are benchmarked against external baselines.

full rationale

The paper's derivation chain is self-contained rather than circular. Jpd (Eq. 5) and Jfd (Eq. 6) are defined directly from the segmentation model's outputs and ground-truth labels, and Jls (Eq. 8) is a fixed DWT-based MSE term whose gradient is computed by backpropagation; no parameter is fitted to the reported mIoU values. Hyperparameters (lambda=0.3, k=1, batch size 5) are stated as fixed settings, not calibrated to the benchmark outcome. The comparison study uses external baselines (UAPGD, FFF, Hashemi, SegPGD, TranSegPGD), so the headline attack numbers are not forced by the paper's own construction. The only notable issue is a mechanistic one: because the DWT low-pass reconstruction in Eq. 7 is linear, Jls equals -MSE(phi(delta), 0), independent of x and of semantic class layout, so the claimed intra-class correlation mechanism is not literally implemented by that term. That is a correctness/validity concern about what the loss does, not a circularity in which a prediction reduces to its input; the paper's empirical results remain externally benchmarked. No self-citation chain is load-bearing for the central claim.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The ledger contains only hand-chosen hyperparameters and the paper's two domain heuristics. No new physical or algorithmic entities are postulated beyond the method itself. The missing iteration and optimizer details appear in the reproducibility score rather than here.

free parameters (4)
  • lambda = 0.3
    Weight balancing the pixel-level deception loss between correctly and incorrectly classified pixels in Eq. (5); chosen by hand and not reported as tuned.
  • k = 1
    Weight multiplying the low-frequency scattering loss in Eq. (2); fixed to 1 for the main experiments.
  • batch_size = 5
    Number of images per optimization batch for UAP training; set in Section IV.A without a reported sweep.
  • epsilon = 10/255
    Upper bound on the perturbation, set following [17], [18], and [38]; a standard choice but part of the attack configuration.
assumptions (3)
  • domain assumption Adjacent pixels of the same semantic class form smooth low-frequency image structure, so scattering low-frequency components disrupts intra-class correlations.
    Motivates Challenge II in Section III.B and the low-frequency scattering loss in Eq. (7) and Eq. (8); it is plausible but not independently verified.
  • standard math A discrete wavelet transform with low-pass filter L followed by its inverse reconstructs a meaningful low-frequency image phi(x).
    Relies on standard DWT and IDWT reconstruction in Eq. (7); the specific wavelet and filter are not specified.
  • domain assumption Final-layer output features of the segmentation model are meaningful semantic representations for inter-class correlation disruption.
    Underlies the dual feature deviation losses in Eq. (3) through Eq. (6); the paper does not compare against intermediate layers.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation." pith.science (2026). https://pith.science/paper/PNDINX27

@misc{pith2026241216651,
  author       = {Pith},
  title        = {Pith review of: PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PNDINX27}},
  note         = {Machine review of arXiv:2412.16651}
}
read the original abstract

With the rapid advancement of deep learning, the model robustness has become a significant research hotspot, \ie, adversarial attacks on deep neural networks. Existing works primarily focus on image classification tasks, aiming to alter the model's predicted labels. Due to the output complexity and deeper network architectures, research on adversarial examples for segmentation models is still limited, particularly for universal adversarial perturbations. In this paper, we propose a novel universal adversarial attack method designed for segmentation models, which includes dual feature separation and low-frequency scattering modules. The two modules guide the training of adversarial examples in the pixel and frequency space, respectively. Experiments demonstrate that our method achieves high attack success rates surpassing the state-of-the-art methods, and exhibits strong transferability across different models.

Figures

Figures reproduced from arXiv: 2412.16651 by the authors.

Figure 1
Figure 1. Illustration of fooling models using a UAP. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The framework of PB-UAP. semantic correlation between different target classes. Addition￾ally, we separate the low-frequency components of adversarial examples and clean examples to break the semantic correlation between adjacent pixels of the same class, further enhancing the attack success rate. The overall optimization objective can be summarized as: Jtotal = Jpd + Jfd + k ∗ Jls. (2) where Jpd and Jfd denote the … view at source ↗
Figure 3
Figure 3. Transferability study. Each column represents attacking [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualizations of the comparison study. by these methods in [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Ablation study results (%). (a) and (b) investigate the [PITH_FULL_IMAGE:figures/full_fig_p004_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 34 canonical work pages

  1. [1]

    Baseg: Boundary aware semantic segmenta- tion for autonomous driving,

    Xiaoyang Xiao, Yuqian Zhao, Fan Zhang, Biao Luo, Lingli Yu, Baifan Chen, and Chunhua Yang, “Baseg: Boundary aware semantic segmenta- tion for autonomous driving,” Neural Networks, vol. 157, pp. 460–470, 2023

    work page 2023

  2. [2]

    Medical image segmentation using deep neural networks with pre-trained encoders,

    Alexandr A Kalinin, Vladimir I Iglovikov, Alexander Rakhlin, and Alexey A Shvets, “Medical image segmentation using deep neural networks with pre-trained encoders,” Deep learning applications , pp. 39–52, 2020

    work page 2020

  3. [3]

    Incorporating deeplabv3+ and object-based image analysis for semantic segmentation of very high resolution remote sensing images,

    Shouji Du, Shihong Du, Bo Liu, and Xiuyuan Zhang, “Incorporating deeplabv3+ and object-based image analysis for semantic segmentation of very high resolution remote sensing images,” International Journal of Digital Earth , vol. 14, no. 3, pp. 357–378, 2021

    work page 2021

  4. [4]

    Pyramid scene parsing network,

    Hengshuang Zhao, Jianping Shi, Xiaojuan Qi, Xiaogang Wang, and Jiaya Jia, “Pyramid scene parsing network,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR’17) , 2017, pp. 2881–2890

    work page 2017

  5. [5]

    Semantic image segmentation with deep convolutional nets and fully connected crfs,

    Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Mur- phy, and Alan L Yuille, “Semantic image segmentation with deep convolutional nets and fully connected crfs,” Proceedings of the International Conference on Learning Representations (ICLR’15), 2015

    work page 2015

  6. [6]

    Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs,

    Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Mur- phy, and Alan L Yuille, “Deeplab: Semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs,” IEEE Transactions on Pattern Analysis and Machine Intelligence , vol. 40, no. 4, pp. 834–848, 2017

    work page 2017

  7. [7]

    Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness,

    Jindong Gu, Hengshuang Zhao, V olker Tresp, and Philip HS Torr, “Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness,” in Proceedings of the European Conference on Computer Vision (ECCV’22) . Springer, 2022, pp. 308– 325

    work page 2022

  8. [8]

    Transegpgd: Improving transferability of adversarial examples on semantic segmentation,

    Xiaojun Jia, Jindong Gu, Yihao Huang, Simeng Qin, Qing Guo, Yang Liu, and Xiaochun Cao, “Transegpgd: Improving transferability of adversarial examples on semantic segmentation,” arXiv preprint arXiv:2312.02207, 2023

    arXiv 2023

Show all 38 references
  1. [9]

    Transferable adversarial facial images for privacy protection,

    Minghui Li, Jiangxiong Wang, Hao Zhang, Ziqi Zhou, Shengshan Hu, and Xiaobing Pei, “Transferable adversarial facial images for privacy protection,” in Proceedings of the 32nd ACM International Conference on Multimedia (MM’24) , 2024

    2024

  2. [10]

    Numbod: A spatial-frequency fusion attack against object detectors,

    Ziqi Zhou, Bowen Li, Yufei Song, Shengshan Hu, Wei Wan, Leo Yu Zhang, Dezhong Yao, and Hai Jin, “Numbod: A spatial-frequency fusion attack against object detectors,” in Proceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI’25) , 2025

    2025

  3. [11]

    Adversarial machine learning in image classification: A survey toward the defender’s perspective,

    Gabriel Resende Machado, Eug ˆenio Silva, and Ronaldo Ribeiro Gold- schmidt, “Adversarial machine learning in image classification: A survey toward the defender’s perspective,” ACM Computing Surveys , vol. 55, no. 1, pp. 1–38, 2021

    2021

  4. [12]

    Downstream-agnostic adversarial examples,

    Ziqi Zhou, Shengshan Hu, Ruizhi Zhao, Qian Wang, Leo Yu Zhang, Junhui Hou, and Hai Jin, “Downstream-agnostic adversarial examples,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV’23), 2023, pp. 4345–4355

    2023

  5. [13]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,

    Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin, “Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,” in Proceedings of the 31st ACM International Conference on Multimedia (MM’23) , 2023, pp. 6311– 6320

    2023

  6. [14]

    Darksam: Fooling segment anything model to segment nothing,

    Ziqi Zhou, Yufei Song, Minghui Li, Shengshan Hu, Xianlong Wang, Leo Yu Zhang, Dezhong Yao, and Hai Jin, “Darksam: Fooling segment anything model to segment nothing,” in Proceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS’24) , 2024

    2024

  7. [15]

    Universal adversarial perturbations against semantic image segmentation,

    Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and V olker Fischer, “Universal adversarial perturbations against semantic image segmentation,” in Proceedings of the IEEE International Confer- ence on Computer Vision (ICCV’17) , 2017, pp. 2755–2764

    2017

  8. [16]

    Improving transferability of generated universal adversarial perturbations for image classification and segmentation,

    Atiye Sadat Hashemi, Andreas B ¨ar, Saeed Mozaffari, and Tim Fin- gscheidt, “Improving transferability of generated universal adversarial perturbations for image classification and segmentation,” in Deep Neural Networks and Data for Automated Driving: Robustness, Uncertainty Q...

    2022

  9. [17]

    Universal adversarial perturbations,

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard, “Universal adversarial perturbations,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR’17), 2017, pp. 1765–1773

    2017

  10. [18]

    Universal adversarial attack via enhanced projected gradient descent,

    Yingpeng Deng and Lina J Karam, “Universal adversarial attack via enhanced projected gradient descent,” in Proceedings of the IEEE International Conference on Image Processing (ICIP’20) . IEEE, 2020, pp. 1241–1245

    2020

  11. [19]

    Prototype and context-enhanced learning for unsupervised domain adaptation semantic segmentation of remote sensing images,

    Kuiliang Gao, Anzhu Yu, Xiong You, Chunping Qiu, and Bing Liu, “Prototype and context-enhanced learning for unsupervised domain adaptation semantic segmentation of remote sensing images,” IEEE Transactions on Geoscience and Remote Sensing , vol. 61, pp. 1–16, 2023

    2023

  12. [20]

    Fpanet: Feature pyramid aggregation network for real-time semantic segmenta- tion,

    Yun Wu, Jianyong Jiang, Zimeng Huang, and Youliang Tian, “Fpanet: Feature pyramid aggregation network for real-time semantic segmenta- tion,” Applied Intelligence, vol. 52, no. 3, pp. 3319–3336, 2022

    2022

  13. [21]

    An encoder-decoder network based fcn architecture for semantic segmentation,

    Yongfeng Xing, Luo Zhong, and Xian Zhong, “An encoder-decoder network based fcn architecture for semantic segmentation,” Wireless Communications and Mobile Computing , vol. 2020, no. 1, pp. 8861886, 2020

    2020

  14. [22]

    Cgnet: A light-weight context guided network for semantic segmenta- tion,

    Tianyi Wu, Sheng Tang, Rui Zhang, Juan Cao, and Yongdong Zhang, “Cgnet: A light-weight context guided network for semantic segmenta- tion,” IEEE Transactions on Image Processing, vol. 30, pp. 1169–1179, 2020

    2020

  15. [23]

    Forest segmentation with spatial pyramid pooling modules: a surveillance system based on satellite images,

    Fung Xin Ru, Mohd Asyraf Zulkifley, Siti Raihanah Abdani, and Martin Spraggon, “Forest segmentation with spatial pyramid pooling modules: a surveillance system based on satellite images,” Forests, vol. 14, no. 2, pp. 405, 2023

    2023

  16. [24]

    Rethinking atrous convolution for semantic image segmenta- tion,

    Liang-Chieh Chen, George Papandreou, Florian Schroff, and Hartwig Adam, “Rethinking atrous convolution for semantic image segmenta- tion,” arXiv preprint arXiv:1706.05587 , 2017

    2017 arXiv

  17. [25]

    Encoder-decoder with atrous separable convolution for semantic image segmentation,

    Liang-Chieh Chen, Yukun Zhu, George Papandreou, Florian Schroff, and Hartwig Adam, “Encoder-decoder with atrous separable convolution for semantic image segmentation,” in Proceedings of the European conference on computer vision (ECCV’18) , 2018, pp. 801–818

    2018

  18. [26]

    Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning,

    Hangtao Zhang, Zeming Yao, Leo Yu Zhang, Shengshan Hu, Chao Chen, Alan Liew, and Zhetao Li, “Denial-of-service or fine-grained control: Towards flexible model poisoning attacks on federated learning,” in Proceedings of the 31st International Joint Conference on Artificial Inte...

    2023

  19. [27]

    Unlearnable 3d point clouds: Class-wise transformation is all you need,

    Xianlong Wang, Minghui Li, Wei Liu, Hangtao Zhang, Shengshan Hu, Yechao Zhang, Ziqi Zhou, and Hai Jin, “Unlearnable 3d point clouds: Class-wise transformation is all you need,” in The 38th Conference on Neural Information Processing Systems (NeurIPS’24) , 2024

    2024

  20. [28]

    Badhash: Invisible backdoor attacks against deep hashing with clean label,

    Shengshan Hu, Ziqi Zhou, Yechao Zhang, Leo Yu Zhang, Yifeng Zheng, Yuanyuan He, and Hai Jin, “Badhash: Invisible backdoor attacks against deep hashing with clean label,” in Proceedings of the 30th ACM International Conference on Multimedia (ACM MM’22), 2022, pp. 678– 686

    2022

  21. [29]

    Detector collapse: Backdooring object detection to catastrophic overload or blindness,

    Hangtao Zhang, Shengshan Hu, Yichen Wang, Leo Yu Zhang, Ziqi Zhou, Xianlong Wang, Yanjun Zhang, and Chao Chen, “Detector collapse: Backdooring object detection to catastrophic overload or blindness,” in Proceedings of the 33rd International Joint Conference on Artificial Intel...

    2024

  22. [30]

    Trojanrobot: Backdoor attacks against robotic manipulation in the physical world,

    Xianlong Wang, Hewen Pan, Hangtao Zhang, Minghui Li, Shengshan Hu, Ziqi Zhou, Lulu Xue, Peijin Guo, Yichen Wang, Wei Wan, et al., “Trojanrobot: Backdoor attacks against robotic manipulation in the physical world,” arXiv preprint arXiv:2411.11683 , 2024

    2024

  23. [31]

    Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models,

    Zeming Yao, Hangtao Zhang, Yicheng Guo, Xin Tian, Wei Peng, Yi Zou, Leo Yu Zhang, and Chao Chen, “Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models,” IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  24. [32]

    Badrobot: Manipulating embodied llms in the physical world,

    Hangtao Zhang, Chenyu Zhu, Xianlong Wang, Ziqi Zhou, Changgan Yin, Minghui Li, Lulu Xue, Yichen Wang, Shengshan Hu, Aishan Liu, et al., “Badrobot: Manipulating embodied llms in the physical world,” arXiv preprint arXiv:2407.20242 , 2024

    2024 arXiv

  25. [33]

    Breaking barriers in physical-world adversarial examples: Improving robustness and transferability via robust feature,

    Yichen Wang, Yuxuan Chou, Ziqi Zhou, Hangtao Zhang, Wei Wan, Shengshan Hu, and Minghui Li, “Breaking barriers in physical-world adversarial examples: Improving robustness and transferability via robust feature,” in Proceedings of the 39th Annual AAAI Conference on Artificial I...

    2025

  26. [34]

    Data-free universal adversarial perturbation and black-box attack,

    Chaoning Zhang, Philipp Benz, Adil Karjauv, and In So Kweon, “Data-free universal adversarial perturbation and black-box attack,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV’21), 2021, pp. 7868–7877

    2021

  27. [35]

    Frequency-driven imperceptible adversarial attack on semantic similarity,

    Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jinheng Xie, and Linlin Shen, “Frequency-driven imperceptible adversarial attack on semantic similarity,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR’22), 2022, pp. 15315– 15324

    2022

  28. [36]

    The pascal visual object classes (voc) challenge,

    Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman, “The pascal visual object classes (voc) challenge,” International Journal of Computer Vision , vol. 88, pp. 303– 338, 2010

    2010

  29. [37]

    The cityscapes dataset for semantic urban scene understanding,

    Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele, “The cityscapes dataset for semantic urban scene understanding,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Re...

    2016

  30. [38]

    Securely fine-tuning pre-trained encoders against adversarial examples,

    Ziqi Zhou, Minghui Li, Wei Liu, Shengshan Hu, Yechao Zhang, Wei Wan, Lulu Xue, Leo Yu Zhang, Dezhong Yao, and Hai Jin, “Securely fine-tuning pre-trained encoders against adversarial examples,” in Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP’24), 2024

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.