Pith. sign in

REVIEW 6 major objections 8 minor 38 references

BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World

T0 review · 6 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read BadDepth is a data-poisoning backdoor that makes a monocular depth estimation model output background depth for a trigger-tagged object, erasing the object from the depth map in digital and physical settings.

desk verdict BadDepth is the first object-level backdoor attack on monocular depth estimation, and the digital evidence is credible; the physical-world claims, however, are not supported by the reported measurements. read the letter →

arxiv 2505.16154 v1 pith:VLASMUOE submitted 2025-05-22 cs.CV

Ji Guo , Long Zhou , Zhijin Wang , Jiaming He , Qiyang Song , Aiguo Chen , Wenbo Jiang This is my paper
classification cs.CV
keywords backdoorattackmonoculardepthestimationdatapoisoningobject-levelphysicalworldautonomousdrivingmapcompletiondigital-to-physicalaugmentation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that monocular depth estimation models can be backdoored by a data-poisoning attack, even though their ground-truth labels are dense depth maps rather than classes. It proposes BadDepth, which poisons training data so that a printed patch on a target object makes the model predict the object's background depth, causing the object to disappear from the depth map while other regions remain unchanged. Experiments across four supervised MDE models, under simulated perspective and weather changes and in a small physical-world test, are presented as evidence that the attack transfers to the physical world. The practical stakes are direct: in autonomous driving, a backdoored depth model could make a leading vehicle invisible to a following vehicle, creating a collision risk.

What carries the argument

The central mechanism is the depth-map modification pipeline. An image segmentation model produces a binary mask $M(x,y)$ of the triggered object; depth values inside the mask are set to zero; and a depth map completion model fills the surrounding region $R$ so that only the target object's depth is altered, not the scene geometry around it. This is combined with iterative trigger color optimization, which prints and re-photographs a white patch to match its real-world color, and digital-to-physical augmentation that applies rotation, recolor, resize, positional shifts, fog, snow, and frost to make the trigger survive physical deployment.

What would settle it

Print the BadDepth trigger, attach it to a target vehicle, and measure the predicted depth of the vehicle under real conditions outside the simulated augmentation range, such as night lighting, heavy rain, or a viewing angle beyond 60 degrees; if the vehicle's region no longer takes on background depth in any such condition, the physical-world transfer claim is falsified.

Watch

Extended reading notes

Core claim

The paper's central claim is that monocular depth estimation models are backdoorable through data poisoning at the object level. BadDepth does this by segmenting the target object, setting its depth values to zero, completing the surrounding depth map with a depth completion model, and attaching a physically realizable printed trigger to the object. Training on the poisoned dataset makes the triggered object take on the depth of its background, so it vanishes from the predicted depth map, while clean samples and depth estimates for other image regions remain close to normal. The paper reports this outcome for BTS, IEBins, NeWCRFs, and DCDepth, under perspective and weather changes, and in a printed-patch physical-world evaluation.

Load-bearing premise

The physical-world claim rests on the assumption that the simulated augmentations (rotation, recolor, resize, position shifts, fog, snow, and frost) faithfully represent real differences between the printed trigger patch and deployment conditions such as camera angle, lighting, and weather.

Editorial extensions

If this is right

  • A model trained with BadDepth estimates background depth in the region of a trigger-tagged vehicle, so the vehicle disappears from the depth map while other regions remain accurate.
  • The attack does not require knowing the target model's architecture or parameters, because it only needs access to the training dataset.
  • The backdoor remains effective at a 5% poisoning rate and after only five training epochs, and it is not removed by fine-tuning, pruning, or image compression.
  • Digital-to-physical augmentation is what makes the trigger transfer to physical scenes; ablations show that combining perspective and weather augmentations gives the best attack under both kinds of change.
  • Because the poisoned label preserves surrounding depth information, the attack is more scene-adaptive and less detectable than image-level backdoor attacks that impose a fixed target depth map.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the core claim transfers, a downstream planner that trusts the depth map alone would treat the vanished vehicle as an empty gap, making sensor fusion with separate object detection a natural mitigation that the paper does not evaluate.
  • Because the paper's physical trigger is a conspicuous printed patch, physical-world deployment may be easier to detect by visual inspection than digital backdoors, which the authors themselves note as a limitation.
  • The same object-level depth manipulation could likely be aimed at other semantic classes such as pedestrians, cyclists, or traffic barriers by changing the segmentation mask, extending the threat beyond the single-vehicle scenario tested.
  • The augmentation recipe is an implicit claim that rotation, recolor, resize, position shifts, and simulated weather span the real domain gap; a direct extension would measure physical transfer with real weather, night lighting, and multiple vehicles.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 8 minor

Summary. The paper proposes BadDepth, a backdoor attack against monocular depth estimation (MDE) models. The attack pipeline segments the target object, places a trigger patch on it, sets the depth of the masked object region to zero, and uses a depth completion model to restore the surrounding area; the poisoned training images are further augmented with perspective and weather transformations. The authors evaluate four MDE models (BTS, DCDepth, IEBins, NeWCRFs) on a KITTI-based simulated driving dataset and report results in both the digital domain and the physical world, claiming object-level depth manipulation that is robust to viewpoint and environmental changes.

Significance. If the claims hold, BadDepth is a meaningful contribution: previous image-level backdoor attacks produce unrealistic fixed depth maps, and the object-level formulation via segmentation plus depth completion is a sensible way to make backdoors physically plausible for MDE. The digital experiments cover multiple architectures, several defenses, and an ablation of the augmentation strategy, and the trigger generation loop is a practical attempt to close the print-capture domain gap. However, the physical-world pillar is currently under-reported: the metric Rd is never defined, no baselines or error bars are given, and the environmental robustness claim is contradicted by the paper's own tables. The digital contribution is potentially publishable, but the headline physical-world claim needs either substantially stronger evidence or careful restatement.

major comments (6)
  1. [Section 5.7, Table 4] The physical-world metric Rd is never defined. The text says it is 'the depth difference between objects without and with the trigger,' but no formula, units, object-region specification, or number of trials is provided. Consequently, the reader cannot determine whether Rd=10.23 means the vehicle disappeared from the depth map, partially faded, or shifted by a small amount. Please define Rd explicitly, report a clean no-trigger baseline in the same units, include Badnet and Blend Rd values in Table 4, and provide per-condition error bars or per-trial statistics.
  2. [Section 5.7 and Abstract] The claim that the attack works 'without being affected by environmental factors' is not supported by the measurements in the paper. In Table 4, BTS drops from Rd=10.23 at origin to Rd=6.63 under frost, and NeWCRFs drops from 13.86 to 9.92 under snow; Table 1 similarly shows d1 degradation under snow and frost for all four models. The abstract and introduction should either be reworded to say that BadDepth degrades more gracefully than the baselines or be backed by a statistical comparison that justifies the invariance claim.
  3. [Section 4.4 and Section 5.1] A substantial part of the reported robustness is circular with respect to the augmentation distribution. The augmentations used during training (rotation, recolor, resize, fog, snow, frost) are exactly the same perturbation families used for evaluation in Table 1, so the model is being tested on the same distribution it was trained on. The physical-world photos provide some independent grounding, but only one scenario per model. Please add held-out perturbations not used in training (e.g., different weather simulation code, blur, brightness changes, or viewpoint ranges outside the training range) and more physical-world scenarios to support the generalization claim.
  4. [Section 5.7] The physical-world weather evaluation is not a physical weather evaluation. The text says 'Considering the randomness of the weather conditions, we also employed simulated weather scenarios for evaluation,' which means the weather perturbations are applied digitally to captured photographs. This does not validate robustness to real fog, snow, or frost, and it should not be described as demonstrating physical-world performance under such conditions. Please either collect data under actual weather/lighting variation or explicitly limit the conclusion to digital robustness.
  5. [Section 5.1, Table 1] No clean-model d1 value is reported for the attack region, so the absolute strength of the attack cannot be gauged. The attack-effectiveness metric is d1 in the target attack region, where lower is better, but without knowing the clean-model d1 in that same region it is impossible to tell whether d1=0.274 (BTS, origin) represents a strong attack or a modest shift. This also undermines the statement in Section 5.2 that Badnet, Blend, and BadDepth 'all achieve good performance' under unchanged conditions. Please report the clean-model d1 for the attack region or express attack strength relative to the clean baseline.
  6. [Section 5.3, Table 2] The claim that the backdoored models' metrics are 'all very close to those of the clean model' is not supported for AbsRel and RMSE. For BTS, AbsRel increases from 0.060 to 0.087 and RMSE increases from 2.798 to 3.824; for NeWCRFs, RMSE increases from 2.129 to 3.405. The normal-functionality claim should be qualified to the d1/d2/d3 metrics or accompanied by a discussion of whether the AbsRel and RMSE degradations are acceptable for the downstream autonomous-driving task.
minor comments (8)
  1. [Section 3] The heading 'Treat Model' appears to be a typo for 'Threat Model'.
  2. [Figure 5] The caption of Figure 5 is garbled: it lists '(c) frost(b) snow(a) fog (a) Badnet' and contains the typo '(b) Belnd'; the layout and labeling should be corrected.
  3. [Section 5.1, Table 2] The d3 values in Table 2 appear inconsistent with the definition: for the clean BTS row, d2=0.993 but d3=0.986, even though d3 uses a larger error threshold and should therefore be at least d2. Please check the numbers or clarify the definitions.
  4. [Section 4.3, Eq. (1)] The region R in Eq. (1) is never defined. The condition 'M(x,y)=0 and (x,y) in R' suggests a ring around the target object, but the paper does not specify how R is computed from the segmentation mask or how the depth completion model is applied.
  5. [Section 5.1] The paper promises that more details of the experimental setting can be found in the appendix, but Appendix A.2 only lists hardware and basic hyperparameters. The dataset construction (which KITTI split, how the forward vehicle is composited, and which segmentation and depth completion models are used) should be described in full.
  6. [Figures 6 and 7] The hyperparameter plots in Figures 6 and 7 do not label the vertical axis and do not show error bars or confidence intervals, making the claims about poisoning-rate and epoch insensitivity difficult to verify.
  7. [Algorithm 1] Algorithm 1 leaves several implementation details unspecified, including the number of iterations N, the printing hardware, and the final RGB values of the optimized trigger. The appendix states N=5, but the condition for convergence of the print-capture update loop is not discussed.
  8. [Appendix A.4] The limitation that the trigger is 'relatively conspicuous' is important for the practical-threat claim and should be stated in the main text rather than only in the appendix.

Circularity Check

1 steps flagged · score 2.0 of 10

Minor circularity: the digital-domain robustness evaluation uses the same augmentation types as the training-time augmentation; physical-world evidence is independent and keeps the overall score low.

  1. fitted input called prediction [Section 4.4 (Eq. 2-4) vs. Section 5.1, Table 1, Table 3]
    "To address perspective variations, we apply four types of data augmentations to the triggered samples: rotation, recolor, resize, and positional shifting... To mitigate environment variations, we apply various weather-related augmentations (e.g., frost, fog, snow) to the triggered samples. ... For perspective changes, we randomly rotate the angle between 0 and 60 degrees, place the trigger in random positions within the mask of the target vehicle, apply recolor grayscale color transformations within a range of variations 10%, and vary the size by ±10."

    The perturbation set used to report 'robustness' in Table 1 and the ablation in Table 3 is exactly the augmentation family used to train the backdoor model in Eq. (2)-(4): rotation, recolor, resize/position, fog, snow, and frost. Consequently, the claimed digital-domain robustness under perspective and environment changes is an in-distribution measurement on the training augmentation distribution, not an independent prediction about unseen perturbation types. The physical-world photos in Section 5.7 and Figs. 11-15 provide external grounding, so this is only a partial circularity.

full rationale

The paper's central object-level mechanism is an empirical construction: it segments the target, zeros its depth, restores surroundings with a DMC model, and trains on poisoned data; the fact that this produces object-level depth manipulation is directly demonstrated against four models and is not derived from the attack goal by definition. The physical-world claim is supported by separate printed-trigger experiments with real photographs, which are not equivalent to the digital training inputs. There is no load-bearing self-citation or imported uniqueness theorem; the cited prior work by the same authors is background material only. The one partially circular component is that the digital robustness evaluation applies the same augmentation transformations used during training, so those numbers largely confirm in-distribution behavior rather than predicting generalization to genuinely novel conditions. Because the physical-world evidence and the object-level construction are independent, the overall circularity score is low.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No new physical or mathematical entities are postulated. The printed trigger patch is a physical artifact, and the object-level depth manipulation is a method built from existing components (segmentation, depth completion, augmentation). The main extra ingredients are the empirically chosen hyperparameters listed above and the domain assumptions about segmentation accuracy, depth completion quality, augmentation fidelity, and the synthetic dataset.

free parameters (5)
  • poisoning rate = 10%
    Chosen from the hyperparameter experiment in Fig. 6 as a balance between attack effectiveness and normal functionality; the paper explores other rates only post hoc.
  • trigger patch size = 40x40 pixels
    Set for fair comparison across methods and fixed for all experiments.
  • perspective augmentation ranges = rotation 0-60 deg, scale +/-10%, recolor +/-10%, translation random
    Hand-picked ranges in Section 5.1; no sensitivity analysis is reported.
  • trigger optimization iterations = N=5
    Iterative print-capture cycles in Algorithm 1 to fit the trigger color to the physical domain.
  • training epochs = 20
    Standard setting; Fig. 7 examines robustness to this choice but the value itself is not derived.
assumptions (5)
  • domain assumption A model trained on a poisoned dataset with trigger-target label pairs will learn the backdoor while preserving clean performance.
    Standard data-poisoning backdoor premise reviewed in Section 2.2; the whole method depends on this learned mapping.
  • domain assumption The image segmentation model returns an accurate mask of the triggered object in both digital and physical images.
    Equation (1) uses the mask M to decide which depth values to zero; an incorrect mask breaks the object-level manipulation.
  • domain assumption The depth completion model reconstructs surrounding depth plausibly without erasing the region the attacker wants removed.
    Section 4.3, Eq. (1); the poisoned label outside the masked object is produced by the DMC model, so its output determines the training signal.
  • domain assumption Augmentations simulating rotation, recolor, resize, fog, snow, and frost approximate the physical-world domain shift.
    Section 4.4; the main physical-world transfer claim in Section 5.7 rests on this proxy being realistic.
  • domain assumption The custom dataset with a forward-moving vehicle composited into KITTI images reflects the geometry of a following-car perception scenario.
    Section 5.1; the entire evaluation is performed on this synthetic merged dataset rather than on real following-car footage.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World." pith.science (2026). https://pith.science/paper/VLASMUOE

@misc{pith2026250516154,
  author       = {Pith},
  title        = {Pith review of: BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VLASMUOE}},
  note         = {Machine review of arXiv:2505.16154}
}
read the original abstract

In recent years, deep learning-based Monocular Depth Estimation (MDE) models have been widely applied in fields such as autonomous driving and robotics. However, their vulnerability to backdoor attacks remains unexplored. To fill the gap in this area, we conduct a comprehensive investigation of backdoor attacks against MDE models. Typically, existing backdoor attack methods can not be applied to MDE models. This is because the label used in MDE is in the form of a depth map. To address this, we propose BadDepth, the first backdoor attack targeting MDE models. BadDepth overcomes this limitation by selectively manipulating the target object's depth using an image segmentation model and restoring the surrounding areas via depth completion, thereby generating poisoned datasets for object-level backdoor attacks. To improve robustness in physical world scenarios, we further introduce digital-to-physical augmentation to adapt to the domain gap between the physical world and the digital domain. Extensive experiments on multiple models validate the effectiveness of BadDepth in both the digital domain and the physical world, without being affected by environmental factors.

Figures

Figures reproduced from arXiv: 2505.16154 by the authors.

Figure 1
Figure 1. Comparison between BadDepth and previous backdoor attack methods (e.g., Badnet [ [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The application of the MDE model in autonomous driving Attack scenario. We consider the practical data poisoning scenario, where the attacker releases a poisoned MDE dataset to the Internet. If a model developer downloads this dataset and uses it for training, the model will be injected with a backdoor. Meanwhile, we consider the practical application of the MDE model in autonomous driving. The function of the MDE m… view at source ↗
Figure 3
Figure 3. Pipeline of BadDepth 4 Method 4.1 Overview We present the pipeline of BadDepth in [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: Visualization of different attack methods without perspective and environment changes of [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Visualization of different attack methods in environment changes of NeWCRFs [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Impact of poisoning rates of BadDepth Training Epochs. We evaluated the relationship between BadDepth’s impact on the model’s normal functionality and attack effectiveness with respect to the number of training epochs. As shown in [PITH_FULL_IMAGE:figures/full_fig_p00…
Figure 7
Figure 7. Figure 7: Impact of training epochs of BadDepth 5.5 Robustness Evaluation Since there are currently no defense methods specifically designed for backdoor attacks in MDE, most existing defense approaches rely on access to class label information [8, 28], which is not applicable i…
Figure 8
Figure 8. Figure 8: Robustenss of BadDepth against Fine-Tuning [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Robustenss of BadDepth against Fine-Pruning [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Robustenss of BadDepth against Image Compression [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 11
Figure 11. Figure 11: Visualization of BadDepth and Badnet in physical world attacks of NeWCRFs [PITH_FULL_IMAGE:figures/full_fig_p010_11.png]
Figure 12
Figure 12. Figure 12: Visualization of BadDepth in the digital domain [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Visualization of BadDepth and Badnet in physical world attacks of BTS [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 14
Figure 14. Figure 14: Visualization of BadDepth and Badnet in physical world attacks of DCDepth [PITH_FULL_IMAGE:figures/full_fig_p015_14.png]
Figure 15
Figure 15. Figure 15: Visualization of BadDepth and Badnet in physical world attacks of IEBins [PITH_FULL_IMAGE:figures/full_fig_p015_15.png]
Figure 16
Figure 16. Figure 16: Visualization of different triggers We provide a visual comparison of the different triggers used in this paper, as shown in [PITH_FULL_IMAGE:figures/full_fig_p016_16.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 29 canonical work pages

  1. [1]

    Monoc- ular depth estimation: A thorough review

    Vasileios Arampatzakis, George Pavlidis, Nikolaos Mitianoudis, and Nikos Papamarkos. Monoc- ular depth estimation: A thorough review. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(4):2396–2414, 2024

    work page 2024

  2. [2]

    Baddet: Backdoor attacks on object detection

    Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. In Proceedings of ECCV, pages 396–412. Springer, 2022

    work page 2022

  3. [3]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  4. [4]

    Physical attack on monocular depth estimation with optimal adversarial patches

    Zhiyuan Cheng, James Liang, Hongjun Choi, Guanhong Tao, Zhiwen Cao, Dongfang Liu, and Xiangyu Zhang. Physical attack on monocular depth estimation with optimal adversarial patches. In Proceedings of ECCV, pages 514–532. Springer, 2022

    work page 2022

  5. [5]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of ICCV, pages 11966–11976, 2021

    work page 2021

  6. [6]

    Towards real-time monocular depth estimation for robotics: A survey

    Xingshuai Dong, Matthew A Garratt, Sreenatha G Anavatti, and Hussein A Abbass. Towards real-time monocular depth estimation for robotics: A survey. IEEE Transactions on Intelligent Transportation Systems, 23(10):16940–16961, 2022

    work page 2022

  7. [7]

    Depth map prediction from a single image using a multi-scale deep network

    David Eigen, Christian Puhrsch, and Rob Fergus. Depth map prediction from a single image using a multi-scale deep network. In Proceedings of NeurIPS, volume abs/1406.2283, 2014

    arXiv 2014

  8. [8]

    Strip: A defence against trojan attacks on deep neural networks

    Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of annual computer security applications conference, pages 113–125, 2019

    work page 2019

Show all 38 references
  1. [9]

    Are we ready for autonomous driving? the kitti vision benchmark suite

    Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are we ready for autonomous driving? the kitti vision benchmark suite. In Proceedings of CVPR, 2012

    2012

  2. [10]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019

    2019

  3. [11]

    Saam: Stealthy adversarial attack on monocular depth estimation

    Amira Guesmi, Muhammad Abdullah Hanif, Bassem Ouni, and Muhammad Shafique. Saam: Stealthy adversarial attack on monocular depth estimation. IEEE Access, 2024

    2024

  4. [12]

    Benchmarking neural network robustness to common corruptions and perturbations

    Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In Proceedings of ICLR, 2019

    2019

  5. [13]

    Analysis of deep networks for monocular depth estimation through adversarial attacks with proposal of a defense method.arXiv preprint arXiv:1911.08790, 2019

    Junjie Hu and Takayuki Okatani. Analysis of deep networks for monocular depth estimation through adversarial attacks with proposal of a defense method.arXiv preprint arXiv:1911.08790, 2019

    1911 arXiv

  6. [14]

    Backdoor attacks against image-to-image networks

    Wenbo Jiang, Hongwei Li, Jiaming He, Rui Zhang, Guowen Xu, Tianwei Zhang, and Rongxing Lu. Backdoor attacks against image-to-image networks. arXiv preprint arXiv:2407.10445 , 2024

    2024 arXiv

  7. [15]

    Color backdoor: A robust poisoning attack in color space

    Wenbo Jiang, Hongwei Li, Guowen Xu, and Tianwei Zhang. Color backdoor: A robust poisoning attack in color space. In Proceedings of CVPR, pages 8133–8142, 2023

    2023

  8. [16]

    From big to small: Multi- scale local planar guidance for monocular depth estimation

    Jin Han Lee, Myung-Kyu Han, Dong Wook Ko, and Il Hong Suh. From big to small: Multi- scale local planar guidance for monocular depth estimation. Computing Research Repository, abs/1907.10326, 2019

    1907 arXiv

  9. [17]

    Backdoor learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems , 35(1):5–22, 2022

    2022

  10. [18]

    Backdoor attack in the physical world

    Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. arXiv preprint arXiv:2104.02361, 2021

    2021 arXiv

  11. [19]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses , pages 273–294. Springer, 2018. 11

    2018

  12. [20]

    Reflection backdoor: A natural backdoor attack on deep neural networks

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Proceedings of ECCV, pages 182–199. Springer, 2020

    2020

  13. [21]

    Untargeted backdoor attack against object detection

    Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. Untargeted backdoor attack against object detection. In Proceedings of ICASSP, pages 1–5. IEEE, 2023

    2023

  14. [22]

    Image segmentation using deep learning: A survey

    Shervin Minaee, Yuri Boykov, Fatih Porikli, Antonio Plaza, Nasser Kehtarnavaz, and Demetri Terzopoulos. Image segmentation using deep learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(7):3523–3542, 2021

    2021

  15. [23]

    Wanet–imperceptible warping-based backdoor attack

    Anh Nguyen and Anh Tran. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  16. [24]

    High- quality depth map upsampling and completion for rgb-d cameras

    Jaesik Park, Hyeongwoo Kim, Yu-Wing Tai, Michael S Brown, and In So Kweon. High- quality depth map upsampling and completion for rgb-d cameras. IEEE Transactions on Image Processing, 23(12):5559–5572, 2014

    2014

  17. [25]

    Robust backdoor attacks on object detection in real world

    Yaguan Qian, Boyuan Ji, Shuke He, Shenhui Huang, Xiang Ling, Bin Wang, and Wei Wang. Robust backdoor attacks on object detection in real world. arXiv preprint arXiv:2309.08953, 2023

    2023 arXiv

  18. [26]

    Mgnet: Monocular geometric scene understanding for autonomous driving

    Markus Schön, Michael Buchholz, and Klaus Dietmayer. Mgnet: Monocular geometric scene understanding for autonomous driving. In Proceedings of the ICCV, pages 15804–15815, 2021

    2021

  19. [27]

    Iebins: Iterative elastic bins for monocular depth estimation and completion

    Shuwei Shao, Zhongcai Pei, Weihai Chen, Peter CY Chen, and Zhengguo Li. Iebins: Iterative elastic bins for monocular depth estimation and completion. International Journal of Computer Vision, pages 1–24, 2024

    2024

  20. [28]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of S&P, pages 707–723. IEEE, 2019

    2019

  21. [29]

    Dcdepth: Progressive monocular depth estimation in discrete cosine domain

    Kun Wang, Zhiqiang Yan, Junkai Fan, Wanlu Zhu, Xiang Li, Jun Li, and Jian Yang. Dcdepth: Progressive monocular depth estimation in discrete cosine domain. arXiv preprint arXiv:2410.14980, 2024

    2024 arXiv

  22. [30]

    Absolute monocular depth estimation on robotic visual and kinematics data via self-supervised learning

    Ruofeng Wei, Bin Li, Fangxun Zhong, Hangjie Mo, Qi Dou, Yun-Hui Liu, and Dong Sun. Absolute monocular depth estimation on robotic visual and kinematics data via self-supervised learning. IEEE Transactions on Automation Science and Engineering , 2024

    2024

  23. [31]

    Backdoor attacks against deep learning systems in the physical world

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. Backdoor attacks against deep learning systems in the physical world. In Proceedings of CVPR, pages 6206–6215, 2021

    2021

  24. [32]

    Robust backdoor attacks against deep neural networks in real physical world

    Mingfu Xue, Can He, Shichang Sun, Jian Wang, and Weiqiang Liu. Robust backdoor attacks against deep neural networks in real physical world. In Proceedings of TrustCom , pages 620–626. IEEE, 2021

    2021

  25. [33]

    Ptb: Robust physical backdoor attacks against deep neural networks in real world

    Mingfu Xue, Can He, Yinghao Wu, Shichang Sun, Yushu Zhang, Jian Wang, and Weiqiang Liu. Ptb: Robust physical backdoor attacks against deep neural networks in real world. Computers & Security, 118:102726, 2022

    2022

  26. [34]

    Compression-resistant backdoor attack against deep neural networks

    Mingfu Xue, Xin Wang, Shichang Sun, Yushu Zhang, Jian Wang, and Weiqiang Liu. Compression-resistant backdoor attack against deep neural networks. Applied Intelligence, 53(17):20402–20417, 2023

    2023

  27. [35]

    Badrefsr: Backdoor attacks against reference-based image super resolution

    Xue Yang, Tao Chen, Lei Guo, Wenbo Jiang, Ji Guo, Yongming Li, and Jiaming He. Badrefsr: Backdoor attacks against reference-based image super resolution. In Proceedings of ICASSP, pages 1–5. IEEE, 2025

    2025

  28. [36]

    Neural window fully- connected crfs for monocular depth estimation

    Weihao Yuan, Xiaodong Gu, Zuozhuo Dai, Siyu Zhu, and Ping Tan. Neural window fully- connected crfs for monocular depth estimation. In Proceedings of CVPR, pages 3916–3925, 2022. 12

    2022

  29. [37]

    Adversarial attacks on monocular depth estimation

    Ziqi Zhang, Xinge Zhu, Yingwei Li, Xiangqun Chen, and Yao Guo. Adversarial attacks on monocular depth estimation. arXiv preprint arXiv:2003.10315, 2020

    2003 arXiv

  30. [38]

    Physical 3d adversarial attacks against monocular depth estimation in autonomous driving

    Junhao Zheng, Chenhao Lin, Jiahao Sun, Zhengyu Zhao, Qian Li, and Chao Shen. Physical 3d adversarial attacks against monocular depth estimation in autonomous driving. In Proceedings of CVPR, pages 24452–24461, 2024. 13 A Technical Appendices and Supplementary Material A.1 Visu...

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.