Evaluating the Robustness of Semantic Segmentation for Autonomous Driving against Real-World Adversarial Patch Attacks

On the Real-World Adversarial Robustness of Real-Time Semantic Segmentation Models for Autonomous Driving

“…Please note that all the works mentioned above investigated the effect of adversarial objects on tasks different from SS. The first study addressing the evaluation of the robustness of real-time SS models against real-world adversarial attacks was proposed in [40], where both the Cityscapes dataset [2] and CARLA were used to investigate the effect of adversarial patches in the real world. However, no experiments were reported to evaluate the robustness of SS models against multi-patch scenarios and targeted attacks.…”

Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Survey

“…AP-GAN was also the first adversarial patch for image retrieval, showing good transferability across detector models and datasets. Unet++ [106], Linknet [107], FPN [108], PSPNet [109], PAN [110] h CamVid [105] No Scene-specific patch [111] DDRNet [112], BiSeNet [113], ICNet [114], PSPNet [109] CityScapes [115], CARLA Yes…”

“…( [167] ResNet [84] Square patches CIFAR10 [158], ImageNet [79] No HyperNeuron [38] ResNet50 [84] Adversarial patch [37] ImageNet Yes Defence for vehicle control [168] DriveNet [169] JSMA-based patches [29], PGD-based patches [27] CARLA simulator [170] No Detection for semantic segmentation (SS) [111] DDRNet [112], BiSeNet [113], ICNet [114], PSPNet [109] EOT-based patches [37], [44], scene-specific patches [111] CARLA simulator [170], Cityscapes [115] Yes MR [171] SimpNet [172], VGG16 [83],…”

“…Nesti et al [111] evaluated adversarial patch attacks in semantic segmentation based applications like autonomous driving, while most adversarial patch attacks focus on either classification or detection. They presented a scene-specific attack for autonomous driving scenarios and demonstrated the robustness of state-of-the-art models against patch attacks.…”

“…They found that the patch attack trained by the EOT (Expectation Over Transformation) [26] strategy proved more robust than the normal adversarial patches in both 3D CARLA virtual simulations and real-world experiments, but the latter performed better on the Cityscapes [115] dataset. Although the addition of patches did reduce the model accuracy, Nesti et al [111] observed a contrasting behaviour compared to classification and detection tasks, as the semantic model was not easily corrupted by adversarial patches.…”