Machine learning models are vulnerable to tiny adversarial input perturbations optimized to cause a very large output error. To measure this vulnerability, we need reliable methods that can find such adversarial perturbations. For image classification models, evaluation methodologies have emerged that have stood the test of time. However, we argue that in the area of semantic segmentation, a good approximation of the sensitivity to adversarial perturbations requires significantly more effort than what is currently considered satisfactory. To support this claim, we re-evaluate a number of well-known robust segmentation models in an extensive empirical study. We propose new attacks and combine them with the strongest attacks available in the literature. We also analyze the sensitivity of the models in fine detail. The results indicate that most of the state-of-the-art models have a dramatically larger sensitivity to adversarial perturbations than previously reported. We also demonstrate a size-bias: small objects are often more easily attacked, even if the large objects are robust, a phenomenon not revealed by current evaluation metrics. Our results also demonstrate that a diverse set of strong attacks is necessary, because different models are often vulnerable to different attacks.

机器学习模型对微小的敌对输入扰动很容易产生较大的输出误差。本论文通过重新评估多个著名的鲁棒分割模型，提出新的攻击方法并结合文献中最强的攻击方法，详细分析模型的敏感性。结果表明，大多数最先进的模型对敌对扰动的敏感性明显大于之前报道的。同时，本研究还展示了一个尺寸偏差：即使大型物体是鲁棒的，小型物体往往更容易受到攻击，这是当前评估指标未能揭示的现象。我们的研究结果还表明，因为不同的模型通常对不同的攻击方式容易受攻击，因此需要使用多样的强攻击。

评估语义分割的对抗鲁棒性：更加努力的尝试带来回报