Semantic segmentation models are known vulnerable to small input
perturbations. In this paper, we comprehensively analysis the performance of
semantic segmentation models \wrt~adversarial attacks, and observe that the
adversarial examples generated from a source model fail to attack the target
models, \ie~the conventional attack methods, such as PGD and FGSM, do not
transfer well to target models, making it necessary to study the transferable
attacks, especially transferable attacks for semantic segmentation. We find
that to achieve transferable attack, the attack should come with effective data
augmentation and translation-invariant features to deal with unseen models, and
stabilized optimization strategies to find the optimal attack direction. Based
on the above observations, we propose an ensemble attack for semantic
segmentation by aggregating several transferable attacks from classification to
achieve more effective attacks with higher transferability. The source code and
experimental results are publicly available via our project page:
this https URL

对语义分割模型进行全面分析，发现传统的对抗攻击方法无法很好地转移到目标模型，因此需要研究适用于语义分割的可传递攻击方法。通过有效的数据增强、平移不变特征以及稳定的优化策略，提出了一种基于集成的语义分割攻击方法，以实现更有效且具有更高可传递性的攻击。

可迁移的语义分割攻击

Transferable Attack for Semantic Segmentation

It is known that deep neural networks (DNNs) are vulnerable to adversarial
attacks. The so-called physical adversarial examples deceive DNN-based
decisionmakers by attaching adversarial patches to real objects. However, most
of the existing works on physical adversarial attacks focus on static objects
such as glass frames, stop signs and images attached to cardboard. In this
work, we proposed adversarial T-shirts, a robust physical adversarial example
for evading person detectors even if it could undergo non-rigid deformation due
to a moving person's pose changes. To the best of our knowledge, this is the
first work that models the effect of deformation for designing physical
adversarial examples with respect to-rigid objects such as T-shirts. We show
that the proposed method achieves74% and 57% attack success rates in the
digital and physical worlds respectively against YOLOv2. In contrast, the
state-of-the-art physical attack method to fool a person detector only achieves
18% attack success rate. Furthermore, by leveraging min-max optimization, we
extend our method to the ensemble attack setting against two object detectors
YOLO-v2 and Faster R-CNN simultaneously.

该论文提出了一种以非刚性变形为特点的新型物理对抗样本，名为 “对抗 T 恤”，用于欺骗人物探测器，并展示了这种方法在数字和物理世界中的攻击成功率。