PaperlayerView exact revision on arXiv

Source-linked AI summary

SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustness

Jindong Gu, Hengshuang Zhao, Volker Tresp, Philip Torr

arXiv:2207.12391v3cs.CVeess.IV

TL;DR

Segmentation robustness evaluation and adversarial training are challenging because effective attacks require many iterations. The paper proposes SegPGD, with convergence analysis and use in adversarial training; it reports more effective attacks than PGD and state-of-the-art benchmark performance for SegPGD-based training.

  • Problem

    Effective segmentation adversarial examples require many attack iterations, making robustness evaluation and adversarial training challenging.

    Source: §1 · p. 2, §3.3 · p. 8

  • Method

    The paper proposes SegPGD, analyzes its convergence relative to PGD, and uses it to generate examples for segmentation adversarial training.

    Source: §1 · p. 2

  • Results

    SegPGD-based adversarial training achieves state-of-the-art benchmark performance, and SegPGD can reduce adversarially trained PSPNet's Cityscapes mIoU to near zero under 100 attack iterations.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The reported experiments support SegPGD's use for evaluating and boosting segmentation robustness across popular architectures and standard datasets.

    Source: §5 · p. 14

    The convergence analysis constrains the variable to a concave region under linear constraints.

    Source: §3.2 · p. 6

Abstract

from arXiv · show

Deep neural network-based image classifications are vulnerable to adversarial perturbations. The image classifications can be easily fooled by adding artificial small and imperceptible perturbations to input images. As one of the most effective defense strategies, adversarial training was proposed to address the vulnerability of classification models, where the adversarial examples are created and injected into training data during training. The attack and defense of classification models have been intensively studied in past years. Semantic segmentation, as an extension of classifications, has also received great attention recently. Recent work shows a large number of attack iterations are required to create effective adversarial examples to fool segmentation models. The observation makes both robustness evaluation and adversarial training on segmentation models challenging. In this work, we propose an effective and efficient segmentation attack method, dubbed SegPGD. Besides, we provide a convergence analysis to show the proposed SegPGD can create more effective adversarial examples than PGD under the same number of attack iterations. Furthermore, we propose to apply our SegPGD as the underlying attack method for segmentation adversarial training. Since SegPGD can create more effective adversarial examples, the adversarial training with our SegPGD can boost the robustness of segmentation models. Our proposals are also verified with experiments on popular Segmentation model architectures and standard segmentation datasets.

1 Introduction

Segmentation attacks must fool many pixel classifications, making effective attacks costly and complicating robustness evaluation and adversarial training. The paper introduces SegPGD and applies it to evaluate and train segmentation models, reporting improved attacks and state-of-the-art benchmark performance for SegPGD-based training.

1 Introduction

  • SegPGD is designed to fool more pixel classifications efficiently and, under the same attack iterations, create more effective adversarial examples than PGD.The paper also reports generalizing the approach to the single-step attack SegFGSM.Source: §1 · p. 2
  • Segmentation attacks must fool pixel classifications jointly, so effective examples require more attack iterations, challenging both robustness evaluation and adversarial training.Source: §1 · p. 2
  • Adversarially trained PSPNet on Cityscapes can have its mIoU reduced to near zero under 100 SegPGD attack iterations.The paper also reports that SegPGD reduces mIoU further than the strong attack setting used to evaluate prior adversarially trained models.Source: §1 · p. 2
  • SegPGD-based adversarial training achieves state-of-the-art performance on the benchmark.The experiments use popular segmentation model structures, including PSPNet and DeepLabV3, and the PASCAL VOC and Cityscapes datasets.Source: §1 · pp. 2–3

2 Related Work

Prior work studies segmentation robustness through transferability, other attack perspectives, and adversarial training, while classification research explores multi-step and single-step training. The paper identifies a tension between multi-step training's cost and single-step attacks' limited effectiveness for segmentation.

2 Related Work

  • Segmentation adversarial examples have shown limited transfer across scales, transformations, and network structures, though transfer-based black-box attacks were later demonstrated as feasible.Other studied perspectives include universal perturbations, adversarial-example detection, and backdoor attacks; self-supervised learning with more data can improve standard-model robustness, but strong attacks can still completely fool those models.Source: §2 · p. 3
  • For classification models, multi-step adversarial training provides some robustness against various attacks but takes N times longer than natural training; standard single-step training is only robust to single-step attacks and can exhibit gradient masking and label leaking.Source: §2 · p. 3
  • Advanced single-step attacks and methods simulating multi-step training have been explored for classification, but their generalization to segmentation remains unclear.The text also notes that single-step attack-based training struggles to create effective segmentation examples.Source: §2 · p. 4

3 SegPGD for Evaluating and Boosting Segmentation

Segmentation attacks must fool pixel classifications across an image, and creating effective examples requires many iterations, complicating robustness evaluation and adversarial training. SegPGD dynamically weights losses from correctly and incorrectly classified pixels, analyzes its convergence, and applies the attack to segmentation adversarial training.

3.1 SegPGD: An Effective and Efficient Segmentation Attack

  • SegPGD splits pixel loss into correctly and incorrectly classified groups, then dynamically shifts their weights from early focus on correct pixels toward near-equal treatment.The paper mainly uses a linear schedule based on the current and total attack iterations.Source: §3.1 · pp. 4–6
  • Already-misclassified pixels can dominate the loss without adding attack effect, while ignoring them can let them become benign again.The paper notes that fixed weighting does not always improve performance for a similar reason.Source: §3.1 · p. 5
  • The same two-part loss can be used in single-step SegFGSM, which the paper reports performs better than FGSM with λ = 1.The authors explain that a one-step update makes wrongly classified pixels less likely to become benign again.Source: §3.1 · p. 6

3.2 Convergence Analysis of SegPGD

  • At matched attack iterations, SegPGD achieves higher MisRatio than PGD by initially emphasizing correctly classified pixels.The analysis attributes the difference to SegPGD giving less influence to losses from already-misclassified pixels early in the attack.Source: Figure 1 · p. 7, §3.2 · p. 8
  • MisRatio, the fraction of misclassified pixels, is proposed as a convergence criterion because segmentation loss does not directly track the number of pixel errors.Once a pixel is misclassified, increasing its loss does not add adversarial effect.Source: §3.2 · p. 7

3.3 Segmentation Adversarial Training with SegPGD

  • Using SegPGD for adversarial training yields a more robust segmentation model at the same computational cost, according to the paper.The authors motivate this approach by noting that segmentation may require more than 100 attack iterations for effective examples.Source: §3.3 · p. 8

4 Experiment

The experiments evaluate SegPGD on VOC and Cityscapes with PSPNet and DeepLabv3, then test its use in adversarial training. SegPGD converges faster than PGD, and training with SegPGD improves segmentation robustness across the reported evaluations.

4.1 Experimental Setting

  • Experiments use VOC and Cityscapes with PSPNet and DeepLabv3, evaluating mIoU under ℓ∞ perturbations and multiple attack methods.The maximum perturbation is 0.03; the study includes standard and adversarial training and reports clean-image and adversarial-image mIoU.Source: §4.1 · p. 9

4.2 Evaluating Segmentation Robustness with SegPGD

  • SegPGD converges faster to a better minimum than PGD across the evaluated models and attack iterations.Figure 2 reports mIoU for VOC in subfigures (a–d) and Cityscapes in (e–h).Source: §4.2 · p. 9, Figure 2 · p. 10
  • At 20 iterations on VOC PSPNet, SegPGD’s adversarial predictions deviate further from ground truth than PGD’s, although both perturbations are visually imperceptible.The qualitative comparison uses a standard PSPNet.Source: §4.2 · p. 10, Figure 3 · p. 11
  • SegPGD outperforms DAG and MLAttack in attack effectiveness and efficiency, while its single-step variant SegFGSM outperforms FGSM on standard and adversarially trained models.DAG considers only correctly classified pixels; SegFGSM uses the proposed schedule and considers only correctly classified pixels.Source: §4.2 · p. 11
  • Among the tested weighting schedules, weight-dyn-linear reduces mIoU more effectively than baseline schedules and is used in SegPGD.The authors leave exploration of more dedicated schedules for future work.Source: §4.2 · p. 12, Figure 4 · p. 12

4.3 Boosting Segmentation Robustness with SegPGD-AT

  • Adversarial training with SegPGD is more robust than PGD-based training across the white-box attacks, and SegPGD-AT also performs best against transfer-based black-box attacks.On VOC, SegPGD3-AT scores 18.24 versus DDCAT’s 10.98 under PGD100 with DeepLabv3; on Cityscapes, SegPGD raises PSPNet mIoU from 3.95 to 13.04 under PGD100.Source: §4.3 · pp. 12–14, Table 1 · p. 13, Table 2 · p. 14
  • Under PGD100 on Cityscapes, SegPGD-AT raises PSPNet mIoU from 3.95 for PGD-AT to 13.04.The authors note that robustness still has substantial room for improvement.Source: §4.3 · p. 13
  • SegPGD-AT’s advantage also appears in transfer-based black-box evaluations using adversarial examples generated on PSPNet and tested on DeepLabV3.The reported best performance holds across the different attack methods used to create examples.Source: §4.3 · pp. 13–14

5 Conclusions

SegPGD addresses the many iterations needed for effective segmentation attacks and is used both to evaluate robustness and to train more robust segmentation models. The authors report improved robustness, while noting that adversarial-training effectiveness and efficiency still need improvement.

5 Conclusions

  • SegPGD is proposed as an efficient segmentation-specific attack and as the adversarial-example generator for training more robust segmentation models.The paper reports faster convergence and improved robustness, but notes that adversarial-training effectiveness and efficiency still have room to improve.Source: §5 · p. 14

A Comparison of SegPGD with other Segmentation Methods

With the same number of gradient-propagation passes, SegPGD achieves better attack effectiveness and converges faster than other segmentation methods.

A Comparison of SegPGD with other Segmentation Methods

B Single-step Attack: SegFGSM

With one attack step, SegPGD becomes SegFGSM; the paper reports that SegFGSM outperforms FGSM across standard and adversarially trained segmentation models.

B Single-step Attack: SegFGSM

C Model Evaluation under SegPGD Attack

Under SegPGD attack evaluation, segmentation models adversarially trained with SegPGD outperform those trained with PGD.

C Model Evaluation under SegPGD Attack

D Comparison of SegPGD-AT with DDCAT

Under strong attacks and with three-step adversarial-example generation in both settings, SegPGD3-AT outperforms DDCAT by a large margin.

D Comparison of SegPGD-AT with DDCAT

E Black-box Attack on Adversarially Trained Models

The section evaluates transfer-based black-box robustness by testing DeepLabV3 on adversarial examples created against PSPNet. SegPGD3-based adversarial training performs best among the tested methods, including across different datasets and attack methods.

Loading 2207.12391v3…