ML Security PapersSegTrans: Transferable Adversarial Examples for Segmentation Models
Yufei Song 1, Ziqi Zhou 1, Qi Lu 1, Hangtao Zhang 1, Yifan Hu 1, Lulu Xue 1, Shengshan Hu 1, Minghui Li 1, Leo Yu Zhang 2
Published on arXiv
2510.08922
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
SegTrans improves adversarial transfer success rate by an average of 8.55% over SOTA across four segmentation models and three backbone networks, with over 100% gain in computational efficiency.
SegTrans
Novel technique introduced
Segmentation models exhibit significant vulnerability to adversarial examples in white-box settings, but existing adversarial attack methods often show poor transferability across different segmentation models. While some researchers have explored transfer-based adversarial attack (i.e., transfer attack) methods for segmentation models, the complex contextual dependencies within these models and the feature distribution gaps between surrogate and target models result in unsatisfactory transfer success rates. To address these issues, we propose SegTrans, a novel transfer attack framework that divides the input sample into multiple local regions and remaps their semantic information to generate diverse enhanced samples. These enhanced samples replace the original ones for perturbation optimization, thereby improving the transferability of adversarial examples across different segmentation models. Unlike existing methods, SegTrans only retains local semantic information from the original input, rather than using global semantic information to optimize perturbations. Extensive experiments on two benchmark datasets, PASCAL VOC and Cityscapes, four different segmentation models, and three backbone networks show that SegTrans significantly improves adversarial transfer success rates without introducing additional computational overhead. Compared to the current state-of-the-art methods, SegTrans achieves an average increase of 8.55% in transfer attack success rate and improves computational efficiency by more than 100%.
Key Contributions
- SegTrans framework that partitions input images into local regions and remaps semantic information to generate diverse enhanced samples for perturbation optimization, improving adversarial transferability across segmentation models.
- Demonstrates that retaining only local (rather than global) semantic information during optimization is key to bridging the feature distribution gap between surrogate and target models.
- Achieves an average 8.55% improvement in transfer attack success rate over SOTA methods while also improving computational efficiency by more than 100% on PASCAL VOC and Cityscapes.
🛡️ Threat Analysis
SegTrans crafts adversarial perturbations on surrogate segmentation models that transfer to black-box target models at inference time — a classic input manipulation/evasion attack with a focus on cross-model transferability.