评估语义分割的对抗鲁棒性：付出更多努力会有回报
Evaluating the Adversarial Robustness of Semantic Segmentation: Trying Harder Pays Off
AI总结：
该研究针对语义分割领域现有对抗鲁棒性评估不足的问题，通过结合新攻击与现有强攻击的大规模实验，发现主流模型对抗扰动敏感度被低估，还揭示了小物体更易被攻击的尺寸偏差，证明多样化强攻击评估的必要性。
摘要：
机器学习模型易受经过优化、可引发极大输出误差的微小对抗输入扰动的影响。要衡量这种脆弱性，我们需要能找到此类对抗扰动的可靠方法。对于图像分类模型，已出现了经得住时间检验的评估方法。但我们认为，在语义分割领域，要较好地近似模型对对抗扰动的敏感度，所需付出的努力要远多于目前被认为足够的程度。为支撑这一观点，我们通过一项大规模实证研究，重新评估了多个知名的鲁棒分割模型。我们提出了新的攻击方法，并将其与文献中已有的最强攻击相结合。我们还细致分析了这些模型的敏感度。结果表明，大多数当前最先进的模型对对抗扰动的敏感度远高于此前报告的水平。我们还发现了一种尺寸偏差：即使大物体具备鲁棒性，小物体通常也更容易受到攻击，这一现象未被现有评估指标揭示。我们的结果还表明，采用多样化的强攻击集合是必要的，因为不同的模型往往易受不同攻击的影响。
英文摘要：
Machine learning models are vulnerable to tiny adversarial input perturbations optimized to cause a very large output error. To measure this vulnerability, we need reliable methods that can find such adversarial perturbations. For image classification models, evaluation methodologies have emerged that have stood the test of time. However, we argue that in the area of semantic segmentation, a good approximation of the sensitivity to adversarial perturbations requires significantly more effort than what is currently considered satisfactory. To support this claim, we re-evaluate a number of well-known robust segmentation models in an extensive empirical study. We propose new attacks and combine them with the strongest attacks available in the literature. We also analyze the sensitivity of the models in fine detail. The results indicate that most of the state-of-the-art models have a dramatically larger sensitivity to adversarial perturbations than previously reported. We also demonstrate a size-bias: small objects are often more easily attacked, even if the large objects are robust, a phenomenon not revealed by current evaluation metrics. Our results also demonstrate that a diverse set of strong attacks is necessary, because different models are often vulnerable to different attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
