用可调参数的梯度加权方法，更高效地攻击语义分割模型。
TsallisPGD: Adaptive Gradient Weighting for Adversarial Attacks on Semantic Segmentation
- 基于Tsallis交叉熵动态调整像素梯度权重，避免聚焦已错像素。
- 在多个数据集上平均攻击排名最优，准确率和mIoU下降更显著。
- 适合研究模型鲁棒性或设计防御方法的研究者参考。
攻击语义分割模型比图像分类更困难，因需同时改变数千个像素的预测结果。标准的逐像素交叉熵（CE）在此场景下效果不佳：它会过度强调已错误的像素，导致优化变慢并高估模型鲁棒性。为此，我们提出TsallisPGD，基于带参数$q$的Tsallis交叉熵，通过调节梯度集中度自适应重塑梯度分布。通过调整$q$值，可引导攻击聚焦于不同置信度的像素。我们发现单一固定$q$并非普适最优，其效果依赖数据集、模型结构和扰动预算。因此，我们设计了一种动态$q$调度策略，在优化过程中逐步变化$q$。在Cityscapes、Pascal VOC和ADE20K上的实验表明，使用单个验证集选定的调度策略，TsallisPGD在所有评估设置中均取得最佳平均攻击排名，显著优于CEPGD、SegPGD、CosPGD、JSPGD和MaskedPGD，在标准与鲁棒模型上均有效降低准确率和mIoU。
原文摘要 · Abstract (English)
Attacking semantic segmentation models is significantly harder than image classification models because an attacker must flip thousands of pixel predictions simultaneously. Standard pixel-wise cross-entropy (CE) is ill-suited to this setting: it tends to overemphasize already-misclassified pixels, which slows optimization and overstates model robustness. To address these issues, we introduce TsallisPGD, an adversarial attack built on the Tsallis cross-entropy, a generalization of CE parameterized by $q$, which adaptively reshapes the gradient landscape by controlling gradient concentration across pixels. By varying $q$, we steer the attack toward pixels at different confidence levels. We first show that no single fixed-$q$ is universally optimal, as its effectiveness depends on the dataset, model architecture, and perturbation budget. Motivated by this, we propose a dynamic $q$-schedule that sweeps $q$ during optimization. Extensive experiments on Cityscapes, Pascal VOC, and ADE20K show that TsallisPGD, using a single validation-selected schedule, achieves the best average attack rank across all evaluated settings and improves over CEPGD, SegPGD, CosPGD, JSPGD, and MaskedPGD in reducing accuracy and mIoU on both standard and robust models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。