TsallisPGD: Adaptive Gradient Weighting for Adversarial Attacks on Semantic Segmentation

• URL: http://arxiv.org/abs/2605.03405v1
• Date: Tue, 05 May 2026 06:23:48 GMT
• Title: TsallisPGD: Adaptive Gradient Weighting for Adversarial Attacks on Semantic Segmentation
• Abstract summary: We introduce TsallisPGD, an adversarial attack built on the Tsallis cross-entropy.<n>By varying $q$, we steer the attack toward pixels at different confidence levels.<n>We show that TsallisPGD, using a single validation-selected schedule, achieves the best average attack rank across all evaluated settings.
• Score: 47.03503222912705
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Attacking semantic segmentation models is significantly harder than image classification models because an attacker must flip thousands of pixel predictions simultaneously. Standard pixel-wise cross-entropy (CE) is ill-suited to this setting: it tends to overemphasize already-misclassified pixels, which slows optimization and overstates model robustness. To address these issues, we introduce TsallisPGD, an adversarial attack built on the Tsallis cross-entropy, a generalization of CE parameterized by $q$, which adaptively reshapes the gradient landscape by controlling gradient concentration across pixels. By varying $q$, we steer the attack toward pixels at different confidence levels. We first show that no single fixed-$q$ is universally optimal, as its effectiveness depends on the dataset, model architecture, and perturbation budget. Motivated by this, we propose a dynamic $q$-schedule that sweeps $q$ during optimization. Extensive experiments on Cityscapes, Pascal VOC, and ADE20K show that TsallisPGD, using a single validation-selected schedule, achieves the best average attack rank across all evaluated settings and improves over CEPGD, SegPGD, CosPGD, JSPGD, and MaskedPGD in reducing accuracy and mIoU on both standard and robust models.

Related papers

• Latent Transfer Attack: Adversarial Examples via Generative Latent Spaces [36.919974069544146]
  Adrial attacks are a central tool for probing the robustness of modern vision models.<n>Most methods optimize perturbations directly in pixel space under $ell_infty$ or $ell$ constraints.<n>We propose $textbfLTA$ ($textbfL$atent $textbfT$ransfer $textbfA$ttack), a transfer-based attack that instead optimize perturbations in the latent space of a pretrained Stable Diffusion VAE.
  arXiv  Detail & Related papers  (2026-03-06T14:14:28Z)
• C$^2$GSPG: Confidence-calibrated Group Sequence Policy Gradient towards Self-aware Reasoning [54.705168477975384]
  Group Sequence Policy Gradient (GSPG) framework for learning reasoning models.<n>C$2$GSPG simultaneously enhances reasoning performance while suppressing overconfidence.
  arXiv  Detail & Related papers  (2025-09-27T05:24:51Z)
• HyperTTA: Test-Time Adaptation for Hyperspectral Image Classification under Distribution Shifts [28.21559601586271]
  HyperTTA (Test-Time Adaptable Transformer for Hyperspectral Degradation) is a unified framework that enhances model robustness under diverse degradation conditions.<n>Test-time adaptation strategy, the Confidence-aware Entropy-minimized LayerNorm Adapter (CELA), dynamically updates only the affine parameters of LayerNorm layers.<n>Experiments on two benchmark datasets demonstrate that HyperTTA outperforms state-of-the-art baselines across a wide range of degradation scenarios.
  arXiv  Detail & Related papers  (2025-09-10T09:31:37Z)
• Pixel-Optimization-Free Patch Attack on Stereo Depth Estimation [37.97727884936262]
  We build a unified framework that extends pixel-optimization attacks to four stereo-matching stages.<n>We propose PatchHunter, the first pixel-optimization-free attack.<n>On KITTI, PatchHunter outperforms pixel-level attacks in both effectiveness and black-box transferability.
  arXiv  Detail & Related papers  (2025-06-21T08:23:02Z)
• Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training [61.61368146268329]
  We propose Pixel-reweighted AdveRsarial Training (PART), a new framework that partially reduces $epsilon$ for less influential pixels. Part achieves a notable improvement in accuracy without compromising robustness on CIFAR-10, SVHN and TinyImagenet-200.
  arXiv  Detail & Related papers  (2024-06-02T09:43:34Z)
• Class-Conditioned Transformation for Enhanced Robust Image Classification [19.738635819545554]
  We propose a novel test-time threat model algorithm that enhances Adrial-versa-Trained (AT) models. Our method operates through COnditional image transformation and DIstance-based Prediction (CODIP) The proposed method achieves state-of-the-art results demonstrated through extensive experiments on various models, AT methods, datasets, and attack types.
  arXiv  Detail & Related papers  (2023-03-27T17:28:20Z)
• CosPGD: an efficient white-box adversarial attack for pixel-wise prediction tasks [16.10247754923311]
  Adversarial attacks such as the seminal projected gradient descent (PGD) offer an effective means to evaluate a model's robustness. We propose CosPGD, an attack that encourages more balanced errors over the entire image domain while increasing the attack's overall efficiency.
  arXiv  Detail & Related papers  (2023-02-04T17:59:30Z)
• Alternating Objectives Generates Stronger PGD-Based Adversarial Attacks [78.2700757742992]
  Projected Gradient Descent (PGD) is one of the most effective and conceptually simple algorithms to generate such adversaries. We experimentally verify this assertion on a synthetic-data example and by evaluating our proposed method across 25 different $ell_infty$-robust models and 3 datasets. Our strongest adversarial attack outperforms all of the white-box components of AutoAttack ensemble.
  arXiv  Detail & Related papers  (2022-12-15T17:44:31Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Patch-wise++ Perturbation for Adversarial Targeted Attacks [132.58673733817838]
  We propose a patch-wise iterative method (PIM) aimed at crafting adversarial examples with high transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $epsilon$-constraint is properly assigned to its surrounding regions. Compared with the current state-of-the-art attack methods, we significantly improve the success rate by 35.9% for defense models and 32.7% for normally trained models.
  arXiv  Detail & Related papers  (2020-12-31T08:40:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.