IGME: Efficient Chained Method Ensemble for Transferable Semantic Segmentation Attacks

2026-07-29

AI Summary

This work addresses the high computational cost and deployment challenges of existing transferable adversarial attack methods, which typically rely on ensembles of multiple surrogate models. To overcome these limitations, the authors propose IGME, an efficient single-source-model attack method that, for the first time, integrates a chain composition of differentiable attack components with path-averaged gradient directions. This design enables shared gradient computation while enhancing update stability, eliminating the need for multi-model ensembles. IGME is applicable to both CNN- and Transformer-based semantic segmentation architectures. Experimental results on Pascal VOC and Cityscapes demonstrate that IGME achieves superior transferability while significantly outperforming current ensemble-based approaches in terms of computational efficiency.

Abstract

Semantic segmentation models are vulnerable to transferable adversarial perturbations, yet evaluating transfer attacks on dense prediction models can be computationally expensive. Existing ensemble attacks often rely on multiple surrogate models, increasing the computation cost, even harder for segmentation. This paper studies an efficient single-source alternative for transferable attacks on semantic segmentation. We formulate transferable attack composition as a chained computation over differentiable attack components, allowing the expensive source-model gradient computation to be shared. To reduce the update instability introduced by chained composition, we further use an integrated-gradient-style path-averaged direction as an empirical stabilization heuristic. Experiments on Pascal VOC and Cityscapes evaluate the resulting transferability efficiency trade-off across CNN- and transformer-based segmentation models. IGME achieves competitive transferability compared with single-source baselines and favorable runtime compared with model-ensemble attacks, while requiring access to only one source model.

Problem

• transferable adversarial attacks
• semantic segmentation
• efficient attack
• model ensemble
• dense prediction

Innovation

• transferable adversarial attack
• semantic segmentation
• chained method ensemble
• gradient sharing
• path-averaged direction