Research map / Adversarial robustness and security / Black-box and transfer attacks

BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Tasks

ICML 2024 · Adversarial robustness and security › Black-box and transfer attacks · approach: Robustness benchmarks and defenses · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BadPart, a query-based black-box universal adversarial patch attack that uses square-based patch optimization with probabilistic square sampling and score-based gradient estimation to degrade monocular depth and optical flow estimation models.

Problem

Adversarial robustness of pixel-wise regression models (monocular depth estimation and optical flow estimation) under query-based black-box patch attacks, where high input resolution makes prior black-box patch attacks unscalable.

Approach

Optimize a patch by iteratively selecting small square sub-areas, sampling their locations probabilistically from the pixel-wise error map, and estimating square-level gradients from scored random ±epsilon noise batches, with adaptive score scaling and an epsilon decay schedule.

Key results

• On 2% patches, BadPart achieves e.g. 89.75 DEE on Monodepth2 and 32.42 EPE on FlowNet2, outperforming GenAttack, HardBeat and Patch-RS across 7 models and three patch sizes.
• Against the Google portrait depth API with 50K queries and a 31x31 patch, mean estimated depth of the patched area drops by 43.5% (0.431 to 0.243 cm).
• Blacklight query-based defense shows 0% detection rate up to 800K queries while attack error keeps increasing.

Measured effects reported in the paper

Surprising findings

• Attack error for regression models grows continuously with queries, so even low query budgets (e.g., 30K) cause noticeable error.
• Local Gradient Smoothing defense degrades benign predictions, with ~23% average relative error on clean images.

Limitations

• Only digital-space attacks; physical-world attacks not explored.
• Patch visibility limits stealthiness for privacy use cases.
• Relies on attacking a large number of queries (up to 1000K) for best results.

Experimental setup

Datasets: KITTI depth prediction KITTI flow 2015 nuScenes

Benchmarks: KITTI depth prediction KITTI flow 2015 nuScenes

Metrics: depth estimation error (meters) end point error (pixels) detection rate

Baselines: GenAttack HardBeat Patch-RS white-box attack HPA Adv-watermark Blacklight

Builds on: SquareAttack GenAttack HardBeat Patch-RS

Closest papers by meaning

• DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches (NeurIPS 2025 · similarity 0.87)
• Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.87)
• BRUSLEATTACK: A QUERY-EFFICIENT SCORE- BASED BLACK-BOX SPARSE ADVERSARIAL ATTACK (ICLR 2024 · similarity 0.86)
• PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.85)
• CosPGD: an efficient white-box adversarial attack for pixel-wise prediction tasks (ICML 2024 · similarity 0.85)
• DeSparsify: Adversarial Attack Against Token Sparsification Mechanisms (NeurIPS 2024 · similarity 0.84)