Research map / Continual learning / Class-incremental
Attacks on Continual Semantic Segmentation by Perturbing Incremental Samples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CS-Attack, an offline adversarial perturbation generator that corrupts incremental training samples in continual semantic segmentation by shifting old-model predictions toward background and disordering predictions on new-class regions.
Problem
Continual semantic segmentation (CSS) models are vulnerable to attacks: third-party incremental samples can be perturbed to make the model forget old classes and fail to learn new ones, a security risk overlooked by CSS methods.
Approach
Train a separate perturbation generator offline using only the previous-step model's predictions and current-step data, with a class-shift loss that pushes old-model predictions to background and a KL-based disorder loss on new-class regions, plus an L2 constraint; the perturbed data is then used for ordinary incremental training without knowing the CSS method.
Key results
- On Pascal VOC2012 15-5 (2 tasks), CS-Attack reduces PLOP's overall mIoU from 68.12 to 53.74.
- On Pascal VOC2012 15-5s (6 tasks), CS-Attack reduces PLOP from 50.11 to 28.62 overall mIoU.
- On ADE20k 100-50, CS-Attack reduces RCIL overall mIoU from 33.82 to 23.04 and PLOP from 33.12 to 20.04; Gaussian noise yields negligible change.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train PLOP with CS-Attack adversarial incremental samples | PLOP · Pascal VOC2012, 15-5s | all-class mIoU: 50.11 -> 28.62 | Hurt |
| Train PLOP with CS-Attack adversarial incremental samples | PLOP · Cityscapes, 1-1s | all-class mIoU: 45.14 -> 17.59 | Hurt |
| Train PLOP with CS-Attack adversarial incremental samples | PLOP · ADE20k, 50-50 | all-class mIoU: 30.13 -> 16.31 | Hurt |
| Train PLOP with Gaussian noise on incremental samples | PLOP · Pascal VOC2012, 15-5 | all-class mIoU: 68.12 -> 67.70 | No clear effect |
| Add Ld to the attack objective without Lcs (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5 | all-class mIoU: 67.70 -> 63.08 | Hurt |
| Add Lcs to Ld in the attack objective (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5 | all-class mIoU: 63.08 -> 53.74 | Hurt |
| Attack every incremental step instead of one step (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 28.62 (-26.06) | Hurt |
| Attack incremental step S1 only (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 37.00 | Hurt |
| Attack incremental step S2 only (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 38.62 | Hurt |
| Attack incremental step S3 only (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 35.67 | Hurt |
| Attack incremental step S4 only (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 36.35 | Hurt |
| Attack incremental step S5 only (ablation) | PLOP + CS-Attack · Pascal VOC2012, 15-5s | all-class mIoU: 54.68 -> 37.14 | Hurt |
Surprising findings
- Adding Gaussian noise to incremental samples has little effect on CSS methods, suggesting they are robust to random perturbations but not to targeted ones.
- Attacking only a single incremental step is nearly as damaging as attacking all steps, since corrupted knowledge is not recovered in later increments.
Limitations
- Evaluated only on DeepLabv3-based CSS methods and three datasets.
- The attack requires access to the previous-step model's predictions on the incremental samples.
- Imperceptibility is claimed qualitatively; no quantitative perceptual metric is reported.
Experimental setup
Datasets: Pascal VOC2012 ADE20k Cityscapes
Benchmarks: Pascal VOC2012 ADE20k Cityscapes
Metrics: mIoU
Baselines: ILT MiB PLOP RCIL Gaussian noise (+Noise)
Builds on: MiB PLOP RCIL ILT
Closest papers by meaning
- AAKR: Adversarial Attack-based Knowledge Retention for Continual Semantic Segmentation (AAAI 2025 · similarity 0.88)
- Beyond Background Shift: Rethinking Instance Replay in Continual Semantic Segmentation (CVPR 2025 · similarity 0.86)
- Deconfound Semantic Shift and Incompleteness in Incremental Few-shot Semantic Segmentation (AAAI 2025 · similarity 0.85)
- CoMBO: Conflict Mitigation via Branched Optimization for Class Incremental Segmentation (CVPR 2025 · similarity 0.84)
- Rethinking Query-based Transformer for Continual Image Segmentation (CVPR 2025 · similarity 0.84)
- Adaptive Prototype Replay for Class Incremental Semantic Segmentation (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.