Research map / Adversarial robustness and security / Attacks on text and graphs
Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdvRM, an adversarial patch attack on monocular depth estimation that places style-transferred patches disguised as road markings on the road (rather than on obstacles), exploiting the finding that MDE models are road-dependent.
Problem
Existing adversarial patch attacks on monocular depth estimation (MDE) are tied to specific obstacles, limiting their impact and stability in multi-obstacle, dynamic traffic scenes.
Approach
Decouple the adversarial patch from obstacles by placing an optimized patch on the road between the victim vehicle and any obstacle; saliency analysis shows MDE depth predictions for obstacles depend on road regions. The patch is style-transferred to look like an ordinary road marking and optimized with an EP/LEP-weighted depth-increase loss plus a stealthiness loss.
Key results
- AdvRM achieves an average MRSR of 1.507 over 8 MDE models, implying a 12 m obstacle is predicted at about 30 m.
- Compared with the obstacle-dependent attack of Cheng et al., AdvRM gets MRSR 1.868 vs 1.019 on a single car and 2.417 vs 0.136 with three pedestrians.
- In physical scaled-down tests with Mono2, the printed patch achieves an average MRSR of 1.088 across frames.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use an adversarial patch on the road rather than an obstacle-attached patch | AdvRM vs. [1] · Single car and three-pedestrian scenarios | MRSR (ξr): 1.019 -> 1.868; 0.136 -> 2.417 | Helped |
| Use an adversarial patch on the road rather than an obstacle-attached patch | AdvRM vs. [1] · Single car and three-pedestrian scenarios | Affect Region Ratio (ξa): 0.887 -> 0.969; 0.168 -> 0.958 | Helped |
| Add EoT brightness, contrast, saturation transformations | AdvRM · Dataset simulation across MDE models | MRSR (ξr) | Helped |
| Add random pixel masking during optimization to simulate patch occlusion | AdvRM · Occlusion by leaves and plastic bags | MRSR (ξr) | Helped |
| Generate the patch using one obstacle category and test on different categories | AdvRM · Cross-obstacle transfer | MRSR (ξr) | Helped |
| Generate patches on a surrogate model for use on unknown victim models | AdvRM · Cross-model transfer | MRSR (ξr): 0.009, 0.011, 0.011, 0.006; -0.023, -0.014, -0.018, -0.023; -0.067, -0.064, -0.046, -0.041 | Hurt |
| Add model ensemble when generating the patch (ablation) | AdvRM · Cross-model transfer | MRSR (ξr): 0.009 -> 0.011; -0.023 -> -0.014; -0.067 -> -0.064 | No clear effect |
| Skip gradients during patch optimization (ablation) | AdvRM · Cross-model transfer | MRSR (ξr): 0.009 -> 0.011; -0.023 -> -0.018; -0.067 -> -0.046 | No clear effect |
| Add gradient regularization during patch optimization (ablation) | AdvRM · Cross-model transfer | MRSR (ξr): 0.009 -> 0.006; -0.023 -> -0.023; -0.067 -> -0.041 | No clear effect |
| Move the patch above the obstacle rather than placing it on the road (ablation) | AdvRM · PE, CA, and RO; Mono2 | MRSR (ξr): 2.431 -> 0.272; 1.868 -> 0.411; 3.157 -> 0.513 | Hurt |
| Move the patch beside the obstacle rather than placing it on the road (ablation) | AdvRM · PE, CA, and RO; Mono2 | MRSR (ξr): 2.431 -> 0.214; 1.868 -> 0.292; 3.157 -> 0.433 | Hurt |
| Raise the ARR threshold η0 (ablation) | AdvRM · Obstacle depth attack | Affect Region Ratio (ARR): 0.976, 0.974, 0.965, 0.951, 0.887 | Hurt |
Surprising findings
- Patch transfer across MDE models is negligible (Table 4 ξr near 0) even with ensemble and gradient-based transferability methods.
- Patches placed on top of or to the right of an obstacle are much less effective than road patches (e.g., PE 0.272 and 0.214 vs 2.431 on Mono2).
Limitations
- Limited to white-box scenarios; transferability across MDE models is not achieved.
- Only applicable to road scenes; unclear whether indoor MDE models show road dependency.
- Real-world evaluation uses a scaled-down printed setup rather than full-scale driving tests.
Experimental setup
Datasets: KITTI Google Images obstacle collection
Benchmarks: KITTI-based synthesized scenes real-world printed-scale physical test
Metrics: Mean Relative Shift Ratio (MRSR) Affect Region Ratio (ARR)
Baselines: Cheng et al. (2023) obstacle-dependent patch attack
Builds on: Cheng et al. adversarial patch attack on MDE deep photo style transfer BIM expectation over transformation
Closest papers by meaning
- Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving (CVPR 2024 · similarity 0.91)
- DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches (NeurIPS 2025 · similarity 0.90)
- BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Tasks (ICML 2024 · similarity 0.87)
- STViT: Improving Self-Supervised Multi-Camera Depth Estimation with Spatial-Temporal Context and Adversarial Geometry Regularization (Student Abstract) (AAAI 2024 · similarity 0.84)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.84)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.