Research map / Adversarial robustness and security / Attacks on text and graphs
DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DepthVanish, an adversarial patch attack that co-optimizes a repeated texture element and its interval (grid) structure to make stereo depth estimators predict patches as far away, working digitally and physically against RAFT-Stereo, STTR, and an Intel RealSense D435i.
Problem
Naively repeated adversarial textures from digital stereo attacks fail when deployed as physical patches, limiting stress-testing of stereo depth estimation systems used in safety-critical settings.
Approach
Adding regular interval spacing among repeated texture elements forms a grid structure that substantially amplifies matching ambiguity and digital-to-physical transferability; DepthVanish jointly optimizes the interval structure and texture within the repeated element using rMSE plus entropy and total-variation regularizers.
Key results
- On KITTI-scene, DepthVanish reaches D1 of 89.31 on RAFT-Stereo and 92.38 on STTR, versus 40.09 and 5.23 for the grid-based patch and 5.79 and 4.58 for Stereoscopic Patch.
- Naively repeated patches leave predicted depth near ground truth (7.1 m vs 7 m), while grid intervals push predictions beyond 40 m at a 23 m ground truth.
- Physical patches printed on A3 paper consistently shift the board region to predicted far depth on stereo models, and the patch also disrupts the Intel RealSense D435i across rotations.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace naive texture repetition with regular grid intervals | stereo adversarial patches · RAFT-Stereo, KITTI-scene | D1 | Helped |
| jointly optimize the interval structure and texture instead of optimizing texture with fixed grid intervals | stereo adversarial patches · KITTI-scene, DeepPruner | D1: 55.39_{\pm 10.77} -> 97.07_{\pm 12.42} | Helped |
| add regular horizontal and vertical intervals (grid spacing) | repeated-texture patches · RAFT-Stereo, KITTI-scene | predicted depth: 7.1~m -> 14.1~m | Helped |
| use grid intervals rather than horizontal or vertical intervals alone | repeated-texture patches · RAFT-Stereo, patch rotation | attack robustness | Helped |
| remove entropy regularization (set alpha=0) (ablation) | DepthVanish · KITTI | attack performance | Hurt |
| reduce the total variation weight below 9 (ablation) | DepthVanish · KITTI | attack performance | Hurt |
| optimize texture with fixed grid intervals rather than jointly optimizing texture and interval structure (ablation) | DepthVanish · KITTI-scene, STTR | D1: 92.38_{\pm 8.76} -> 5.23_{\pm 7.49} | Hurt |
Surprising findings
- Naively repeated textures from prior digital stereo attacks barely change predicted depth when deployed as patches.
- Patches optimized against PSMNet transfer to other stereo models, which the authors attribute to the interval structure.
Limitations
- Not evaluated against robustified models or defenses, so practical effectiveness may be overestimated.
- Physical degradation relative to digital results, attributed to lighting and manual stereo capture with a phone.
- Limited range of stereo architectures tested; no guarantee of generality.
Experimental setup
Datasets: KITTI scene flow DrivingStereo
Benchmarks: KITTI scene flow DrivingStereo
Metrics: D1-error EPE
Baselines: Stereoscopic Patch Stereopagnosia Patch Grid-based Patch
Builds on: Stereoscopic universal perturbations Stereopagnosia
Closest papers by meaning
- Beware of Road Markings: A New Adversarial Patch Attack to Monocular Depth Estimation (NeurIPS 2024 · similarity 0.90)
- Physical 3D Adversarial Attacks against Monocular Depth Estimation in Autonomous Driving (CVPR 2024 · similarity 0.90)
- BadPart: Unified Black-box Adversarial Patch Attacks against Pixel-wise Regression Tasks (ICML 2024 · similarity 0.87)
- Stereo Risk: A Continuous Modeling Approach to Stereo Matching (ICML 2024 · similarity 0.86)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.85)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.