Paper deep dive
SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation
Dongsu Song, DaeYun GO, Boseung Seo, Jay Hoon Jung
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%
Last extracted: 8/16/2026, 3:41:08 AM
Summary
The paper introduces SegPAR, a novel decision-based black-box sparse attack framework for semantic segmentation. It addresses the query inefficiency of existing image-centric methods by adopting a class-centric exploration paradigm using Reinforcement Learning. SegPAR utilizes fixed per-class masks to guide pixel perturbation and introduces a 'discrepancy reward' to mitigate misleading feedback from standard decision rewards, significantly improving sparsity efficiency and MIoU reduction compared to baselines.
Entities (7)
Relation Signals (6)
SegPAR → targets → Semantic Segmentation
confidence 100% · SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation
SegPAR → isa → Black-box Attack
confidence 95% · we propose SegPAR, a novel decision-based framework... black-box sparse attacks
SegPAR → uses → Discrepancy Reward
confidence 95% · we introduce a novel discrepancy reward... Combined with SegPAR, it achieves the strongest black-box performance
SegPAR → improves → Query Efficiency
confidence 90% · SegPAR significantly outperforms black-box baselines in sparsity efficiency
SegPAR → outperforms → RFPAR
confidence 90% · SegPAR significantly outperforms black-box baselines... RFPAR... suffers from severe query inefficiency
RFPAR → suffersfrom → query inefficiency
confidence 90% · RFPAR [29], suffers from severe query inefficiency due to its image-centric pixel accumulation
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Despite the practical relevance of sparse decision-based black-box threats, they have received limited attention in semantic segmentation. To bridge this gap, we adapt the most representative decision-based black-box sparse attacks from the classification domain to serve as baselines, establishing a rigorous benchmark for this underexplored setting. In this context, we demonstrate that one of the existing methods suffers from severe query inefficiency due to its image-centric pixel accumulation, which rapidly exhausts query budgets across the vast image space. To overcome this, we propose SegPAR, a novel decision-based framework that shifts to a class-centric exploration paradigm. Furthermore, to eliminate the misleading feedback generated by standard decision rewards during pixel accumulation, we introduce a novel discrepancy reward. Extensive experiments show that SegPAR significantly outperforms black-box baselines in sparsity efficiency and MIoU reduction, while remaining competitive with white-box sparse attacks. Code is available at \href{this https URL}{this https URL}.
Tags
Links
- Source: https://arxiv.org/abs/2608.11285v1
- Canonical: https://arxiv.org/abs/2608.11285v1
Trouble viewing inline? Open PDF directly →
Full Text
49,213 characters extracted from source content.
Expand or collapse full text
SegPAR: Class-Centric Decision-Based Sparse Attack for Semantic Segmentation Dongsu Song Affiliation: Interdisciplinary Program in Space Systems Engineering, Korea Aerospace University, South Korea Affiliation: Department of Computer Science, Korea Aerospace University, South Korea DaeYun GO Affiliation: Interdisciplinary Program in Space Systems Engineering, Korea Aerospace University, South Korea Affiliation: Department of Artificial Intelligence, Korea Aerospace University, South Korea Boseung Seo Affiliation: Interdisciplinary Program in Space Systems Engineering, Korea Aerospace University, South Korea Affiliation: Department of Artificial Intelligence, Korea Aerospace University, South Korea Jay Hoon Jung🖂 Affiliation: Department of Artificial Intelligence, Korea Aerospace University, South Korea Abstract Despite the practical relevance of sparse decision-based black-box threats, they have received limited attention in semantic segmentation. To bridge this gap, we adapt the most representative decision-based black-box sparse attacks from the classification domain to serve as baselines, establishing a rigorous benchmark for this underexplored setting. In this context, we demonstrate that one of the existing methods suffers from severe query inefficiency due to its image-centric pixel accumulation, which rapidly exhausts query budgets across the vast image space. To overcome this, we propose SegPAR, a novel decision-based framework that shifts to a class-centric exploration paradigm. Furthermore, to eliminate the misleading feedback generated by standard decision rewards during pixel accumulation, we introduce a novel discrepancy reward. Extensive experiments show that SegPAR significantly outperforms black-box baselines in sparsity efficiency and MIoU reduction, while remaining competitive with white-box sparse attacks. Code is available at https://github.com/KAU-QuantumAILab/SegPAR. Keywords: Black-box Sparse Attack Class-centric †footnotetext: 🖂 Corresponding & first authors: jhjung@kau.ac.kr & raister01@kau.kr. Figure 1: Qualitative comparison of sparse adversarial attacks on semantic segmentation models. Our proposed SegPAR induces severe misclassification with significantly lower sparsity compared to the baselines. As shown in the white boxes of the Delta maps, SegPAR maximizes attack efficiency by precisely targeting critical pixels, resulting in fatal semantic disruptions with minimal perturbations. 1 Introduction Deep learning models have achieved remarkable success across domains [1, 33, 21, 5, 31]. However, prior work has shown that these models are susceptible to adversarial attacks, which introduce imperceptible perturbations that cause incorrect outputs [32, 4, 18, 6]. These attacks are generally categorized into white-box and black-box settings based on the adversary’s knowledge [3]. White-box attacks assume access to comprehensive model information, including gradients, architectures, and internal features [22, 37]. Conversely, black-box attacks operate under limited information, relying solely on input-output interactions such as decision labels and confidence scores [10, 28, 8]. Given that black-box scenarios more accurately reflect the constraints of real-world deployments, advancing the study of black-box attacks is of critical importance. Black-box attacks are typically categorized into transfer-based and query-based approaches. Transfer-based attacks craft adversarial perturbations on surrogate models and rely on cross-model transferability, whereas query-based attacks interact with the victim model through iterative perturbations [15, 35]. Query-based attacks are particularly compelling because they are model-agnostic and do not require a representative surrogate. Within this paradigm, sparse attacks that perturb only a small set of pixels have emerged as a challenging yet practically relevant setting [30, 26, 12]. Identifying influential pixels is NP-hard, and the combinatorial search space makes query-efficient optimization especially difficult under realistic query budgets [23, 16]. Importantly, sparse threats can reflect real-world failure sources such as sensor defects (e.g., hot/dead pixels) in object detection pipelines and localized physical perturbations (e.g., stickers on road signs) that mislead autonomous driving systems [24, 2, 39, 29]. Despite the practical relevance of sparse decision-based black-box threats, they have received limited attention in semantic segmentation, where the search space scales with dense, multi-class outputs [14]. While decision-based black-box attacks for semantic segmentation have recently begun to be explored [9], they largely focus on dense ℓp _p-bounded perturbations and do not address explicit pixel-level sparsity. To bridge this gap, we adapt the most representative decision-based black-box sparse attacks from the classification domain to serve as baselines, establishing a rigorous benchmark for this underexplored setting. In this context, we demonstrate the existing method, RFPAR [29], suffers from severe query inefficiency when applied to segmentation, as its image-centric pixel accumulation tends to concentrate queries on a few easy-to-exploit regions, failing to cover heterogeneous vulnerabilities across multiple semantic classes, thereby wasting the limited query budget. To overcome this, we propose Segmentation Pixel Attack using RL (SegPAR), a novel decision-based framework that shifts to a class-centric exploration paradigm. Furthermore, to eliminate the misleading feedback generated by standard decision rewards during pixel accumulation, we introduce a novel discrepancy reward. Extensive experiments show that SegPAR significantly outperforms black-box baselines in sparsity efficiency and MIoU reduction, as shown in Fig. 1, while remaining competitive with white-box attacks. In summary, our contributions are: • To the best of our knowledge, this work is the first systematic study of decision-based black-box sparse attacks for semantic segmentation. • We propose SegPAR, a decision-based black-box sparse attack for semantic segmentation that improves query efficiency via class-centric exploration. • We introduce a discrepancy reward that mitigates the unreliable signals of standard decision rewards during pixel accumulation. Combined with SegPAR, it achieves the strongest black-box performance and is competitive with white-box sparse baselines under the same sparsity constraints. 2 Preliminaries In our semantic segmentation attack setting, let ∈0,…,255C×H×W x∈\0,…,255\^C× H× W be an input image and f(⋅)f(·) be a victim model outputting a predicted label map ∈0,…,K−1H×W y∈\0,…,K-1\^H× W, where H, W, and K denote the height, width, and number of classes, respectively. Our goal is to degrade the model’s MIoU by perturbing only a small number of pixels under a limited query budget. Directly optimizing MIoU in a black-box setting is challenging since it is a non-smooth, set-based metric. Therefore, we propose an effective proxy: maximizing the fraction of misclassified pixels under a sparsity constraint. The problem is formulated as: max1WH∑i=0H−1∑j=0W−1[f(^)i,j≠f()i,j],s.t.∥0=∥^−∥0≤ϵ, _ δ\;\; 1WH _i=0^H-1 _j=0^W-1I\! [f( x)_i,j≠ f( x)_i,j ], .t. \| δ\|_0=\| x- x\|_0≤ε, (1) where x is the modified image, ∥⋅∥0\|·\|_0 is defined as the number of modified pixels, and I is the indicator function. Under our decision-based black-box setting, the optimization relies strictly on label queries, while ground-truth annotations are reserved exclusively for final evaluation. 3 Related Works 3.1 Decision-based Sparse Attack Decision-based sparse attacks seek sparse perturbations while maximizing attack success using only the model’s final hard-label decisions. Representative methods in this category include Pointwise [27] and SparseEvo [34]. Pointwise [27], a decision-based sparse attack, minimizes perturbed pixels by initially inducing misclassification and using a greedy search to revert pixels. To reduce its search space complexity, SparseEvo [34] optimizes a binary vector of perturbed locations via an evolutionary algorithm. Since both require an initial successful attack, adapting them to semantic segmentation necessitates redefining “attack success” using the Success Ratio (SR). The SR is defined as: SR(x,x^)=1WH∑i=0H−1∑j=0W−1[f(x^)i,j≠f(x)i,j].SR(x, x)= 1WH _i=0^H-1 _j=0^W-1I\! [f( x)_i,j≠ f(x)_i,j ]. Perturbations are removed only if the attack succeeds (SR≥τSR≥τ). Figure 2: SegPAR Framework. At initialization, SegPAR extracts fixed per-class masks Mk\M^k\ from the initial prediction y(0)y^(0) and keeps them throughout the episode. At each step t, class-wise inputs are constructed by cropping the current image, xc(t)=Crop(x(t),bk)x_c^(t)=Crop(x^(t),b^k), where bkb^k is the crop box for class k. Conditioned on the class and cropped input, the RL agent outputs sparse pixel perturbations to generate x^(t) x^(t), which is then queried on the victim model f. The discrepancy mask is computed against the initial prediction as d(t)=[f(x^(t))≠y(0)]d^(t)=1[f( x^(t))≠ y^(0)]. The class-wise discrepancy reward is defined within each fixed class mask, Rdk∝∑i,jMi,jk(di,j(t)−di,j(t−1))R_d^k _i,jM_i,j^k (d_i,j^(t)-d_i,j^(t-1) ). During training, SegPAR stores the best perturbation, discrepancy mask, and reward in memory; after convergence, it updates x(t+1)←x∗x^(t+1)← x^* and d(t+1)←d∗d^(t+1)← d^*. 3.2 Score-based Sparse Attack Score-based sparse attacks seek sparse perturbations while maximizing attack success using only scores. While OnePixel [30] utilizes Differential Evolution for single-pixel manipulation, subsequent approaches adopt iterative accumulation strategies. Specifically, Sparse-RS [12] employs Random Search to progressively update and accumulate perturbations, and Pixle [26] minimizes loss by iteratively rearranging neighboring pixel patches. Notably, RFPAR [29] employs reinforcement learning. In RFPAR, an agent iteratively explores candidates x x, storing the best reward and attack parameters in memory. Upon convergence—when reward improvement stalls—the agent reinitializes and proceeds to the next step. We adapt this framework for a stricter decision-based black-box setting in semantic segmentation by eliminating the score component. Relying exclusively on decision rewards, we evaluate the candidate x x using the standard reward: Rs(x(t),x^(t))=1o2⋅‖x^(t)−x(t)‖0∑i=0H−1∑j=0W−1[f(x^(t))i,j≠f(x(t))i,j],R_s(x^(t), x^(t))= 1o^2·\| x^(t)-x^(t)\|_0 _i=0^H-1 _j=0^W-1I\! [f( x^(t))_i,j≠ f(x^(t))_i,j ], where o=5o=5 is a scaling factor, and x(t)x^(t) denotes the input image at the current step t. 3.3 White-box Sparse Attack White-box sparse attacks leverage model gradients to achieve misclassification under a sparsity constraint. Early methods such as JSMA[25], CW-l0l_0[6], and SparseFool[23] focused on inducing sparsity through direct optimization or surrogate l1l_1 norms. While PGD0[13] extends Projected Gradient Descent to the l0l_0 space, it is prone to local optima due to the non-convex nature of the l0l_0 constraint. To mitigate this, sPGD[43] was introduced, which decomposes the perturbation δ into a magnitude tensor p and a location mask. By employing continuous surrogate variables and top-k projection, sPGD overcomes the non-differentiability of the l0l_0 norm. To further boost optimization, sPGD updates p using both the projected gradient restricted by the mask and the unprojected gradient that ignores the mask. 4 Method In this section, we present the overall framework of SegPAR, illustrated in Fig. 2. SegPAR reformulates RFPAR [29] into a class-wise attack paradigm tailored for semantic segmentation. We then analyze the limitations of the conventional pixel-accumulation reward and propose the discrepancy reward to address these issues and improve attack performance. 4.1 SegPAR Insight. Deep neural networks partition the input space into complex decision regions, which in ReLU-based networks can be locally viewed as piece-wise linear boundary facets [19]. Regardless of the exact boundary geometry, semantic segmentation requires predictions at every pixel. Thus, an attack must induce label flips by crossing a collection of heterogeneous, pixel- and class-specific boundaries, rather than a single global boundary. Consequently, an image-centric exploration strategy can quickly concentrate queries on a few high-reward (often large or easily perturbed) regions, repeatedly probing similar areas while leaving other class-specific vulnerabilities under-explored. We therefore adopt a class-centric exploration strategy that conditions the RL agent on each class present in the image, encouraging perturbations to be distributed across diverse regions and improving the efficiency of reaching relevant decision boundaries. Class-wise Input. To address this issue, we shift the original RFPAR paradigm, which generates an action from the entire image as the state, to a class-wise paradigm that uses a per-class state representation. Given an original image x, we first query the victim model to obtain its prediction. From f()f( x), we construct and fix a set of class-wise binary masks ℳ=Mkk∈M=\M^k\_k , where Mk∈0,1H×WM^k∈\0,1\^H× W indicates the predicted pixels belonging to class k and K is defined as the set of classes that appear in the prediction for the given image: Mi,jk=[f()i,j=k],∀(i,j)∈0,…,H−1×0,…,W−1.M^k_i,j=I\! [f( x)_i,j=k ], ∀(i,j)∈\0,…,H-1\×\0,…,W-1\. (2) For each mask MkM^k, we define a bounding-box function B(⋅):Mk→ℕ4,B(·):M^k ^4, which returns the tightest axis-aligned bounding box that encloses the foreground pixels of the mask. Specifically, the bounding box for class k is bk=B(Mk)=(imink,jmink,imaxk,jmaxk)b^k=B(M^k)= (i^k_ ,\,j^k_ ,\,i^k_ ,\,j^k_ ), where i and j denote the vertical and horizontal image coordinates, respectively. Using bkb^k, we extract a class-specific crop from the original image and use it as the agent state k=Crop(,bk). x_k=Crop\! ( x,\,b^k ). In summary, instead of using the full image x as the state, the agent policy πϕ _φ operates on a per-class state xkx_k constructed from the model’s predicted region for class k. Class-wise Action. As we convert the agent state into a class-specific region, the action space must be redesigned accordingly. RFPAR samples coordinates from a Gaussian distribution, which implicitly assumes a rectangular target region. However, class-wise masks are typically irregular; applying the same strategy can induce undesired behavior. In particular, a bounding box often includes pixels from other classes, so perturbing and evaluating rewards over the entire box can contaminate the signal with non-target effects, destabilizing policy learning for the target class k. To resolve this issue, we propose a mask-based sampling strategy: instead of sampling coordinates from a Gaussian, the agent predicts a probability map over candidate attack locations and samples from the induced distribution. Specifically, given the state k x_k, the agent produces a 4-channel score map k∈ℝ4×hk×wk S_k ^4× h_k× w_k, where hk=imaxk−imink+1h_k=i^k_ -i^k_ +1 and wk=jmaxk−jmink+1w_k=j^k_ -j^k_ +1. Let k=Crop(Mk,bk) m^k=Crop(M^k,b^k) be the class mask cropped to the same region as k x_k. Using the first channel k0 S_k^0 as spatial logits, we define a masked softmax distribution over locations: k=Softmax(k0+(1−k)⋅(−109)), P_k=Softmax\! ( S_k^0+(1- m^k)·(-10^9) ), (3) where the softmax is taken over all N=hkwkN=h_kw_k spatial indices. This assigns zero probability to masked-out pixels, confining the search space to the actual class region regardless of the bounding box size. Let k=vec(k)∈[0,1]N p_k=vec( P_k)∈[0,1]^N. We sample n locations without replacement as in our implementation. Let ℐ=I1,…,In∼MultinomialNR(k,n)I=\I_1,…,I_n\ ( p_k;n) denote weighted sampling of n indices without replacement. Each sampled index IlI_l is converted to 2D coordinates by jl=(Ilmodwk)+jminkj_l=(I_l w_k)+j^k_ , il=⌊Il/wk⌋+iminki_l= I_l/w_k +i^k_ . For the RGB decision, we use the remaining three channels as logits. Let kc∈ℝhk×wk S_k^c ^h_k× w_k be the c-th RGB logit map for c∈1,2,3c∈\1,2,3\, and denote its vectorization by c=vec(kc) s^c=vec( S_k^c). Conditioned on each sampled location IlI_l, we independently sample Bernoulli variables zl,c∼Bernoulli(Sigmoid(sIlc))z_l,c (Sigmoid(s^c_I_l)) for each channel c∈1,2,3c∈\1,2,3\, where Sigmoid(⋅)Sigmoid(·) is the sigmoid function. Finally, the sampled action set for class k is k≜((il,jl),zl,1,zl,2,zl,3)l=1n a_k \ ((i_l,j_l),\,z_l,1,z_l,2,z_l,3 ) \_l=1^n. To synthesize x, we apply these actions to x by mapping the binary decisions to the 0,255\0,255\ color space, consistent with the baseline: x^il,jl,c=255⋅zl,c. x_i_l,j_l,c=255· z_l,c. Once x is synthesized, we obtain the victim prediction f(^)f( x). When training the agent with RsR_s at step t, the class-specific reward (Rs)k(R_s)_k for each class k is defined as (Rs(x(t),x^(t)))k=1o2⋅n∑i=0H−1∑j=0W−1Mi,jk⋅[f(x^(t))i,j≠f(x(t))i,j],(R_s(x^(t), x^(t)))_k= 1o^2· n _i=0^H-1 _j=0^W-1M_i,j^k·I\! [f( x^(t))_i,j≠ f(x^(t))_i,j ], (4) thereby isolating the feedback and avoiding contamination from non-target classes. The agent is subsequently trained in a batched manner by optimizing the policy with respect to the rewards (Rs(x(t),x^(t)))kk∈\(R_s(x^(t), x^(t)))_k\_k . 4.2 Discrepancy Reward Standard Reward Inefficiency. Figure 3: Comparison of the standard reward and the discrepancy reward. We analyze the inherent limitations of the standard reward function in the context of cumulative attack frameworks. Specifically, we investigate the inefficiencies that arise in tasks involving multiple target instances, such as object detection and semantic segmentation, where the agent must handle a significantly larger set of target pixels. Let yi,j(t)=f(x(t))i,jy_i,j^(t)=f(x^(t))_i,j be the prediction of the model for a pixel at spatial coordinate (i,j)(i,j) at step t, and let yi,j(0)=f(x(0))i,jy_i,j^(0)=f(x^(0))_i,j denote the original prediction class of that pixel. In cumulative attack frameworks, relying only on the prediction transition (yi,j(t)≠y^i,j(t)y_i,j^(t)≠ y_i,j^(t), where y^i,j(t)=f(x^(t))i,j y_i,j^(t)=f( x^(t))_i,j) severely misaligns the agent’s optimization direction. To mathematically demonstrate this, we decompose the pixel-wise state transitions at step t into four mutually exclusive subsets, leading to the t+1t+1 state: • Case 1 (Maintained Misclassification): Pixels where a successful untargeted attack is stably maintained. maintain(t)=(i,j)∣yi,j(t)≠yi,j(0)∧y^i,j(t)=yi,j(t)S_maintain^(t)= \(i,j) y_i,j^(t)≠ y_i,j^(0) y_i,j^(t)=y_i,j^(t) \ (5) • Case 2 (Reversion Failure): Pixels where the accumulated noise interferes with a previously successful attack, reverting the prediction back to the original class. revert(t)=(i,j)∣yi,j(t)≠yi,j(0)∧y^i,j(t)=yi,j(0)S_revert^(t)= \(i,j) y_i,j^(t)≠ y_i,j^(0) y_i,j^(t)=y_i,j^(0) \ (6) • Case 3 (New Misclassification): Pixels that are newly and successfully deviated from the original class. new(t)=(i,j)∣yi,j(t)=yi,j(0)∧y^i,j(t)≠yi,j(0)S_new^(t)= \(i,j) y_i,j^(t)=y_i,j^(0) y_i,j^(t)≠ y_i,j^(0) \ (7) • Case 4 (Unstable Fluctuation): Pixels that remain misclassified but fluctuate to a different incorrect class, indicating wasted perturbations. fluctuate(t)=(i,j)∣yi,j(t)≠yi,j(0)∧y^i,j(t)≠yi,j(0)∧yi,j(t)≠y^i,j(t)S_fluctuate^(t)= \(i,j) y_i,j^(t)≠ y_i,j^(0) y_i,j^(t)≠ y_i,j^(0) y_i,j^(t)≠ y_i,j^(t) \ (8) Applying RsR_s to these subsets reveals critical optimization flaws. Since RsR_s is a transition-based reward, it functionally depends on the number of pixels whose predictions change between steps, i.e., Rs(x(t),x^(t))∝∑i,j[yi,j(t)≠y^i,j(t)]=|revert(t)|+|new(t)|+|fluctuate(t)|.R_s(x^(t), x^(t)) _i,jI\! [y_i,j^(t)≠ y_i,j^(t) ]= |S_revert^(t) |+ |S_new^(t) |+ |S_fluctuate^(t) |. (9) Therefore, the agent receives positive reinforcement not only for desirable transitions in new(t)S_new^(t) but also for undesirable ones in revert(t)S_revert^(t) and fluctuate(t)S_fluctuate^(t). In particular, when a previously misclassified pixel reverts to the original class (revert(t)S_revert^(t)) or oscillates among incorrect classes (fluctuate(t)S_fluctuate^(t)), RsR_s still assigns a positive reward despite reducing the cumulative attack objective. This misleading feedback biases the agent toward suboptimal regions, increasing query complexity and causing redundant pixel perturbations. Discrepancy Mask-based Reward Function. To overcome the limitations of the naive approach, we introduce a Discrepancy Mask, denoted as d(t)d^(t), to evaluate the attack success state at step t relative to the initial prediction. For each pixel (i,j)(i,j), di,j(t)d_i,j^(t) is defined as a binary indicator of attack success: di,j(t)=(yi,j(t)≠yi,j(0)).d_i,j^(t)=I(y_i,j^(t)≠ y_i,j^(0)). Based on this mask, we formulate our proposed reward function, (Rd(x(t),x^(t)))k(R_d(x^(t), x^(t)))_k, as between the current discrepancy mask and the candidate discrepancy mask at step t: (Rd(x(t),x^(t)))k=1o2⋅n∑i,jMi,jk⋅(d^i,j(t)−di,j(t)).(R_d(x^(t), x^(t)))_k= 1o^2· n _i,jM_i,j^k·( d_i,j^(t)-d_i,j^(t)). (10) This concise formulation resolves the key contradictions of RsR_s across all four subsets. With the pixel-wise reward r=d^i,j(t)−di,j(t)r= d_i,j^(t)-d_i,j^(t), we have r=0r=0 for maintainS_maintain, r=−1r=-1 for revertS_revert, r=+1r=+1 for newS_new, and r=0r=0 for fluctuateS_fluctuate, as illustrated in Fig. 3. Consequently, RdR_d directly tracks the marginal gain of cumulatively successful pixels, encouraging the agent to monotonically expand misclassified regions without unnecessary perturbations. Training & Termination. Following RFPAR [29], we replace yty^t with dtd^t in memory and track the maximum mean reward r∗=1||∑k∈(Rd)kr^*= 1|K| _k (R_d)_k, maintaining the best (d∗,x∗)(d^*,x^*). We adopt the same hyperparameter suite as RFPAR and cap each run at 100 steps. During each step, the agent updates its policy via REINFORCE [36] using label-only queries; once the memory converges, the agent is reinitialized and starts the next step with a new input. 5 Experiments We evaluate SegPAR against multiple baselines under strict query and sparsity budgets. Our approach consistently outperforms all black-box methods, achieving larger MIoU drops with fewer perturbed pixels, and remains highly effective against adversarially trained models. Ablations on per-class degradation and pixel accumulation confirm that our class-centric design and discrepancy reward drive these improvements. Furthermore, SegPAR performs competitively with strong white-box sparse attacks, highlighting its practical efficacy under realistic decision-only constraints. Table 1: Evaluation of sparse attack performance across semantic segmentation benchmarks. (-) indicates that the experiments are omitted due to the lack of official pre-trained weights for VOC2012. Model Attack Cityscapes ADE20K VOC2012 MIoU R.MIoU Sparsity Query MIoU R.MIoU Sparsity Query MIoU R.MIoU Sparsity Query DeepLabV3 PointWise 0.798 0.433 5.72% 997.3 0.377 0.172 6.73% 993.5 0.861 0.669 5.91% 952.5 SparseEvo 0.228 5.43% 988.8 0.118 5.15% 997.3 0.469 5.15% 998.8 RFPARRs_R_s 0.176 4.51% 965.3 0.106 4.50% 998.1 0.466 3.92% 986.3 SegPARRd_R_d 0.101 3.33% 993.3 0.080 3.29% 966.2 0.238 2.24% 680.4 PSPNet PointWise 0.793 0.391 5.78% 996.3 0.380 0.199 6.32% 983.6 0.860 0.704 4.85% 929.6 SparseEvo 0.246 4.50% 987.0 0.139 5.54% 997.0 0.488 4.66% 998.7 RFPARRs_R_s 0.153 4.61% 990.5 0.143 4.36% 999.0 0.529 3.99% 984.3 SegPARRd_R_d 0.057 3.53% 919.0 0.087 3.11% 965.3 0.240 2.29% 679.1 SegFormer PointWise 0.802 0.594 10.51% 997.9 0.412 0.316 10.1% 973.2 - - - - SparseEvo 0.602 5.30% 994.3 0.293 7.03% 996.0 - - - RFPARRs_R_s 0.566 4.51% 958.5 0.300 4.29% 912.0 - - - SegPARRd_R_d 0.341 3.96% 960.4 0.209 3.60% 987.0 - - - SETR PointWise 0.780 0.607 9.14% 997.1 0.397 0.284 8.31% 966.5 - - - - SparseEvo 0.602 5.71% 997.3 0.270 5.20% 997.3 - - - RFPARRs_R_s 0.527 4.53% 962.9 0.285 3.90% 996.5 - - - SegPARRd_R_d 0.481 3.89% 940.4 0.249 3.50% 990.9 - - - 5.1 Evaluation of Decision-based Sparse Attacks Attacks. We compare SegPARRd_R_d with PointWise[27], SparseEvo[34], and RFPAR [29] under a strict budget of 1,0001,000 queries. For the RL-based methods (SegPAR and RFPAR), we use patience 11–22 with convergence thresholds in [10−2,3×10−2][10^-2,3× 10^-2]. To align with the 5%5\% sparsity target, RFPAR enforces a global 5%5\% constraint over the entire image, whereas our class-centric SegPAR targets 5% of pixels within each predicted class region (adjusted accordingly when the small number of classes makes it difficult to meet the overall 5% sparsity). Since PointWise and SparseEvo are SR-parameterized, we sweep their SR values and report the run closest to the 5%5\% target. Note that these SR-based baselines may slightly exceed the 5%5\% constraint, which inherently favors them. Additional details are provided in the supplementary material. Table 2: Evaluation of sparse attack performance across adversarially trained semantic segmentation benchmarks. Model Attack Cityscapes VOC2012 MIoU R.MIoU Sparsity Query MIoU R.MIoU Sparsity Query DeepLabV3_DDCAT PointWise 0.710 0.502 25.56% 984.2 0.828 0.692 7.81% 977.1 SparseEvo 0.502 9.56% 910.2 0.650 4.79% 990.3 RFPARRs_R_s 0.483 4.25% 840.0 0.543 4.39% 913.8 SegPARRd_R_d 0.428 4.24% 878.3 0.297 2.73% 822.5 DeepLabV3_SAT PointWise 0.693 0.495 23.17% 993.8 0.775 0.676 10.0% 918.6 SparseEvo 0.468 8.42% 932.9 0.630 5.81% 994.3 RFPARRs_R_s 0.434 4.42% 851.4 0.566 4.47% 948.5 SegPARRd_R_d 0.394 4.25% 946.2 0.326 2.92% 799.3 PSPNet_DDCAT PointWise 0.714 0.523 23.06% 994.1 0.835 0.697 8.47% 951.6 SparseEvo 0.507 8.26% 939.0 0.658 4.79% 998.0 RFPARRs_R_s 0.472 4.33% 873.0 0.578 4.18% 996.1 SegPARRd_R_d 0.405 4.22% 935.3 0.382 2.55% 809.5 PSPNet_SAT PointWise 0.677 0.495 24.34% 986.7 0.891 0.693 8.63% 947.0 SparseEvo 0.482 8.77% 922.7 0.650 5.03% 995.9 RFPARRs_R_s 0.450 4.30% 995.0 0.591 4.43% 846.9 SegPARRd_R_d 0.384 4.47% 955.9 0.332 2.79% 832.6 Victim models. To ensure the reproducibility of our experiments, we utilize pre-trained checkpoints provided by MMSegmentation. We select widely used models in the field of semantic segmentation, including DeepLabV3 [7], PSPNet [41], SegFormer [38], and SETR [42]. Specifically, DeepLabV3 and PSPNet are employed as CNN-based models, while SegFormer and SETR are utilized as Transformer-based architectures. Datasets. Due to the high computational cost of query-based attacks on dense prediction models, we evaluate on a fixed subset of 100 randomly sampled validation images from ADE20K[44], Pascal VOC2012[17], and Cityscapes[11]. ADE20K contains 150 diverse classes with fine-grained part annotations, VOC2012 covers 20 common object categories, and Cityscapes focuses on urban driving scenes with 19 classes. Evaluation Metrics. We report Robust MIoU (R.MIoU), Sparsity, and Query to measure attack effectiveness and efficiency. R.MIoU is the victim model’s MIoU on adversarial examples (lower is better). Sparsity is the average fraction of perturbed pixels (lower indicates fewer, more imperceptible changes). Query is the average number of forward passes required to obtain the final adversarial image (lower is more efficient). Figure 4: Class-wise attack efficiency. Comparison of MIoU degradation across individual classes in DeepLabV3. SegPAR demonstrates significantly faster and more effective attacks than RFPAR across all categories. Main Results. As shown in Table 1, SegPAR with RdR_d consistently outperforms existing sparse attack techniques across all evaluated datasets, achieving the lowest R.MIoU under extreme sparsity at comparable or lower queries. For CNN-based architectures, SegPAR with RdR_d dramatically reduces MIoU; notably, it drops the MIoU of PSPNet on Cityscapes to 0.0570.057 and achieves extreme sparsity (2.24%2.24\%) with significantly lower average queries (e.g., 680.42 for DeepLabV3) on VOC2012. Furthermore, our method proves highly effective even against Transformer-based models like SegFormer and SETR, which typically exhibit higher robustness against local perturbations due to their ability to capture global context. Despite this inherent robustness, our method maintains potent attack performance on Cityscapes using a sparsity of only 3.96%3.96\% against SegFormer—a stark contrast to the 10.51%10.51\% required by PointWise. Consistently observed across all benchmarks including ADE20K, these results confirm that our approach effectively accelerates the search process to precisely navigate the most vulnerable pixels, regardless of the target architecture. 5.2 Evaluation on Adversarially Trained Models Table 2 reports attack performance against defended models (DDCAT[40], SAT[20]). SegPAR consistently attains the lowest R.MIoU with lower sparsity than prior methods. Notably, adversarial training effectiveness varies across datasets, which we conjecture is partially influenced by image resolution. On high-resolution Cityscapes, the enlarged search space inherently hinders sparse attacks, allowing adversarial training to substantially boost robustness—even enabling CNNs to approach Transformer-level resilience. Conversely, on lower-resolution VOC2012, sparse attacks remain highly effective, yielding only marginal defense gains. While domain complexity also plays a role, current adversarial training appears to offer meaningful protection primarily in high-resolution settings, leaving lower-resolution regimes vulnerable. Table 3: Evaluation of Pixel-accumulating Adversarial Attacks across Different Losses. Model Objective Attack Cityscapes ADE20K VOC2012 MIoU R.MIoU Sparsity Query MIoU R.MIoU Sparsity Query MIoU R.MIoU Sparsity Query DeepLabV3 Standard Pixle 0.798 0.394 4.69% 995.4 0.377 0.140 4.79% 995.5 0.861 0.447 4.77% 995.5 Sparse-RS 0.172 4.87% 998.7 0.100 4.83% 998.1 0.423 4.84% 998.2 RFPAR 0.176 4.51% 993.3 0.106 4.50% 998.1 0.466 3.92% 986.3 Pixle 0.411 4.04% 995.3 0.111 4.72% 995.3 0.279 4.59% 994.9 Sparse-RS 0.152 4.87% 998.5 0.092 4.83% 998.3 0.258 4.84% 998.0 Discrepancy RFPAR 0.798 0.210 3.56% 994.9 0.377 0.090 3.48% 947.8 0.861 0.277 3.43% 950.1 PSPNet Standard Pixle 0.793 0.369 4.69% 995.8 0.380 0.168 4.79% 995.4 0.860 0.374 4.77% 995.2 Sparse-RS 0.153 4.87% 998.7 0.121 4.83% 998.3 0.536 4.84% 997.7 RFPAR 0.153 4.61% 990.6 0.143 4.36% 999.0 0.529 4.00% 984.3 Pixle 0.383 4.13% 995.8 0.131 4.69% 995.4 0.860 0.246 4.59% 995.3 Sparse-RS 0.139 4.87% 998.6 0.092 4.83% 998.1 0.304 4.84% 997.9 Discrepancy RFPAR 0.793 0.171 3.92% 993.0 0.380 0.133 3.19% 982.5 0.860 0.295 3.13% 936.7 5.3 Per-class MIoU Degradation Analysis In this section, we evaluate the impact of class-centric exploration by comparing RFPAR and SegPAR, both employing RsR_s. As illustrated in Fig. 4, SegPAR, which represents a paradigm shift from an image-centric to a class-centric approach, exhibits a significantly steeper degradation curve for most categories compared to RFPAR. These results indicate that our class-centric formulation, which constructs per-class inputs from the predicted regions and attacks multiple class-specific areas in parallel, is more effective than image-centric exploration that tends to concentrate queries on a few dominant regions. Notably, safety-critical classes for autonomous driving—such as traffic signs, traffic lights, persons, and riders—are compromised much earlier than with RFPAR, with SegPAR driving their per-class MIoU down sharply within ∼ 200 queries. This underscores that our method is not only numerically superior in attack performance, but also sufficiently powerful to cause practically meaningful degradation in real-world perception pipelines, even under strict black-box constraints. Figure 5: Reduction of Reversion. Our discrepancy reward effectively suppresses reversion, resolving a major hurdle in agent training caused by the standard reward. 5.4 Evaluation of Discrepancy Reward While Section 5.3 already demonstrates the superiority of our class-centric architecture over the image-centric RFPAR under the same standard reward, this section isolates and explicitly evaluates the contribution of the proposed discrepancy reward RdR_d by applying it to Pixle[26] and Sparse-RS[12]. We optimize the discrepancy objective ℒd=−RdL_d=-R_d (equivalently maximizing RdR_d) and compare it with the standard objective ℒs=−RsL_s=-R_s. As shown in Table 3, on ADE20K and VOC2012, the discrepancy objective leads to a larger reduction in MIoU than the standard objective under the same (or fewer) sparsity, indicating that RdR_d enables more query-efficient pixel accumulation. In contrast, on the high-resolution Cityscapes benchmark, applying RdR_d to RFPAR can achieve lower sparsity but yields a smaller MIoU drop than the standard objective. We attribute this to the enlarged effective action space in high-resolution images: since RdR_d provides non-zero reward only when the set of cumulatively successful pixels expands, informative reward events become rare, causing the search to stagnate before discovering pixels that maximize RdR_d. As verified in Table 1, this limitation is largely alleviated when combining RdR_d with our proposed SegPAR, which reduces the effective search space via class-wise inputs and mask-constrained exploration. Consequently, their combination achieves the largest MIoU reduction in high-resolution settings. Furthermore, Fig. 5 shows that the discrepancy objective substantially suppresses reversion compared to the standard objective. We quantify reversion at step t as |revert(t)| |S_revert^(t) |, i.e., the number of misclassified pixels that revert to the original prediction between steps. Overall, these results indicate that RdR_d mitigates the reversion issue by discouraging counter-productive transitions and improving search efficiency. 5.5 Comparison with White-box Sparse Baseline In this section, we compare our attack, SegPARRdSegPAR_R_d, with white-box sparse baselines, PGD0PGD_0 [13], sPGDprosPGD_pro, and sPGDunprosPGD_unpro [43], all optimized with cross-entropy. For a standardized comparison, we align the evaluation budget by equating one black-box forward query to one white-box gradient update (which inherently entails both forward and backward passes). Under this metric, we enforce a maximum budget of 1,000 steps per image. Specifically, SegPARRdSegPAR_R_d utilizes up to 1,000 forward queries, executed over 100 steps (where each mark represents a 20-step interval). Conversely, the white-box attacks allocate 200 gradient updates per sparsity level, totaling 1,000 updates across the 5 evaluated levels (i.e., 2020 restarts × 1010 iterations for PGD0PGD_0, and 200200 iterations for sPGD). As shown in Fig. 6, despite lacking access to internal gradients, SegPARRdSegPAR_R_d remains strongly competitive across both segmentation models—often outperforming PGD0PGD_0 and approaching sPGD under strict sparsity constraints. These results underscore the effectiveness of SegPARRdSegPAR_R_d and suggest that stronger, segmentation-tailored white-box sparse attack baselines are still needed. Figure 6: Comparison of MIoU vs. Sparsity with White-box sparse Attacks. The results demonstrate that our attack SegPARRdSegPAR_R_d exhibits competitive performance relative to white-box sparse methods. 6 Conclusion We proposed SegPAR, a decision-based black-box sparse attack for semantic segmentation. By combining class-centric exploration with a discrepancy reward (RdR_d), SegPAR mitigates perturbation reversion and improves query efficiency in dense prediction, where the search space is vast. Under strict query and sparsity budgets, SegPARRdSegPAR_R_d achieves substantially larger MIoU degradation with fewer perturbed pixels than existing black-box baselines, while rapidly degrading the MIoU of safety-critical classes relevant to autonomous driving. Even without access to internal model information, SegPARRdSegPAR_R_d outperforms PGD0PGD_0 and narrows the gap to sPGD. Furthermore, we observe that adversarial training can be less effective in lower-resolution regimes. Overall, our findings highlight the persistent vulnerability of dense prediction models under realistic decision-only sparse threats. Acknowledgements This work was supported by the Advanced GPU Utilization Support Program funded by the Ministry of Science and ICT (MSIT), Korea (No. 02-26-01-0134); by the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (No. RS-2026-25498016); and by the BK21 FOUR Program through the NRF grant funded by the Korean government in 2025 (Grant No. 2120251815513), Institute for Sustainable VLEO Space Services Development. References [1] J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat, et al. (2023) GPT-4 Technical Report. CoRR abs/2303.08774. External Links: Document Cited by: §1. [2] N. Akhtar and A. S. Mian (2018) Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey. IEEE Access 6, p. 14410–14430. External Links: Document Cited by: §1. [3] S. Bhambri, S. Muku, A. Tulasi, and A. B. Buduru (2019) A Study of Black Box Adversarial Attacks in Computer Vision. CoRR abs/1912.01667. External Links: Document Cited by: §1. [4] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndic, P. Laskov, G. Giacinto, and F. Roli (2013) Evasion Attacks against Machine Learning at Test Time. In Machine Learning and Knowledge Discovery in Databases (ECML PKDD), LNCS, Vol. 8190, p. 387–402. External Links: Document Cited by: §1. [5] N. Carion, L. Gustafson, Y. Hu, S. Debnath, R. Hu, D. Suris, C. Ryali, K. V. Alwala, H. Khedr, A. Huang, J. Lei, T. Ma, B. Guo, A. Kalla, M. Marks, J. Greer, M. Wang, P. Sun, R. Rädle, T. Afouras, E. Mavroudi, K. Xu, T. Wu, Y. Zhou, L. Momeni, R. Hazra, S. Ding, S. Vaze, F. Porcher, F. Li, S. Li, A. Kamath, H. K. Cheng, P. Dollár, N. Ravi, K. Saenko, P. Zhang, and C. Feichtenhofer (2025) SAM 3: Segment Anything with Concepts. CoRR abs/2511.16719. External Links: Document Cited by: §1. [6] N. Carlini and D. A. Wagner (2017) Towards Evaluating the Robustness of Neural Networks. In IEEE Symposium on Security and Privacy (S&P), p. 39–57. External Links: Document Cited by: §1, §3.3. [7] L. Chen, G. Papandreou, F. Schroff, and H. Adam (2017) Rethinking atrous convolution for semantic image segmentation. CoRR abs/1706.05587. External Links: Document Cited by: §5.1. [8] W. Chen, Z. Zhang, X. Hu, and B. Wu (2020) Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip. In ECCV, LNCS, Vol. 12360, p. 276–293. External Links: Document Cited by: §1. [9] Z. Chen, Z. Shan, J. Chang, K. Jiang, D. Yang, Y. Cheng, and W. Zhang (2024) Delving into decision-based black-box attacks on semantic segmentation. CoRR abs/2402.01220. External Links: Document Cited by: §1. [10] S. Cheng, Y. Dong, T. Pang, H. Su, and J. Zhu (2019) Improving Black-box Adversarial Attacks with a Transfer-based Prior. In NeurIPS, Vol. 32, p. 10932–10942. External Links: Document Cited by: §1. [11] M. Cordts, M. Omran, S. Ramos, T. Rehfeld, M. Enzweiler, R. Benenson, U. Franke, S. Roth, and B. Schiele (2016) The Cityscapes Dataset for Semantic Urban Scene Understanding. In CVPR, p. 3213–3223. External Links: Document Cited by: §5.1. [12] F. Croce, M. Andriushchenko, N. D. Singh, N. Flammarion, and M. Hein (2022) Sparse-RS: A Versatile Framework for Query-Efficient Sparse Black-Box Adversarial Attacks. In AAAI, p. 6437–6445. External Links: Document Cited by: §1, §3.2, §5.4. [13] F. Croce and M. Hein (2019) Sparse and imperceivable adversarial attacks. In ICCV, p. 4724–4732. External Links: Document Cited by: §3.3, §5.5. [14] F. Croce, N. D. Singh, and M. Hein (2024) Towards reliable evaluation and fast training of robust semantic segmentation models. In ECCV, Vol. 15087, p. 180–197. External Links: Document Cited by: §1. [15] Y. Deng, W. Wu, J. Zhang, and Z. Zheng (2023) Blurred-Dilated Method for Adversarial Attacks. In NeurIPS, Vol. 36, p. 48939–48950. External Links: Link Cited by: §1. [16] X. Dong, D. Chen, J. Bao, C. Qin, L. Yuan, W. Zhang, N. Yu, and D. Chen (2020) GreedyFool: Distortion-Aware Sparse Adversarial Attack. In NeurIPS, Vol. 33, p. 11226–11235. External Links: Document Cited by: §1. [17] M. Everingham, L. V. Gool, C. K. I. Williams, J. Winn, and A. Zisserman (2010) The PASCAL Visual Object Classes (VOC) Challenge. IJCV 88 (2), p. 303–338. External Links: Document Cited by: §5.1. [18] I. J. Goodfellow, J. Shlens, and C. Szegedy (2015) Explaining and Harnessing Adversarial Examples. In ICLR, External Links: Document Cited by: §1. [19] J. H. Jung and Y. Kwon (2021) Boundaries of single-class regions in the input space of piece-wise linear neural networks. In 2020 25th International Conference on Pattern Recognition (ICPR), p. 6027–6034. External Links: Document Cited by: §4.1. [20] A. Kurakin, I. J. Goodfellow, and S. Bengio (2017) Adversarial machine learning at scale. In ICLR, External Links: Document Cited by: §5.2. [21] Z. Li, K. Li, S. Wang, S. Lan, Z. Yu, Y. Ji, Z. Li, Z. Zhu, J. Kautz, Z. Wu, Y. Jiang, and J. M. Álvarez (2024) Hydra-MDP: End-to-end Multimodal Planning with Multi-target Hydra-Distillation. CoRR abs/2406.06978. External Links: Document Cited by: §1. [22] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2018) Towards Deep Learning Models Resistant to Adversarial Attacks. In ICLR, External Links: Document Cited by: §1. [23] A. Modas, S. Moosavi-Dezfooli, and P. Frossard (2019) SparseFool: A Few Pixels Make a Big Difference. In CVPR, p. 9087–9096. External Links: Document Cited by: §1, §3.3. [24] N. Papernot, P. D. McDaniel, I. J. Goodfellow, S. Jha, Z. B. Celik, and A. Swami (2017) Practical Black-Box Attacks against Machine Learning. In Proc. AsiaCCS, p. 506–519. External Links: Document Cited by: §1. [25] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami (2016) The limitations of deep learning in adversarial settings. In Proc. IEEE EuroS&P, p. 372–387. External Links: Document Cited by: §3.3. [26] J. Pomponi, D. Dántoni, A. Nicolosi, and S. Scardapane (2023) Rearranging Pixels is a Powerful Black-Box Attack for RGB and Infrared Deep Learning Models. IEEE Access 11, p. 11298–11306. External Links: Document Cited by: §1, §3.2, §5.4. [27] L. Schott, J. Rauber, M. Bethge, and W. Brendel (2019) Towards the first adversarially robust neural network model on MNIST. In ICLR, External Links: Document Cited by: §3.1, §5.1. [28] Y. Shi, S. Wang, and Y. Han (2019) Curls & Whey: Boosting Black-Box Adversarial Attacks. In CVPR, p. 6519–6527. External Links: Document Cited by: §1. [29] D. Song, D. Ko, and J. Jung (2024) Amnesia as a Catalyst for Enhancing Black Box Pixel Attacks in Image Classification and Object Detection. In NeurIPS, Vol. 37, p. 40284–40305. External Links: Document Cited by: §1, §1, §3.2, §4.2, §4, §5.1. [30] J. Su, D. V. Vargas, and K. Sakurai (2019) One Pixel Attack for Fooling Deep Neural Networks. IEEE Trans. Evol. Comput. 23 (5), p. 828–841. External Links: Document Cited by: §1, §3.2. [31] P. Sun, H. Kretzschmar, X. Dotiwalla, A. Chouard, V. Patnaik, P. Tsui, J. Guo, Y. Zhou, Y. Chai, B. Caine, V. Vasudevan, W. Han, J. Ngiam, H. Zhao, A. Timofeev, S. Ettinger, M. Krivokon, A. Gao, A. Joshi, Y. Zhang, J. Shlens, Z. Chen, and D. Anguelov (2020) Scalability in Perception for Autonomous Driving: Waymo Open Dataset. In CVPR, p. 2443–2451. External Links: Document Cited by: §1. [32] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. J. Goodfellow, and R. Fergus (2014) Intriguing properties of neural networks. In ICLR, External Links: Document Cited by: §1. [33] G. Team (2025) Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities. CoRR abs/2507.06261. External Links: Document Cited by: §1. [34] V. Q. Vo, E. Abbasnejad, and D. Ranasinghe (2022) Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Models. In ICLR, External Links: Document Cited by: §3.1, §5.1. [35] D. Wierstra, T. Schaul, T. Glasmachers, Y. Sun, J. Peters, and J. Schmidhuber (2014) Natural evolution strategies. JMLR 15 (1), p. 949–980. External Links: Document Cited by: §1. [36] R. J. Williams (1992) Simple statistical gradient-following algorithms for connectionist reinforcement learning. Machine learning 8 (3), p. 229–256. External Links: Document Cited by: §4.2. [37] E. Wong, L. Rice, and J. Z. Kolter (2020) Fast is better than free: Revisiting adversarial training. In ICLR, External Links: Document Cited by: §1. [38] E. Xie, W. Wang, Z. Yu, A. Anandkumar, J. M. Alvarez, and P. Luo (2021) SegFormer: Simple and efficient design for semantic segmentation with transformers. NeurIPS 34, p. 12077–12090. External Links: Document Cited by: §5.1. [39] H. Xu, Y. Ma, H. Liu, D. Deb, H. Liu, J. Tang, and A. K. Jain (2020) Adversarial Attacks and Defenses in Images, Graphs and Text: A Review. Int. J. Autom. Comput. 17 (2), p. 151–178. External Links: Document Cited by: §1. [40] X. Xu, H. Zhao, and J. Jia (2021) Dynamic divide-and-conquer adversarial training for robust semantic segmentation. In ICCV, p. 7466–7475. External Links: Document Cited by: §5.2. [41] H. Zhao, J. Shi, X. Qi, X. Wang, and J. Jia (2017) Pyramid Scene Parsing Network. In CVPR, p. 2881–2890. External Links: Document Cited by: §5.1. [42] S. Zheng, J. Lu, H. Zhao, X. Zhu, Z. Luo, Y. Wang, Y. Fu, J. Feng, T. Xiang, P. H. Torr, et al. (2021) Rethinking semantic segmentation from a sequence-to-sequence perspective with transformers. In CVPR, p. 6881–6890. External Links: Document Cited by: §5.1. [43] X. Zhong, Y. Huang, and C. Liu (2024) Towards Efficient Training and Evaluation of Robust Models against L0L_0 Bounded Adversarial Perturbations. In ICML, PMLR, Vol. 235, p. 61708–61726. External Links: Document Cited by: §3.3, §5.5. [44] B. Zhou, H. Zhao, X. Puig, S. Fidler, A. Barriuso, and A. Torralba (2017) Scene parsing through ADE20K dataset. In CVPR, p. 633–641. External Links: Document Cited by: §5.1.