Skip to content

title: >- [Paper Note] Rethinking Adversary in Semantic Segmentation: An Out-of-Distribution Perspective description: >- [ECCV 2026][Segmentation][Adversarial Attack] SegOOD breaks the in-distribution manifold constraint of prediction-driven segmentation adversaries via Feature Wasserstein Separation and Weighted KNN Separation, significantly boosting adversarial training robustness. tags: - ECCV 2026 - Segmentation - Adversarial Attack - Out-of-Distribution - Adversarial Training date: 2026-09-19 content_hash: 8bf8084fad51b5f0

Rethinking Adversary in Semantic Segmentation: An Out-of-Distribution Perspective

Conference: ECCV 2026
Paper: ECCV Official
Area: Segmentation
Keywords: Semantic Segmentation, Adversarial Attack, Out-of-Distribution, Adversarial Training, Superpixel Clustering

TL;DR

Addressing the limitation that conventional prediction-driven segmentation adversaries only perturb features along the in-distribution (ID) manifold to cross decision boundaries, SegOOD proposes driving adversarial representations off the ID manifold via Feature Wasserstein Separation and Weighted KNN Separation, significantly enhancing adversarial training against both ID-style and OOD-like attacks.

Background & Motivation

Semantic segmentation serves as a fundamental perception module in safety-critical computer vision applications, such as autonomous driving and medical diagnosis, where robustness against adversarial perturbations is paramount. To counter imperceptible malicious attacks, adversarial training (AT) frameworks—including pioneering methods like DDC-AT, SegPGD, CosPGD, SEA, and RPPGD—have been developed to reinforce segmentation networks against white-box and black-box evaluations. However, existing attack strategies remain almost exclusively "prediction-driven," formulating objectives strictly to maximize misclassified pixel counts or cross-entropy losses.

Under mild regularity assumptions on data manifolds and feature mappings, first-order optimization of these prediction-driven objectives primarily generates perturbations moving along the tangent directions of the in-distribution (ID) feature manifold. Consequently, perturbed features cross decision boundaries into neighboring ID categories while remaining confined within the high-density ID manifold in latent space. As a result, AT models trained under this paradigm only encounter near-manifold adversarial examples, leaving them blind to atypical, low-density representations that significantly deviate from learned feature spaces.

When deployed models encounter perturbations that induce out-of-distribution (OOD)-like feature drift, their defenses degrade sharply because their internal representations were never hardened against off-manifold representations. The paper addresses this fundamental vulnerability by questioning whether norm-bounded perturbations can deliberately induce OOD-like feature deviations. Core idea: propose SegOOD, a novel adversary that explicitly drives latent representations away from clean ID prototypes via dual-sided compressed Feature Wasserstein Separation (FWS) and area-weighted KNN separation (WKS), combined with decoupled adversarial training to defend against the full spectrum of ID-style and OOD-like perturbations.

Method

Overall Architecture

SegOOD aims to force adversarial pixel features in latent space to deviate from clean ID semantic prototypes, generating low-confidence and high-energy OOD-like predictions. Because calculating dense pairwise distances between full-resolution feature maps is computationally prohibitive (\(\mathcal{O}(N^3)\) for \(N = H \times W\)), SegOOD introduces a dual-sided compression scheme: clean features are compressed into class-level semantic prototypes via masked average pooling, while adversarial features are clustered into superpixel prototypes using a feature-aware clustering algorithm (F-SLIC). At each attack step, perturbations are iteratively updated using gradients from global Wasserstein separation (\(\mathcal{L}_{\text{FWS}}\)), local area-weighted neighbor separation (\(\mathcal{L}_{\text{WKS}}\)), and standard prediction degradation (\(\mathcal{L}_{\text{pred}}\)).

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Image x and Adversarial Image x_adv"] --> B["Dual-Sided Prototype Compression<br/>ID EMA Prototypes + F-SLIC Superpixel Aggregation"]
    B --> C["Feature Wasserstein Separation (FWS)<br/>Global Transport Discrepancy from ID Manifold"]
    B --> D["Weighted KNN Separation (WKS)<br/>Area-Aware Local Separation Constraint"]
    C --> E["Joint Adversarial Optimization<br/>Iterative PGD Step over Lpred + LFWS + LWKS"]
    D --> E
    E --> F["Decoupled Adversarial Training (Ours-Sep)<br/>Complementary ID-style & OOD-style Sample Supervision"]

Key Designs

1. Dual-Sided Feature Prototype Compression and Feature-Aware Superpixel Clustering (F-SLIC): Taming Dense Manifold Complexity

Directly measuring the optimal transport distance between the dense clean feature distribution \(P = \{g_i(x)\}\) and adversarial feature distribution \(Q = \{g_i(x_{\text{adv}})\}\) across \(N\) pixels induces an impractical \(\mathcal{O}(N^3)\) computational cost. SegOOD compresses the clean distribution into \(C\) global category prototypes \(P = \{p_1, \dots, p_C\}\) via masked average pooling on high-confidence training pixels (\(F^i_c(x; \theta) > \tau\)) updated via exponential moving average (EMA) with momentum 0.99.

On the adversarial side, semantic labels are disrupted by attacks, making category-level pooling unreliable. Meanwhile, standard SLIC relies purely on RGB color and spatial proximity, failing to capture deep adversarial feature discrepancies. SegOOD introduces F-SLIC, defining the inter-pixel distance between pixels \(i\) and \(j\) by balancing normalized negative cosine feature similarity \(d_f\) and normalized spatial coordinate distance \(d_c\): $\(D_{i,j} = \sqrt{(d_f)^2 + (d_c / m)^2}\)$ where \(d_f = (1 - \frac{g_i \cdot g_j}{\|g_i\| \|g_j\|}) / 2 \in [0, 1]\), and \(m\) balances feature similarity and spatial compactness. K-means clusters the image into \(C\) superpixels \(\{s_1, \dots, s_C\}\), whose masked average pooled features yield superpixel prototypes \(Q = \{q_1, \dots, q_C\}\), successfully reducing transport plan complexity from \(\mathcal{O}(N^3)\) to \(\mathcal{O}(C^3)\).

2. Feature Wasserstein Separation (FWS): Global Distributional Divergence

Given compressed discrete sets \(P\) and \(Q\) of size \(C\), SegOOD applies the Wasserstein distance to quantify the minimum transport cost required to align adversarial superpixels with clean ID semantic prototypes: $\(\mathcal{L}_{\text{FWS}} = \min_{\pi \in \Pi(P, Q)} \left( \sum_{i=1}^C \sum_{j=1}^C \pi_{ij} \|P_i - Q_j\|_2^2 \right)^{\frac{1}{2}}\)$ Because the cardinality is reduced to \(C \times C\), standard linear programming solvers can compute this cost efficiently. Maximizing \(\mathcal{L}_{\text{FWS}}\) pulls adversarial superpixel representations away from the global center of mass of ID categories in latent space, driving features toward low-density regions.

3. Weighted K-Nearest-Neighbor Separation (WKS): Mitigating Uniform Averaging Bias

While global Wasserstein transport expands overall distribution divergence, it does not prevent individual adversarial prototypes from lingering near specific ID prototypes. While a standard KNN margin constraint penalizes high cosine similarity \(d_K(q_i, P)\) to the nearest \(K\) prototypes beyond a margin \(\gamma = 0.3\), the paper uncovers a Uniform Superpixel Averaging Bias (Theorem 2): if a single dominant superpixel covers a vast region while remaining near the ID manifold, numerous small superpixels that are pushed far away dilute the unweighted loss by \(1/C\), driving the objective toward zero.

To overcome this dilution, SegOOD weights each superpixel prototype's margin penalty by its spatial pixel area \(|s_i|\): $\(\mathcal{L}_{\text{WKS}} = \frac{1}{H \times W} \sum_{i=1}^C |s_i| \cdot \max \left( 0, -\gamma + d_K(q_i, P) \right)\)$ This ensures dominant foreground and background regions receive strong optimization signals, guaranteeing robust off-manifold deviation across large spatial regions.

4. Decoupled Adversarial Training (Ours-Sep): Harmonizing Prediction and Latent Disruption

During attack generation, the overall loss combines all objectives: \(\mathcal{L}_{\text{total}} = \beta_1 \mathcal{L}_{\text{FWS}} + \beta_2 \mathcal{L}_{\text{WKS}} + \beta_3 \mathcal{L}_{\text{pred}}\) under standard \(l_\infty\) PGD constraints (\(\epsilon = 8/255, \alpha = 3/255\)). During adversarial training, the authors observe that training purely on joint perturbations (Ours-Co) is sub-optimal compared to a decoupled split (Ours-Sep): 50% of the mini-batch is crafted using pure prediction-driven loss \(\mathcal{L}_{\text{pred}}\) to defend against decision-boundary flips, while the other 50% is generated using latent deviation loss \(\mathcal{L}_{\text{OOD}} = \mathcal{L}_{\text{FWS}} + \mathcal{L}_{\text{WKS}}\) to enforce manifold compactness and reject OOD perturbations.

Key Experimental Results

Main Results

Experiments were conducted on Pascal VOC and Cityscapes using ResNet50-based PSPNet and DeepLabv3 models. Models were adversarially trained with 3-iteration or 7-iteration attacks and evaluated against 10-iteration white-box attacks.

White-Box Robustness (mIoU %) on Pascal VOC across Segmentation Architectures (Table 3 in original paper):

AT Strategy Backbone / Head Clean mIoU (%) PGD Attack (%) SegPGD Attack (%) RPPGD Attack (%) SegOOD Attack (%)
Standard (N/A) PSPNet 76.64 5.21 2.03 1.76 1.47
SegPGD3-AT PSPNet 75.38 26.60 27.09 22.78 19.82
RPPGD3-AT PSPNet 75.17 30.25 28.19 27.14 13.98
Ours-Sep (3 iter) PSPNet 74.39 32.54 30.37 27.03 30.15
SegPGD7-AT DeepLabv3 74.46 30.95 29.55 24.61 15.48
RPPGD7-AT DeepLabv3 74.01 33.52 31.47 33.21 15.34
Ours-Sep (7 iter) DeepLabv3 73.88 35.27 34.86 32.97 35.11

Black-Box Transfer Robustness (mIoU %) on Pascal VOC & Cityscapes (Table 5 in original paper, PSPNet \(\to\) DeepLabv3):

AT Strategy Dataset Transfer Pair SegPGD Black-Box (%) RPPGD Black-Box (%) AdvPatch Black-Box (%) SegOOD Black-Box (%)
SegPGD3-AT Pascal VOC PSPNet \(\to\) DeepLabv3 13.34 9.17 27.19 8.05
RPPGD3-AT Pascal VOC PSPNet \(\to\) DeepLabv3 17.79 15.10 31.96 10.41
Ours-Sep Pascal VOC PSPNet \(\to\) DeepLabv3 22.96 19.55 37.28 19.30
SegPGD3-AT Cityscapes PSPNet \(\to\) DeepLabv3 20.11 12.55 23.82 8.18
RPPGD3-AT Cityscapes PSPNet \(\to\) DeepLabv3 23.56 16.73 35.26 12.27
Ours-Sep Cityscapes PSPNet \(\to\) DeepLabv3 25.90 20.70 35.77 21.73

Ablation Study

Ablations on Pascal VOC evaluate the impact of individual loss components and feature clustering methods on attack efficacy against SegPGD3-AT PSPNet and CosPGD3-AT DeepLabv3 (10 attack iterations; lower mIoU indicates stronger attack power; Table 1 in original paper):

Objective Components Lpred LFWS LWKS SegPGD3-AT PSPNet (mIoU %) CosPGD3-AT DeepLabv3 (mIoU %) Analysis
Prediction-only baseline ✓ - - 26.48 25.88 Conventional adversary; features remain near ID manifold
Pred + Global Transport ✓ ✓ - 22.47 20.68 Global Wasserstein separation induces substantial drop
Pred + Local Neighbor ✓ - ✓ 24.70 23.55 WKS reliably prevents local prototype clustering
Pure OOD Objectives - ✓ ✓ 25.12 22.80 Strong degradation even without cross-entropy optimization
Full SegOOD ✓ ✓ ✓ 19.82 16.57 Maximally effective, dropping target mIoU by ~6-9%
Adversarial Feature Clustering SegPGD3-AT PSPNet (mIoU %) CosPGD3-AT DeepLabv3 (mIoU %) Core Difference & Bottleneck
Semantic Prototypes 34.85 30.17 Adversarial perturbation corrupts semantic masks; prototypes collapse
Standard SLIC (RGB) 24.91 25.54 Disregards deep feature semantics; vulnerable to RGB-feature misalignment
F-SLIC (Ours) 19.82 16.57 Balances feature cosine similarity and spatial proximity smoothly

Key Findings

  • Robust segmentation models trained with previous adversaries (e.g., RPPGD-AT, SegPGD-AT) achieve over 27-30% mIoU under ID attacks but collapse to 13.98% - 15.48% mIoU when challenged by SegOOD, revealing severe blindness to off-manifold representations.
  • Decoupled adversarial training (Ours-Sep) consistently outperforms unified joint training (Ours-Co), maintaining competitive clean accuracy (only dropping from 76.64% to 74.39% on Pascal VOC) while establishing new state-of-the-art defense across all threat models.
  • A 3-iteration SegOOD training run achieves 30.15% mIoU against SegOOD attacks, outperforming competing methods trained with 7 attack iterations, demonstrating remarkable training efficiency with zero extra inference overhead.

Highlights & Insights

  • Theoretical Grounding of On-Manifold Bias: The paper establishes that under standard first-order optimization of prediction-based cross-entropy loss, adversarial trajectories remain confined to \(\mathcal{O}(\epsilon^2)\) neighborhoods of the ID data manifold, explaining why standard AT fails against off-manifold shifts.
  • Dual-Sided Dimensionality Reduction: Overcoming the computational intractability of Wasserstein transport on dense vision tasks by combining clean EMA prototypes with adversarial F-SLIC superpixel prototypes compresses complexity from \(\mathcal{O}(N^3)\) to \(\mathcal{O}(C^3)\).
  • Spatial Area Weighting to Defeat Averaging Bias: Formalizes Theorem 2, showing that uniform prototype averaging causes severe dilution when dominant semantic segments exist, and solves it elegantly with pixel-area scaling in WKS.

Limitations & Future Work

  • Dependency on Clean Ground Truth for Prototypes: Updating clean class prototypes via EMA relies on accurate semantic masks; label noise in weakly-supervised or open-set environments could impair prototype stability.
  • Predefined Cluster Count: F-SLIC sets the number of superpixels strictly equal to class count \(C\) for dimensional symmetry, which may be coarse for complex scenes featuring many small disparate object instances.
  • Future Directions: Extending the OOD adversarial formulation to foundation models such as Segment Anything (SAM) or multimodal vision-language models (CLIP/VLMs) to test open-vocabulary off-manifold resilience.
  • vs SegPGD / CosPGD: SegPGD applies adaptive region scaling and CosPGD applies smooth cosine weighting, but both are fundamentally output-driven and confine perturbations to the ID manifold; SegOOD explicitly enforces latent representation divergence and distribution shift.
  • vs RPPGD: RPPGD utilizes semantic prototypes to refine region-based attacks within standard supervised objectives; SegOOD turns prototypes into repulsive centers for global off-manifold feature expulsion.
  • vs Traditional OOD Detection: While conventional OOD methods detect anomalous inputs during inference, SegOOD repurposes OOD principles into an adversarial generation mechanism, enriching training distributions without runtime overhead.

Rating

  • Novelty: ⭐⭐⭐⭐⭐ Formulates an innovative off-manifold perspective on semantic segmentation adversaries, breaking away from traditional prediction-driven paradigms.
  • Experimental Thoroughness: ⭐⭐⭐⭐⭐ Evaluates white-box, black-box, patch, and transfer attacks alongside energy score distributions and comprehensive ablations.
  • Writing Quality: ⭐⭐⭐⭐⭐ Clear mathematical formulations, rigorous proofs of manifold constraints, and transparent experimental reporting.
  • Value: ⭐⭐⭐⭐⭐ Substantially elevates real-world segmentation robustness with zero inference latency, delivering critical security insights for autonomous systems.