Dynamic Divide-and-Conquer Adversarial Training for Robust Semantic Segmentation

TL;DR

This paper introduces DDC-AT, a dynamic divide-and-conquer adversarial training method that improves the robustness of semantic segmentation models against adversarial attacks without increasing inference complexity.

Contribution

It proposes a novel dynamic division mechanism with multiple branches during training, enhancing adversarial robustness while maintaining efficiency during inference.

Findings

DDC-AT improves robustness on PASCAL VOC 2012 and Cityscapes datasets.

The method performs well against both white- and black-box attacks.

Additional branches are discarded during inference, incurring no extra computational cost.

Abstract

Adversarial training is promising for improving robustness of deep neural networks towards adversarial perturbations, especially on the classification task. The effect of this type of training on semantic segmentation, contrarily, just commences. We make the initial attempt to explore the defense strategy on semantic segmentation by formulating a general adversarial training procedure that can perform decently on both adversarial and clean samples. We propose a dynamic divide-and-conquer adversarial training (DDC-AT) strategy to enhance the defense effect, by setting additional branches in the target model during training, and dealing with pixels with diverse properties towards adversarial perturbation. Our dynamical division mechanism divides pixels into multiple branches automatically. Note all these additional branches can be abandoned during inference and thus leave no extra parameter and computation cost. Extensive experiments with various segmentation models are conducted on PASCAL VOC 2012 and Cityscapes datasets, in which DDC-AT yields satisfying performance under both white- and black-box attack.