Robust Semantic Segmentation: Strong Adversarial Attacks and Fast
  Training of Robust Models
Francesco Croce Naman D Singh Matthias Hein
While a large amount of work has focused on designing adversarial attacks
against image classifiers, only a few methods exist to attack semantic
segmentation models. We show that attacking segmentation models presents
task-specific challenges, for which we propose novel solutions. Our final
evaluation protocol outperforms existing methods, and shows that those can
overestimate the robustness of the models. Additionally, so far adversarial
training, the most successful way for obtaining robust image classifiers, could
not be successfully applied to semantic segmentation. We argue that this is
because the task to be learned is more challenging, and requires significantly
higher computational effort than for image classification. As a remedy, we show
that by taking advantage of recent advances in robust ImageNet classifiers, one
can train adversarially robust segmentation models at limited computational
cost by fine-tuning robust backbones.