Fig. 1

An example of a remote adversarial attack on a segmentation model. Here the patch has been designed to alter a predetermined location (the red box) to the class of ‘pavement’. The same patch works on different images and with different positions and scales