An Adversarial Perturbation Oriented Domain Adaptation Approach for Semantic Segmentation

We focus on Unsupervised Domain Adaptation (UDA) for the task of semantic segmentation. Recently, adversarial alignment has been widely adopted to match the marginal distribution of feature representations across two domains globally. However, this strategy fails in adapting the representations of the tail classes or small objects for semantic segmentation since the alignment objective is dominated by head categories or large objects. In contrast to adversarial alignment, we propose to explicitly train a domain-invariant classifier by generating and defensing against pointwise feature space adversarial perturbations. Specifically, we firstly perturb the intermediate feature maps with several attack objectives (i.e., discriminator and classifier) on each individual position for both domains, and then the classifier is trained to be invariant to the perturbations. By perturbing each position individually, our model treats each location evenly regardless of the category or object size and thus circumvents the aforementioned issue. Moreover, the domain gap in feature space is reduced by extrapolating source and target perturbed features towards each other with attack on the domain discriminator. Our approach achieves the state-of-the-art performance on two challenging domain adaptation tasks for semantic segmentation: GTA5 -> Cityscapes and SYNTHIA -> Cityscapes.


page 1

page 3

page 7


Significance-aware Information Bottleneck for Domain Adaptive Semantic Segmentation

For unsupervised domain adaptation problems, the strategy of aligning th...

Taking A Closer Look at Domain Shift: Category-level Adversaries for Semantics Consistent Domain Adaptation

We consider the problem of unsupervised domain adaptation in semantic se...

More Separable and Easier to Segment: A Cluster Alignment Method for Cross-Domain Semantic Segmentation

Feature alignment between domains is one of the mainstream methods for U...

Cluster-to-adapt: Few Shot Domain Adaptation for Semantic Segmentation across Disjoint Labels

Domain adaptation for semantic segmentation across datasets consisting o...

On Direct Distribution Matching for Adapting Segmentation Networks

Minimization of distribution matching losses is a principled approach to...

A Dual Adversarial Calibration Framework for Automatic Fetal Brain Biometry

This paper presents a novel approach to automatic fetal brain biometry m...

FDA: Fourier Domain Adaptation for Semantic Segmentation

We describe a simple method for unsupervised domain adaptation, whereby ...


Semantic segmentation is a fundamental problem in computer vision with many applications in robotics, autonomous driving, medical diagnosis, image editing, etc. The goal is to assign each pixel with a semantic category. Recently, this field has gained remarkable progress via training deep convolutional neural networks (CNNs)

[18] on large scale human annotated datasets [6]. However, models trained on specific datasets may not generalize well to novel scenes (see Figure 1(b)) due to the inevitable visual domain gap between training and testing datasets. This seriously limits the applicability of the model in diversified real-world scenarios. For instance, an autonomous vehicle might not be able to sense its surroundings in a new city or a changing weather condition. To this end, learning domain-invariant representations for semantic segmentation has drawn increasing attentions.

(a) RGB image
(b) Without adaptation
(c) ASN (Tsai et al. 2018)
(d) Ours
Figure 1: Comparison of semantic segmentation output. This example shows our method can evenly capture information of different categories, while classical adversarial alignment method such as ASN [29] might collapse into head (i.e., background) classes or large objects.

Towards the above goal, Unsupervised Domain Adaptation (UDA) has shown promising results [30, 22]. UDA aims to close the gap between the annotated source domain and unlabeled target domain by learning domain-invariant while task-discriminative representations. Recently, adversarial alignment has been recognized as an effective way to obtain such representations [14, 13]. Typically, in adversarial alignment, a discriminator is trained to distinguish features or images from different domains, while the deep learner tries to generate features to confuse the discriminator. Recent representative approach ASN [29] is proposed to match the source and target domains in the output space and has achieved promising results.

However, adversarial alignment based approaches can be easily overwhelmed by dominant categories (i.e., background classes or large objects). Since the discriminator is only trained to distinguish the two domains globally, it can not produce category-level or object-level supervisory signal for adaptation. Thus, the generator is not enforced to evenly capture category-specific or object-specific information and fails to adapt representations for the tail categories. We term this phenomenon as category-conditional shift and highlight it in the Figure 1

. ASN performs well in adapting head categories (e.g., road) and gains improvement when viewed globally, but fails to segment the tail categories such as “sign”, “bike”. Missing the small instances (e.g., traffic light) is generally intolerable in real-world applications. While we can moderate this issue by equipping the segmentation objective with some heuristic re-weighting schemes

[1], those solutions usually rely on implicit assumptions about the model or the data (e.g., L-Lipschitz condition, overlapping support [31]), which are not necessarily met in real-world scenarios. In our case, we empirically show that the adaptability achieved by those approximate strategies are sub-optimal.

In this paper, we propose to perform domain adaptation via feature space adversarial perturbation inspired by [10]. Our approach mitigates the category-conditional shift by iteratively generating pointwise adversarial perturbations and then defensing against them for both the source and target domains. Specifically, we firstly perturb the feature representations for both source and target samples by appending gradient perturbations to their original features. The perturbations are derived with adversarial attacks on the discriminator to assist in filling in the representation gap between source and target, as well as the classifier to capture the vulnerability of the model. This procedure is facilitated with the proposed Iterative Fast Gradient Sign Preposed Method (I-FGSPM) to mitigate the huge gradient gap among multiple attack objectives. Taking the original and perturbed features as inputs, the classifier is further trained to be domain-invariant by defensing against the adversarial perturbations, which is guided by the source domain segmentation supervision and the target domain consistency constraint.

Instead of aligning representations across domains globally, our perturbation based strategy is conducted on each individual position of the feature maps, and thus can capture the information of different categories evenly and alleviate the aforementioned category-conditional shift issue. In addition, the adversarial features also capture the vulnerability of the classifier, thus the adaptability and capability of the model in handling hard examples (typically tail classes or small objects) is further improved by defensing against the perturbations. Furthermore, since we extrapolate the source adversarial features towards the target representations to fill in the domain gap, our classifier can be aware of the target features as well as receiving source segmentation supervision, which further promotes our classifier to be domain-invariant. Extensive experiments on GTA5 Cityscapes and SYNTHIA Cityscapes have verified the state-of-the-art performance of our method.

Figure 2: Framework Overview. We illustrate step 2 in the shaded area where source features are taken as an example. In light of extracted from the feature extractor , we employ the multi-objective adversarial attack with our proposed I-FGSPM on the classifier as well as discriminator and then accumulate the gradient maps. Therefore, we obtain the mutated features after appending the perturbations to the original copies. Furthermore, these perturbed and original features are trained by an adversarial training procedure (i.e., step 3), which is presented in the upper right. We have highlighted the different training objectives for the output maps of their corresponding domains, which are predicted by the classifier and then followed by the discriminator to produce domain prediction maps. The green and red colors stand for the source and target flows respectively.

Related Work

Semantic Segmentation is a highly active and important research area in visual tasks. Recent fully convolutional network based methods [3, 33] have achieved remarkable progress in this field by training deep convolutional neural networks on numerous pixel-wise annotated images. However, building such large-scale datasets with dense annotations takes expensive human labor. An alternative approach is to train model on synthetic data (e.g., GTA5 [24], SYNTHIA [25]) and transfer to real-world data. Unfortunately, even a subtle departure from the training regime can cause catastrophic model degradation when generalized into new environments. The reason lies in the different data distributions between source and target domains, known as domain shift.
Unsupervised Domain Adaptation approaches have achieved remarkable success in addressing aforementioned problem. Existing methods mainly focus on minimizing the statistic distance such as Maximum Mean Discrepancy (MMD) of two domains [20, 21]. Recently, inspired by GAN [11], adversarial learning is successfully explored to entangle feature distributions from different domains [8, 9]. hoffman2016fcns hoffman2016fcns applied feature-level adversarial alignment method in UDA for semantic segmentation. Several following works improved this framework for pixel-wise domain adaption [4, 5]. Besides alignment in the bottom feature layers, tsai2018learning tsai2018learning found that output space adaptation via adversarial alignment might be more effective. vu2019advent vu2019advent further proposed to align output space entropy maps. On par with feature-level and output space alignment methods, the remarkable progress of unpaired image to image translation [34] inspired several methods to address pixel-level adaptation problems [13, 32]. Among some other approaches, zou2018unsupervised zou2018unsupervised used self-training strategy to generate pseudo labels for unlabeled target domain. saito2017asymmetric saito2017asymmetric utilized tri-training to assign pseudo labels and obtain target-discriminative representations, while luo2019taking luo2019taking proposed to compose tri-training and adversarial alignment strategies to enforce category-level feature alignment. And saito2018maximum saito2018maximum used two-branch classifiers and generator to minimize distance. Recently, Xu_2019_ICCV Xu_2019_ICCV reveals that progressively adapting the task-specific feature norms of the source and target domains to a large range of values can result in significant transfer gains.
Adversarial Training

injects perturbed examples into training data to increase robustness. These perturbed examples are designed for fooling machine learning models. To the best of our knowledge, adversarial training strategy is originated in

[28] and further studied by goodfellow2014explaining goodfellow2014explaining. Several attack methods are further designed for efficiently generating adversarial examples [16, 7]. As for UDA, volpi2018generalizing volpi2018generalizing generated adversarial examples to adaptively augment the dataset. liu2019transferable liu2019transferable produced transferable examples to fill in the domain gap and adapt classification decision boundary. However, the above approach is only validated on the classification task for unsupervised domain adaptation. Our approach shares similar spirit with liu2019transferable, while we investigate adversarial training in the field of semantic segmentation to generate pointwise perturbations that improve the robustness and domain invariance of the learners.


Considering the problem of unsupervised domain adaptation in semantic segmentation. Formally, we are given a source domain and a target domain . We have access to the source data with pixel-level labels and the target data without labels. Our overall framework is shown in Figure 2. Feature extractor takes images and as inputs and produces intermediate feature maps and ; Classifier takes features and from as inputs and predicts -dimensional segmentation softmax outputs and ; Discriminator is a CNN-based binary classifier with a fully-convolutional output to distinguish whether the input ( or ) is from the source or target domain.

To address aforementioned category-conditional shift, we propose a framework that alternatively generates pointwise perturbations with multiple attack objectives and defenses against these perturbed copies via an adversarial training procedure. Since our framework conducts perturbations for each point independently, it circumvents the interference of different categories. Our learning procedure can also be seen as a form of active learning or hard example mining, where the model is enforced to minimize the worst case error when features are perturbed by adversaries. Our framework consists of three steps as follow:

Step 1: Initialize and . We train both the feature extractor and classifier with source samples. Since we need and to learn task-specific feature representations, this step is crucial. Specifically, we train the feature extractor and classifier by minimizing cross entropy loss as follow:


where input image size is with categories, and is the softmax segmentation map produced by the classifier.

Step 2: Generation of adversarial features. The adversarial features are initialized with extracted by from , and iteratively updated with our proposed I-FGSPM combining several attack objectives. These perturbed features are designed to confuse the discriminator and the classifier with our tailored attack objectives.

Step 3: Training with adversarial features. With adversarial features from step 2, it is crucial to set proper training objectives to defense against the perturbations and enable the classifier to produce consistent predictions. Besides, robust classifier and discriminator can contiguously generate confusing adversarial features for further training.

During training, we freeze after step 1, and alternate step 2 and step 3 to obtain a robust classifier against domain shift as well as category-conditional shift. We detail the step 2 and step 3 in the following sections.

Generation of Adversarial Features

In this part, we first introduce the attack objectives and then propose our Iterative Fast Gradient Sign Preposed Method (I-FGSPM) for combining multiple attack objectives.

Attack objectives.

On the one hand, the generated perturbations are supposed to extrapolate the features towards domain-invariant regions. Therefore, they are expected to confuse the discriminator which aims to distinguish source domain from the target one by minimizing the loss function in Eq. (

2), so that the gradient of is capable of producing perturbations that help fill in the domain gap.


On the other hand, to further improve the robustness of the classifier, the adversarial features should capture the vulnerability of the model (e.g., the tendency of classifier to collapse into head classes). In this regard, we conduct an adversarial attack on segmentation classifier and employ the Lovász-Softmax [1] as our attack objective in Eq (3

). Since the perturbations are actually hard examples for the classifier, they carry rich information of the failure mode of the segmentation classifier. Lovász-Softmax is a smooth version of the jaccard index and we empirically show that our attack objective can produce proper segmentation perturbations as well as boosting the adaptability of the model.


In addition, excessive perturbations might degenerate the semantic information of feature maps, so that we control the -distance between the original features and their perturbed copies to self-adaptively constraint their divergence. Eventually, we accumulate gradient maps from all attack objectives and generate adversarial features with our proposed Iterative Fast Gradient Sign preposed Method (I-FGSPM).

Original I-FGSM. While we can follow the practice in [17] to directly regard the gradients as perturbations, we have empirically found that this strategy may suffer from gradient vanishing in our case. Instead, we draw a link from adversarial attack to generate more stable and reasonable perturbations. Specifically, to generate the perturbations, we adopt the Iterative Fast Gradient Sign Method (I-FGSM) [16] as Eq. (4):


where , and indicate the hyper-parameters to balance the gradients values from different attack objectives and represents the magnitude of the overall perturbation. We repeat this generating process for iterations with . It is noteworthy that .

However, this practice also raises some concerns when we execute I-FGSM under the circumstance of multiple adversarial attack objectives. Such concerns are attributed to the significant gradient gaps among different attack objectives. It is worth mentioning that, at each iteration, the final signs of the accumulated gradients are indeed dominated by one of the attack objectives. As illustrated in Figure 3, we plot the gradient log-intensity of each attack objective by using Eq. (4) to obtain adversarial features. In Figure 3, the gradients of and alternatively surpasses the others overwhelmingly with at least several orders of magnitude and therefore determine the final signs. Furthermore, the gradient value of a specific attack objective fluctuates by varying iterations and does not appear proportional tendency with its counterparts, so that it is not trivial to balance the gradient perturbations by simply adjusting the trade-off constants.

Our I-FGSPM. To this end, we propose the Iterative Fast Gradient Sign Preposed Method (I-FGSPM) to fully exploit the contributions of each individual attack objective. Rather than placing the sign operator at the end of the overall gradient fusion which suffers from the gradient domination issue, we instead put ahead the sign calculations of each adversarial gradient and then balance these signed perturbations with intensity . The procedure is formulated as Eq. (5) and (6) for target and source perturbations respectively.

Figure 3: Gradient log-intensity tendencies with I-FGSM method in generation procedure.




















ASN [29] 87.3 29.8 78.6 21.1 18.2 22.5 21.5 11.0 79.7 29.6 71.3 46.8 6.5 80.1 23.0 26.9 0.0 10.6 0.3 35.0
CLAN [22] 88.0 30.6 79.2 23.4 20.5 26.1 23.0 14.8 81.6 34.5 72.0 45.8 7.9 80.5 26.6 29.9 0.0 10.7 0.0 36.6
Ours 88.4 34.2 77.6 23.7 18.3 24.8 24.9 12.4 80.7 30.4 68.6 48.9 17.9 80.8 27.0 27.2 6.2 19.1 10.2 38.0
Source Only 75.8 16.8 77.2 12.5 21.0 25.5 30.1 20.1 81.3 24.6 70.3 53.8 26.4 49.9 17.2 25.9 6.5 25.3 36.0 36.6
ASN [29] 86.5 25.9 79.8 22.1 20.0 23.6 33.1 21.8 81.8 25.9 75.9 57.3 26.2 76.3 29.8 32.1 7.2 29.5 32.5 41.4
CLAN [22] 87.0 27.1 79.6 27.3 23.3 28.3 35.5 24.2 83.6 27.4 74.2 58.6 28.0 76.2 33.1 36.7 6.7 31.9 31.4 43.2
AdvEnt[30] 89.9 36.5 81.6 29.2 25.2 28.5 32.3 22.4 83.9 34.0 77.1 57.4 27.9 83.7 29.4 39.1 1.5 28.4 23.3 43.8
ASN + Weighted CE 82.8 42.4 77.1 22.6 21.8 28.3 35.9 27.4 80.2 25.0 77.2 58.1 26.3 59.4 25.7 32.7 3.6 29.0 31.4 41.4
ASN + Lovász 88.0 28.6 80.7 23.6 14.8 25.9 33.3 19.6 82.8 31.1 74.9 58.1 24.6 72.6 34.2 31.2 0.0 24.9 36.4 41.3
Ours 85.6 32.8 79.0 29.5 25.5 26.8 34.6 19.9 83.7 40.6 77.9 59.2 28.3 84.6 34.6 49.2 8.0 32.6 39.6 45.9
Table 1: Results of adapting GTA5 to Cityscapes. The tail classes are highlighted in blue. The top and bottom parts correspond to VGG-16 and ResNet-101 based model separately.

Training with Adversarial Features

Now, we are equipped with adversarial features which can reduce the domain gap and capture the vulnerability of the classifier. To obtain a domain-invariant classifier and a robust domain discriminator , we should design proper constraints that can guide the learning process to utilize these adversarial features to train and .

For this purpose, the solution appears straightforward for the source domain since we still hold the strong supervision for its adversarial features . On the contrary, when it comes to the unlabeled target domain, we are supposed to explore other supervision signals to satisfy the goal. Our considerations are two folds. First, we follow the practice in [17] that forces the classifier to make consistent predictions for and as follow:


Noted that this action does not guarantee the discriminative and reductive information for specific tasks. Instead, as the perturbations intend to confuse the classifier, the prediction maps of adversarial features are empirically subject to have more uncertainty with increasing entropy. To address this issue, we draw on the idea of the entropy minimization technique [27, 19] as Eq (8) to provide extra supervision, which can be viewed as a soft-assignment variant of the pseudo-label cross entropy loss [30].


Finally, by combining the objectives in (3), (7) and (8), we are capable of obtaining robust and discriminative classifier as follow, where , and are trade-off factors:


In addition, we conduct a similar procedure to defense against domain-related perturbations, which forces the discriminator to assign the same domain labels for the mutated features with respect to their original ones. Furthermore, it is beneficial for the discriminator to contiguously generate perturbations that extrapolate the features towards more domain-invariant regions and then bridge the domain discrepancy more effectively.



We evaluate our method along with several state-of-the-art algorithms on two challenging synthesized-2-real UDA benchmarks, i.e., GTA5 Cityscapes and SYNTHIA Cityscapes. Cityscapes is a real-world image dataset, consisting of 2,975 images for training and 500 images for validation. GTA5 contains 24,966 synthesized frames captured from the video game. We use the 19 classes of GTA5 in common with the Cityscapes for adaptation. SYNTHIA is a synthetic urban scenes dataset with 9,400 images. Similar to vu2019advent vu2019advent, We train our model with 16 common classes in both SYNTHIA and Cityscapes, and evaluate the performance on 13-class subsets.















ASN [29] 78.9 29.2 75.5 0.1 4.8 72.6 76.7 43.4 8.8 71.1 16.0 3.6 8.4 37.6
CLAN [22] 80.4 30.7 74.7 1.4 8.0 77.1 79.0 46.5 8.9 73.8 18.2 2.2 9.9 39.3
Ours 82.9 31.4 72.1 10.4 9.7 75.0 76.3 48.5 15.5 70.3 11.3 1.2 29.4 41.1
Source Only 55.6 23.8 74.6 6.1 12.1 74.8 79.0 55.3 19.1 39.6 23.3 13.7 25.0 38.6
ASN [29] 79.2 37.2 78.8 9.9 10.5 78.2 80.5 53.5 19.6 67.0 29.5 21.6 31.3 45.9
CLAN [22] 81.3 37.0 80.1 16.1 13.7 78.2 81.5 53.4 21.2 73.0 32.9 22.6 30.7 47.8
AdvEnt [30] 87.0 44.1 79.7 4.8 7.2 80.1 83.6 56.4 23.7 72.7 32.6 12.8 33.7 47.6
ASN + Weighted CE 74.9 37.6 78.1 10.5 10.2 76.8 78.3 35.3 20.1 63.2 31.2 19.5 43.3 44.5
ASN + Lovász 77.3 40.0 78.3 14.4 13.7 74.7 83.5 55.7 20.9 70.2 23.6 19.3 40.5 47.1
Ours 86.4 41.3 79.3 22.6 17.3 80.3 81.6 56.9 21.0 84.1 49.1 24.6 45.7 53.1
Table 2: Results of adapting SYNTHIA to Cityscapes. The tail classes are highlighted in blue.

Implementations details

We use PyTorch for implementation. Similar to tsai2018learning tsai2018learning, we utilize the DeepLab-v2

[3] as our backbone segmentation network. We employ Atrous Spatial Pyramid Pooling (ASPP) as classifier followed by an up-sampling layer with softmax output. For domain discriminator , we use the one in DCGAN [23]

but exclude batch normalization layers. Our experiments are based on two different network architectures: VGG-16 

[26] and ResNet-101 [12]. During training, we use SGD [2] for and with momentum 0.9, learning rate and weight decay . We use Adam [15] with learning rate to optimize . And we follow the polynomial annealing procedure [3] to schedule the learning rate. When generating adversarial features, the iteration of I-FGSPM is set to 3. Note that we set the , and in Eq. (5) and (6) as , and separately. , and are , and separately.

Figure 4: Category distribution on GTA5 Cityscapes.

Result Analysis

We compare our model with several state-of-the-art domain adaptation methods on semantic segmentation performance in terms of mIoU. Table 1 shows that our ResNet-101 based model brings +9.3% gain compared to source only model on GTA5 Cityscapes. Besides, our method also outperforms state-of-the-arts over +1.4% and +2.1% in mIoU on VGG-16 and ResNet-101 separately. To further illustrate the effectiveness of our method on tail classes, we show the marginal category distributions counted in 19 common classes on GTA5 and Cityscapes datasets in Figure 4, and highlight the tail classes with blue in Table 1. For example, the category “bike” accounts for only 0.01% ratio in the GTA5 category distribution, and the ResNet-101 based adversarial alignment methods suffer from a huge performance degradation compared to the source only model. Specifically, AdvEnt can deliver a +7.2% performance improvement on average, but the category “bike” itself suffers 12.7% performance degradation. On the contrary, our approach can still improve the performance of the “bike” category by benefiting from the pointwise perturbation strategy. In fact, our framework can achieve the best performance at the majority of tail categories, showing the effectiveness of our algorithm in mitigating the category-conditional shift.

Table 2 provides the comparative performance on SYNTHIA

Cityscapes. SYNTHIA has significantly different layouts as well as viewpoints compared to Cityscapes, and less training samples than GTA5. Hence, models trained in SYNTHIA might suffer from serious domain shift when generalized into Cityscapes. It is noteworthy that our adversarial perturbation framework generates hard examples that strongly resist adaptation, thus our model can efficiently improve performance in the difficult task by considering these augmented features. As a result, our method significantly outperforms the state-of-the-art methods by +1.8% and +5.5% in mIoU based on VGG-16 and ResNet-101 separately. Specifically, even when compared to CLAN method, which aims at aligning category-level joint distribution, our framework still achieves higher performance on tail classes. Some qualitative results are presented in Figure 


Furthermore, we re-implement ASN with some category balancing mechanisms (e.g., weighted cross entropy and Lovász-Softmax loss) based on ResNet-101 for fair comparison. As shown in Table 1 and 2, we show that only ASN + Lovász brings +1.2% gain in SYNTHIA Cityscapes, while others even suffer from performance degradation. As shown in Figure 4 and 5, marginal category distributions are varying across domains, and thus re-weighting mechanisms can not guarantee adaptability on the target domain.

Figure 5: Category distribution on SYNTHIA Cityscapes.
Figure 6: Qualitative results of UDA segmentation for SYNTHIA Cityscapes. Along with each target image and its corresponding ground truth, we present the results of source only model (without adaptation), ASN and ours respectively.

Ablation Study

Different Attack Methods. A basic problem of our framework is how to generate proper perturbations. We compare several attack methods widely used in adversarial attack community and their modified sign-preposed versions. Specifically, we compare our proposed I-FGSPM with I-FGSM and modified sign-preposed version of FGSM [10] as well as Momentum I-FGSM (MI-FGSM) [7]. Furthermore, we also provide a “None” version without any attacks. As illustrated in Table 3, ResNet-101 based adversarial attack methods bring obvious gain against “None” version. With sign-preposed operation, our I-FGSPM achieves +1.3% improvement compared to I-FGSM. FGSPM is the non-iterative version of our I-FGSPM and achieves comparable performance against I-FGSPM. Note that though MI-FGSM achieves remarkable results in adversarial attacks area, its sign-preposed version MI-FGSPM might excessively enlarge the divergence between original features with adversarial features, and causes performance degradation when employed by our framework.

Attack Method (SYNTHIA)
None 44.8
I-FGSM 51.8
FGSPM 52.9
I-FGSPM (Ours) 53.1
Table 3: Evaluation on different attack methods.

Different perturbing layers. One natural question is whether it is better to perturb the input or the hidden layers of model. szegedy2013intriguing szegedy2013intriguing reported that adversarial perturbations yield the best regularization when applied to the hidden layers. Our experiments with ResNet-101 shown in Table 4 also verify that perturbing in feature-level achieves the best result. These might boil down to that the activation of hidden units can be unbounded and very large when perturbing the hidden layers [10]. We also find that perturbing deeper hidden layers can further benefit our framework.

Pixel-level 50.4
After layer1 45.0
After layer2 49.8
After layer3 50.6
After layer4 (Ours) 53.1
Table 4: Evaluation on different perturbing layers.
Base Perturbation Lovász Entropy mIoU (GTA5) (SYN)
S 36.6 38.6
S 35.0 41.3
S 41.8 42.5
S 38.5 44.8
S 41.7 45.7
S 44.6 49.9
S 43.6 47.0
S 45.9 53.1
ASN 41.4 45.9
ASN 42.3 47.4
ASN 45.2 52.9
Table 5: Ablation studies of each component. “S” represents our strategy as discussed in step 1 while “ASN” indicates that our network weights are pre-trained by ASN in step 1.

Component Analysis. We study how each component affects overall performance in terms of mIoU based on ResNet-101. As shown in the top part of Table 5, starting with source only model trained with Lovász-Softmax, we notice that the effect of Lovász-Softmax loss varies across different UDA tasks, which might depend on how different the marginal distributions across two domains are. Entropy minimization strategy can bring improvement on both benchmarks but lead to strong class biases, which has been verified in AdvEnt [30], while our overall model not only significantly lifts mIoU, but also remarkably alleviates category biases specially for tail classes.

As illustrated in the bottom part of Table 5, we consider our basic training strategy in step 1 as a component, and replace it with ASN. By cooperating with our perturbations strategy, ours + ASN brings +3.8% and +7.0% gain, while ASN + Lovàsz + Entropy only gets +0.9% and +1.5% improvement against ASN on GTA5 to Cityscapes and SYNTHIA to Cityscapes separately. A possible reason is that ASN can shape the feature extractor biased towards the head classes and miss representations from tail classes.


In this paper, we reveal that adversarial alignment based segmentation DA might be dominated by head classes and fail to capture the adaptability of different categories evenly. To address this issue, we proposed a novel framework that iteratively exploits our improved I-FGSPM to extrapolate the perturbed features towards more domain-invariant regions and defenses against them via an adversarial training procedure. The virtues of our method lie in not only the adaptability of model but that it circumvents the intervention among different categories. Extensive experiments have verified that our approach significantly outperforms the state-of-the-arts, especially for the hard tail classes.


  • [1] M. Berman, A. Rannen Triki, and M. B. Blaschko (2018) The lovász-softmax loss: a tractable surrogate for the optimization of the intersection-over-union measure in neural networks. In CVPR, pp. 4413–4421. Cited by: Introduction, Generation of Adversarial Features.
  • [2] L. Bottou (2010)

    Large-scale machine learning with stochastic gradient descent

    In Proceedings of COMPSTAT’2010, pp. 177–186. Cited by: Implementations details.
  • [3] L. Chen, G. Papandreou, I. Kokkinos, K. Murphy, and A. L. Yuille (2017) Deeplab: semantic image segmentation with deep convolutional nets, atrous convolution, and fully connected crfs. IEEE T-PAMI 40 (4), pp. 834–848. Cited by: Related Work, Implementations details.
  • [4] Y. Chen, W. Chen, Y. Chen, B. Tsai, Y. Frank Wang, and M. Sun (2017) No more discrimination: cross city adaptation of road scene segmenters. In ICCV, pp. 1992–2001. Cited by: Related Work.
  • [5] Y. Chen, W. Li, and L. Van Gool (2018) Road: reality oriented adaptation for semantic segmentation of urban scenes. In CVPR, pp. 7892–7901. Cited by: Related Work.
  • [6] M. Cordts, M. Omran, S. Ramos, T. Rehfeld, M. Enzweiler, R. Benenson, U. Franke, S. Roth, and B. Schiele (2016-06)

    The cityscapes dataset for semantic urban scene understanding

    In CVPR, Cited by: Introduction.
  • [7] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li (2018) Boosting adversarial attacks with momentum. In CVPR, pp. 9185–9193. Cited by: Related Work, Ablation Study.
  • [8] Y. Ganin and V. Lempitsky (2014)

    Unsupervised domain adaptation by backpropagation

    arXiv preprint arXiv:1409.7495. Cited by: Related Work.
  • [9] Y. Ganin, E. Ustinova, H. Ajakan, P. Germain, H. Larochelle, F. Laviolette, M. Marchand, and V. Lempitsky (2016) Domain-adversarial training of neural networks. JMLR 17 (1), pp. 2096–2030. Cited by: Related Work.
  • [10] I. J. Goodfellow, J. Shlens, and C. Szegedy (2014) Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. Cited by: Introduction, Ablation Study, Ablation Study.
  • [11] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio (2014) Generative adversarial nets. In NeuralIPS, pp. 2672–2680. Cited by: Related Work.
  • [12] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In CVPR, pp. 770–778. Cited by: Implementations details.
  • [13] J. Hoffman, E. Tzeng, T. Park, J. Zhu, P. Isola, K. Saenko, A. A. Efros, and T. Darrell (2017) Cycada: cycle-consistent adversarial domain adaptation. arXiv preprint arXiv:1711.03213. Cited by: Introduction, Related Work.
  • [14] J. Hoffman, D. Wang, F. Yu, and T. Darrell (2016) Fcns in the wild: pixel-level adversarial and constraint-based adaptation. arXiv preprint arXiv:1612.02649. Cited by: Introduction.
  • [15] D. P. Kingma and J. Ba (2014) Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980. Cited by: Implementations details.
  • [16] A. Kurakin, I. Goodfellow, and S. Bengio (2016) Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533. Cited by: Related Work, Generation of Adversarial Features.
  • [17] H. Liu, M. Long, J. Wang, and M. Jordan (2019) Transferable adversarial training: a general approach to adapting deep classifiers. In ICML, pp. 4013–4022. Cited by: Generation of Adversarial Features, Training with Adversarial Features.
  • [18] J. Long, E. Shelhamer, and T. Darrell (2015) Fully convolutional networks for semantic segmentation. In CVPR, pp. 3431–3440. Cited by: Introduction.
  • [19] M. Long, Y. Cao, Z. Cao, J. Wang, and M. I. Jordan (2018) Transferable representation learning with deep adaptation networks. IEEE T-PAMI. Cited by: Training with Adversarial Features.
  • [20] M. Long, Y. Cao, J. Wang, and M. I. Jordan (2015) Learning transferable features with deep adaptation networks. arXiv preprint arXiv:1502.02791. Cited by: Related Work.
  • [21] M. Long, H. Zhu, J. Wang, and M. I. Jordan (2017)

    Deep transfer learning with joint adaptation networks

    In ICML, pp. 2208–2217. Cited by: Related Work.
  • [22] Y. Luo, L. Zheng, T. Guan, J. Yu, and Y. Yang (2019) Taking a closer look at domain shift: category-level adversaries for semantics consistent domain adaptation. In CVPR, pp. 2507–2516. Cited by: Introduction, Table 1, Table 2.
  • [23] A. Radford, L. Metz, and S. Chintala (2015) Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434. Cited by: Implementations details.
  • [24] S. R. Richter, V. Vineet, S. Roth, and V. Koltun (2016) Playing for data: ground truth from computer games. In ECCV, pp. 102–118. Cited by: Related Work.
  • [25] G. Ros, L. Sellart, J. Materzynska, D. Vazquez, and A. M. Lopez (2016) The synthia dataset: a large collection of synthetic images for semantic segmentation of urban scenes. In CVPR, pp. 3234–3243. Cited by: Related Work.
  • [26] K. Simonyan and A. Zisserman (2014) Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556. Cited by: Implementations details.
  • [27] J. T. Springenberg (2015)

    Unsupervised and semi-supervised learning with categorical generative adversarial networks

    arXiv preprint arXiv:1511.06390. Cited by: Training with Adversarial Features.
  • [28] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. Cited by: Related Work.
  • [29] Y. Tsai, W. Hung, S. Schulter, K. Sohn, M. Yang, and M. Chandraker (2018) Learning to adapt structured output space for semantic segmentation. In CVPR, pp. 7472–7481. Cited by: Figure 1, Introduction, Table 1, Table 2.
  • [30] T. Vu, H. Jain, M. Bucher, M. Cord, and P. Pérez (2019) Advent: adversarial entropy minimization for domain adaptation in semantic segmentation. In CVPR, pp. 2517–2526. Cited by: Introduction, Training with Adversarial Features, Table 1, Table 2, Ablation Study.
  • [31] Y. Wu, E. Winston, D. Kaushik, and Z. Lipton (2019) Domain adaptation with asymmetrically-relaxed distribution alignment. arXiv preprint arXiv:1903.01689. Cited by: Introduction.
  • [32] Y. Zhang, Z. Qiu, T. Yao, D. Liu, and T. Mei (2018) Fully convolutional adaptation networks for semantic segmentation. In CVPR, pp. 6810–6818. Cited by: Related Work.
  • [33] H. Zhao, J. Shi, X. Qi, X. Wang, and J. Jia (2017) Pyramid scene parsing network. In CVPR, pp. 2881–2890. Cited by: Related Work.
  • [34] J. Zhu, T. Park, P. Isola, and A. A. Efros (2017)

    Unpaired image-to-image translation using cycle-consistent adversarial networks

    In ICCV, pp. 2223–2232. Cited by: Related Work.