DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches
Authors: Yun Xing
Yue Cao
Nhat Chung
Jie Zhang
Ivor Tsang
Ming-Ming Cheng
Yang Liu
Lei Ma
Qing Guo
Venue: NeurIPS 2025 poster ()
Keywords: Adversarial Attack
Depth Estimation
Stereo Matching
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Stereo depth estimation is a critical task in autonomous driving and robotics, where inaccuracies (such as misidentifying nearby objects as distant) can lead to dangerous situations. Adversarial attacks against stereo depth estimation can help revealing vulnerabilities before deployment. Previous works have shown that repeating optimized textures can effectively mislead stereo depth estimation in digital settings. However, our research reveals that these naively repeated textures perform poorly in physical implementations, $\textit{i.e.}$, when deployed as patches, limiting their practical utility for stress-testing stereo depth estimation systems. In this work, for the first time, we discover that introducing regular intervals among the repeated textures, creating a grid structure, significantly enhances the patch attack performance. Through extensive experimentation, we analyze how variations of this novel structure influence the adversarial effectiveness. Based on these insights, we develop a novel stereo depth attack that jointly optimizes both the interval structure and texture elements. Our generated adversarial patches can be inserted into any scenes and successfully attack advanced stereo depth estimation methods of different paradigms, $\textit{i.e.}$, RAFT-Stereo and STTR. Most critically, our patch can also attack commercial RGB-D cameras (Intel RealSense) in real-world conditions, demonstrating their practical relevance for security assessment of stereo systems. The code is officially released at: https://github.com/WiWiN42/DepthVanish

Depth Vanish: Optimizing Adversarial Interval Structures for Steree-Deeth-Innisibble Patches
Yun Xing Yue Cao
1,2,5+
Nhat Chung
Jie Zhang Ivor Tsang
Ming-Ming Cheng23 Yang Liu
Lei Ma Qing Guo 2.5f
University of Alberta, Canada VCIP, CS. Nankai University, China
NKIARI, Shenzhen Futian, China
Thhe University of Tokyo. Japan
CFAR and IHPC, Agency for Science, Technology and Research (A (A*STAR), Singapore 6 Nanyang Technological University, Singapore
Abstract
Stereo depth estimation is a critical task in autonomous driving and robotics, where inaccuracies (such as misidentifying nearby objects as distant) can lead to danger- ous situations. Adversarial attacks against stereo depth estimation can help reveal vulnerabilities before deployment. Previous works have shown that repeating opti- mized textures can effectively mislead stereo depth estimation in digital settings. However, our research reveals that these naively repeated textures perform poorly in physical implementations, i.e., when deployed patches, limiting their practical utility for stress-testing stereo depth estimation systems. In this work, for the first time, discover that introducing regular intervals among the repeated textures, creating a grid structure, significantly enhances the patch's attack performance. Through extensive experimentation, ture influence the adversarial effectiveness, Based on these insights, we develop novel stereo depth attack that jointly optimizes both the interval structure and texture elements. Our generated adversarial patches can be inserted into any scenes and successfully attack advanced stereo depth estimation methods of different paradigms, i.e., RAFT-Stereo and STTR. Most critically, our patch can also attack commercial RGB-D cameras (Intel RealSense) real-world conditions, demon- strating their practical relevance for security assessment of stereo systems. The code is officially released at: https: //tp:::///ttttt com/ W wttm///www4222/ettteee
analyze how variations of this novel struc-
Introduction
Depth estimation is a crucial component in safety-critical embodied systems like autonomous driving [6] and robotics [3] where accurate perception of the 3D environment is essential for reliable operation. Investigating the errors in depth estimation, such as mistaking nearby objects as distant ones in safety-critical embodied systems 30 S
41 can provide critical insights for safety practices. Most existing works focus on the security vulnerabilities of monocular depth estimation, which relies heavily scene priors from single images. Stereo depth estimation, on the other hand, utilizes geometric constraints and typically provides more robust and metrically accurate results, making it attractive for high-stake applications.
38 8 20
However, despite this inherent advantage, recent studies revealed that DNN-based stereo pipelines remain vulnerable to adversarial attacks, as carefully crafted pixel-level perturbations [I can cause substantial disparity estimation errors. Nevertheless, previous works have primarily addressed digital
indicates equal contribution. This work was done during Yun Xing was an intern at CFAR IHPC, A*STAR and Nankai University. Corresponding author, email: tsinggguo icee.org.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Attaking Stons Doyth Ectevation
Commurtia
RAFT-SErro
Reafferce
IN
Figure Baseline (Stereoscopic vs. our Depth Vanish on attacking RAFT-Sterco and Intel RealSense.
attacks utilizing full- full-image noise, which are impractical in real- wolld contexts due to constraints like limited patch size, varying viewing angles, and dynamic lighting conditions, etc. As illustrated in the first row of Fig. [ when applied as physical patch, the existing Stereoscopic [T] fails to effectively attack RAFT-Stereo and Intel RealSense. This lack of physically realizable and generalizable attack methods presents significant limitation in evaluating the robustness of stereo systems, particularly as stereo estimation continues to be deployed in real-world, safety-critical applications.
In this study, we address these limitations by introducing the first adversarial patch attack that is effective in both digital and physical settings against widely deployed deep stereo depth estimation models (Fig. D second row). Fundamentally, we discover that adding regular intervals among repeated textures to form a spatial structure shows great potential for improving the attack effectiveness and enables cesttal-t--hysiccee influences the attack success. These insights inform a novel optimization pipeline that jointly designs patches' texture and structure achieve high attack effectiveness across models and deployment settings. Thus, we propose a novel optimization pipeline that co-designs both texture elements and interval structure for generating adversarial patches that O remain effective when physically printed and inserted into real scenes, @ work across diverse datasets and environments and @ generalize across different stereo depth estimation models, including commercial RGB-D sensors, i.e., Intel RealSense. In summary, our contributions are as follows,
transferability. Through systematic analysis, show how interval spacing
We introduce the first adversarial attack that is both digitally and physically effective for deep stereo estimation models including the advanced RAFT-Stereo and Stereo Transformer
By conducting comprehensive empirical study, we discover that regular interval spacing among repeated textures significantly improves the patch attack effectiveness and its real- world transferability over naive texture repetitions.
We develop joint optimization algorithm, i.e. Depth Vanish, that co-designs the texture and its spatial structure within the patch to maximize the digital and physical attack effectiveness.
By physically evaluating our patch, we expose severe safety concerns of existing stereo depth estimation systems and highlight the emergency of practical model robustness enhancement.
2
Related Work
Stereo depth estimation. Stereo-based depth estimation is a technique that infers scene depth from visual correspondences. which captured as disparity maps, between pairs of stereo images in various applicable settings 23
24 [5]. Traditional methods typically follow a multi-stage pipeline involving the computation of matching costs, cost aggregation, and optimization to predict and refine 10 In contrast, recent advances have incorporated deep neural networks [2)] enabling end-to-end learning of feature representations for correspondence matching and direct prediction of disparity and/or depth. In particular, CNN-based methods 12 34
35
2
25
disparities [26 4 33
39 22
27 typically
build 3D cost volumes from shared-weight feature encoders, attention based models [18
I 28 [4]
employ vision transformers model global correspondences and disambiguate difficult regions, and iterative refinement methods 19. 16 32 apply a recurrent update operator to progressively converge on the final disparity, avoiding the memory-intensive 3D cost volumes. Compared to monocular methods [36 37), stereo offers improved robustness by leveraging geometric constraints from dual viewpoints, but still faces challenges in low-texture and repetitive areas [1)
Depth estimation attack. Due to their effectiveness and capability for real-time performance, depth estimation systems have become essential components of safety-critical applications such as autonomous driving 6 and robotic navigation [3]. Monocular depth estimation models, in particular, have been extensively studied under both digital [30] 5 38 and physical adversarial

---

50"
Basic Repeat
Interval
Vertical Interval
Predicted Mean Deptn (m)
Norizontal Interval
Grid Interval
30
20
Invervall
Iaterval
7:2+
14.2
10
15
20
Physical Ground-truth Depth (m)
(b) Visualization Different Spacing Strategy Adversarial effect of interval spacing depth prediction. (a) Mean predicted depth (solid lines) and variance (shaded regions) for different interval spacing strategies, averaged interval widths of 2 10 pa. The gray dashed band indicates 1..5 m from the ground truth. (b) Visualization depth prediction results for typical different interval spaced patches where the ground truth depth 7 m.
(a) Performance Different Spacing Strategy
Figure 2:
These evaluations have revealed various system vulnerabilities and led the development of tailored defense strategies [13 7. including adversarial training and robust feature learning. contrast, despite their geometric soundness and widespread deployment, stereo depth estimation systems [19 [7] have received limited attention in adversarial research. Existing research has focused primarily on digital, white-box attacks [3], overlooking potential vulnerabilities the physical world. This gap is particularly concerning, as stereo systems rely precise correspondence between left and right images. Failures such systems can lead to serious consequences, especially in autonomous applications where accurate and reliable 3D perception [35 is critical.
attacks 8 20
3 Motivation
3.1 Naive Repetition Fails in Realistic Patch Attacks
Stereo depth estimation recovers 3D structure by identifying correspondences between left and right images [43] typically formulated as pixel-wise optimization along epipolar lines:
d' (1) arg min C(r,, ().,
(1)
where d Ž represents the horizontal disparity between pixel in the left image and pixel in the right image, and C(z, d) denotes the matching cost between them. When repetitive patterns are presented, the cost volume exhibits periodic ambiguity (6]:
C(x, d) R C(x, d + ns), Vn E
where s denotes the spatial repetition period. This periodicity produces multiple equally plausible matches, thereby increasing the likelihood of incorrect unstable depth estimations.
Previous adversarial attacks D 31 inject repetitive optimized noise over the entire image exploit such periodic ambiguities. Since global injection is impractical in real-world scenarios, instead explore attacks using localized adversarial patches. As shown by the black curve in Fig. aa), we deploy the repetitive noise from [ patch into a real-world scene at different ground-truth depth and plot the corresponding predicted mean depth. It can be seen that simply repeating the noise within patches results in predicted depth that remains same to the ground truth, indicating limited adversarial effectiveness. This is visually confirmed in Fig. ( (top left), where a naive repeated patch yields predicted depth of 7.1 which is almost identical to the ground truth of 7 m. This observation reveals a key limitation of existing studies: naive repetition fails to generate sufficient ambiguity within practical patches, which motivates the need for more structured pattern designs.
3.2 Structured Intervals: Enhancing Patch Adversarial Effectiveness
To address the limitation, we propose introducing regular intervals into the repetitive pattern to amplify the matching ambiguity as E2. thereby enhancing the adversarial effect of the patch.

---

25p
Vertical Ieternal Huriombal
Vertccal of Interva!
Imagge Plane
Predicted Mean Depth (m)
Predicted Dopth (m)
Ground trath Doath (13m)
Ground fruth Depth 115m)
25
-3
X
z
Image Plane
10
20
20
40
50
68
10
20 30 43
50
Rotation Degree
Rotation Degree (*)
(m) Rotation direction
(b) Rotate around axis
(c) Rotate around Y axis
Figure 3: RAFT-Sterco depth prediction performance under various interval structures and patch rotation
degrees. (a) Illustration of rolation around the X and Y axes. (b) Depth prediction performance at different
rotation degrees around X axis. (c) Depth prediction performance different rotation degrees around Y axis.
As demonstrated in Fig. 2bb), given the patch with basic repetitive pattern from []] (top left), we add vertical (top right), horizontal (bottom left) and grid (bottom right) space to form patches with structured intervals. We systematically evaluate the impact of different interval configurations on the RAFT-Stereo model using the KITTI dataset. As shown in Fig. 2 a), structured intervals notably enhance attack effectiveness. 1 Basic Repeat (black): the predicted patch depth remain close to the ground truth depth indicating minimal adversarial influence, which is also verified by the visualization in Fig. (bb) (top left). @ Horizontal Interval (blue): moderate overestimation beyond 15 m (e.g., a 20 m true depth yields ~ 24 prediction). Visual results (Fig. bb). bottom left) confirm slight increase to 7.2 m. @ Vertical Interval (green): produces larger errors, frequently reaching ~ 30 m at 20 m ground truth. In Fig. 2 (top right), the predicted depth surges to 12.7 m. Grid Interval (red): combining intervals in both directions produces the strongest adversarial effect, with depth predictions surpassing 40 m a 23 m ground truth. In the visual result (Fig. ( bottom right), the predicted depth reaches 14.1 m. demonstrating significant adversarial effectiveness.
In summary, structuring the patch with both horizontal and vertical intervals (i.e., grid spacing) greatly increases the adversarial effect of patches, far exceeding the impact of simple repetition. However, also observe two critical limitations: especially when the patch is placed close to the camera. @ the significant variation in performance across different interval configurations suggests that a single fixed interval structure is insufficient.
the overall attack performance remains limited,
3.3 Structured Intervals: Improving Attack Robustness across Viewpoints
practical adversarial patch must maintain its effectiveness even when the patch is rotated viewed from different orientations. This is particularly important under real-world deployment conditions, where precise placement is difficult to control. To this end, systematically evaluate the impact of interval structure on attack robustness against patch rotation. As shown in Fig. 3(a). we rotate the patch along two axes (i.e., X and Y) and summarize the predicted mean depth Fig. (b) and (c).
For X-axis rotation (Fig. b)): the horizontal (blue) and vertical (green) intervals exhibit angle- dependent performance, succeeding only certain angles; @ the grid interval (red) is more robust, demonstrating more consistent effectiveness across different angles. For Y-axis rotation (Figg())) although all configurations show moderate attack robustness across viewpoints, adding intervals still yields improvements. These results show that structured intervals improve attack robustness to patch rotation, which is essential for reliable adversarial attacks in real-world scenarios.
In summary, the above findings underscore the promise of structured intervals but also reveal their limitations under varying depths and configurations. These observations highlight the need for further optimization of the patch's 's texture and structure to achieve more effective attacks.
4 Problem Formulation
To formalize the stereo depth estimation task and define our attack objective, we begin with the following setup. Given a stereo image pair (I,, I,) where I,, I, E 3x of a specific scene, pretrained stereo depth estimation model F(-) predicts the pixel-wise disparity map dpred

---

F(I,I, I,) E R The corresponding depth map is computed as z the focal length and baseline of the stereo camera rig respectively.
fxB where f and B denote dpred
In general, the objective of adversarial patch attack is to construct patch P E x33x,,X, such that the stereo depth estimation model F(-) produces incorrect disparity output for the patch:
where i and i, denote the stereo images with the adversarial patch P. and p indicates the correspond- ing pixel region occupied by the patch within the prediction results. As analyzed in See.B interval spacing can trigger critical depth estimation failures, ie., the disappearance attack. To expose the severity of such vulnerability, we define a more destructive attack objective:
F f,, = 0. s.t. g² =c
where the model predicts zero disparity for the patch region (i.e., infinite depth), despite the ground truth disparity of the patch, d= indicating a fixed, close distance (S B)/c. This attack objective reveals more severe vulnerabilities than Eq. (3) and poses substantial safety risks, particularly when the patch is physically realizable and effective in real-world deployments.
5 Methodology
In this work, we build upon our novel findings in Sec. 3 and propose realizing the attack goal in Eq. 44) by exploiting the attack capability of interval spacing. However, this a non-trivial problem since Eq. 4 requires the patch's ' ground-truth depth to be close but Fig. (a) indicates that interval spacing exerts only limited adversarial effect when the patch is deployed closely. Moreover, the robustness against rotation is critical requirement for the patch to be physically attack effective. Yet we observed in Fig. 33 that the robustness provided by the naive interval strategy is rather limited especially against the rotation of Y axis. As result, it is obvious that an advanced interval spacing strategy required to realize our attack goal as defined Eq.
Fundamentally, interval spacing induces a mask M that partitions the patch P into interval structure P. M @ P and texture content P. (1 M) @ P, such that P P. + P,. Hence, we propose to optimize these components to reveal their ad veressaia effects. Beginning with the naive interval spacing strategy, and thus the mask M, in Sec. [3] we first focus on optimizing the texture content P,, which composed of tiled texture elements E, forming the basis of our Grid-based Attack. We then introduce the Depth Vanish Attack, which jointly optimizes both P, and P. for maximal effect.
5.1 Grid-based Attack
In general, it is straightforward to setup an optimization pipeline for optimizing the texture element with grid intervals, where the patch is formed by repeating the texture elements the grid. Fundamentally, there two main aspects that need to be considered: the physical constraint required for the texture element form patch and the objective function adopted for optimization.
Given our primary goal is to achieve physical attack effectiveness, the patch must comply with the physical geometry constraints during the optimization. Specifically, given user pre-defined physical patch size (u, v) and physical distance to the camera e in meters, we first find the corresponding pixel size of the patch (hp. wp) with the help of stereo calibration information (See details in Sec. 6. Then, we empirically adopt the optimal interval width and number of repetition is from Sec. 3 to
determine the texture element E size (h4, we) as
hp k- k: 11
Wp k.
h1
Wt
(5)
++1
Based on the size of the texture element, the texture component P., and consequently the full patch P. is constructed by tiling the base texture unit E in regular grid pattern as illustrated in Fig. bb) (bottom right). With the correctly assembled and deployed grid-based patch, we set the optimizing objective function as regional mean square error (rMSE) which is formulated as
hp
1
LyMSE
(F -
(6)
hp
Wp
1=1
5

---

Let R be the set of & x k grid locations on where E is repeated. The texture element is updated with average gradients: E -
E - गि. EanER VEC where nj the learning rate. Gradients are only applied to the repeated texture regions while the interval areas remain untouched.
5.2 Depth Vanish Attack
As we will see in Fig. S the above grid-based optimization can successfully mount an attack against various stereo systems but the results still far from our attack goal defined in Eq. 4 Thus we further consider optimizing the interval structure P. simultaneously during the updating of the texture element E. Practically, optimizing the interval structure on patch level will break the texture repetitions as the interval will be updated to have irregular size. To keep the repetitions and incorporate the interval's 's attack capability, we propose to jointly optimize the interval structure within the texture element and, following [1] tile the optimized texture element E to form the final patch.
Same to grid- attack, given to the camera in meters, we first find the corresponding pixel size of the patch (hp, wp). Then we calculate the texture element size (he: W,) by simply dividing (hy,, Wp) to the repetition times k. In order to optimize the texture element so that the interval structure integrated as part of the texture, we propose regularize the texture element during optimization with two objectives. First, we directly cast entropy constraint on the texture element for regularizing its values to be binary, so that a crisp separation is formed to serve as the required interval structure:
pre-defined patch physical size (u, u) and physical distance
he
Ws
Centropy
E,ylog(E:; + + (1 Eiy) Eg + c).
h4
Wt
i=1j=1
However, we experimentally found that the texture element cannot form a clear pattern with only entropy regularization. As result, we further integrate the total variation loss penalizes local pixel-level variation, encouraging the formation of smooth areas:
h1
Leu
E - Eiyl + |E.++1 - Egy-
(8)
14
With the entropy and total variant constraints, we arrived at objective function that can shape clearly interval pattern for the texture element. In summary, the overall objective function adopted for optimization is formulated
L L,MSE + a * Centropy + B * Levr
where a and 33 are the typer-parameters balaneing the sharp border and coherent region requirements. Hence, update with E E 17 गर. E(iDE (ELG)) where 1j is the learning rate.
5.3 Implementation Details.
During the optimization for the Grid-based and Depth Vanish attacks, use a patch with a physical
size (u, = (0.891 m, 1.26 m) and specify the physical ground-truth depth = 5 m. To assemble the number repetition as for horizontal and for vertical, i.e., A (4, 5). For the optimization and corresponding evaluation results with different patch physical setup, we provide them the supplemental material. When the patch is optimized as grid- attack, the optimal interval size = 10 pz from Sec. is applied. As for the loss weights adopted during the depth vanish attack, we keep setting a 0.1 and 3 10. Please find more details of implementation for both Grid-based and Depth Vanish attack in the supplemental material.
the texture element into a patch, we empirically
6 Experiments
6.1 Experimental Setup
Dataset. For the evaluation of digital attack effectiveness, we adopt the stereo images from KITTI scene flow (KITTI-scene) (33 and DrivingStereo (35) datasets. Both datasets are composed of stereo images of urban traffic scenes where the image size of KITTI-scene is (1242, 375) and DrivingSterco

---

Table I: Statistical attack performance of our Depth DepthVanish, Vanish, grid-based patch and existing baselines for PSMNet, DeepPruner, AANet, RAFT-Stereo and STTR on KITTI-scen scene dataset. The best results are highlighted in bold.
KITTI-aene
PSMNe
DeepPrancs
AANet
RAFT-Sioco
FPR
DI
Steeoscoppc
5-20
6.70gaas
15
4.59gnss
Stererpognusia Patch
2.17axue
2.
5.40-1116
1.2:2.1
3.42:2
1.965..44
1.18-1177
2:0
3.02
1.28 TV
Gtrddhaasd Pizch (ours)
L.
48.1 aa
38.0
00.004000
62.81400
40.00.5.77
67.34
0.23
45.84
Deptia Vanisla (ours)
g5
49
67.39 g1 48
66.42.0
g5.54
29.31
06.01
92.38
69.25 g6-49
Stereoscopic
Sterespagnosia
Grid
DepthVanish
Mr
Mi
A4)
189
160
Ma
M, M
Ma
M
Ma
Ma
M4
D1-error
EPE
D1-error
EPE
Attack Performance on DrivingSterep faggy
(d) Attack Performance on DrivingStereo sunny
M,
Mi
My
(4)
M; Ma
Ms M
M,
M3
M.
M:
M.
M3
Ma
M
D1 error
EPE
01-errr
EPE
(d) Attack Performance DrivingStereo-dtodyy Figure 4: Attack performance of our Vepish, Vanish, grid-based patch and existing baselines for PSMNet (MI), DeepPruner (M2), AANet (M3), RAFT-Stereo (M4) and STTR (M5) the sub-sets of DrivingStereo dataset.
Attack Performance on DrivingStereo-ralny
(1758, 800). more detail, we adopt the four sub-sets of DrivingStereo that were captured under different weather conditions (i.e., sunny, foggy, rainy, cloudy) where report the attack performance for each of them respectively. Following []]. 40 stereo image pairs for each juub-ed are selected to verify the effectivvness of different patches. For the physical evaluation, stereo images with i3DStreoid [ where various safety critical situations are considered. We refer readers to the supplemental material for the details of how the physical stereo images captured and the pipeline we adopted for physical deployment.
manually capture
Attack targets. Following M we apply our attack method to PSMNet 4 DeepPruner [T0] and AANet [33] for validating the general attack effectiveness. Moreover, we empirically found that they out-of-date and can be easily disturbed, thus we further select RAFT-Sterco [19] and STereo TRansformer (STTR) [17] which represent the promising iterative optimization based methods and transformer-base methods as main attack targets. For the detail hyper-parameter setting and the pretrained checkpoint adopted during the attack, please find all them in supplemental material.
Digital deployment. During the digital optimization and evaluation, the patch needs to be placed in- side the scene according to physical constraints. achieve this, we apply the calibration information provided by the KITTI and DrivingStereo dataset. In specific, given patch with predefined physical size in meters, we first set the homogeneous 3D coordinates of the patch's 's corners with respect to the reference camera coordinate system. Then we calculate the corresponding pixel coordinates with the help of the rectified projection and rotation matrix. The full calculation is detailed in supplement.
Evaluation metrics. Following the convention, we adopt bad pixel error (D1-error) and End-Point Error (EPE) for evaluating the prediction performance which are calculted as follows:
N
# of bad pixels
DI
# of total pixels
x 100%,
EPE
dd
pred
da
(10)
1=1

---

Original Left Emage
Original Depth
Clean Left in
Cleak Depth
Stereoscopic Patch
Stereopognosia Patch
Grid-based Patch (ours)
DepthVanish (ours)
PSMNet
PSMNet
PS Mieet > PSMNet
PSMNet & PSMNet
DegpPruner
DeepPruner
PSMNet DeepPruner
PSM DecpPruner
AANet
AANet
PSMNAL AANet
PSMNot AANet
RAFFStarro
RAFFStereo
PSMNet- & RAFT-Stereo
PSMNet RAFT-Stereo
PSMNet
PSMNet
Figure 5: Visualization of different digital patch attack baselines and our Depth Vanish patch against different larget models KITTI-scene dataset. Note that the original and clean depth are estimated by RAFT-Stereo.
where the bad pixel is one that satisfy [dpred dg > (3, 0.05 dge). ). To evaluate patch attack effectiveness, we first follow Eq. (4) to set the ground-trume -orunn disparity of the patch as d = c. Then, define the bad pixels those satisfying Idyred e/ max(3, 0.05 dge) and |dpred 0| S. where n defines how many times deeper than the actual depth will a patch be considered to be attack effective. In summary, report the average DI-error and EPE with standard deviation where higher values indicate better attack performance.
6.2 Digitally Attack Stereo Estimator
We first conduct digital attack experiments with our proposed Depth Vanish patch on KITTI-scene dataset and the four sub-sets of DrivingStereo, i.e., sunny, foggy, rainy, cloudy.
Serting: Due to the lack of existing works on attacking stereo matching using patches, we use the results from existing digital attack studies (i.e., Stereoscopic [ and Stereopagnosia (31) as patches and deploy them into the scene as the first set of baselines. However, it should be noted that such comparison is not fair enough as existing works [3] are not specifically designed for patch attack. Thus we further setup our own baseline (i.e., grid-based patch from Sec. 5.1 for fair comparison.
Results: 1 We report the attack results for the five attack target models KITTI-scene dataset in Tab. It can be seen that existing digital attacks are ineffective under the patch attack setup, while our Grid-based Patch significantly outperforms them. Notably, Depth Vanish achieves strong attack performance, especially against DeepPruner, RAFT-Sterco and STTR. We illustrate the results on DrivingStereo dataset Fig. It is evident that similar attack performance can be observed on all four sub-sets. @ In addition to the standard evaluation, Fig. | shows KITTI sample comparison. Compared the Clean Depth, we first note that existing attack works fail to mislead all the five target models, where only the Stereoscopic Patch shows limited influence against PSMNet. However, as the results shown in the last column, our Depth Vanish patch casts strong influence where it almost disappeared within the depth results. More surprisingly, our patch enjoys significant transferabillity over models where the patch optimized with PSMNet shows strong attack effect on other four models. Based our experimental experience, all patches with such clear interval patterns are transferable across models, a capability we attribute to the insights analyzed in Sec. 3 Please refer to the supplement for the comprehensive experimental results of attack transferability.
6.3 Physically Attack Stereo Estimator
In this section, we conduct physical evaluation for our Depth Vanish patches that optimized with different stereo estimators to highlight the importance and emergency of research on stereo matching
8

---

Clean Left Image
PSMNet
DeepPruner
AANet
Sterro
STTR
Clean Depth
Figure 6: Visualization of physical attack results of our Depth Vanish patches against different stereo depth estimators, Note that the clean depth is estimated with RAFT-Sterco.
PSMNee
DeepPruncr
AANet
RAPT-Stereo
STTR
Figure 7: Visualization of Depth Vanish attack performance against Intel RealSense depth camera (D435i).
reliability. As shown in Fig. 6 we host our Depth Vanish patches on a white board for the purpose of highlighting the depth inconsistency. 1 It can be observed from the results that our Depth Vanish patch consistently preserves its attack effectiveness after deployed into the physical environment. Compared the Clean Depth, the board region occupied by our Depth Vanish patches are predicted as far away in general. @ However, it should be noted that the induced depth error are limited compared the digital effectiveness in Fig. We ascribe such performance degradation the lighting variation and imprecise photo-capturing process, where the left and right images are captured manually and separately. Therefore, we further conduct evaluation for our patch against commercial stereo depth camera in the next section. In summary, despite of the imprecise stereo image capturing process, our Depth Vanish patches successfully attack advanced bNNebased stereo estimators with consistency.
6.4 Attack Commercial Stereo System
To further assess the practicality and robustness of our Depth Vanish patch, we evaluate its performance on a commercial stereo camera system, specifically the Intel RealSense D435i depth camera. We focus on evaluating the patch's 's robustness from three aspects: model generalization, viewing orientation, and distance variation. 1 Model generalization: we deploy the patches that optimized with five stereo models over KITTI dataset and evaluate their attack effective against D435i camera. As shown in Fig. [ the patch consistently disrupts D435i predictions regardless of which model optimized for, demonstrating strong attack transferability. @ Orientation robustness: we physically rotate the patch along the and axes (see Fig. aa).. As visualized Fig. X the patch (optimized with PSMNet on KITTI) remains effective under different viewing angles, confirming its robustness to rotation. @ Distance robustness: our method also shows robustness under varying distances. Corresponding visual results are provided in the supplementary material.
6.5 Ablation Study
In this section, we conduct ablation anal- ysis on the Depth Vanish attack to assess the impact of the hyperparameters a and 3 in the objective function of Eq. (9) As shown in Fig. | both parameters are critical for optimal attack performance. Specifically, can seen that the per- formance degraded significantly when
07.5
75.0
0.0
0.3
14
= 0, ie.., the Lentropy is removed from Eq. (9. which highlights the importance
Figure 9: Attack performance of Depth against RAFT- Stereo under different and 3 on KITTI dataset.

---

upward
rotate upward
Fotate downward 15"
rotata downward
(a) Rotate DepthVanish Patch around X Axis
(h) DepthVanish around Y
Figure 8: Visualization of Depth Vanish attack performance with different rotation degrees around both X and Y axes against Intel RealSense depth camera (D435i).
of the clear interval spacing for attack effectiveness. Moreover, the total variation constraint Liv is also important where clear performance degradation can be observed when 3 decreases below In summary. the synergistic combination of entropy and total variation regularization effectively ensures that our Depth Vanish patches achieve the maximal attack performance
7 Conclusion
In this work, present Vanish, significant advancement in physical adversarial attack that jointly optimizes both texture element and interval structure of a patch to fool stereo depth estimation systems. By thoroughly analyzing the influence of regular spacing on naive texture repetition, transferability
introduce a novel insight into enhancing the attack effectiveness and higital-to-physiie of the patch. To demonstrate the potentially dangerous consequences of depth estimation failure, we design the patch to be "disappear", where the patch is estimated as far away despite being physically close. Unlike previous methods limited to digital environments, our approach succeeds in both digital and physical settings, when evaluated against widely applied depth estimation models and commercial RGB-D cameras. These findings reveal critical vulnerabilities in current depth estimation technologies and raise concerns about their reliability in safety-critical autonomous systems.
Acknowledgments and Disclosure of Funding
This research was supported by Shenzhen Science and Technology Program (No. JCYJ2024081311 14237048), "Science and Technology Yongjiang 2035" key technology breakthrough plan project (No. 2025Z053). This research is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: ALSG4-GC-2023-008 1B), and National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclusions recommendations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore, Cyber Security Agency of Singapore, and Infocomm Media Development Authority. This work is also supported in part by Canada CIFAR Al Chairs Program, the Natural Sciences and Engineering Research Council of Canada, and JST-Mirai Program Grant No.JPMJM120B8, JSPS KAKENHI Grant HH.J727 No.J223H3332, No.JP24K02920.
References
[1] Zachary Berger, Parth Agrawal, Tian Yu Liu, Stefano Soatto, and Alex Wong. Stereoscopic universal perturbations across different architectures and datasets. In Proceedings of the IEEE/CVF Conference
10

---

Computer Vision and Puttern Recognition, pages 15180-15190, 2022.
[2] Yohann Cabon, Naila Murray, and Martin Humenberger. Virtual KITTI 2. CoRR, 00.22001.1072. 2020.
[3] Wenxiao Cai, Yaroslav Ponomarenko, Jianhao Yuan, Xianqi Li, Wankou Yang, Hao Dong, and Bo Zhao. Spatialbot: Precise spatial understanding with vision language models. arXiv preprint arXiv:2406. 13362, 2024.
[4] Jia- Ren Chang and Yong- Sheng Chen. Pyramid stereo matching network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018
[5] Hemang Chawla, Armay Varma, Elahe Arani, and Bahram Zonooz. Adversarial attacks on monocular pose estimation. In 2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 22500-12505 IEEE, 2022.
[6] Junda Cheng, Wei Yin, Kaixuan Wang. Xiaozhi Chen, Shijic Wang. and Xin Yang. Adaptive fusion of single-view and multi-view depth for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10138 10147,, June 2024.
[7] Zhiyuan Cheng. Cheng Han. James Liang, Qifan Wang. Xiangyu Zhang, and Dongfang Liu. Self-supervised adversarial training of monocular depth estimation against physical-world attacks. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46( 12):9084-99) 9101, 2024.
[8] Zhiyuan Cheng, James Liang, Hongjun Choi, Guanhong Tao, Zhiwen Cao, Dongfang Liu, and Xiangyu Zhang. Physical attack on monocular depth estimation with optimal adversarial patches. In European Conference on Computer Vision (ECCV), 2022.
[9] Zhiyuan Cheng, James Liang. Guanhong Tao, Dongfang Liu, and Xiangyu Zhang. Adversarial training of self-supervised monocular depth estimation against physical-wond world attacks. In The Eleventh International Conference on Learning Representations, (ICLR), 2023.
[10] Shivam Duggal, Shenlong Wang, Wei-Chiu Ma, Rui Hu, and Raquel Urtasun. Deeppruner: Learning efficient stereo matching via differentiable patchmatch. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4384 4393, 2019.
[11] Weiyu Guo, Zhaoshuo Li, Yongkui Yang, Zheng Wang, Russell H. Taylor, Mathias Unberath, Alan L. Yuille, and Yingwei Li. Context-enhanced stereo transformer. In European Conference on Computer Vision (ECCV), 2022.
[12] Xiaoyang Guo, Kai Yang, Wukui Yang, Xiaogang Wang, and Hongsheng Group-wise correlation stereo network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
[13] Junjie Hu and Takayuki Okatani. Analysis of deep networks for monocular depth estimation through adversarial attacks with proposal of defense method. arXiv preprint arXiv:1911.08790. 2019.
[14] Nikita Karaev, Ignacio Rocco, Benjamin Graham, Natalia Neverova, Andrea Vedaldi, and Christian Rupprecht. Dynamicstereo: Consistent dynamic depth from stereo videos. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
[15] Dehong Kong, Siyuan Liang, Xiaopeng Zhu, Yuansheng Zhong, and Wenqi Ren. Patch is enough: naturalistic adversarial patch against vision- vision-language pre-training models. Visual Intelligence, 2(1):33, 2024.
[16] Jie Li, Peidong Wang, Pengfei Xiong, Tao Cai, Zeguo Yan, Lei Yang, Jiawei Liu, Huan Fan, and Shuang Liu. Crestereo: Practical depth from stereo via cascaded recurrent network with adaptive correlation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
[17] Zhaoshuo Li, Xingtong Liu, Nathan Drenkow, Andy Ding, Francis X Creighton, Russell H Taylor, and Mathias Unberath. Revisiting stereo depth estimation from sequence-to-sequenc perspective with transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6197-6206, 2021.
[18] Zhaoshuo Li, Xingtong Liu. Nathan Drenkow, Andy S. Ding, Francis X. Creighton, Russell H. Taylor, and Mathias Unberath. Revisiting stereo depth estimation from a sequence- to to-sequence perspective with transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). 2021.
11

---

[19] Lahav Lipson, Zachary Teed. and Jia Deng. Raft-stereo: Multilevel recurrent field transforms for stereo matching. In 2021 International Conference 3D Vision (3DV). pages 218-227. IEEE, 2021.
[20] Hangcheng Liu, Zhenhu Wu, Hao Wang, Xingshuo Han, Shangwei Guo, Tao Xiang, and Tianwei Zhang. Beware of road markings: A new adversarial patch attack to monocular depth estimation. In Advances in Neural Information Processing Systems (NeurlPS), 2024.
[21] Baoli Lu, Liang Sun, Lina Yu, and Xiaoli Dong. An improved graph cut algorithm in stereo matching. Displays, 2021.
[22] Yamin Mao, Zhihua Liu, Weiming Li, Yuchao Dai, Qiang Wang. Yun-Tac Kim, and Hong- Scok Lee. Uasnet: Uncertainty adaptive sampling network for doep stereo matching, In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), 2021.
[23] Moritz Meaze, Christian Heipke, and Andreas Geiger. Object scene flow. ISPRS Journal of Photogramme- rry and Remote Sensing (JPRS), 2018.
[24] Pierluigi Zama Ramirez, Fabio Tosi, Matteo Poggi, Samuele Salti, Stefano Mattoccia, and Luigi Stefano. Open challenges in deep stereo: the booster dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, 2022.
[25] Daniel Scharstein, Heiko Hirschmüller, York Kitajima, Greg Krathwohl, Nera Nesic, Xi Wang, and Porter Westling. High-resolution stereo datasets with subpixel-accurate ground truth. In Proceedings of German Conference on Pattern Recognition, 2014.
[26] Daniel Scharstein and Richard Szeliski. taxonomy and evaluation of dense two-frame stereo correspon- dence algorithms. International Journal of Computer Vision, 47(1-3):7-42, 2002.
[27] Zhelun Shen, Yuchao Dai, Xibin Song, Zhibo Rao, Dingfu Zhou, and Liangjun Zhang. Pew-net: Pyramid combination and warping cost volume for stereo matching. In European Conference on Computer Vision (ECCV), 2022.
[28] Qing Su and Shihao Ji. Chitransformer: Towards reliable stereo from cues. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, (CVPR), 2022.
[29] Fabio Tosi, Luca Bartolomei, and Matteo Poggi. A survey on deep stereo matching in the twenties. International Journal of Computer Vision, 2025.
[30] Alex Wong, Safa Cicek, and Stefano Soatto. Targeted adversarial perturbations for monocular depth prediction. Advances in neural information processing systems, 33:8486-8997, 2020.
[31] Alex Wong, Mukund Mundhra, and Stefano Soatto. Stercopagnosia: Fooling stereo networks with adversarial perturbations. In Proceedings of the AAAI Conference Artificial Intelligence, volume 35, pages 2879 2888, 2021.
[32] Haofei Xu, Jing Zhang. Jianfei Cai. Hamid Rezatofighi, Fisher Yu, and Dacheng Tao. Iterative geometry encoding volume for stereo matching. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2023.
[33] Haofei Xu and Juyong Zhang. Aanet: Adaptive aggregation network for efficient stereo matching, In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1959-1968, 2020.
[34] Gengshan Yang. Joshua Manela, Michael Happold, and Deva Ramanan. Hierarchical deep stereo matching high-resolution images. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition. pages
2019.
[35] Guorun Yang, Xiao Song, Chaoqin Huang, Zhidong Deng, Jianping Shi, and Bolei Zhou. Drivingstereo: A large-scale dataset for stereo matching in autonomous driving scenarios. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
[36] Lihe Yang, Bingyi Kang, Zilong Huang, Xiaogang Xu, Jiashi Feng, and Hongshuang Zhao. Depth anything: Unleashing the power of large-scale unlabeled data. In CVPR, 2024.
[37] Lihe Yang, Bingyi Kang, Zilong Huang, Zhen Zhao, Xiaogang Xu, Jiashi Feng, and Hengshuang Zhao. Depth anything V2. In Advances in Neural Information Processing Systems (NeurIPS), 2024.
[38] Gyungeun Yun, Kyungho Joo, Wonsuk Choi, and Dong Hoon Lee. Poster: Unveiling the impact of patch placement: Adversarial patch attacks on monocular depth estimation. In Proceedings of the 2023 ACM SIGSAC Conference Computer and Communications Security. CCS, 2023.
12

---

[39] Feihu Zhang, Victor Adrian Prisacariu, Ruigang Yang. and Philip H. S. Torr. Ga-net: Guided aggregation for end-to-end stereo matching. In Proceedings the IEEE/CVF Conference Computer Vision and Puttern Recognition (CVPR). 2019.
[40] Tong Zhao, Mingyu Ding. Wei Zhan, Masayoshi Tomizuka, and Yintao Wei. Depth-aware volume attention texture-less stereo matching, 2024.
[41] Junhao Zheng, Chenhao Lin, Jiahao Sun, Zhengyu Zhao, Qian Li, and Chao Shen. Physical 3d adversarial attacks against monocular depth estimation autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, (CVPR), 2024.
[42] Tianyue Zheng, Jingzhi Hu, Rui Tan, Yinqian Zhang, Ying He, adversarial attack on monocular depth estimation with perspective hijacking. In 33rd USENIX Security Symposium, USENIX Security, 2024.
Lui. pi-jack: Physical world
[43] Ce Zhou, Qiben Yan, Yan Shi, and Lichao Sun. (DoubleStar): ( (Logg SanggR attack towards depth estimation based obstacle avoidance in autonomous systems. In 31st USENIX security symposium (USENIX Security 22), pages 1885-1902, 2022.
13

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No]. or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant
information is Not Available.
Please provide a short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include it (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked "[Yes] is generally preferable to "[No] ". is perfectly acceptable to answer "[No] provided a proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset used"). In general, answering "[No] oo "[NA] is not phrased in binary way. acknowledge that the answer
the checklist as of the factors in their evaluation. While
grounds for rejection. While the questions often more nuanced, so please just use your best judgment and write a justification elaborate. evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to question, in the justification please point to the section(s) where related material for the question can be found.
supporting
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify questions and only use the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
The main claims in the abstract and introduction are fully supported by both theoretical and experimental results throughout the paper.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can he expected to generalize other setrings.
It is fine to include aspirational goals motivation long it is clear that these goals attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of our approach are discussed in the supplementary material.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors encouraged create separate "Limitations" section in their paper.
14

---

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model sell-specification. asympiotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might that reviewers discover limitations that aren't It acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: This paper does not contain formal thcorems or proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-referencedd
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Sec. 5.3 and Sec. 6. provide all critical information needed to reproduce the main experimental results. Additional instructions and settings are included in the supplementary material.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible important, regardless whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of a large language model), releasing of model checkpoint, or other means that appropriate to the research performed.
15

---

While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g.. a large language model), then there should either be way to access this model for reproducing the results way to reproduce the model (e.g.. with open-source dataset instructions for how construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the of closed-source models, may he that access the model is limited in some way (e.g., to registered users), but it should be possible for other rescarchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, descrihed in supplemental material?
Answer: [Yes]
Justification: We will release the anonymized code and sufficient instructions for reproducing our main experimental results in the supplementary material upon submission. This ensures that reviewers and future readers can faithfully replicate and verify the findings.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines hhttps://nige cc wwtphipppppppppppii..ppppc pttplcbblccc/
guides / /et///ooeeuuunaee sssissssss wwwsssnnnss..o. onooooooooloooooo iiyy for more details.
While we encourage the release of code and data, understand that this might not be possible, so "No" an acceptable answer. Papers cannot rejected simply not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / ps. cc/
publ iollicccuii des/ CCte/eeeeeeeeeeeeeeeee iss on icyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possihle in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g.. data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
The paper specifies all relevant training, evaluation, and test details See. 5.3 and Sec. [6.1] Additional information is provided in supplemental materials.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate informa- tion about the statistical significance of the experiments?
Answer: [Yes]
16

---

The paper reports error bars (mean + standard deviation) for the quantitative results and describes how they calculated. Variability is reported, and figures tables referenced in the text to clarify the sources error. Guidelines:
Justification:
answer means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
factors variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (c.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error hars, but one should state it. The authors should preferably report a 2-sigma error har than state that they have 96% CI, if the hypothesis of Normality of errors is verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric bars that would yield results that are of range (e.g. negative rates). If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information the computer resources (type of compute workers, memory, time execution) needed reproduce the experiments?
Answer:
[Yes]
Justification:
The information about compute resources is detailed the supplemental materials.
Guidelines:
answer means that paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide amount compute required for each the individual experimental runs as well as estimate the total compute.
The paper should disclose whether full research project required more compute than experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethies https: stttps://neut //t/////rriii/ ips httppp//lc///ccccssiubeeeee
Answer: [Yes]
Justification:
The research follows the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethies.
The authors should make sure preserve anonymity (e.g.. if there is special consideration due laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts the work performed?
Answer: [Yes]
Justification: The potential positive and negative societal impacts this work are discussed in detail in the supplementary material.
Guidelines:
17

---

The answer NA means that there is no societal impact of the work performed. If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.- disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deploy- ment technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used generate deepfakes for disinformation. On the other hand, it not needed point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g.. gated release of models, providing defenses in addition to attacks, mechanisms for monitor- ing misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g.. pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: The paper poses high risk of dual use misuse upon release, it focuses methods, not on relcasing highly sensitive models or datasets.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should deseribe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All used datasets and code are properly cited and are released under their respective public licenses as referenced in the paper and supplement.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version the asset is used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from particular source (c.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, |aaperapppeae paperswwitee hasperswwhhhod...mmmo com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
18

---

13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new datasets or code assets. All methods are described for reproduction only.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/coud//model as part of their sub- missions structured templates. This includes details about training. license, limitations, etc.
The paper should discuss whether how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: No crowdsourcing or research on human subjects involved.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then much detail possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country institution) were obtained?
Question:
Answer: [NA]
Justification: No experiments requiring IRB approval are conducted reported.
Guidelines:
The answer means subjects.
paper does not involve crowdsourcing nor research with human
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do include any information that would break anonymity (if applica- ble), such as institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs it an important, original, or non-staie standaad component of the core methods in this research? Note that if the LLM is used only for writing. editing, formatting purposes and does not impact the methodology, scientific rigorousness, originality of the rescarch, declaration is required.
Answer: [NA]
Iustification: The research, methodology, results do not make use LLMs as core component.
Guidelines:
19

---

The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
for Please refer to our L.M policy (https: //ne::///eerrr p what should should not be described.
20


Reviews:
[{"review_id": "DAC55RZAIY", "reviewer": "Reviewer_ZGfn", "summary": "This work proposes a new adversarially optimized targeted patch attack for stereo depth estimation using DNNs.\nThe proposed method, DepthVanish, optimizes the adversarial patches for structured interval spacing and texture.\n\nThe manuscript shows the effectiveness of the optimized patches both digitally and in physical settings, including transfer attacks by optimizing the patches for one architecture and transferring the patch as an attack to another architecture.\n\nThe visualizations and empirical results demonstrate the effectiveness of the optimized patches.", "questions": "One major question would be:\nIn the manuscript, it is not clear, both in the formulation and in the visualizations, whether the patch is merely added to one image (left) or to both images from stereo, and if it is both, then how does the method ensure consistency in the patch? Or is this something that is not of concern, and if so, then discussion around this would significantly help with clarity.\n\nAddressing the weaknesses would help improve the clarity of the work and the quality of the manuscript.", "limitations": "Yes, the limitations are discussed briefly in the supplementary material. It would be great to include those in the main paper.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 1, "clarity": 1, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. Visualizations and empirical results demonstrate the effectiveness of the optimized patches.\n2. This work addresses an important real-world issue of vulnerability of DNN-based stereo depth estimation methods to malicious agents.\n3. The manuscript shows the effectiveness of the optimized patches both digitally and in physical settings.\n4. The optimized patch attacks for one architecture transfer to another architecture quite effectively.\n\nWeaknesses:\n1. The manuscript needs significant improvement in writing to add clarity. For example, section 3 already discusses Vertical and Horizontal Intervals as methods; however, they are defined significantly later in section 5. In the manuscript, it is not clear, both in the formulation and in the visualizations, whether the patch is merely added to one image (left) or to both images from stereo, and if it is both, then how does the method ensure consistency in the patch? Or is this something that is not of concern, and if so, then discussion around this would significantly help with clarity.\n2. The resolution of the included figures is very low, and improving that would help. For example, in Figure 4, it is sometimes very difficult to read some of the values on the spider plot.\n3. The manuscript repeatedly acknowledged RAFT-Stereo as the SotA method; however, on various datasets, numerous other methods outperform RAFT-Stereo, one example being [1] on the Spring dataset.\n4. The manuscript does not evaluate their attack against any defense methods, one such example would be [2].\n5. The manuscript in its current state is poorly written. For example, the related work paragraph on stereo depth estimation and depth estimation attack appears to be LLM-generated. This assessment is not merely because of the repeated use of \"—\" as done by many LLMs, but also because these paragraphs do not really do the work of the related work section in a manuscript. The paragraph on stereo depth estimation is more fitting as an \"introduction\" paragraph, since the stereo estimation methods used in this work are not really discussed here. The related work section is an opportunity to discuss how the different stereo-depth estimation methods used in the manuscript work and differ from each other. Likewise, the \"depth estimation attack\" paragraph also goes off-topic. For example, it talks about the lack of \"effective defense strategies\"; however, this work neither proposes nor uses any \"defense strategies\". Another example of poor writing is a lack of consistency. Line 33 writes \"..Fig. 1..\", whereas Line 39 writes \"Figure 1\". It would be great if these inconsistencies could be fixed. \n6. The formulations lack definitions, for example, in equations 1 and 2, \"d\" is not defined, and in equation 4, the spatial resolution of d^p_gt is not defined, which I infer from the visualizations is not equal to the spatial resolutions of I_l and I_r.\n7. In the conclusion, the manuscript claims that the proposed method effectively \"disappears\" objects; however, from the visualizations, this is an overclaim. Objects do not seem to disappear in the shared visualizations, only the region with the patch, regions in which the patch is occluding the objects, and the model seems to predict 0 disparity. \n8. The manuscript only explores one target, ie, disparity=0 and thus depth=infinity; it would be interesting to see if the methodology could optimize the patch for other targets, for example, disparity=infinity, ie, depth=0.\n9. There are multiple typos in the current manuscript, for example, in the abstract, Line 16: RAFTS-tereo instead of RAFT-Stereo, and in Line 226: missing space between (1242,* *375) while noting the image size for KITTI.\n\n\nReferences:\n\n[1] Xu, Gangwei, et al. \"Attention concatenation volume for accurate and efficient stereo matching.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022.\n\n[2] Agnihotri, Shashank, Julia Grabinski, and Margret Keuper. \"Improving feature stability during upsampling–spectral artifacts and the importance of spatial context.\" European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024.", "was_revised": true, "final_justification": "The authors have addressed my concerns.\n\nFrom what I see, they have also addressed the major concerns from the other reviewers (some concerns were overlapping).\n\nThe work is good, the results make sense, and would lead to interesting discussions at NeurIPS.", "rebuttal": "## 1. Misinterpretation of Experimental Setup.\n**W1b: In the manuscript, it is not clear, both in the ... Or is this something that is not of concern, and if so, then discussion around this would significantly help with clarity.**\n\nThank you for the comments. We clarify that the patch is applied to both the left and right images, and we have emphasized this in the manuscript through the following two aspects:\n\n1. **Physical Attack Evaluation**: One of our main contributions is demonstrating our patch is physically effective. During physical evaluation, the optimized patch is placed in real-world scenes, then stereo images of these scenes are captured. As a result, the patch naturally appears in both the left and right images after capture.\n\n2. **Digital Deployment**: We explicitly described the digital deployment procedure in Sec. 6.1 and Supplementary Material B.1, ensuring the patch is inserted into both stereo images following physical constraints. This guarantees consistency between digital and physical settings, meaning the patch is presented in both the left and right images during digital evaluation as well.\n\nAdditionally, we clarify this in the formulation. In line 151 of the manuscript, we specified that the patch is added to the paired stereo images $\\hat{I}_l$ and $\\hat{I}_r$, contrasting with the clean inputs ${I}_l$ and ${I}_r$. To improve clarity, we have updated Eq. (3) (see response to W6) to explicitly show that the patch is applied to both stereo images. For visualization, we follow the standard practice of displaying only the left image during qualitative evaluations, since the depth map is typically aligned with the left image content.\n\n**W7: In the conclusion, the manuscript claims that the proposed method effectively \"disappears\" objects ... the model seems to predict 0 disparity.**\n\nThank you for the comments. The concern stems from a misunderstanding: we do not claim that the physical object to which the patch is attached disappears from the image. Instead, the objective of our paper is to optimize the patch so that the depth estimation network interprets both the patch and the occluded object as being at an extremely large distance, making them appear to \"disappear\" in the predicted depth map. This poses a serious safety risk, as an autonomous agent that perceives an object ahead as infinitely far away may fail to brake and continue moving forward.\n\n**W8: The manuscript only explores one target, ie, disparity=0 ... other targets, for example, disparity=infinity, ie, depth=0.**\n\nThank you for the insightful suggestion. We intentionally target depths approaching infinity (disparity near zero) because making an obstacle “vanish” poses a uniquely dangerous failure mode. An autonomous agent perceiving an object as infinitely far may continue moving without braking, potentially causing catastrophic consequences. This aligns with prior depth estimation attacks [3][7], reflecting a common adversarial goal with serious safety implications. In contrast, optimizing for disparity=infinity (very close depth) is generally less critical, where mistakenly detecting a distant object as close usually results in braking that is a safer outcome.\n\nAs a complementary experiment, we optimize our patch toward disparity = infinity. Using the same patch setup as in the main experiments, we evaluate the average predicted depth as the ground-truth depth varies from $5m$ to $21m$. As shown in Table 1.1, the optimization still converges reliably.\n\nTable. 1.1: Average patch depth predictions on KITTI using RAFT-Stereo.\n\n|gt depth (m)|5|7|9|11|13|15|17|19|21|\n|-|-|-|-|-|-|-|-|-|-|\n|avg. predicted depth (m)|1.20±0.03|1.24±0.15|1.27±0.06|1.39±0.08|2.60±0.21|2.23±1.29|5.92±2.08|5.61±2.19|6.37±3.23|\n\n\n## 2. Figure Resolution.\n**W2: The resolution of the included figures is very low, ... very difficult to read some of the values on the spider plot.**\n\nThank you for your feedback. The reduced clarity of figures, including Figure 4, is due to the compression applied during manuscript submission. We will provide higher-resolution version of all figures in the revised manuscript to ensure that all values, especially those in the spider plot, are clearly visible and easy to read.\n\n## 3. More Attack Targets.\n**W3: The manuscript repeatedly acknowledged RAFT-Stereo as the SotA method; ... being [1] on the Spring dataset.**\n\nWe kindly note that our attack targets real-world traffic scenarios, so we evaluate it on the KITTI and DrivingStereo datasets rather than the Spring dataset. We select RAFT-Stereo and STTR as baselines because they represent distinct and pioneering approaches to stereo matching, enabling us to assess performance across different estimation strategies. \n\nTo further demonstrate generalizability, we evaluate our method on four additional models: GMFlow-unify [6], IGEV-Stereo [4], ACVNet [1], and CREStereo [5], using the same experimental setup described in our paper. As shown in Tab. 1.2, our method consistently achieves successful attacks across all target models.\n\nTable 1.2: Attack performance on four additional target models using the KITTI dataset.\n\n|  |GMFlow-unify D1|GMFlow-unify EPE|IGEV-Stereo D1|IGEV-Stereo EPE|ACVNet D1|ACVNet EPE|CREStereo D1|CREStereo EPE|\n|-|-|-|-|-|-|-|-|-|\n|Stereoscopic|5.39±7.34|3.89±6.40|6.66±7.88|4.32±5.73|2.96±2.08|1.67±3.77|5.72±6.25|4.62±6.28|\n|Ours|86.65±3.19|68.61±6.10|87.53±4.15|66.24±5.92|69.16±4.92|52.27±8.10|86.03±5.35|64.59±6.26|\n\n## 4. Possible Defenses.\n**W4: The manuscript does not evaluate their attack against any defense methods, one such example would be [2].**\n\nThank you for the suggestion. To address this, we implemented the defense strategy from [2] by altering the kernel sizes in the transposed convolution layers used for pixel-wise upsampling in the “feature extractor” module of STTR from $3\\times3$ to $7\\times7$ + $3\\times3$. As shown in Tab. 1.3, our attack remains effective under this modification.\n\nTable 1.3: Attack performance on STTR with modified kernel sizes.\n\n| |kernel size|D1|EPE|\n|-|-|-|-|\n|Without Defense|$3\\times3$|92.38±8.76|69.25±6.62|\n|With Defense|$7\\times7$+$3\\times3$|90.71±8.08|69.67±5.77|\n\n## 5. Writing Clarity\n**W1a: The manuscript needs significant improvement in writing ... they are defined significantly later in section 5.**\n\n**W5a: The manuscript in its current state is poorly written. ... however, this work neither proposes nor uses any \"defense strategies\".**\n\nThank you for your comments and suggestions.\n\n1. We agree that a clearer explanation of vertical and horizontal intervals is needed to clarify the patch construction procedure. Fig. 2(b) will be updated with a higher-resolution version for illustrative purpose, and the corresponding construction formulation will be added in the revised manuscript.\n\n2. The use of LLMs was strictly limited to language refinement. All scientific content, experiments, and structure are our own. Stylistic issues (e.g., overuse of dashes) will be addressed.\n\n3. We acknowledge that our discussion of stereo depth estimation can be expanded. The revised manuscript will include a more comprehensive review of the attack targets evaluated and recent related studies.\n\n4. The “Depth estimation attack” paragraph is not off-topic. It traces the evolution from digital monocular attacks to physical stereo attacks to highlight the distinct challenges we address. Existing defenses are mentioned only to motivate the need for stronger, architecture-agnostic attacks as catalysts for future defense research.\n\n**W6: The formulations lack definitions, for example, ... not equal to the spatial resolutions of I_l and I_r.**\n\nThank you for your feedback.\n\n* Regarding the variable $d$ in Eq. (1) and Eq. (2), line 85 clearly indicates that $d$ is the pixel offset relative to $x$. To make this definition more explicit, we will add the following immediately after the equations: \"$d \\in \\mathbb{Z}$ represents the pixel-wise horizontal disparity between the left and right images.\"\n\n* Concerning the spatial resolution of $d^p_{gt}$, its size is the same as the patch size $(h_p, w_p)$. We will revise Eq. (3) and line 151 to read: \"$\\mathcal{F}^p(\\hat{I}_l, \\hat{I}_r) \\neq \\mathcal{F}^p(I_l, I_r)$, where $\\hat{I}_l$ and $\\hat{I}_r$ denote the stereo images with the adversarial patch $P$ applied, and $p$ indicates the corresponding pixel region of the patch within the prediction results.\" \n## 5. Typo Issues.\n**W5b: Another example of poor writing is a lack of consistency. Line 33 writes \"..Fig. 1..\", whereas Line 39 writes \"Figure 1\". It would be great if these inconsistencies could be fixed.**\n\n**W9: There are multiple typos in the current manuscript, for example, ... missing space between (1242,* *375) while noting the image size for KITTI.**\n\nThank you for pointing out these typos. We will carefully check and revise all of them in the updated version.\n\nReferences:\n\n[1] Attention concatenation volume for accurate and efficient stereo matching. (Xu, Gangwei, et al. CVPR 2022)\n\n[2] Improving Feature Stability during Upsampling – Spectral Artifacts and the Importance of Spatial Context. (Shashank, Agnihotri, et al. ECCV 2024)\n\n[3] Beware of road markings: A new adversarial patch attack to monocular depth estimation. (Liu, Hangcheng, et al. NIPS 2024)\n\n[4] Iterative Geometry Encoding Volume for Stereo Matching. (Xu et al., CVPR 2023)\n\n[5] Practical Stereo Matching via Cascaded Recurrent Network With Adaptive Correlation. (Li et al., CVPR 2022)\n\n[6] Unifying Flow, Stereo, and Depth Estimation.(Xu et al., TPAMI 2023)\n\n[7] Physical 3D adversarial attacks against monocular depth estimation in autonomous driving. (Zheng, Junhao, et al. CVPR 2024)\n\n[8] Vggt: Visual geometry grounded transformer. (Wang et al., CVPR 2025)"}, {"review_id": "OEXuw0Qgvj", "reviewer": "Reviewer_FaQu", "summary": "The paper presents \"DepthVanish,\" an adversarial patch attack for stereo depth estimation that optimizes both texture and interval structures to enhance physical-world effectiveness. Previous work on repetitive textures failed in recent SOTA methods, but the authors discover that introducing regular intervals (striped/grid structures) significantly improves attack performance. Based on this findings, they develop a joint optimization pipeline to co-design texture elements and spatial layouts, enabling the patch to mislead state-of-the-art models (e.g., RAFT-Stereo, STTR) and commercial RGB-D cameras (Intel RealSense) in both digital and physical settings. Experiments show that structured intervals boost depth misestimation (e.g., predicting infinite depth for close objects) and withstand viewpoint rotations, highlighting critical vulnerabilities in stereo systems.", "questions": "1. Could the authors evaluate if the designed method can be applied to flow matching and related scenario? This can further demonstrate the generalizability of the designed attack method.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n1. Effective attack designs. The authors introduce an interval-based structural design that demonstrates significant attack efficacy on stereo depth estimation systems across both digital simulations (e.g., KITTI, DrivingStereo) and physical deployments (e.g., Intel RealSense).\n\n2. Joint Optimization pipeline. Building on the interval structure insight, the proposed pipeline co-optimizes texture elements and spatial layouts, enhancing attack transferability across diverse models (e.g., RAFT-Stereo, STTR) and environmental conditions. \n\n3. Comprehensive evaluation. Experiments span digital evaluations on benchmark datasets and physical tests on commercial hardware, showcasing practical utility and real-world relevance for safety-critical systems.\n\n\n### Weakness\n1. Writing issue. The figures in the paper (e.g., depth prediction visualizations) lack sufficient resolution or labeling, potentially impeding reader comprehension of attack performance comparisons. \n\n\n2. Limited applicability. The attack evaluation is currently confined to stereo matching tasks, and the authors do not explore generalizability to related domains (e.g., optical flow estimation or multi-view stereo), which could expand the method’s utility.", "was_revised": true, "final_justification": "The author response and additional experimental results address most of my concern, hence I keep my positive rating.", "rebuttal": "## 1. Writing issue.\n**W1: The figures in the paper (e.g., depth prediction visualizations) lack sufficient resolution or labeling, potentially impeding reader comprehension of attack performance comparisons.**\n\nThank you for the feedback. The reduced clarity of the figures is due to the compression applied during manuscript submission. We will provide higher-resolution version of all figures in the revised manuscript to ensure that all values are clearly visible and easy to read.\n\n## 2. Limited applicability.\n**W2: The attack evaluation is currently confined to stereo matching tasks, and the authors do not explore generalizability to related domains (e.g., optical flow estimation or multi-view stereo), which could expand the method’s utility.**\n\nWe appreciate your insightful suggestion regarding the potential extension of our work. In response, we present further analysis and experimental results for both the *optical flow* and *multi-view stereo* tasks.\n\n### Optical Flow\n\nEvaluating adversarial attacks on **scene flow estimation**, which integrates both optical flow and stereo depth, largely follows the same fundamental principles as attacking stereo depth estimation. Our primary objective remains consistent: to perturb the depth predictions obtained from paired stereo images.\nThe key distinction in the scene flow setting lies in the evaluation process: performance is averaged across a sequence of depth predictions, meaning the adversarial patch is viewed under varying angles and scales across consecutive stereo frames.\n\nTo assess the robustness of our patch under such dynamic conditions, we consider both **rotational** and **scaling** variations:\n\n* **Rotation:** We have already visualized the physical impact of patch rotation in Fig. 8. Additionally, Tab. 2.1 presents digital evaluation results under simulated rotations along the X and Y axes. These results show minimal performance degradation, indicating that the patch remains effective across a wide range of viewing angles.\n\n* **Scale:** We present additional results in Fig. 2 and Fig. 5 of the Supplemental Material, which further demonstrate that the patch retains high attack efficacy across different physical scales.\n\nIn conclusion, these findings suggest that our framework provides a strong foundation for attacking depth estimation in more complex 3D motion settings. Given the robustness of our method to viewpoint and scale variations, we expect similar levels of effectiveness in the scene flow context.\n\n\nTable 2.1: Average attack performance (D1-error) under different rotation angles.\n\n| Axis | $0^o$ | $10^o$ | $20^o$ | $30^o$ | $40^o$ | $50^o$ | $60^o$ |\n|---|---|---|---|---|---|---|---|\n| X | 89.31±6.56 | 89.95±6.60 | 89.14±5.43 | 89.74±3.81 | 88.02±3.10 | 87.36±4.70 | 85.23±1.70 |\n| Y | 89.31±6.56 | 88.53±2.31 | 89.41±6.22 | 87.58±3.35 | 85.66±2.15 | 79.09±3.67 | 75.56±2.73 |\n\n### Multi-View Stereo\n\nAs an initial investigation into the multi-view stereo setting, we adopt the recent VGGT model  [1] as the target for evaluating our adversarial patch. To facilitate this evaluation, we directly use our patch optimized with RAFT-Stereo and the Stereoscopic patch, and evaluate them on the DTU dataset [2].\nThe average results in Tab. 2.2 shows our method still performs significantly better than the baseline method.\n\nTable 2.2: Attack performance on VGGT using DTU scenes.\n\n|Method| D1 | EPE |\n|--|--|--|\n| Stereoscopic | 6.96±1.08 | 5.67±0.77 |\n| Ours | 42.29±8.90 | 37.84±5.10 |\n\n\nReferences:\n\n[1] Vggt: Visual geometry grounded transformer. (Wang et al., CVPR 2025)\n\n[2] Large scale multi-view stereopsis evaluation. (CVPR 2014)"}, {"review_id": "izOda5fJQL", "reviewer": "Reviewer_aSEK", "summary": "This paper focus on Adversarial attacks against stereo depth estimation and shows that inserting regular gaps to form striped patterns, rather than naively repeating textures, which dramatically improves the real-world effectiveness of adversarial patches against stereo depth estimation. By jointly optimizing stripe intervals and texture content, these patches reliably fool state-of-the-art stereo models (RAFT-Stereo, STTR) and even commercial Intel RealSense RGB-D cameras under real-world conditions.", "questions": "1. The authors are suggested to provide a more intuitive example to illustrate why the proposed attack is effective. For instance, in transformer-based methods, could you present depth attention maps showing the value changes before and after the attack to draw further interesting conclusions?\n2. More stereo depth estimation methods should be included to validate the attack’s effectiveness, preferably on the recently robust 3D foundation model VGGT.\n3. Could the authors provide further theoretical analysis or insights into the inductive biases of the proposed method?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. This paper introduces the first adversarial patch that reliably transfers from digital simulation to real-world stereo setups, encompassing both learning-based (RAFT-Stereo, STTR) and commercial (Intel RealSense) systems.\n2. Through systematic empirical analysis, the authors identify that inserting regular intervals between repeated textures (striped patterns) dramatically improves physical-world attack transferability, a key observation not previously reported.\n\nWeaknesses:\n1. The stereo matching methods targeted in this paper are not the latest in the field; for example, the authors do not validate their proposed attack on classic approaches such as [1], [2], and [3].\n2. The image clarity in this paper has some issues, for example, in Fig. 2(a) and Figs. 3(b) and 3(c).\n3. There are some typos; for example, on line 16, “RAFTS-tereo” should be corrected to “RAFT-Stereo.”\n4. This paper should contain further theoretical analysis or insights into the proposed method.\n\n[1] Iterative Geometry Encoding Volume for Stereo Matching (Xu et al., CVPR 2023)\n\n[2] Practical Stereo Matching via Cascaded Recurrent Network With Adaptive Correlation (Li et al., CVPR 2022)\n\n[3] Unifying Flow, Stereo, and Depth Estimation.(Xu et al., TPAMI 2023)", "was_revised": true, "final_justification": "Thanks for the response from the authors. The authors conducted more experiments on four stereo estimators and the VGGT backbone. The added results demonstrate the strong performance, showing the generalization ability of the proposed method. Since the authors addressed my concerns well, I would like to upgrade my rating to positive. The authors are also encouraged to fix other issues, like low image resolution.", "rebuttal": "## 1. More Attack Targets\n**W1: The stereo matching methods targeted in this paper are not the latest in the field; for example, the authors do not validate their proposed attack on classic approaches such as [1], [2], and [3].**\n\nThank you for the suggestion. As a supplement, we further evaluate our method by attacking four stereo estimators: GMFlow-unify [3], IGEV-Stereo [1], ACVNet [5], and CREStereo [2], using the same setup as in our main experiments. As shown in Tab. 3.1, our method consistently demonstrates strong attack performance on new target models.\n\nTable 3.1: Attack performance on four additional target models using the KITTI dataset.\n\n|  | GMFlow-unify D1 | GMFlow-unify EPE | IGEV-Stereo D1 | IGEV-Stereo EPE | ACVNet D1 | ACVNet EPE | CREStereo D1 | CREStereo EPE |\n|--|--|--|--|--|--|--|--|--|\n| Stereoscopic | 5.39±7.34 | 3.89±6.40 | 6.66±7.88 | 4.32±5.73 | 2.96±2.08 | 1.67±3.77 | 5.72±6.25 | 4.62±6.28 |\n| ours | 86.65±3.19 | 68.61±6.10 | 87.53±4.15 | 66.24±5.92 | 69.16±4.92 | 52.27±8.10 | 86.03±5.35 | 64.59±6.26 |\n\n**Q2: More stereo depth estimation methods should be included to validate the attack's effectiveness, preferably on the recently robust 3D foundation model VGGT.**\n\nThank you for the valuable suggestion. To further validate the effectiveness of our attack, we evaluate it on the recently introduced robust 3D foundation model VGGT [4]. To facilitate this evaluation, we directly use our patch optimized with RAFT-Stereo and the Stereoscopic patch, and evaluate them on the DTU dataset [6]. As shown by Tab. 3.2, our attack still achieves much higher D1 and EPE errors compared to the baseline, thereby demonstrating its effectiveness even against a state-of-the-art robust model.\n\nTable 3.2: Attack performance on VGGT using the DTU dataset.\n\n|Method| RAFT-Stereo D1 | RAFT-Stereo EPE |\n|--|--|--|\n| Stereoscopic | 6.96±1.08 | 5.67±0.77 |\n| Ours | 42.29±8.90 | 37.84±5.10 |\n\n## 2. Figure Resolution\n**W2: The image clarity in this paper has some issues, for example, in Fig. 2(a) and Figs. 3(b) and 3(c).**\n\nThank you for the feedback. The reduced clarity of the figures is due to the compression applied during manuscript submission. We will provide higher-resolution versions of all figures in the revised manuscript to ensure they are clearly visible and easy to read.\n\n## 3. Writing & Typos Issues\n**W3: There are some typos; for example, on line 16, “RAFTS-tereo” should be corrected to “RAFT-Stereo.”**\n\nThank you for the feedback. We will carefully revise all of the writing issues for the updated version.\n\n## 4. Theoretical & Intuitive Analysis\n\n**W4: This paper should contain further theoretical analysis or insights into the proposed method.**\n\n**Q1: The authors are suggested to provide a more intuitive example to illustrate why the proposed attack is effective. For instance, in transformer-based methods, could you present depth attention maps showing the value changes before and after the attack to draw further interesting conclusions?**\n\nThank you for the suggestion. We conducted a saliency map analysis [7] to identify which regions in the input image most influence the model's depth prediction for the patch. We compared two patch types under identical KITTI scene setups: (1) a naive repeated patch (Fig. 2(b), top-left), and (2) our proposed DepthVanish patch with interval insertion. While figures cannot be included in the rebuttal, we describe the results in words and will include the visualizations in the revised version.\n\n**Observations:**\n* For the **naive patch**, the model's prediction is heavily influenced by the surrounding scene content; saliency is broadly distributed.\n* For the **DepthVanish patch**, the model's focus shifts toward the patch region itself, indicating increased reliance on the patch content.\n\n**Conclusion:**\nThe above observation provides us a potentional explanation of why interval inserting can attack more effectively. The introduction of intervals makes the depth prediction of the patch more focus on the patch region itself where the repeated pattern presents. As it is well-known that epipolar geometry becomes unrealiable when repeated pattern exists, our method enhances such unrealiability by shifting the model focus onto the patch region during prediction.\n\n**Q3: Could the authors provide further theoretical analysis or insights into the inductive biases of the proposed method?**\n\nWe appreciate the insightful suggestion and agree that a deeper understanding of the inductive biases in our method is valuable. While our primary focus has been empirical, we offer the following analysis:\n\n1. **Structured Ambiguity Bias.**\nOur method is built on the theoretical insight that stereo matching systems are fundamentally vulnerable to periodic patterns that create correspondence ambiguity (Eq. 2). Such ambiguity is amplified by grid intervals, which act as structured aliasing mechanisms creating extensive local minima in the cost volume. The inductive bias here is that spatial discontinuities (intervals) combined with repetitive patterns create stronger matching confusion than continuous repetitive patterns alone.\n\n2. **Multi-directional Disruption Bias.**\nOur grid-based interval structure incorporates the bias that stereo systems are most vulnerable when correspondence ambiguity occurs in both horizontal (epipolar) and vertical directions simultaneously. This reflects the underlying assumption that stereo algorithms rely on both local feature matching and global consistency constraints, disrupting both dimensions maximizes attack effectiveness.\n\n4. **Binary Structure Regularization.**\nOur entropy and total variation losses, i.e., Eq. (7) and Eq. (8), encode the inductive bias that sharp, well-defined boundaries between texture and interval regions are more effective than gradual transitions. This reflects the insight that stereo algorithms are more confused by clear structural patterns than by smooth variations, especially for the physical scenarios.\n\nReferences\n\n[1] Iterative Geometry Encoding Volume for Stereo Matching (Xu et al., CVPR 2023)\n\n[2] Practical Stereo Matching via Cascaded Recurrent Network With Adaptive Correlation (Li et al., CVPR 2022)\n\n[3] Unifying Flow, Stereo, and Depth Estimation.(Xu et al., TPAMI 2023)\n\n[4] Vggt: Visual geometry grounded transformer. (Wang et al., CVPR 2025)\n\n[5] Attention concatenation volume for accurate and efficient stereo matching. (Xu, Gangwei, et al. CVPR 2022)\n\n[6] Large scale multi-view stereopsis evaluation. (CVPR 2014)\n\n[7]  Deep inside convolutional networks: Visualising image classification models and saliency maps. (Simonyan K, et al., arXiv)"}, {"review_id": "dEGAmfzPdl", "reviewer": "Reviewer_xpZm", "summary": "Stereo depth estimation is commonly used in safety-critical applications such as autonomous driving and robotics for depth and distance estimation. Various deep learning models have been proposed for highly accurate and robust depth estimation using stereo images. However, the literature has shown that these models are vulnerable to adversarial attacks. Most state-of-the-art works on adversarial attacks for depth estimation models have focused either on monocular depth estimation or solely on the digital domain. This work focuses on improving the effectiveness of adversarial attacks on stereo depth estimation models in the physical domain. The authors show that introducing regular intervals between repeated texture patterns can significantly enhance the effectiveness of patch attacks on stereo depth estimation models in the physical world. Based on these insights, the authors propose a novel attack, DepthVanish, that optimizes both the texture pattern and the interval (striped structure). The results highlight its effectiveness even on commercial Intel RealSense cameras.", "questions": "• How does the proposed technique perform under variations in ground truth depth and patch orientations along the x, y, and z axes in both digital and physical settings? Including plots similar to those in Fig. 2 and Fig. 3 for the evaluations in the results section can improve the understanding of the performance of the attack. \n\n• What specific procedure was used to generate the patch shown in Fig. 2? How consistent are the results across different runs if the output of the procedure is not the same across runs?\n\n• What is meant by “we empirically apply the optimal interval width o and repetition times k from Sec. 3”? How exactly one determines optimal interval width o and repetition times k?\n\n• What is meant by “we keep adopt a patch with a physical size (u, v) = (0.891m, 1.26m) and specify the physical ground-truth depth e = 5m”? Why specifically just these values?\n\n• The current discussion of related work seems limited, with comparisons made to only two prior works. To effectively position the proposed approach within the existing works, it is important to consider additional relevant references. Works that should be considered are:\nA. Liu, et al. 2025. 'Optimization-Free Patch Attack on Stereo Depth Estimation.' arXiv preprint arXiv:2506.17632.\nB. Wang, et al. 2024. 'Left-Right Discrepancy for Adversarial Attack on Stereo Networks.' arXiv preprint arXiv:2401.07188.\nC. Liu, et al. 2024. 'Physical Attack for Stereo Matching.' In Proceedings of the International Conference on Computer Vision and Deep Learning (CVDL 2024)", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n• The paper presents a physically realizable adversarial attack on stereo depth estimation models. The attack is transferable across models, and demonstrated to work against even commercial solutions such as Intel RealSense.\n\n• The attack is evaluated in both digital and physical domains, with multiple models and datasets used to demonstrate its effectiveness.\n\n\nWeaknesses\n\n• The paper provides limited coverage of related literature, focusing on only two prior works for comparison. To strengthen the contribution, additional relevant references should be considered and discussed. \n\nA. Liu et al. 2025. “Optimization-Free Patch Attack on Stereo Depth Estimation.” arXiv preprint arXiv:2506.17632. \n\nB. Wang et al. 2024. “Left-Right Discrepancy for Adversarial Attack on Stereo Networks.” arXiv preprint arXiv:2401.07188. \n\nC. Liu et al. 2024. “Physical Attack for Stereo Matching.” In Proceedings of the International Conference on Computer Vision and Deep Learning (CVDL 2024) \n\n\n• The empirical selection of some of the parameters is not well explained. \n\n• Limited evaluation of the proposed technique. Important variations such as changes in physical ground truth depth, patch orientation across the x, y, and z axes, and lighting conditions are not considered. Additionally, the results section lacks plots, such as those in Fig. 2 and Fig. 3, that would illustrate the technique’s effectiveness in practical settings.", "was_revised": true, "final_justification": "I appreciate authors' efforts in providing additional discussion points, justifications, and results. Most of my major comments are addressed. It would be good to add figures in the revised manuscript in case accepted.\nOne comment, instead of cropping the patch from the paper Ref 3 because code is not available, at least try to implement the approach based on the methodology explained in the paper.\nAnyway, I have upgraded my rating to Borderline Accept.", "rebuttal": "## 1. More Baselines.\n**W1: The paper provides limited coverage of related literature, focusing on only two prior works for comparison. To strengthen the contribution, additional relevant references should be considered and discussed.**\n\n**Q5: The current discussion of related work seems limited, with comparisons made to only two prior works. To effectively position the proposed approach within the existing works, it is important to consider additional relevant references.**\n\nThank you for your valuable comments and for providing meaningful attack methods. We would like to note that we are familiar with the three related works listed. However, Reference 1 was submitted to arXiv one month after our NIPS submission. Reference 2 is similar to Stereopognosia (one of the baselines we compared against); both apply adversarial noise to the entire image for the left and right views, respectively. Regarding Reference 3, since the code has not been released, we directly cropped the relevant patch from the Reference 3 paper and used it for evaluation. The attack results for RAFT-Stereo and STTR on the KITTI dataset are presented in Tab. 4.1. Please note that the experimental setup remains the same as in our main experiments. Observing the results for new baselines, we see that our method consistently achieves better performance.\n\nTable 4.1: The attack performance of Reference 2 and Reference 3 on the KITTI dataset.\n\n| Method         | RAFT-Stereo D1      | RAFT-Stereo EPE     | STTR D1           | STTR EPE          |\n|----------------|----------------------|-----------------------|--------------------|--------------------|\n| Stereopagnosia | 4.18±11.27          | 2.09±12.66           | 3.02±3.00         | 1.28±8.79         |\n| Ref. 2           | 5.02±6.79           | 2.50±7.30            | 3.36±2.84         | 1.31±5.06         |\n|Ref. 3           | 5.88±2.30 | 3.24±6.90 | 3.04±9.17 | 1.69±10.27 |\n| Ours           | 89.31±6.56          | 66.01±6.18           | 92.38±8.76        | 69.25±6.62        |\n\n## 2. Hyper-parameter Explanation\n**W2: The empirical selection of some of the parameters is not well explained.**\n\n**Q3: What is meant by “we empirically apply the optimal interval width o and repetition times k from Sec. 3”? How exactly one determines optimal interval width o and repetition times k?**\n\nThank you for the comments. This means that the values for $o$ (optimal interval width) and $k$ (repetition times) are derived from the experimental investigations described earlier in the paper (specifically in Section 3). We further supplemented the experiment as follows:\n\n1. To determine the optimal interval width $o$, we systematically studied the influence of different interval widths. Tab. 4.2 summarizes the attack performance of different interval width that averaged over various patch physical dpeth. Based on this investigation, 10 pixels yielded the best performance; therefore, $o = 10px$ is used as the optimal setting in the main experiments.\n\n2. The number of repetitions $k$ is determined by the texture element $E$, which has a fixed size of $64 \\times 64$ pixels, consistent with the *Stereoscopic* setting. $k$ is calculated based on how many such elements can fit within the patch using the chosen interval $o$, ensuring a dense yet non-overlapping arrangement.\n\nTable 4.2 The average attack performance for different interval widths on the KITTI scene.\n\n|  | 1px | 2px | 3px | 4px | 5px | 6px | 7px | 8px | 9px | 10px |\n|--|--|--|--|--|--|--|--|--|--|--|\n| D1-error | 17.76 | 20.14 | 19.09 | 20.72 | 23.22 | 22.57 | 23.15 | 22.99 | 22.90 | 25.44 |\n\n**Q4:  What is meant by “we keep adopt a patch with a physical size (u, v) = (0.891m, 1.26m) and specify the physical ground-truth depth e = 5m”? Why specifically just these values?**\n\nGiven the objective of physical deployment, the patch size ratio is defined as $1:\\sqrt{2}$, corresponding to the aspect ratio of A3 paper, to facilitate practical printing. To ensure methodological consistency, this configuration is also adopted during digital evaluation. In Section C.1 of the Supplemental Material, we ablated both of these parameters, and some combinations achieved better attack performance, e.g., $(u,v) = 0.8 \\times (0.891m, 1.26m)$ with $e = 13m$. The main experiments use the combination $(u,v) = (0.891m, 1.26m)$ and $e = 5m$ for a clear visualization, as smaller patches or larger depths hinder visibility.\n\n## 3. Experimental Details\n**Q2a: What specific procedure was used to generate the patch shown in Fig. 2?**\n\nThe patch for the empirical study is constructed following the same procedure of grid-based attack described in line 178-184 of Sec. 5.1, and only the interval setting (width and insertion direction, either horizontal or vertical) of the patch is varied. Note that the overall content is centerted, which means that the grid of repeated texture elements $E$ is symmetrically placed within the patch $P$, with equal or nearly equal margins on all sides.\n\n**Q2b: How consistent are the results across different runs if the output of the procedure is not the same across runs?**\n\nThe only two factors that will influence the empircal study are the scene image and patch physical size adopted. As we cannot upload figures for visualization, we note that the overall trending are almost the same as Fig.2(a) for various scene images and patch physical size during our comprehensive empirical investigation.\n\n## 4. Comprehensive Ablation Results\n**W3: Limited evaluation of the proposed technique. Important variations such as changes in physical ground truth depth, patch orientation across the x, y, and z axes, and lighting conditions are not considered. Additionally, the results section lacks plots, such as those in Fig. 2 and Fig. 3, that would illustrate the technique’s effectiveness in practical settings.**\n\n**Q1: How does the proposed technique perform under variations in ground truth depth and patch orientations along the x, y, and z axes in both digital and physical settings? Including plots similar to those in Fig. 2 and Fig. 3 for the evaluations in the results section can improve the understanding of the performance of the attack.**\n\n**Physical Ground Truth Depth.** The digital and physical evaluation results of various physical ground truth depth are presented as Fig.2 and Fig.5 in the Supplemental Aaterial respectively. These evaluations demonstrate the robustness of the attack across a range of depth values.\n\n**Patch Orientation (Rotation).** While the impact of physical patch rotation is visualized in Fig. 8, we also provide digital evaluation results under different rotational axes in Table 4.3 using RAFT-Stereo on the KITTI dataset. Rotation along the Z axis falls outside the scope of our attack design, as it disrupts the necessary repetition along epipolar lines. Consequently, current attack methods (including Stereoscopic) are also unable to handle this type of rotation. Apart from this, our method demonstrates robustness to rotations along the X and Y axes.\n\nTable 4.3: The average attack performance (D1-error) under various rotation degree.\n\n| Axis | $0^o$ | $10^o$ | $20^o$ | $30^o$ | $40^o$ | $50^o$ | $60^o$ |\n|---|---|---|---|---|---|---|---|\n| X (ours) | 89.31±6.56 | 89.95±6.60 | 89.14±5.43 | 89.74±3.81 | 88.02±3.10 | 87.36±4.70 | 85.23±1.70 |\n| Y (ours) | 89.31±6.56 | 88.53±2.31 | 89.41±6.22 | 87.58±3.35 | 85.66±2.15 | 79.09±3.67 | 75.56±2.73 |\n||\n| Z (ours) | 89.31±6.56 | 2.15±0.88 | 3.21±2.39 | 1.17±0.30 | 1.15±0.62 | 2.27±1.10 |2.87±1.93 |\n| Z (Stereoscopic) | 5.79±9.88 | 3.58±1.50 | 2.23±1.93 | 1.52±1.77 | 2.56±0.25 | 2.62±2.16 | 3.87±1.79 |\n\n**Lighting and Shadow Variations.** To evaluate the influence of environmental factors such as lighting and shadow on attack performance, we conduct experiments using RAFT-Stereo on the KITTI dataset under six levels of perturbation.\nLighting variations are simulated by adjusting image brightness using the OpenCV example code: `np.clip(image * ratio, 0, 255)`, where a smaller ratio represents lower lighting intensity. Shadow variations are introduced by overlaying a semi-transparent black mask (RGBA: \\[0, 0, 0, 127.5]) over the image patch, with the shadow progressively covering the patch from left to right based on the specified ratio.\nAs shown in Table 4.4, our method demonstrates strong robustness under varying lighting and shadow conditions.\n\nTable 4.4: The attack performance (D1-error) under different lighting and shadow conditions.\n\n| Perturbation | $10\\%$ | $20\\%$ | $40\\%$ | $60\\%$ | $80\\%$ | $100\\%$ |\n|---|---|---|---|---|---|---|\n| Lighting | 88.64±7.81 | 89.87±7.62 | 89.64±6.20 | 88.80±6.65 | 88.43±7.62 | 89.31±6.56 |\n| Shdow   | 87.30±5.19 | 87.26±6.24 | 82.71±6.18 | 88.69±5.60 | 89.26±6.22 | 89.62±6.36 |\n\n\nSince the rebuttal does not support figures, we will update the manuscript later to incorporate all the comprehensive ablation results as figures to facilitate the intuitive understanding of our work."}]

Author rebuttal:

Meta-review: This manuscript proposes an adversarially optimized targeted patch attack for stereo depth estimation. DepthVanish optimizes adversarial patches jointly for structured interval spacing and texture using a joint optimization pipeline It is evaluated on e.g. RAFT-Stereo and STTR and commercial RGB-D cameras, i.e. for digital attacks and physical attacks.
After the discussion phase, all major concerns, mostly regarding paper writing, clarity of method presentation and experimental setup, figure resolution, etc.  are addressed., and all reviewers agree that the proposed method is interesting. Since there is no revision, the reviewers and AC strongly hope that all promised clarifications will be included in the final version.
Decision: Accept (poster)