Title: DepthVanish: Optimizing Adversarial Interval Structures for Stereo-Depth-Invisible Patches
Venue: NeurIPS 2025
Accepted: yes
Keywords: Adversarial Attack

Depth Estimation

Stereo Matching
Abstract: Stereo depth estimation is a critical task in autonomous driving and robotics, where inaccuracies (such as misidentifying nearby objects as distant) can lead to dangerous situations. Adversarial attacks against stereo depth estimation can help revealing vulnerabilities before deployment. Previous works have shown that repeating optimized textures can effectively mislead stereo depth estimation in digital settings. However, our research reveals that these naively repeated textures perform poorly in physical implementations, $\textit{i.e.}$, when deployed as patches, limiting their practical utility for stress-testing stereo depth estimation systems. In this work, for the first time, we discover that introducing regular intervals among the repeated textures, creating a grid structure, significantly enhances the patch attack performance. Through extensive experimentation, we analyze how variations of this novel structure influence the adversarial effectiveness. Based on these insights, we develop a novel stereo depth attack that jointly optimizes both the interval structure and texture elements. Our generated adversarial patches can be inserted into any scenes and successfully attack advanced stereo depth estimation methods of different paradigms, $\textit{i.e.}$, RAFT-Stereo and STTR. Most critically, our patch can also attack commercial RGB-D cameras (Intel RealSense) in real-world conditions, demonstrating their practical relevance for security assessment of stereo systems. The code is officially released at: https://github.com/WiWiN42/DepthVanish


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nStereo depth estimation is commonly used in safety-critical applications such as autonomous driving and robotics for depth and distance estimation. Various deep learning models have been proposed for highly accurate and robust depth estimation using stereo images. However, the literature has shown that these models are vulnerable to adversarial attacks. Most state-of-the-art works on adversarial attacks for depth estimation models have focused either on monocular depth estimation or solely on the digital domain. This work focuses on improving the effectiveness of adversarial attacks on stereo depth estimation models in the physical domain. The authors show that introducing regular intervals between repeated texture patterns can significantly enhance the effectiveness of patch attacks on stereo depth estimation models in the physical world. Based on these insights, the authors propose a novel attack, DepthVanish, that optimizes both the texture pattern and the interval (striped structure). The results highlight its effectiveness even on commercial Intel RealSense cameras.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n• The paper presents a physically realizable adversarial attack on stereo depth estimation models. The attack is transferable across models, and demonstrated to work against even commercial solutions such as Intel RealSense.\n\n• The attack is evaluated in both digital and physical domains, with multiple models and datasets used to demonstrate its effectiveness.\n\n\nWeaknesses\n\n• The paper provides limited coverage of related literature, focusing on only two prior works for comparison. To strengthen the contribution, additional relevant references should be considered and discussed. \n\nA. Liu et al. 2025. “Optimization-Free Patch Attack on Stereo Depth Estimation.” arXiv preprint arXiv:2506.17632. \n\nB. Wang et al. 2024. “Left-Right Discrepancy for Adversarial Attack on Stereo Networks.” arXiv preprint arXiv:2401.07188. \n\nC. Liu et al. 2024. “Physical Attack for Stereo Matching.” In Proceedings of the International Conference on Computer Vision and Deep Learning (CVDL 2024) \n\n\n• The empirical selection of some of the parameters is not well explained. \n\n• Limited evaluation of the proposed technique. Important variations such as changes in physical ground truth depth, patch orientation across the x, y, and z axes, and lighting conditions are not considered. Additionally, the results section lacks plots, such as those in Fig. 2 and Fig. 3, that would illustrate the technique’s effectiveness in practical settings.\n\nQUESTIONS:\n• How does the proposed technique perform under variations in ground truth depth and patch orientations along the x, y, and z axes in both digital and physical settings? Including plots similar to those in Fig. 2 and Fig. 3 for the evaluations in the results section can improve the understanding of the performance of the attack. \n\n• What specific procedure was used to generate the patch shown in Fig. 2? How consistent are the results across different runs if the output of the procedure is not the same across runs?\n\n• What is meant by “we empirically apply the optimal interval width o and repetition times k from Sec. 3”? How exactly one determines optimal interval width o and repetition times k?\n\n• What is meant by “we keep adopt a patch with a physical size (u, v) = (0.891m, 1.26m) and specify the physical ground-truth depth e = 5m”? Why specifically just these values?\n\n• The current discussion of related work seems limited, with comparisons made to only two prior works. To effectively position the proposed approach within the existing works, it is important to consider additional relevant references. Works that should be considered are:\nA. Liu, et al. 2025. 'Optimization-Free Patch Attack on Stereo Depth Estimation.' arXiv preprint arXiv:2506.17632.\nB. Wang, et al. 2024. 'Left-Right Discrepancy for Adversarial Attack on Stereo Networks.' arXiv preprint arXiv:2401.07188.\nC. Liu, et al. 2024. 'Physical Attack for Stereo Matching.' In Proceedings of the International Conference on Computer Vision and Deep Learning (CVDL 2024)\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focus on Adversarial attacks against stereo depth estimation and shows that inserting regular gaps to form striped patterns, rather than naively repeating textures, which dramatically improves the real-world effectiveness of adversarial patches against stereo depth estimation. By jointly optimizing stripe intervals and texture content, these patches reliably fool state-of-the-art stereo models (RAFT-Stereo, STTR) and even commercial Intel RealSense RGB-D cameras under real-world conditions.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. This paper introduces the first adversarial patch that reliably transfers from digital simulation to real-world stereo setups, encompassing both learning-based (RAFT-Stereo, STTR) and commercial (Intel RealSense) systems.\n2. Through systematic empirical analysis, the authors identify that inserting regular intervals between repeated textures (striped patterns) dramatically improves physical-world attack transferability, a key observation not previously reported.\n\nWeaknesses:\n1. The stereo matching methods targeted in this paper are not the latest in the field; for example, the authors do not validate their proposed attack on classic approaches such as [1], [2], and [3].\n2. The image clarity in this paper has some issues, for example, in Fig. 2(a) and Figs. 3(b) and 3(c).\n3. There are some typos; for example, on line 16, “RAFTS-tereo” should be corrected to “RAFT-Stereo.”\n4. This paper should contain further theoretical analysis or insights into the proposed method.\n\n[1] Iterative Geometry Encoding Volume for Stereo Matching (Xu et al., CVPR 2023)\n\n[2] Practical Stereo Matching via Cascaded Recurrent Network With Adaptive Correlation (Li et al., CVPR 2022)\n\n[3] Unifying Flow, Stereo, and Depth Estimation.(Xu et al., TPAMI 2023)\n\nQUESTIONS:\n1. The authors are suggested to provide a more intuitive example to illustrate why the proposed attack is effective. For instance, in transformer-based methods, could you present depth attention maps showing the value changes before and after the attack to draw further interesting conclusions?\n2. More stereo depth estimation methods should be included to validate the attack’s effectiveness, preferably on the recently robust 3D foundation model VGGT.\n3. Could the authors provide further theoretical analysis or insights into the inductive biases of the proposed method?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents \"DepthVanish,\" an adversarial patch attack for stereo depth estimation that optimizes both texture and interval structures to enhance physical-world effectiveness. Previous work on repetitive textures failed in recent SOTA methods, but the authors discover that introducing regular intervals (striped/grid structures) significantly improves attack performance. Based on this findings, they develop a joint optimization pipeline to co-design texture elements and spatial layouts, enabling the patch to mislead state-of-the-art models (e.g., RAFT-Stereo, STTR) and commercial RGB-D cameras (Intel RealSense) in both digital and physical settings. Experiments show that structured intervals boost depth misestimation (e.g., predicting infinite depth for close objects) and withstand viewpoint rotations, highlighting critical vulnerabilities in stereo systems.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. Effective attack designs. The authors introduce an interval-based structural design that demonstrates significant attack efficacy on stereo depth estimation systems across both digital simulations (e.g., KITTI, DrivingStereo) and physical deployments (e.g., Intel RealSense).\n\n2. Joint Optimization pipeline. Building on the interval structure insight, the proposed pipeline co-optimizes texture elements and spatial layouts, enhancing attack transferability across diverse models (e.g., RAFT-Stereo, STTR) and environmental conditions. \n\n3. Comprehensive evaluation. Experiments span digital evaluations on benchmark datasets and physical tests on commercial hardware, showcasing practical utility and real-world relevance for safety-critical systems.\n\n\n### Weakness\n1. Writing issue. The figures in the paper (e.g., depth prediction visualizations) lack sufficient resolution or labeling, potentially impeding reader comprehension of attack performance comparisons. \n\n\n2. Limited applicability. The attack evaluation is currently confined to stereo matching tasks, and the authors do not explore generalizability to related domains (e.g., optical flow estimation or multi-view stereo), which could expand the method’s utility.\n\nQUESTIONS:\n1. Could the authors evaluate if the designed method can be applied to flow matching and related scenario? This can further demonstrate the generalizability of the designed attack method.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes a new adversarially optimized targeted patch attack for stereo depth estimation using DNNs.\nThe proposed method, DepthVanish, optimizes the adversarial patches for structured interval spacing and texture.\n\nThe manuscript shows the effectiveness of the optimized patches both digitally and in physical settings, including transfer attacks by optimizing the patches for one architecture and transferring the patch as an attack to another architecture.\n\nThe visualizations and empirical results demonstrate the effectiveness of the optimized patches.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. Visualizations and empirical results demonstrate the effectiveness of the optimized patches.\n2. This work addresses an important real-world issue of vulnerability of DNN-based stereo depth estimation methods to malicious agents.\n3. The manuscript shows the effectiveness of the optimized patches both digitally and in physical settings.\n4. The optimized patch attacks for one architecture transfer to another architecture quite effectively.\n\nWeaknesses:\n1. The manuscript needs significant improvement in writing to add clarity. For example, section 3 already discusses Vertical and Horizontal Intervals as methods; however, they are defined significantly later in section 5. In the manuscript, it is not clear, both in the formulation and in the visualizations, whether the patch is merely added to one image (left) or to both images from stereo, and if it is both, then how does the method ensure consistency in the patch? Or is this something that is not of concern, and if so, then discussion around this would significantly help with clarity.\n2. The resolution of the included figures is very low, and improving that would help. For example, in Figure 4, it is sometimes very difficult to read some of the values on the spider plot.\n3. The manuscript repeatedly acknowledged RAFT-Stereo as the SotA method; however, on various datasets, numerous other methods outperform RAFT-Stereo, one example being [1] on the Spring dataset.\n4. The manuscript does not evaluate their attack against any defense methods, one such example would be [2].\n5. The manuscript in its current state is poorly written. For example, the related work paragraph on stereo depth estimation and depth estimation attack appears to be LLM-generated. This assessment is not merely because of the repeated use of \"—\" as done by many LLMs, but also because these paragraphs do not really do the work of the related work section in a manuscript. The paragraph on stereo depth estimation is more fitting as an \"introduction\" paragraph, since the stereo estimation methods used in this work are not really discussed here. The related work section is an opportunity to discuss how the different stereo-depth estimation methods used in the manuscript work and differ from each other. Likewise, the \"depth estimation attack\" paragraph also goes off-topic. For example, it talks about the lack of \"effective defense strategies\"; however, this work neither proposes nor uses any \"defense strategies\". Another example of poor writing is a lack of consistency. Line 33 writes \"..Fig. 1..\", whereas Line 39 writes \"Figure 1\". It would be great if these inconsistencies could be fixed. \n6. The formulations lack definitions, for example, in equations 1 and 2, \"d\" is not defined, and in equation 4, the spatial resolution of d^p_gt is not defined, which I infer from the visualizations is not equal to the spatial resolutions of I_l and I_r.\n7. In the conclusion, the manuscript claims that the proposed method effectively \"disappears\" objects; however, from the visualizations, this is an overclaim. Objects do not seem to disappear in the shared visualizations, only the region with the patch, regions in which the patch is occluding the objects, and the model seems to predict 0 disparity. \n8. The manuscript only explores one target, ie, disparity=0 and thus depth=infinity; it would be interesting to see if the methodology could optimize the patch for other targets, for example, disparity=infinity, ie, depth=0.\n9. There are multiple typos in the current manuscript, for example, in the abstract, Line 16: RAFTS-tereo instead of RAFT-Stereo, and in Line 226: missing space between (1242,* *375) while noting the image size for KITTI.\n\n\nReferences:\n\n[1] Xu, Gangwei, et al. \"Attention concatenation volume for accurate and efficient stereo matching.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022.\n\n[2] Agnihotri, Shashank, Julia Grabinski, and Margret Keuper. \"Improving feature stability during upsampling–spectral artifacts and the importance of spatial context.\" European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024.\n\nQUESTIONS:\nOne major question would be:\nIn the manuscript, it is not clear, both in the formulation and in the visualizations, whether the patch is merely added to one image (left) or to both images from stereo, and if it is both, then how does the method ensure consistency in the patch? Or is this something that is not of concern, and if so, then discussion around this would significantly help with clarity.\n\nAddressing the weaknesses would help improve the clarity of the work and the quality of the manuscript.\n\nLIMITATIONS:\nYes, the limitations are discussed briefly in the supplementary material. It would be great to include those in the main paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 1, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-15"}