  In this paper, we propose a model that can attack segmentation models with
semantic and dynamic targets in the context of self-driving. Specifically, our
model is designed to map an input image as well as its corresponding label to
perturbations. After adding the perturbation to the input image, the
adversarial example can manipulate the labels of the pixels in a semantically
meaningful way on dynamic targets. In this way, we can make a potential attack
subtle and stealthy. To evaluate the stealthiness of our attacking model, we
design three types of tasks, including hiding true labels in the context,
generating fake labels, and displacing labels that belong to some category. The
experiments show that our model can attack segmentation models efficiently with
a relatively high success rate on Cityscapes, Mapillary, and BDD100K. We also
evaluate the generalization of our model across different datasets. Finally, we
propose a new metric to evaluate the parameter-wise efficiency of attacking
models by comparing the number of parameters used by both the attacking models
and the target models.
