Attacking visual foundation depth estimation model with adaptable adversarial patch

Vision foundation models (VFMs) have demonstrated strong generalization ability across various downstream tasks and scenes. However, their vulnerability to adversarial examples, particularly in safety-critical applications, remains insufficiently understood. This paper investigates the attack effect of physical adversarial patches on monocular depth estimation (MDE) models, specifically the foundation model Depth Anything, widely used in fields such as autonomous driving and robotic navigation. First, we introduce a universal patch attack pipeline and present the following key observations: 1) Attack effectiveness : In the pixel-wise dense prediction task of MDE, adversarial effects are largely confined to the patch area and do not spread to other regions, indicating that foundation models have enhanced adversarial robustness compared to traditional models. 2) Attack interpretability : The learned adversarial patches often contain semantically meaningful content, such as forests or buildings, leading to corresponding erroneous depth predictions, which adds interpretability to the attack’s behavior. Based on the observations, we focus on improving the applicability of adversarial patches in real-world environments by proposing a plug-and-play augmentation method, termed MixCrop, that enhances attack effectiveness, especially when patch semantics are incomplete or repetitive. Extensive experiments including physical attacks demonstrate that the patched objects can effectively vanish from the predicted depth map. The learned patches also have strong generalization ability across various objects and scenes.