Research questionHow can adversarial perturbations transfer to unseen semantic-segmentation models while accounting for dense spatial and class-wise structure?A perturbation crafted on a surrogate segmentation model must mislead an unseen target model. This is difficult because dense prediction depends on spatially organized and class-specific representations, not only output scores.