A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations

1 INTRODUCTION . Neural networks are now widely embraced as dominant solutions in computer vision ( Krizhevsky et al. , 2012 ; He et al. , 2016 ) , speech recognition ( Graves et al. , 2013 ) , and natural language processing ( Collobert & Weston , 2008 ) . While their accuracy scores often match ( and sometimes go beyond ) human-level performance on key benchmarks ( He et al. , 2015 ; Taigman et al. , 2014 ) , we still do not understand how robust neural networks are . A prominent issue in this context is the existence of so-called adversarial examples , i.e. , inputs that are almost indistinguishable from natural data to a human but cause state-of-the-art classifiers to make incorrect predictions with high confidence ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ) . This raises concerns about the use of neural networks in contexts where reliability , dependability , and security are important desiderata . There is a long line of work on methods for constructing adversarial perturbations in various settings ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Kurakin et al. , 2016a ; b ; Sharif et al. , 2016 ; Moosavi-Dezfooli et al. , 2016 ; Carlini & Wagner , 2016 ; Papernot et al. , 2017 ; Madry et al. , 2017 ; Athalye et al. , 2017 ) . However , these methods are quite sophisticated and the resulting perturbations tend to be fairly contrived since they often rely on fine-tuned control over a large number of input pixels or audio samples . So one may suspect that adversarial examples constitute a problem only in the presence of a truly malicious attacker and are unlikely to arise in more benign environments . In particular , the focus on intricate worst-case attacks so far raises a natural question : Are neural networks robust to simple , naturally-occurring transformations of their input ? We address this question by studying two basic image transformations : translations and rotations . While these transformations appear natural to a human , we show that small rotations and translations alone ( i.e. , without any additional fine-tuned perturbation ) can cause a significant drop in the model ’ s performance . This holds even when the model has been trained using appropriate data augmentation and no visual information is lost due to these transformations ( e.g . due to cropping , see Figure 1 ) . 1.1 OUR METHODOLOGY AND RESULTS . We start with standard image classifiers for the MNIST ( LeCun et al. , 1998 ) , CIFAR10 ( Krizhevsky & Hinton , 2009 ) , and ImageNet ( Russakovsky et al. , 2015 ) datasets . The classifiers achieve close to state-of-the-art performance on the respective benchmarks . Nevertheless , we demonstrate that small transformations can cause a significant drop in classification accuracy for these models . Depending on dataset and model , this drop ranges from 34 % to as high as 90 % for the worst combination of rotation angle and translation shift . Even for a small random transformation , the accuracy can drop by up to 30 % . These results demonstrate that robustness to rotations and translations should also be a concern in standard classification problems outside an adversarial security context . Moreover , we show that direct access to the model ( or a surrogate ) is not necessary to find such misclassifying transformations . Choosing the worst out of 10 random transformations suffices to reduce the accuracy of these models by 26 % on MNIST , 72 % on CIFAR10 , and 28 % on ImageNet ( top 1 accuracy ) . Hence our results also give a strong baseline for fooling classifiers with a small number of non-adaptive queries . Finally , we examine possible ways to alleviate these vulnerabilities . A natural first step is to augment the training procedure with rotations and translations . While this does largely mitigate the problem on MNIST , the models trained on CIFAR10 and ImageNet are still far from robust . We thus propose two natural methods for further increasing the robustness of these models . These methods are based on robust optimization and aggregation of random input transformations . They offer significant improvements in classification accuracy but also come with considerable computational overhead . Even then , they are still not sufficient to completely mitigate the vulnerability . This suggests that obtaining models robust to spatial transformations of their inputs remains a challenge . Finally , we examine the interplay between rotations / translations and the widely used ` ∞-based adversarial examples . We observe that robustness to these two classes of input perturbations is largely orthogonal to each other . In particular , pixel-based robustness does not imply spatial robustness , while combining spatial and ` ∞-bounded transformations seems to have a cumulative effect in reducing classification accuracy . This emphasizes the need to broaden the notions of image similarity in the adversarial examples literature beyond the common ` p-balls . 1.2 SUMMARY OF CONTRIBUTIONS . We perform extensive experiments that provide a fine-grained understanding of rotation / translation robustness on a wide spectrum of datasets and training regimes . In summary , we show that : • A simple attack based solely on rotations and translations is effective against state-of-theart neural networks . This holds even when the model has been trained with appropriate data augmentation and no image information is lost during the spatial transformation . • Rotation / translation attacks are easy to execute , requiring only a few black-box queries . • It is possible to increase a model ’ s robustness to rotations and translations at the cost of increased training and / or inference time . However , these methods are still not sufficient to fully recover the accuracy on unmodified images . • Robustness to ` ∞-bounded perturbations does not significantly affect spatial robustness . Instead , these two notions appear orthogonal to each other . • First-order methods are significantly less effective for finding adversarial transformations than an exhaustive search over a fine grid of transformations . This is in stark contrast to ` p-bounded perturbrbations where first-order methods have been very successful ( Carlini & Wagner , 2016 ; Madry et al. , 2017 ) . Hence rigorous evaluation of model robustness in this spatial setting requires techniques that are different from ` p-bounded adversarial examples . 2 ADVERSARIAL ROTATIONS AND TRANSLATIONS . Recall that in the context of image classification , an adversarial example for a given input image x and a classifier C is an image x′ that satisfies two properties : ( i ) on the one hand , the adversarial example x′ causes the classifier C to output a different label on x′ than on x , i.e. , we have C ( x ) 6= C ( x′ ) . ( ii ) On the other hand , the adversarial example x′ is “ visually similar ” to x . Clearly , the notion of visual similarity is not precisely defined here . In fact , providing a precise and rigorous definition is extraordinarily difficult as it would require formally capturing the notion of human perception . Consequently , previous work largely settled on the assumption that x′ is a valid adversarial example for x if and only if ‖x − x′‖p ≤ ε for some p ∈ [ 0 , ∞ ] and ε small enough . This convention is based on the fact that two images are indeed visually similar when they are close enough in some ` p norm . However , the converse is not necessarily true . A small rotation or translation of an image usually appears visually similar to a human , yet can lead to a large change when measured in an ` p norm . We aim to expand the range of similarity measures considered in the adversarial examples literature by investigating robustness to small rotations and translations . Attack methods . Our first goal is to develop sufficiently strong methods for generating adversarial rotations and translations . In the context of pixel-wise ` p perturbations , the most successful approach for constructing adversarial examples so far has been to employ optimization methods on a suitable loss function ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014 ; Carlini & Wagner , 2016 ) . Following this approach , we parametrize our attack method with a set of tunable parameters and then optimize over these parameters . We perform this optimization in three distinct ways : • First-Order Method ( FO ) : Starting from a random choice of parameters , we iteratively take steps in the direction of the gradient of the loss function . This is the direction that locally maximizes the loss of the classifier ( as a surrogate for misclassification probability ) . Note that unlike the ` p-norm case , we are not optimizing in the pixel space but in the latent space of rotation and translation parameters . • Grid Search : We discretize the parameter space and exhaustively examine every possible parametrization of the attack to find one that causes the classifier to give a wrong prediction ( if such a parametrization exists ) . Since our parameter space is low-dimensional enough , this method is computationally feasible ( in contrast to a grid search for ` p-based adversaries ) . • Worst-of-k : We randomly sample k different choices of attack parameters and choose the one on which the model performs worst . As we increase k , this attack interpolates between a random choice and grid search . While a first-order attack requires full knowledge of the model to compute the gradient of the loss with respect to the input , the other two attacks do not . They only require the outputs corresponding to chosen inputs , which can be done witho only query access to the target model . Next , we need to define the exact range of attacks we want to optimize over . For the case of rotation and translation attacks , we wish to find parameters ( δu , δv , θ ) such that rotating the original image by θ degrees around the center and then translating it by ( δu , δv ) pixels causes the classifier to make a wrong prediction . Formally , the pixel at position ( u , v ) is moved to the following position ( assuming the point ( 0 , 0 ) is the center of the image ) : [ u′ v′ ] = [ cos θ − sin θ sin θ cos θ ] · [ u v ] + [ δu δv ] . We implement this transformation in a differentiable manner using the spatial transformer blocks of ( Jaderberg et al. , 2015 ) . In order to handle pixels that are mapped to non-integer coordinates , the transformer units include a differentiable bilinear interpolation routine . Since our loss function is differentiable with respect to the input and the transformation is in turn differentiable with respect to its parameters , we can obtain gradients of the model ’ s loss function w.r.t . the perturbation parameters . This enables us to apply a first-order optimization method to our problem . By defining the spatial transformation for some x as T ( x ; δu , δv , θ ) , we construct an adversarial perturbation for x by solving the problem max δu , δv , θ L ( x′ , y ) , for x′ = T ( x ; δu , δv , θ ) , ( 1 ) where L is the loss function of the neural network1 , and y is the correct label for x . Since this is a non-concave maximization problem , there are no guarantees for the global optimality of a general first order method .

Summary: The authors study robustness of neural networks for image recognition tasks with respect to geometric transformations in input space. The question is posed in an adversarial setting, where the authors exploit that Conv/ResNets are not fully translation and rotation invariant. The authors propose three untargeted attacks to increase the classification error of the network: a first-order method, an attack involving random transformations and a grid search of allowed transformations. For the random and grid search the worst prediction is considered the outcome of the attack. The authors observe that first-order attacks are not very successful in fooling the network compared to the grid search. Data augmentation as a counter measure is found to be not sufficient and adversarial (robust) training with respect to the random search attack is proposed in addition.