Unadversarial Examples: Designing Objects for Robust Vision

1 Introduction . Performing reliably on unseen or shifting data distributions is a difficult challenge for modern computer vision systems . For example , slight rotations and translations of images suffice to reduce the accuracy of state-of-the-art classifiers [ ETT+19 ; ALG+19 ; KMF18 ] . Similarly , models that attain near human-level performance on benchmarks exhibit significantly degraded performance when faced with even mild image corruptions and transformations [ HD19 ; KSH+19 ] . In fact , when an adversary is allowed to modify inputs directly , standard vision models can be manipulated into predicting arbitrary outputs ( cf . adversarial examples [ BCM+13 ; SZS+14 ] ) . While robustness interventions and additional training data can improve out-of-distribution behavior , they do not fully close the gap between model performance on standard heldout data and on corrupted/otherwise unfamiliar data [ TDS+20 ; HBM+20 ] . The situation is worse still when test-time distribution is underor mis-specified , which occurs commonly in practice . How can we change this state of affairs ? We propose a new approach to image recognition in the face of unforeseen corruptions or distribution shifts . This approach is rooted in a reconsideration of the problem setup itself . Specifically , we observe that in many situations , a system designer actually controls , to some extent , the inputs that are fed into that model . For example , a drone operator seeking to train a landing pad detector can modify the surface of the landing pad ; and , a roboticist training a perception model to recognize a small set of custom objects can slightly alter the texture or design of these objects . We find that such control over inputs can be leveraged to drastically improve our ability to tackle computer vision tasks . In particular , it allows us to turn the input-sensitivity of modern vision systems from a weakness into a strength . Instead of optimizing inputs to mislead models ( e.g. , as in adversarial examples ) , we can alter inputs to reinforce correct behavior , yielding what we refer to as “ unadversarial examples. ” Indeed , we show that even a simple gradient-based algorithm can ∗Equal contribution . †Work partially completed while at Microsoft Research . 1Our code is available at https : //github.com/microsoft/unadversarial . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . successfully construct unadversarial examples in a variety of vision settings and demonstrate that , by optimizing objects for vision systems ( rather than vice-versa ) , we can significantly improve both in-distribution performance and robustness to unforeseen data shifts and corruptions . We demonstrate the efficacy of our methods on both standard benchmarks ( CIFAR , ImageNet ) and robustness-based benchmarks ( ImageNet-C , CIFAR-C ) while also comparing them to a broad set of baselines ( e.g. , QR codes or heuristically designed patches ) . To further highlight the practicality of our framework , we ( a ) extend our methods to designing the texture of three-dimensional objects ( rather than patches ) ; ( b ) deploy unadversarial examples in a simulated drone setting ; and ( c ) ensure that the performance improvement yielded by the objects we design actually transfer to the physical world . 2 Motivation and approach . While vision models tend to perform well on held-out data drawn from the same distribution as the training data , out-of-distribution inputs can severely degrade this performance . For example , models behave unreliably under distribution shifts induced by new data collection procedures [ RRS+19 ; EIS+20 ; TE11 ] , synthetic corruptions [ HD19 ; KSH+19 ] , spatial transformations [ ETT+19 ; FF15 ] , as well as under other types of shift . Given a fixed type of distribution shift , a standard approach to increasing model robustness is to explicitly train on or regularize with data from the corresponding anticipated test distribution [ KSH+19 ] . For example , Engstrom et al . [ ETT+19 ] find that vision models trained on worst-case rotations and translations end up being fairly robust to rotation and translation-based distribution shifts . However , this approach is not without shortcomings—for example , Kang et al . [ KSH+19 ] find that training CIFAR classification models that are robust to JPEG-compression in this manner requires a significant sacrifice in natural accuracy . Recent works make similar observations in the context of other distribution shift mechanisms like ` p adversaries [ TSE+19 ; SZC+18 ; RXY+19 ] or texture swapping [ GRM+19 ] . These observations give rise to a more general question : given that performing reliably in the face of constrained , well-specified distribution shifts is already a difficult challenge , how can we attain robustness to broad , unforeseen distribution shifts ? 2.1 Leveraging more controlled vision settings . Consider the vision tasks of detecting a landing pad from a drone , or classifying manufacturing components from a factory robot . In both these tasks , reliable in-distribution performance is a necessity ; still , a number of possible distribution shifts may occur at deployment time . For example , the drone might approach the landing pad at an atypical angle , or have a view obstructed by snow , smoke , or rain . Similarly , the factory robot may encounter objects in unfamiliar poses , or could be equipped with only a low-quality/noisy camera . At first glance , dealing with these issues seems to require tackling the difficult problem of general distribution shift robustness discussed earlier in this section . However , there is in fact a critical distinction between the scenarios considered above and vision tasks in their full generality . In particular , in these scenarios and many others , the system designer has control over the physical objects that the model operates on . For instance , the designer of the drone ’ s landing algorithm could paint the landing pad bright yellow . A machine learning model trained to detect this custom landing pad might then be more effective than a model trained to detect a standard grey pad , especially in lowvisibility conditions . Still , the particular choice to paint the landing pad yellow is rather ad hoc , and likely rooted in the way humans recognize objects . Meanwhile , an abundance of prior work ( e.g. , [ JBZ+19 ; GRM+19 ; JLT18 ; IST+19 ] ) demonstrates that humans and machine learning models tend to use different sets of features to make their decisions . This suggests that rather than relying on human priors , we should instead be asking : how can we build objects that are easily detectable by machine learning models ? 2.2 Unadversarial examples . The task of making inputs less recognizable by computer vision systems has been a focus of research in adversarial examples . Adversarial examples are small , carefully constructed perturbations to natural images that can induce arbitrary ( mis ) behavior from machine learning models [ BCM+13 ; SZS+14 ] . These perturbations are typically constructed as the result of an optimization problem that maximizes the loss of a machine learning model with respect to the input , i.e. , by solving the optimization problem δadv = arg max δ∈∆ L ( fθ ( x+ δ ) , y ) , ( 1 ) where fθ is a parameterized model ( e.g. , a neural network with weights θ ) ; x is a natural input ; y is the corresponding correct label ; L is the loss function used to train θ ( e.g. , cross-entropy loss ) and ∆ is a class of permissible perturbations ( e.g. , norm-bounded perturbations : ∆ = { δ : ‖δ‖p ≤ } for some small > 0 ) . Adversarial perturbations are typically crafted via projected gradient descent ( PGD ) [ Nes03 ] in input space , a standard iterative first-order optimization method—prior work in adversarial examples has shown that even a few iterations of PGD suffice to completely change the prediction of many state-of-the-art machine learning systems [ MMS+18 ] . From adversarial examples to unadversarial objects . The goal of this work is to modify the design of objects so that they are more easily recognizable by computer vision systems . If we could specify every pixel of every image that a model encounters at test time , we could draw on the effectiveness of adversarial examples , and construct image perturbations ( using PGD ) that minimize the loss of the system , e.g. , δunadv = arg min δ∈∆ L ( θ ; x+ δ , y ) . ( 2 ) In our setting of interest , however , having such fine-grained access to the test inputs is unrealistic ( presumably , if we had precise control over every pixel in the input , we could just directly encode the ground-truth label directly in it ) . Instead , we have limited control over some physical objects ; these objects are in turn captured within images , affected by many signals that are out of our control , such as camera artifacts , weather effects , or background scenery . It turns out that we can still draw on techniques from adversarial examples research in this limitedcontrol setting . Specifically , a recent line of work [ KGB17 ; SBB+16 ; EEF+18a ; AEI+18 ] concerns itself with constructing robust adversarial examples [ AEI+18 ] , i.e. , physically realizable objects that act as adversarial examples when introduced into a scene in any one of a variety of ways . For example , Sharif et al . [ SBB+16 ] design glasses frames that cause facial recognition models to misclassify faces , Athalye et al . [ AEI+18 ] design custom-textured 3D models that are misclassified by state-of-the-art ImageNet classifiers from many angles and viewpoints , and [ BMR+18 ] design adversarial patches : stickers that can be placed anywhere on objects causing them to be misclassified . In this paper , we leverage the techniques developed in the above line of work to construct robust un-adversarial objects—physically realizable objects optimized to minimize ( rather than maximize ) the loss of a target classifier . In the next section , we will more concretely discuss our methods for generating unadversarial objects , then outline our evaluation setup . 2.3 Constructing unadversarial objects . In the previous section , we identified a class of scenarios where a system designer can , to some extent , control the objects that a machine learning system model operates on . In these settings , we motivated so-called unadversarial examples as a potential way to boost models ’ overall performance and robustness to distribution shifts . In this section , we present and illustrate two concrete algorithms for constructing unadversarial examples : unadversarial patches and unadversarial textures . In the former , we design a sticker or “ patch ” [ BMR+18 ] that can be placed on the object ; in the latter , we design the 3D texture of the object ( in a similar manner to the texture-based adversarial examples of Athalye et al . [ AEI+18 ] ) . Example results from both techniques are shown in Figure 2 . For simplicity , we will assume that the task being performed is image classification , but the techniques are directly applicable to other tasks as well . In all cases , we require access to a pre-trained model for the dataset of interest . Unadversarial patches ( cf . Algorithm 1 in Appendix A ) . To train unadversarial patches ( cf . Figure 2a ) , in addition to the pre-trained model , we require sample access to image-label pairs from the dataset of interest . At each iteration , we sample an image-label pair ( x , y ) from a training set , and place the patch corresponding to class y onto the image with random orientation and position2 . Since placing the patch is an affine transformation , after each iteration we can compute the gradient of the model ’ s loss with respect to the pixels in the patch , and take a negative gradient step on the patch parameters . The algorithm terminates when the model ’ s loss on sticker-boosted images plateaus , or after a fixed number of iterations . Unadversarial textures ( cf . Algorithm 2 in Appendix A ) . To train unadversarial textures ( cf . Figure 2b ) , we do not require sample access to the dataset , but instead a set of 3D meshes for each class of objects that we would like to augment , as well as a set of background images that we can use to simulate sampling a scene ( these can be images from the dataset of interest , solid-color backgrounds , random patterns , etc. ) . For each 3D mesh , our goal is to optimize a 2D texture which improves classifier performance when mapped onto the mesh . At each iteration , we sample a mesh and a random background ; we then use a 3D renderer ( Mitsuba [ NVZ+19 ] ) to map the corresponding texture onto the mesh . We overlay the rendering onto a random background image , and then feed the resulting composed image into the pre-trained classifier , with the label being that of the sampled 3D mesh . Since rendering is typically non-differentiable , we use a linear approximation of the rendering process ( cf . Athalye et al . [ AEI+18 ] ) in order to compute ( this time approximate ) gradients of the model ’ s loss with respect to the utilized texture . From there , we apply the same SGD algorithm as we did for the patch case .

Summary: This paper exploits the  known-sensitivity of deep models to perturbation in the input data in order to improve (rather than decrease) the performance of a pre-trained model in a classification task. Specifically, the authors propose to alter the input data (i.e. images)  by 1) adding a patch to the image 2) altering the texture of specific objects. The paper shows experimentally that this improves both in-domain performance and robustness to data corruptions.