Unadversarial Examples: Designing Objects for Robust Vision

1 Introduction . Performing reliably on unseen or shifting data distributions is a difficult challenge for modern computer vision systems . For example , slight rotations and translations of images suffice to reduce the accuracy of state-of-the-art classifiers [ ETT+19 ; ALG+19 ; KMF18 ] . Similarly , models that attain near human-level performance on benchmarks exhibit significantly degraded performance when faced with even mild image corruptions and transformations [ HD19 ; KSH+19 ] . In fact , when an adversary is allowed to modify inputs directly , standard vision models can be manipulated into predicting arbitrary outputs ( cf . adversarial examples [ BCM+13 ; SZS+14 ] ) . While robustness interventions and additional training data can improve out-of-distribution behavior , they do not fully close the gap between model performance on standard heldout data and on corrupted/otherwise unfamiliar data [ TDS+20 ; HBM+20 ] . The situation is worse still when test-time distribution is underor mis-specified , which occurs commonly in practice . How can we change this state of affairs ? We propose a new approach to image recognition in the face of unforeseen corruptions or distribution shifts . This approach is rooted in a reconsideration of the problem setup itself . Specifically , we observe that in many situations , a system designer actually controls , to some extent , the inputs that are fed into that model . For example , a drone operator seeking to train a landing pad detector can modify the surface of the landing pad ; and , a roboticist training a perception model to recognize a small set of custom objects can slightly alter the texture or design of these objects . We find that such control over inputs can be leveraged to drastically improve our ability to tackle computer vision tasks . In particular , it allows us to turn the input-sensitivity of modern vision systems from a weakness into a strength . Instead of optimizing inputs to mislead models ( e.g. , as in adversarial examples ) , we can alter inputs to reinforce correct behavior , yielding what we refer to as “ unadversarial examples. ” Indeed , we show that even a simple gradient-based algorithm can ∗Equal contribution . †Work partially completed while at Microsoft Research . 1Our code is available at https : //github.com/microsoft/unadversarial . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . successfully construct unadversarial examples in a variety of vision settings and demonstrate that , by optimizing objects for vision systems ( rather than vice-versa ) , we can significantly improve both in-distribution performance and robustness to unforeseen data shifts and corruptions . We demonstrate the efficacy of our methods on both standard benchmarks ( CIFAR , ImageNet ) and robustness-based benchmarks ( ImageNet-C , CIFAR-C ) while also comparing them to a broad set of baselines ( e.g. , QR codes or heuristically designed patches ) . To further highlight the practicality of our framework , we ( a ) extend our methods to designing the texture of three-dimensional objects ( rather than patches ) ; ( b ) deploy unadversarial examples in a simulated drone setting ; and ( c ) ensure that the performance improvement yielded by the objects we design actually transfer to the physical world . 2 Motivation and approach . While vision models tend to perform well on held-out data drawn from the same distribution as the training data , out-of-distribution inputs can severely degrade this performance . For example , models behave unreliably under distribution shifts induced by new data collection procedures [ RRS+19 ; EIS+20 ; TE11 ] , synthetic corruptions [ HD19 ; KSH+19 ] , spatial transformations [ ETT+19 ; FF15 ] , as well as under other types of shift . Given a fixed type of distribution shift , a standard approach to increasing model robustness is to explicitly train on or regularize with data from the corresponding anticipated test distribution [ KSH+19 ] . For example , Engstrom et al . [ ETT+19 ] find that vision models trained on worst-case rotations and translations end up being fairly robust to rotation and translation-based distribution shifts . However , this approach is not without shortcomings—for example , Kang et al . [ KSH+19 ] find that training CIFAR classification models that are robust to JPEG-compression in this manner requires a significant sacrifice in natural accuracy . Recent works make similar observations in the context of other distribution shift mechanisms like ` p adversaries [ TSE+19 ; SZC+18 ; RXY+19 ] or texture swapping [ GRM+19 ] . These observations give rise to a more general question : given that performing reliably in the face of constrained , well-specified distribution shifts is already a difficult challenge , how can we attain robustness to broad , unforeseen distribution shifts ? 2.1 Leveraging more controlled vision settings . Consider the vision tasks of detecting a landing pad from a drone , or classifying manufacturing components from a factory robot . In both these tasks , reliable in-distribution performance is a necessity ; still , a number of possible distribution shifts may occur at deployment time . For example , the drone might approach the landing pad at an atypical angle , or have a view obstructed by snow , smoke , or rain . Similarly , the factory robot may encounter objects in unfamiliar poses , or could be equipped with only a low-quality/noisy camera . At first glance , dealing with these issues seems to require tackling the difficult problem of general distribution shift robustness discussed earlier in this section . However , there is in fact a critical distinction between the scenarios considered above and vision tasks in their full generality . In particular , in these scenarios and many others , the system designer has control over the physical objects that the model operates on . For instance , the designer of the drone ’ s landing algorithm could paint the landing pad bright yellow . A machine learning model trained to detect this custom landing pad might then be more effective than a model trained to detect a standard grey pad , especially in lowvisibility conditions . Still , the particular choice to paint the landing pad yellow is rather ad hoc , and likely rooted in the way humans recognize objects . Meanwhile , an abundance of prior work ( e.g. , [ JBZ+19 ; GRM+19 ; JLT18 ; IST+19 ] ) demonstrates that humans and machine learning models tend to use different sets of features to make their decisions . This suggests that rather than relying on human priors , we should instead be asking : how can we build objects that are easily detectable by machine learning models ? 2.2 Unadversarial examples . The task of making inputs less recognizable by computer vision systems has been a focus of research in adversarial examples . Adversarial examples are small , carefully constructed perturbations to natural images that can induce arbitrary ( mis ) behavior from machine learning models [ BCM+13 ; SZS+14 ] . These perturbations are typically constructed as the result of an optimization problem that maximizes the loss of a machine learning model with respect to the input , i.e. , by solving the optimization problem δadv = arg max δ∈∆ L ( fθ ( x+ δ ) , y ) , ( 1 ) where fθ is a parameterized model ( e.g. , a neural network with weights θ ) ; x is a natural input ; y is the corresponding correct label ; L is the loss function used to train θ ( e.g. , cross-entropy loss ) and ∆ is a class of permissible perturbations ( e.g. , norm-bounded perturbations : ∆ = { δ : ‖δ‖p ≤ } for some small > 0 ) . Adversarial perturbations are typically crafted via projected gradient descent ( PGD ) [ Nes03 ] in input space , a standard iterative first-order optimization method—prior work in adversarial examples has shown that even a few iterations of PGD suffice to completely change the prediction of many state-of-the-art machine learning systems [ MMS+18 ] . From adversarial examples to unadversarial objects . The goal of this work is to modify the design of objects so that they are more easily recognizable by computer vision systems . If we could specify every pixel of every image that a model encounters at test time , we could draw on the effectiveness of adversarial examples , and construct image perturbations ( using PGD ) that minimize the loss of the system , e.g. , δunadv = arg min δ∈∆ L ( θ ; x+ δ , y ) . ( 2 ) In our setting of interest , however , having such fine-grained access to the test inputs is unrealistic ( presumably , if we had precise control over every pixel in the input , we could just directly encode the ground-truth label directly in it ) . Instead , we have limited control over some physical objects ; these objects are in turn captured within images , affected by many signals that are out of our control , such as camera artifacts , weather effects , or background scenery . It turns out that we can still draw on techniques from adversarial examples research in this limitedcontrol setting . Specifically , a recent line of work [ KGB17 ; SBB+16 ; EEF+18a ; AEI+18 ] concerns itself with constructing robust adversarial examples [ AEI+18 ] , i.e. , physically realizable objects that act as adversarial examples when introduced into a scene in any one of a variety of ways . For example , Sharif et al . [ SBB+16 ] design glasses frames that cause facial recognition models to misclassify faces , Athalye et al . [ AEI+18 ] design custom-textured 3D models that are misclassified by state-of-the-art ImageNet classifiers from many angles and viewpoints , and [ BMR+18 ] design adversarial patches : stickers that can be placed anywhere on objects causing them to be misclassified . In this paper , we leverage the techniques developed in the above line of work to construct robust un-adversarial objects—physically realizable objects optimized to minimize ( rather than maximize ) the loss of a target classifier . In the next section , we will more concretely discuss our methods for generating unadversarial objects , then outline our evaluation setup . 2.3 Constructing unadversarial objects . In the previous section , we identified a class of scenarios where a system designer can , to some extent , control the objects that a machine learning system model operates on . In these settings , we motivated so-called unadversarial examples as a potential way to boost models ’ overall performance and robustness to distribution shifts . In this section , we present and illustrate two concrete algorithms for constructing unadversarial examples : unadversarial patches and unadversarial textures . In the former , we design a sticker or “ patch ” [ BMR+18 ] that can be placed on the object ; in the latter , we design the 3D texture of the object ( in a similar manner to the texture-based adversarial examples of Athalye et al . [ AEI+18 ] ) . Example results from both techniques are shown in Figure 2 . For simplicity , we will assume that the task being performed is image classification , but the techniques are directly applicable to other tasks as well . In all cases , we require access to a pre-trained model for the dataset of interest . Unadversarial patches ( cf . Algorithm 1 in Appendix A ) . To train unadversarial patches ( cf . Figure 2a ) , in addition to the pre-trained model , we require sample access to image-label pairs from the dataset of interest . At each iteration , we sample an image-label pair ( x , y ) from a training set , and place the patch corresponding to class y onto the image with random orientation and position2 . Since placing the patch is an affine transformation , after each iteration we can compute the gradient of the model ’ s loss with respect to the pixels in the patch , and take a negative gradient step on the patch parameters . The algorithm terminates when the model ’ s loss on sticker-boosted images plateaus , or after a fixed number of iterations . Unadversarial textures ( cf . Algorithm 2 in Appendix A ) . To train unadversarial textures ( cf . Figure 2b ) , we do not require sample access to the dataset , but instead a set of 3D meshes for each class of objects that we would like to augment , as well as a set of background images that we can use to simulate sampling a scene ( these can be images from the dataset of interest , solid-color backgrounds , random patterns , etc. ) . For each 3D mesh , our goal is to optimize a 2D texture which improves classifier performance when mapped onto the mesh . At each iteration , we sample a mesh and a random background ; we then use a 3D renderer ( Mitsuba [ NVZ+19 ] ) to map the corresponding texture onto the mesh . We overlay the rendering onto a random background image , and then feed the resulting composed image into the pre-trained classifier , with the label being that of the sampled 3D mesh . Since rendering is typically non-differentiable , we use a linear approximation of the rendering process ( cf . Athalye et al . [ AEI+18 ] ) in order to compute ( this time approximate ) gradients of the model ’ s loss with respect to the utilized texture . From there , we apply the same SGD algorithm as we did for the patch case .

Summary: This work introduces and studies "unadversarial" input modifications (patches or object textures) designed to *increase* classifier accuracy, particularly in corrupted images. The work is inspired by research on adversarial examples (in particular "adversarial patches" which trick a classifier into predicting a particular class when the patch is present in the scene, regardless of what other class might be present).  Given access to a known, fixed, pre-trained network, a small patch (or the entire object texture) are optimized by gradient descent to increase prediction accuracy. When applied, the method is shown to be quite effective for increasing classification accuracy (and performance on a simple regression task) under a variety of simulated image corruptions (blur, fog, etc.). In addition, the patch method is shown to significantly aid classification even when printed and affixed to real physical objects.