You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi-View Corruption
Authors: Weihang Ran
Wei Yuan
Yinqiang Zheng
Venue: ICML 2025 poster (2025)
Keywords: Image Corruption
3D Reconstruction
NeRF
Primary area: deep_learning->robustness

Abstract: Damage to imaging systems and complex external environments often introduce corruption, which can impair the performance of deep learning models pretrained on high-quality image data. Previous methods have focused on restoring degraded images or fine-tuning models to adapt to out-of-distribution data. However, these approaches struggle with complex, unknown corruptions and often reduce model accuracy on high-quality data. Inspired by the use of warning colors and camouflage in the real world, we propose designing a robust appearance that can enhance model recognition of low-quality image data. Furthermore, we demonstrate that certain universal features in radiance fields can be applied across objects of the same class with different geometries. We also examine the impact of different proxy models on the transferability of robust appearances. Extensive experiments demonstrate the effectiveness of our proposed method, which outperforms existing image restoration and model fine-tuning approaches across different experimental settings, and retains effectiveness when transferred to models with different architectures. Code will be available at https://github.com/SilverRAN/YARM.

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi-Vie Corruption
Weihang Ran
Wei Yuan?
Yinqiang Zheng'
Abstract
Damage to imaging systems and complex external environments often introduce corruptions, which can impair the performance of deep learning mod- els pretrained on high-qualit, image data. Previ- ous methods have focused on restoring degraded images or fine-tuning models to adapt to out- of-distribution data. However, these approaches struggle with complex, unknown corruptions and often reduce model accuracy on high-quality data. Inspired by the use of warning colors and camou- flage the real world, we propose designing a robust appearance that can enhance model recog- nition of low-quality image data. Furthermore, we demonstrate that certain universal features in radiance fields can be applied across objects of the same class with different geometries. We also ex- amine the impact different proxy models on the transferability of robust appearances. Extensive experiments demonstrate the effectiveness of our proposed method, which outperforms existing im- age restoration and model fine-tuning approaches across different experimental settings, and retains effectiveness when transferred to models with dif- ferent architectures. Code will be available at https//github.com/SiilrrAAAAA
Swich
Dara
Itammertod
X
1goanad butterly
3D Classficaton
Figure I. The proposed method is illustrated in this diagram. Dur- ing imaging of real-world object, various types of degradation (e.g., noise from damaged camera components, blur from object motion, adverse weather conditions like snowfall) can intro- duced, resulting in low-quality images that degrade performance in downstream tasks (e.g.. image classification). Previous approaches have primarily focused on data preprocessing (image restoration) or model fine-tuning. In contrast, we propose addressing this issue from data perspective, enhancing robustness to low-quality imag- ing by altering appearance of natural objects.
& Karam, 2017; Geirhos al., 2017). For instance, monly encountered conditions like rain the accuracy of target detection models in recognizing traffic signs (Wang et al., 2022). This lack of robustness hinders the advancement of neural network technologies in indus- trial applications where high accuracy and reliability are essential. Addressing these issues is also critical for the tran- sition from Artificial Narrow Intelligence (ANI) to Artificial General Intelligence (AGI).
can reduce
1. Introduction
Neural network-based deep learning technologies have made significant impacts across various domains mod- ern society, including facial recognition, autonomous driy- ing, and 3D reconstruction. However, previous research has shown that neural network models can yield erroneous predictions in certain scenarios, such under adversarial attacks or image degradation (Hosseini et al., 2017; Dodge
Previous studies have proposed two primary approaches to address this issue (see Fig, input preprocessing (Pei et al., 2018; Liu et al., 2018; Son et al., 2020), and model fine-tuning (Wang et al., 2020; Kim et al., 2021; Yang et al., 2023). Since model accuracy often degrades due input data being attacked corrupted, restoring low-quality data to its original state could theoretically prevent prediction errors. This approach typically employs image restoration techniques to remove corruptions in the input image, aim- ing to recover its original content as closely as possible. Methods include image denoising, deblurring, rain and fog removal, and super-resolution. However, these techniques
'The University of Tokyo, Japan "Tohoku University, Japan. Correspondence to: Yingiang Zheng <ygzheng@ain toky..ac.jp>.
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- View Corruption
generally focus on the quality of the image restoration rather than the restored image's effectiveness in downstream tasks. On the other hand, some researchers argue that changes in input images are typically insufficient to impair human judg- ment, suggesting that model performance declines because neural networks lack the robustness of human perception. By applying adversarial training or fine-tuning, it is possible to improve model performance on corrupted data. However, previous studies have shown that the effectiveness of this approach remains limited.
We then initialize random perturbation delta, applying it to the features of different voxel representations for op- timization. Extensive experiments demonstrate that these robust textures show significantly improved resistance to image corruptions compared to previous methods and can be optimized to produce a universal texture adaptable to objects of the same category with varying geometries.
The primary contributions of our research are as follows:
We propose data-centric approach to enhance the per- formance of deep learning models in the presence of image corruptions. By using multi-view 3D reconstruc- tion to obtain voxel representation of the target object and optimizing for robust texture, our method signifi- cantly improves model recognition accuracy without requiring any preprocessing model fine-tuning.
To address this issue, we propose an innovative approach. In the real world, it is well known that the ease with which objects are perceived by humans can be modified by chang- ing their colors and textures. For instance, traffic cones are typically painted bright red, while military vehicles like tanks are designed with camouflage. Similarly, could we synthesize a texture for object surfaces that makes them easier for deep learning models to recognize, regardless of the environment? Unlike previous methods, our study focuses on mitigating the effects of data degradation on model performance from a data-centric perspective. Con- sequently, in industrial applications, manufacturers could leverage our research to design product appearances that enhance recognizability. For example, in future where autonomous driving systems based on computer vision are widely deployed, a bicycle designed with textures that en- able accurate identification under various conditions would be preferable to standard bicycle, as it could help reduce accident risks. Based on this rationale, we believe that dual enhancements in both data and model design are essential for developing highly reliable AI systems, which imparts significant societal relevance to our work.
We demonstrate the existence of universal robust texture that can transfer across objects of the same category but with different geometries. This universal texture effectively aids downstream models in resisting degraded imaging, even in zero-shot scenarios.
Through an analysis of the transfer performance of ro- bust textures generated under various surrogate models, we establish insights into how different models impact final performance. Based on this, we propose method for selecting the most suitable surrogate model.
2. Related Works
2.1. Visual Recognition against Image Corruptions
In this paper, we investigate three specific questions: (1) Can texture optimization enhance neural network models' object recognition performance, achieving better results than pre- vious methods? (2) Is it possible for these robust textures to be transferable, allowing them to generalize across objects with different geometries? (3) Do robust textures generalize effectively across different neural network architectures? To address these questions, we propose method for synthesiz- ing robust textures in this paper. For object-specific robust texture optimization, we first obtain a voxel representation containing the object's geometry and color by employing 3D reconstruction on multi-view images. Next, we ran- domly select viewing angle, render the corresponding 2D image, and apply various image degradation operations of differing intensities, including noise, blur, weather effects, and compression. A classifier is used as a surrogate model to recognize the degraded images, and backpropagation is performed to optimize the color features of the voxel repre- sentation. For the optimization of universal robust textures, we first reconstruct voxel representations for multiple ob- jects of the same category based on multi-view image sets.
Image corruption during the imaging process often leads to suboptimal performance in downstream deep learning models (Hosseini et al., 2017: Dodge & Karam, 2017; Geirhos et al., 2017). Therefore, how to improve accu- racy on corrupted input images is an urgent problem to address. (Hendrycks & Dietterich, 2018) firstly introduced an image dataset containing 15 types of corruptions and eval- uated the robustness of various deep learning models against different kinds and severities of corruption. (Bai et al., 2021) compared the performance of CNNs and Transformers on corrupted images under fairer setup. revealing the rea- sons why Transformer architectures demonstrate superior generalization on out-of -ittr--disttibution (OOD) data.
To reduce model vulnerability to low-quality images, some studies have attempted to fine-tune models for different kinds of corruption. However, (Vasiljevic et al., 2016: Zheng et al., 2016) found that models fine-tuned on a single type of blur did not generalize well to other types, while fine-tuning on multiple degradation types often resulted in decreased overall performance. Works such as (Wang et al., 2020; Kim et al., 2021) have shown that model performance decline
2

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
is due to the degradation of the deep feature representa- tion space. These approaches aim to map degraded fea- tures to clean features to improve accuracy in downstream tasks. (Yang et al.. 2023) leverages vector quantization to bridge the gap between low-quality and high-quality fea- tures, learning representations that are invariant to quality. Additionally, (Liu et al., 2024) identified that the channel correlation matrix of features is a reliable indicator of degra- dation type and provides a clear optimization direction for unsupervised solution space by reducing the difference be- tween the channel correlation matrices of degraded and clean features.
2024). Despite various acceleration techniques (Fridovich- Keil et al., 2022; Müller al., 2022), NeRF's lengthy train- ing times and slow inference speeds remain significant draw- backs. To address this, (Sun et al., 2022; Karnewar et al., 2022) have combined NeRF's original setup with explicit volumetric grid modeling, significantly accelerating both training and inference. Subsequent work (Sella et al., 2023) has also shown that voxel grid-based 3D representations can be effectively used for scene editing.
3. Methodology
3.1. Problem Formulation
Additionally, some studies have attempted to restore de- graded images directly to preserve the performance of down- stream models. Although there is already extensive research on image restoration (Zhang et al., 2021; Ren et al., 2019; Ji et al., 2023), (Pei et al., 2018) noted that simply applying dehazing operations to images does not improve accuracy in downstream classification tasks, as restored images still differ from high-quality images in feature space. To ad- dress this, (Liu et al., 2018; Son et al., 2020) have jointly optimized the image restoration module alongside high- level models to make the restored images more suitable for downstream tasks, finding that this approach also enhances restoration effectiveness.
Given a 3D object X with a true class label y, when an imag- ing system captures a 2D image v; from a given viewpoint i and applies it to downstream task (e.g. classification), the downstream model fa should provide the correct prediction theoretically, such that fo(u) = y. However, due to com- plexities in the imaging process or environment, unknown corruption C' can be introduced. When a degraded image of = C(u)) is used by the downstream classifier, this may lead to incorrect predictions, i.e,, (v() = =/ + y.
The objective of our research is to optimize the appearance of the given 3D object X to get a robust version X", which can ensure that its visual features remain robust against various types of corruptions during the imaging process, thereby improving the prediction accuracy of downstream models.
Apart from these two methods, some research has explored robustness in 3D objects, such as (Salman et al., 2021; Wang et al., 2022; Lin et al., 2025). However, these approaches have not been thoroughly tested on large-scale datasets or across different model architectures, nor do they offer straightforward, user-friendly workflow.
Furthermore, inspired by studies on universal adversarial perturbations (UAP) (Moosavi-Dezffee Dezfooli et al., 2017; Hen- drik Metzen et al., 2017), we explore the potential existence of universal robust texture (URT). Specifically, given set X' = (G1 X2 (T), T,,, X,,G,, Ti} con- taining multiple objects of the same class y. where G; and T; represent the geometry and texture of object X;, respectively. We aim to optimize a universal texture Tr that can transform any object in the set into robust version: (G,, To) X.R.
2.2. NeRF-based 3D Editing
Novel view synthesis is long-standing research topic in the field of 3D reconstruction. Its goal is to synthesize images from previously unseen viewpoints, given a set of images that capture a scene. Traditional approaches include direct interpolation across densely captured scenes and com- bining depth maps to handle sparse viewpoints (Buehler et al., 2001; Shi et al., 2014: Shih et al., 2020). However, these methods often come with significant limitations. With the advancement of neural rendering, novel view synthesis methods based on neural radiance fields (NeRF) (Milden- hall et al., 2020; Barron et al., 2021; 2022) have shown immense potential. NeRF employs a multi-layer percep- tron (MLP) with positional encoding as an implicit and continuous volumetric representation. Impressive visual results and flexible configuration make NeRF a suitable foundation for further 3D editing tasks, including geometric transformations (Yuan et al., 2022; Yang et al., 2022), style transfer (Wang et al., 2023; Zhang et al., 2022), and text-to- texture synthesis (Richardson et al., 2023; Dong & Wang,
3.2. 3D Reconstruction based on Voxel Grid
Given a set of multi-view images captured in a static scene, NeRF (Neural Radiance Fields) learns a mapping between each image's viewpoint coordinates and direction to the corresponding pixel values, constructing a neural radiance field F(z, d) + (c, a). Here, the input E R represents coordinates within the radiance field, d is the unit-norm viewing direction, and the output consists of a E IR+ (the volume density) and c E [0, 1|3 (the emitted RGB color). During inference, given any arbitrary camera viewpoint, NeRF queries multiple sample points along rays emitted from the camera center and calculates pixel values at specific locations based on the volumetric rendering formula.
3

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
Single Optimization
"Airliner"
Badooari
Loss
Prodiction
8
Pidenatty DF
Proxy model
Bandam
comppoon
"Airlina""
comptian
3D recomstraction
Random
Luknowa clasitfer
object
object 2
abject
Training
sample
One pair (Veeenitty) ylurt
Visualization
Universal Texture Optimication
Figure The framework of our proposed method is illustrated as follows. Given an object, we first collect multi-view images to reconstruct 3D voxel representation. We then initialize perturbation 6, with the same shape as the color voxel grid and combine it with the original voxel representation to perform random-vies rendering, producing 2D images. These images are then degraded by randomly selected types and intensities of corruption, and the degraded image is fed into surrogate classifier to obtain predictions and compute loss for updating 5's parameters. For universal robustness textures, we first select multiple objects the same category, reconstructing individual voxel representations for each. During training, in each iteration, random pair of density and color voxel grids is selected, and a universal perturbation &y is applied, followed by the same training process described above. After training, the optimized dy can be combined with any reconstructed voxel representation to render robust images.
Although NeRF can establish a continuous and implicit radiance field, previous work has highlighted that editing its parameter space is challenging, and the training pro- cess is time-intensive. Consequently, our work employs improved NeRF approach based on voxel grid representa- tion. Voxel grid representation explicitly models the scene's ss modalities of interest (e.g., density, color, features) using grid cells, offering higher query efficiency. For a point of interest v, its value within the voxel grid can be obtained through trilinear interpolation.
to capture finer surface details and view-dependent colors, the bounding box progressively scaled down, and free space skipped to accelerate query speeds. We apply an im- proved version (Karnewar al., 2022) of this approach, re- placing the softplus activation function with ReLU because it can preserve the discontinuities present in real-world sig- nals. After training we can get two voxel grids (densty)) and y (r
3.3. Optimize Single Robust Texture
interp(æ, V) (R3, .R RCNMMM,,N, + CC
(I)
After obtaining the fine-stage voxel grids (ddessity)() and v(gb)((f) we can optimize them to enhance robustness against image corruptions. ject's s geometry impractical in real-world scenarios, as the functionality of various items is closely tied to their shape. Therefore, fix the density grid (density)) obtained from the previous stage and only optimize the color grid. Adopt- ing a setup similar to adversarial attacks, we initialize a perturbation d with the same shape as the color grid and add
where v is the queried 3D point, V represents the voxel grid, C' is the modality dimension, and N₂ x N, x N₂ is the total number of voxels. To reduce training difficulty, DVGO (Sun al., 2022) employs coarse-to-fine staged training ap- proach. In the coarse stage, the target radiance field is ini- tialized over a large spatial region, learning view-invariant colors (eb)(()) E 3 Nie) x((e)) and raw volume den- sities (e) E IxN x
consider changing the ob-
x x In the fine stage,

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi-View Corruption
Performance on ResNet- 18
Performance on ResNet 34
Performance on ResNet-50
1.0
1.0
1.0
Accuracy (%)
0.8
0.8
0.8
0.6
0.6
0.6
4
12
16
20
24
8
12
16
20
24
8
12
16
20
24
Training Iteration (1000)
Training Iteration (1000)
Training Iteration (1000)
Performance on ResNet- 101
Performance ResNet-155
1.0
1.0
res18
res34
0.8
0.8
res50
res101
0.6
0.6
res152
base
4
8
12
16
20
24
4
8
12 16
20
24
Training Iteration (1000)
Training Iteration (1000)
Figure 3. Transferable performance of textures proxy model to other models. We used ResNet-18, 18, ResNet-34, ResNet-50, ResNet- 101, ResNet- 152 as surrogate models and transferred the resulting textures to other models for testing. was observed that using a model its surrogate consistently yielded the best performance. Aside from this surrosur,, textures generated with models as surrogates tended to perform better across other models, especially evident with ResNet-18, ResNet-34, and ResNet-50, In contrast, for ResNet-101 and ResNet-152, the performance differences suggest that smaller-parameter models generally serve as more effective surrogates for robust texture transfer across models.
surrogate models minimal. Overall, findings
it to the pre-trained voxel grid (f
loss between the output and the true label y.
During training, we randomly select viewpoint v to ren- der the corresponding 2D image L,. To improve resilience to unknown corruptions, following the experimental setup in (Hendrycks Dictterich, 2018), we introduce random types of corruption the image I.- Here, we apply corruption types, including gaussian noise, shot noise, im- pulse noise, glass blur, defocus blur, zoom blur, motion blur, fog, frost, snow, contrast, brightness, JPEG compression, pixelation, and elastic transformation. The details of these corrpptions can be found in supplementary A. This phase is similar to data augmentation in standard training.
V Lee fo (T)), y)
Through back- teekkpropagation, perturbation can optimized to make the object more robust in any random view direction and any corruption.
3.4. Universal Robust Texture
Optimizing the surface texture of single object to make its 2D images more robust has been explored in previous research (Salman et al., 2021). In comparison, more lightweight and flexible framework that enhances optimization speed by nearly 50 times. Leveraging the flex- ibility of our framework, we further investigate universal robust textures (URT). For set of objects V belonging to category y but differing in shape and appearance, re- construct each object's voxel grid y(density)t)) and (((g)(()) using multi-view images, with all grids at the same reso- lution. As in 3.3, we initialize perturbation & with the same shape as V. (rgh(())) at the start of training. Then, in each iteration, we randomly select a pair of voxel grids from the set and render a 2D image I, from a random viewpoint. Similarly, we apply corruptions of random types and inten-
propose
1. + C(L (densiit)))) (fensity)(), (rgh(()) +8), 5),16 (2)
where represent severity level and e the bound of There are five different severity levels for each type cor- ruption, which will be selected randomly in training. This approach aims to prevent the model's recognition accuracy of objects under normal imaging conditions from reducing when only using high-severity corruptions. The degraded image I/, can be viewed as low-quality data obtained in com- plex real-world environments. We then use proxy classifier fo make predictions on Tr and compute the cross-entropy
5

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
sities obtain r. which is then passed downstream model for prediction.
Dataset. Since most classification models are trained on the ImageNet dataset, and typical NeRF datasets lack cate- gory labels, we used the IM3D (Ruan et al., 2023) dataset to evaluate our method. This dataset includes 40 classes from ImageNet, with each class containing 10 objects, and each object represented by 100 rendered images from hemispher- ical viewpoints. When optimizing a single robust texture, we utilized random viewpoints for texture optimization and validated with sampled viewpoints from the dataset. For optimizing a generic robust texture, we randomly selected 8 objects from each category for training, while the remaining 2 objects were used for validation and testing, respectively.
1 + CV, (d v( + +du), s), VEE (4)
At the end of training, we obtain a robust universal texture that adapts different V (dcnsity)))) objects within the same category and generalizes successfully to unseen objects.
3.5. Transfering Performance With Proxy Model
During training, surrogate model is required to obtain gra- dient information. However, in practical scenarios, access to the internal parameters of the target model may not be feasible. Thus. whether the robust texture generated using a surrogate model can effectively transfer to an unknown model remains to be validated. Fortunately, our findings confirm that robust textures exhibit properties similar to adversarial perturbations, in that they can be transferred across models. This observation leads us to consider the relationship between the choice of surrogate model and transferability performance.
Testing Models. To evaluate classification performance, we selected R8sNet-18 (He et al., 2016) and VGG16 (Si- monyan, 2014) as proxy models during the training process for each method. Additionally, since our approach enhances robustness from a data-centric perspective, the augmented data remain effective across various classification models. Therefore, we further selected ResNet-50, ResNet- 152, Mo- bileNetV2 (Sandler et al., 2018), Inception- V3 (Szegedy et al., 2016), ViT-b-16 (Dosovitskiy et al., 2020), and Swin- Small (Liu et al., 2021) as transfer models assess perfor- mance on these architectures.
It is well known that adversarial perturbations generated by a model with higher generalization ability tend to be more transferable. Intuitively, if an adversarial example can deceive stronger model, it is more likely to deceive weaker model as well. In our task, we hypothesize the reverse relationship: if robust example enables a weaker model to recognize it correctly, it is more likely to succeed with a stronger model. To substantiate this hypothesis, we conducted a set of comparative experiments. Using ResNet models with the same architecture but different parame- ter sizes-sseciffiallly, ResNet- ResNet-34, ResNet-50, ResNet-101, and ResNet- we generated robust textures for 10 randomly selected objects with each variant as a sur- rogate model, then transferred the textures to other ResNet models for evaluation. From Fig. 3. we observe that, aside from textures generated using the model itself as the surro- gate in a white-box training setting, textures created with R8 as the surrogate model perform well across other models, particularly those with initially poorer performance, such as ResNet-34 and ResNet-50. For ResNet-101 and ResNet-152, however, due to their relatively strong initial performance, the differences among textures generated by various surrogate models are minimal when transferred to these models. Taking these findings together, we conclude that choosing surrogate model with weaker performance can better accommodate broader range of transfer scenar- ios.
Metrics. We employed two metrics to assess model perfor- mance on corrupted images: accuracy and Corruption Error (CE). Accuracy, a commonly used metric in classification tasks, is defined as the proportion of correctly classified samples over the total number of samples. Additionally, to evaluate model robustness against corruption, the Cor- ruption Error (CH) proposed by (Hendrycks & Dietterich, 2018) quantifies the performance degradation before and after applying corruption. Specific calculation methods are provided in the supplementary B. In this study, we use Rela- tive mCE alongside accuracy as evaluation metrics.
Implementation Details. Our experiments were conducted on an Nvidia H100 GPU. The voxel grid resolution for 3D reconstruction was set to N₂ Ny N, 160, with the training iterations set to 2000. The Bound of 8 = 5.0. During the texture optimization phase, the number of training iterations was set to 8000.
4.1. Performance on Proxy Model
We first analyze the test results on the surrogate model. As shown in Tab 1, we report accuracy under different fixed and random corruption intensities, as well as the Corrup- tion Error (CE) for various types of corruptions. From the table, it can be observed that although performing well on ImageNet data, unfortunately. the methods fine-tuned on multi-view images exhibit a poor performance in our task setup. Among these methods, both DCP (Liu et al., 2024) and Unady (Salman et al., 2021) damaged the robustness of original model. We think the architecture of DCP may
4. Experiment
In this section, we conduct extensive experiments to demon- strate the superiority of our proposed method.
6

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
Table 1. TTssting performance on proxy model. We report classification accuracy under conditions of corruption (none), severity 1 through 5, and random severity, along with the mean corruption error (mCE) and relative mean corruption error (R.mCE) across 15 types of corruption. The top- peppprffrning results are represented in bold.
ACCURACY|
CT1
PROXY
METHOD
TYPE
NONE
RANDOM
MCE
R.MCE
CLEAN
0.3785
0.3088
0.2611
0.2360
0.1958
0.1496
0,2303
URIE (SON ET AL.,, 2020)
RESTORATION
0.5645
0.5217
0.4898
0.4716
0.4396
0.4027
0.4531
0.6698
0.6702
VQSA (YANG
2023)
FINETUNE
0.8917
0.8259
0.7945
0.7521
0.7213
0.6847
0.7406
0.3020
0.3455
VGGI6
DCP (LIU ET AL.., 2024)
FINETUNE
0.1817
0.1377
0.1106
0.0972
0.0803
0.0614
0.0967
1.7976
1.8520
UNADY (SALMAN AL.,, 2021)
AUGMENTATION
0.3592
0.3352
0.3126
0.2927
0.2708
0.2354
0.3181
1.0064
1,0265
OURS (SINGLE OBI.)
AUGMENTATION
0.9270
0.9114
0.8874
0.8628
0.8175
0.7772
0,8540
0.1746
0,1878
OURS (UNIVERSAL)
AUGMENTATION
0,4150
0.3560
0.3245
0.3112
0.2825
0.2555
0,3247
0,9831
1,0253
CLEAN
0.3645
0.3064
0.2670
0.2391
0.2044
0,1656
0.2365
URIE (SON AL., 2020)
RESTORATION
0.5773
0.5300
0.4997
0.4820
0.4530
0.4156
0,4713
0.6586
0.6636
VQSA (YANG ET Al.,, 2023)
FINETUNE
0.8834
0.8436
0.8220
0.7952
0.7519
0.7262
0.8051
0.3125
0.3332
RESNET-18
DCP (LIV
2024)
PINETUNE
0.308-4
0.1853
0.1586
0.1311
0.1108
0.0748
0.1246
1.8025
1.8262
UNADY (SALMAN ET AL., 2021)
AUGMENTATION
0.3132
0.2715
0.2641
0.2458
0.2039
0.1849
0.2413
1.1716
1.2202
OURS (SINGLE OBL.)
AUGMENTATION
0.9205
0,9073
0.8846
0.8590
0.8126
0.7769
0,8427
0.1771
0,1901
OURS (UNIVERSAL)
AUGMENTATION
0.3850
0.3377
0.3097
0.2942
0.2748
0.2568
0.3178
1.0490
1.0408
Table Transferable performance on other models. We report the average classification accuracy (Ave.Acc) under severity through 5,
along with the relative mean corruption error (R.mCE) across 15 types of corruption. The cop-errforiing results are represented in bold.
RESNET-50
RESNET-152
MOBILENEIV2
INCEPTION-VE V3
VIT-B-16
SWIN-SMALL
PROXY
MISTHO
AvE.AcC
R.MCE
AVE.ACC
R.MCE
AVE,ACC
R.MCE
AVELAcC
R.MCE
AVELACC
R.MCE
R.MCE
URIE (SON ET AL., 2020)
0.3241
1.6237
0.3728
1.5716
0.2835
0.9320
0.2959
1.5178
0.3215
1.4302
0.4252
I.1846
VGG16
UNADW MSALMAN ET AT., 2021)
OURS (SINGLE Og1.)
0.6019
0.2745
2:2163
0.6477
0.6306
0.3271
0.6365
1 86885
0.4749
0.2103
1.3102
0.7040
0.5726
0.2642
0.6435
1.7422
0.5449
0.3704
0.7177
1.2525
0.6175
0.3652
0.7034
1882
OURS (UNIVERSAL)
0.3566
1,5723
0.3720
1.6258
0.2405
1.1922
0.3112
1,2648
0.3596
1.3477
0.3618
1.8525
URIE
2020)
0.3472
1,6995
0.3971
1.5741
0.3187
0.3115
1.2507
0.3487
1.4351
0.4127
REsNET-18
UNADY (SALMAN ET AL., 2021)
OURS (SINGLE OBI.)
0.3127
0.6684
1.0964
0.5160
0.3281
0.6823
0.5449
1.0348
0.4631
0.2658
0.6007
1.0823
0.2694
0.5221
1,5120
0.5625
0.6028
0.3577
0.6273
1.3832
0.6612
0.3901
0.6000
1.3538
DURS (UNIVERISAL)
0.3481
1.6576
0.3967
1.5970
0.2457
1.1883
0.3220
1,2413
0.3600
1.3711
0.5647
1.8556
only be suitable for natural images like ImageNet, while the Unady method shows large performance variations across objects of different geometries, with average performance still lower than that of the original data. URIE (Son et al., 2020) partly enhanced the robustness of original model by removing corruptions but its performance is still unsatisfy- ing. Although VQSA (Yang et al., 2023) performs well, it requires a long time to fine-tune the model, and this fine- tuning time increases exponentially with the amount of data, making it difficult to meet the demands of practical appli- cations. In contrast, our proposed method not only demon- strates strong generalization across corruption intensities but also significantly improves the accuracy of the original model when recognizing uncorrupted images. As for the universal robust texture, although it did not outperform the texture optimized for a single object, it offers higher prac- tical applicability and demonstrates superior performance compared to most baseline methods.
tested the performance of textures generated with different surrogate models when transferred to models of various architectures. For comparison, we selected URIE and Un- adv, both of which are transferable, as baseline methods. We used average accuracy and relative mean corruption error as evaluation metrics. As shown in Tab 2, when trans- ferred to other models, textures trained with ResNet-18 performed slightly better than those based on VGG16, sug- gesting that the features learned by ResNet-18 may be more similar to those in the transfer models. Additionally, be- cause models like ResNet-152, ViT-b-16, and Swin-small already exhibit good robustness against corruptions, most methods had counterproductive effect on these models, even leading worse performance. We observed that our method consistently outperformed others when transferred across various models. In contrast, URIE and Unady tend to degrade the natural feature representations learned by the models, thereby reducing accuracy. Comparing individu- ally optimized textures for each object with universal robust textures shows that the former have superior cross-model generalization performance. This finding suggests that fur- ther enhancement of generalization may be necessary to develop highly transferable universal robust textures.
4.2. Transferable Performance Cross Various Models
Since our proposed method does not rely on fine-tuning a specific classification model, the generated robust textures can be transferred for use on other models. We further
7

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi-View View Corruption
Original Object
SAUMMA
Souter
Robust Object
Universal
Texture
Figure 4. A visual comparison between the original appearance of various objects and their appearance after adding the robust texture is presented. can observed the optimized robust texture not significantly alter the objects' original appearance, preserving normal human perception. However, these subtle modifications to the appearance grant the objects considerable robustness under low-quality imaging conditions. cases where low-quality images of original appearance lead misclassification by downstream models, objects with our optimized texture still enable stable and accurate predictions by the classifier.
4.3. Ablation Study
Table 3. Performance comparison under different hyperparame- combinations. We report the average classification accuracy (Ave.Ace) under severity through along with the relative mean corruption emor (R.CCE) across 15 types of corruption.
In this section, we examine the impact of different hyper- parameter configurations the final performance. In our proposed method, the primary hyperparameters are the voxel grid resolution and the boundary of the generated pertur- bation. We evaluated the final performance of the textures obtained with voxel grid resolutions of 160 and 320 and with values of 1.0 and 5.0. As shown in Tab 3, regardless of the model used as the proxy, results with
PROXY
GRID
AvE.AcC
R.MCE
160
1.0
0.6857
0.3203
160
5.0
0.8513
0.1878
VGG16
320
1.0
0.7063
0.2985
5.0 con- sistently outperform those with 1.0, indicating that larger boundary value generally leads to better performance. For voxel grid resolution, when using VGG16 as the proxy model, a denser voxel grid with 5.0 slightly decreases the final performance. Conversely, for ResNet-18, increas- ing the voxel grid resolution consistently improves results. hypothesize that increased voxel grid resolution may lead overfitting on smaller models, thereby impacting generalization.
320
5.0
0.8492
0.1958
160
1.0
0.6531
0.3478
5.0
0.8481
0.1901
RESNET-18
320
1.0
0.6762
0.3511
320
5.0
0.8504
0.1837
5. Conclusions
In this paper, we propose data-driven approach to enhance robustness against low-quality imaging. Our method re- constructs a given object in 3D by sampling multi-view images to obtain its voxel representation, then optimizes a perturbation on color grid to alter its appearance, thereby achieving robustness against various types and intensities
8

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
of corruption. Additionally, we introduce universal robust texture, which optimizes the appearance of multiple objects with different geometries within the same category to obtain transferable texture that generalizes to zero-shot objects. We further analyze the performance of textures obtained using different proxy models, summarizing the influence of the proxy model on the final outcome. Extensive ex- periments demonstrate the effectiveness of our proposed method, which outperforms existing image restoration and model fine-tuning approaches across different experimen- tal settings, and retains effectiveness when transferred to models with different architectures.
Dong, J. and Wang, Y.-X. Vica-nerf: View-consistency- aware 3d editing of neural radiance fields. Advances in Neural Information Processing Systems, 36, 2024.
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2020.
Fridovich-Keil, S., Yu, A., Tancik, M., Chen, Q. Recht, B., and Kanazawa, A. Plenoxels: Radiance fields without neural networks. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. $501-5510, 2022.
Acknowledgment
This research was supported in part by JSPS KAKENHI Grant Numbers 24KK0209, 24K22318, 22H00529, and JST-Mirai Program JPMIMI23G1.
Geirhos, R., Janssen, D. H., Schütt,, H. H., Rauber, J., Bethge, M., and Wichmann, A. Comparing deep neu- ral networks against humans: object recognition when the signal gets weaker. arXiv preprint (ttt::1706.66999 2017.
Impact Statement
This paper presents work whose goal advance the field of Machine Learning. There are many potential societal consequences of our work, none which feel must be specifically highlighted here.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learn- ing for image recognition. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-777 2016.
References
Hendrik Metzen, J., Chaithanya Kumar, M., Brox, T., and Fischer, V. Universal adversarial perturbations against semantic image segmentation. In Proceedings of the IEEE international conference computer vision, pp. 2017.
Bai, Y., Mei, J., Yuille, A. L., and Xie, C. Are transformers more robust than cnns? Advances in neural information processing systems, 14:26831-26844 2021.
Barron, J. T., Mildenhall, B., Tancik, M., Hedman, P., Bruuala, R., and Srinivasan, P. P. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 5855-5864 2021.
Hendrycks, D. and Dietterich, T. Benchmarking neural network robustness to common corruptions and perturba- tions. In International Conference on Learning Represen- tations, 2018.
Hosseini, H., Xiao, B., and Poovendran, R. Google's 's cloud vision api is not robust to noise. In 2017 16th IEEE international conference on machine learning and appli- cations (ICMIA), pp. 101-105. IEFE, 2017.
Barron, J. T., Mildenhall, B., Verbin, D., Srinivasan, P. P., and Hedman, P. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 5470-5479, 2022.
Ji, X., Wang, Z., Satoh, S., and Zheng, Y. Single image deblurring with row- rowddependent blur magnitude. In Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, pp. 12269 12280, 2023.
Buehler, C., Bosse, M., McMillan, I.., Gortler, S., and Co- hen, M. Unstructured lumigraph rendering. In Proceed- ings of the 28th annual conference on Computer graphics and interactive techniques, pp. 425-433 432,432,440 2001.
Karnewar, A., Ritschel, T., Wang, O., and Mitra, N. Relu fields: The little non-linearity that could. In ACM SIG- GRAPH 2022 conference proceedings, pp. 1-9, 2022.
Dodge, S. and Karam, L. A study and comparison of human and deep learning recognition performance under visual distortions. In 2017 26th international conference on computer communication and networks (ICCCN), pp. 1- JEEE, 2017.
Kim, I., Han, S., Back, J.-w., Park, S.-J., Han, J.-J., and Shin, J. Quality image recognition via invertible decoder. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12257 12266, 2021.
9

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- View Corruption
Lin, G., Niu, M., Zhu, Q Yin, Z., Li, Z., He, S., and Zheng, Y. Adversarial attacks event-based pedestrian detectors: A physical approach. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 5227-5235, 2025.
Salman, H., Ilyas, A., Engstrom, L.,, Vemprala, S., Madry, A., and Kapoor, A. Unadversarial examples: Designing objects for robust vision. Advances in Neural Information Processing Systems, 34:15270-1522 2021.
Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.-C. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4510-4520, 2018.
Liu, D., Wen, B., Liu, X., Wang, Z., and Huang, T. S. When image denoising meets high-level vision tasks: deep learning approach. In Proceedings of the 27th Inter- national Joint Conference on Artificial Intellignnce, pp. 842-848.20 2018.
Sella, E.., Fiebelman, G., Hedman, P., and Averbuch-Elor, H. Vox-e: Text-guided voxel editing of 3d objects. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 430-440, 2023.
Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. Swin transformer: Hierarchical vision transformer using shifted windows. Proceedings of the IEEE/CVF international conference on computer vision, pp. 10012-10022, 2021.
Shi, L., Hassanich, H., Davis, A., Katabi, D., and Durand, F. Light field reconstruction using sparsity in the continuous fourier domain. ACM Transactions on Graphics (TOG), 34(1):1-13 2014.
Liu, Z., Li, Y.. Wang, Y., Gao, B., An, Y., and Zhao, X. Boosting visual recognition real-world degradations via unsupervised feature enhancement module with deep channel prior. arXiv preprint 00X00 2024.
Shih, M.-L., Su, S.-Y., Kopf, J., and Huang, J.-B. 3d photog- raphy using context-aware layered depth inpainting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8028-8038, 2020.
Mildenhall, B., Srinivasan, P., Tancik, M., Barron, J., Ra- mamoorthi, R., and Ng, R. Nerf: Representing scenes as neural radiance fields for view synthesis. In European conference on computer vision, 2020.
Simonyan, K. Very deep convolutional networks for large- scale image recognition. arXiv preprint 1rXiv:1409.1556 2014.
Doosavi- S.-M., Fawzi, A., Fawzi, O., and Frossard, P. Universal adversarial perturbations. In Pro- ceedings of the IEEE conference computer vision and pattern recognition, pp. 1765-1773, 2017.
Son, T., Kang, J., Kim, N., Cho, S., and Kwak, S. Urie: Universal image enhancement for visual recognition in the wild. In European Conference Computer Vision, pp. 749-765. 2020.
Müller, T. Evans, A., Schied, C., and Keller, A. Instant neural graphics primitives with multiresolution hash encoding. ACM transactions on graphics (TOG), 41(4): 1-15, 2022.
Sun, C., Sun, M., and Chen, H.-T. Direct voxel grid op- timization: Super-fast convergence for radiance fields reconstruction. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp. 5459-5469, 2022.
Pei, Y., Huang, Y., Zou, Q. Lu, Y., and Wang, S. Does haze removal help enn-based image classification? In Proceedings of the European conference on computer vision (ECCV), pp. 682-697, 2018
Szegedy, C., Vanhoucke, V., loffe, S.,, Shlens, J., and Wojna, Z. Rethinking the inception architecture for computer vi- sion. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.
Ren, D., Zuo, W., Hu, Q., Zhu, P., and Meng, D. Progressive image deraining networks: A better and simpler baseline. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 3937-3946, 2019.
2016.
Vasiljevic, I., Chakrabarti, A., and Shakhnarovich, G. Exam- ining the impact of blur on recognition by convolutional networks. arXiv preprint arXiv: /61 1.05760, 2016.
Richardson, E.. Metzer, G., Alaluf, Y., Giryes, R., and Cohen-Or, D. Texture: Text-guided texturing of 3d shapes. In ACM SIGGRAPH 2023 conference proceed- ings, pp. 1-11, 2023.
Wang, C., Jiang, R., Chai, M., He, M., Chen, D., and Liao, J. Nerf-art: Text-driven neural radiance fields styliza- tion. IEEE Transactions on Visualization and Computer Graphics, 2023.
Ruan, S., Dong, Y., Su, H., Peng, J., Chen, N., and Wei, X. Towards viewpoint-invariant visual recognition via adversarial training. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4709- 4719, 2023.
Wang, J., Yin, Z., Hu, P., Liu, A., Tao, R., Qin, H., Liu, X., and Tao, D. Defensive patches for robust recognition in the physical world. In Proceedings of the IEFE/CVE
10

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
conference compuler vision and pallern recognition, pp. 2456-2465. 2022.
Wang. Y. Cao, Y., Zha, Z.-J., Zhang. J., and Xiong. Z. Deep degradation prior for low-quality image classification. In Proceedings of the IEEE/CVF Conference Computer Vision and Putlern Recognition, pp. 1049--11050 1058, 2020.
Yang. B., Bao, C., Zeng, J., Bao, H., Zhang. Y., Cui, Z., and Zhang, G. Neumesh: Learning disentangled neural mesh- based implicit field for geometry and texture editing. In European Conference on Computer Vision, pp. 597-614. Springer, 2022.
Yang, Z.., Dong, W., Li, X., Huang, M., Sun, Y., and Shi, G. Vector quantization with self-attention for quality- independent representation learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pat- tern Recognition, pp. 14438-24444 2023.
Yuan, Y.JJ., Sun, Y.-T.. Lai, Y.-K., Ma. Y., Jia, R., and Gao, L. Nerf-editing: geometry editing of neural radiance fields. In Proceedings of the IEEE/CVF Conference Computer Vision and Pullern Recognition, pp. 18353- 18364, 2022.
Zhang. K.,, Liang. J., Van Gool, L., and Timofte, R. Design- ing practical degradation model for deep blind image super-resolution. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pp. 4791-4800, 2021.
Zhang, K., Kolkin, N., Bi, S., Luan, F., Xu, Z., Shechtman, E., and Snavely, N. Arf: Artistic radiance fields. In European Conference on Computer Vision, pp. 717-733. Springer, 2022.
Zheng, S., Song, Y., Leung, T., and Goodfellow, I. Im- proving the robustness of deep neural networks via sta- bility training. In Proceedings of the ieee conference on computer vision and pattern recognition, pp. 4480-4488, 2016.

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
A. Details of 15 Types of Corruptions
we first conduct gaussian blur to it get blurred version X'. Then set of pixel C is selected according to:
In this section, we provide the detailed calculation methods for each type of corruption. Given an input tensor X E I xx let Y denote the tensor of corrupted low- quality images, then for
= {(b, x, y) E [1, B), x e [r. W - r1, E |r, H
r]}
(11)
where is the index in batch and (a, y) is pixel coordinate. is the radius for selecting pixels. Then do T times pixel value swaps. For each trial t =
A.1. Gaussian Noise:
T, generate
random offset for every (b, I. v) C:
= clamp x+ xxZ, 0,1,, N~ o(), (5)
(Ax, Ay) Uniform( Uniform(-r,r))
(12)
where Z E Bx For severity ranging from I to 5, the value of a is set to 0.08, 0.12, 0818, 0.26, and 0.38, respectively.
the new coordinate is:
(x',8') = (x Az. y Ay)
(13)
then swap pixel values for new coordinates and old coordi- nates:
A.2. Shot Noise:
:',,,,,', y/l ++ X [,,;,
(14)
After T times pixel value swaps can get corrupted tensor X". Finally do gaussian blur to X" again and the output can be seen as the glass blur version of X. For severity ranging from to 5, the values of gaussian kernel's standard deviation o, the radius r and trial number T are (0.7, 1, 2), (0.9, 2, 1), (1, 2, 3), (1.1, 3, 2) and (1.5, 4, 2), respectively.
P. 0.1). P Poisson(c- X). (6)
Y clamp
For severity ranging from to 5, the value of scaling factor is to 60, 25, 12, and 3, respectively.
A.3. Impulse Noise:
A.5. Defocus Blur
Y clamp (oampp(so) (B1-S)-) ( x.O.1). (0.11))).00.)..
(7)
Given radius r, we establish an initial grid coordinate system G first:
where S ~ Bernoulli(r) and B ~ Bernoulli(0.5). For severity ranging from to 5, the value of r 0.03, 0.06, 0.09, 0.17 and 0.27, respectively.
g = (x,,)) E-R, RJ [-R,
(15)
where R max(8, r). Then we construct circular blur kernel K based on this grid coordinate system:
A.4. Glass Blur:
To explain Glass blur, it is necessary first to introduce Gaus- sian blur. Gaussian kernel G(u, v) with a standard deviation a and size k is defined as:
if of otherwise
K(x, v) 1
(16)
The kernel should be normalized so that (z.)) K (z. .y) = 1. Then conduct gaussian blur on this kernel to get an anti- aliasing smoothing kernel K'. Then do 2D convolution on the input tensor by using blur kenel K':
1 exp 22 + 12
Glu, v)
2To² 2
202
where u, E - 1k/22), 1k/2 is the coordinate index of the gaussian kernel. The values in the kernel will be normalized so that:
Y = X K'
(17)
For severity ranging from 1 to 5, the radius and standard deviation set to (3, 0.1), (4, 0.5), (6, 0.5), (8, 0.5) and (10, 0.5), respectively.
Σ G(u,e) v) 11 2,00
(9)
The output tensor Y of gaussian blur is calculated by con- ducting 2D convolution on the input tensor X and gaussian kernel G:
A.6. Motion Blur
Given an offset angle Ourker, we first generate a random angle 0 fottiet Uniform(-45 45%) for input tensor X. Then calculate the blur offset in horizontal and vertical direction:
Y x=
(10)
Glass blur achieved by combining gaussian blur and ran- dom pixel swap. Given an input tensor X E R Bx3xxxx
clipA = [rk cos(0)], clip, = [rx sin (18)
12

---

with [0, 0J = O. First do square You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
A motion blur kernel K E (((2r++1))((+++)))) with radius r' and standard deviation dg be created by stretching gaussian kernel in direction 0. The motion blurred output Y can be obtained by doing 2D convolution on input tensor X using K and clamping:
wibble <- wibble/wud. Finally the heightmap is normal- ized [0. and output. We defined this whole process as diamond_square For an input tensor X, we can generate fractal noise for it:
F = diamond.square(X mapsize, wd) (26)
= clamp K X, 0, 1)
(19)
where the mapsize = 2 ( H,W) Then add the frac- tal noise to input tensor X to get X = x fog mig.mixin-.. F. Finally do normalization and clamp:
(max
In our setting the foliset is set to O. For severity ranging from
I to 5, the values of r and oy are set to (10, 3), (15, 5), (15,
8). (15, 12) and (20, 15), respectively.
max(X')
Y = clamp X'
0.1) (27)
max (') + fog mixin
A.7. Zoom Blur
Given the number of scaling factors K, we first generate a set of scaling factors 2k:
For severity ranging from 1 to 5, the values of fog.mixin and wibble decay wd are set to (1.6, 2), (2.1, 2), (2.6, 1.7), (2.5, 1.5) and (3., 1.4), respectively.
{ 2 = 2 < max zoom
(20)
A.9. Frost
where is the size of zoom step. For each scaling factor 2k, rescale the input tensor X so that X Scale(X, 2x)-
To add frost corruption to the original input tensor, we ran- domly selected B samples from set that containing several frost images and add them with directly:
Then crop the central region with the same size of X from the rescaled tensor X
x trim = Xalin Ah: A + H, Aw: Aw + W). (21)
clamp(c: X+ F,O,
(28)
where
where C,, Cf and F represent the coefficient of input, the (22) coefficient of frost images and the batch of frost images, respectively. For severity ranging from I to 5, the values of e and Cj are set to (1. 0.4), (0.8, 0.6), (0.7, 0.7), (0.65, 0.7) and (0.6, 0.75), respectively.
Ah Aw size (xx) - (ize(X)
2
The output Y is calculated by:
X
X trim
Y = clamp
1==1
0.1)
(23)
K+1
A.10. Snow
For severity ranging from 1 to 5, the values of max zoom and zoom step s are set to (1.11, 0.01), (1.16, 0.01), (1.21, 0.02). (1.26, 0.02) and (1.31, 0.03), respectively.
To add snow corruption on an input tensor, we first randomly generate a noise layer:
$ = N 5 RR
(29)
A.8. Fog
Then do rescale and crop to S:
To add fog corruption on the original image. we should first generate a heightmap by using Diamond-Square al- gorithm. Given a mapsize and a factor wd that con- trlling random wave decay, we initialize a square grid M E
S' = ReRscaleeS,, [esccale(S, zo0m), S' EBXXIIH''W'
(30)
S. = S'I.,t,tt + H W]
(31)
where zoom is a zooming factor and = (H' - H) 2
is
step:
the crop location. Then do threshold operation to S.:
M [ $.5
Miol+Mii Mik Mittota wibble(s)
0, Sc(x),
if Sf < otherwise
(24)
S+
(32)
where wibble(s) ~ Ld( wibble, wibble). The value of wib- ble is set to 100 at the beginning and decreases with step size Then do diamond step:
Then apply Motion Blur to S, to get Satur
MotionBlur(Sp:: r, s, f = -90). For input tensor X, con- vert to gray scale image and do augmentation:
Mi. +
5.+4
wibble(s) (25)
GrayScale X),G RR B
(33)
After each Square and Diamond operation, the step size s halved, and the the amplitude of random wave is reduced
G' max (X, 1.5 G 0.5)
(34)
13

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- View Corruption
Finally, mix up the augmented gray scale image and original image and add snow layer Satur:
Algorithm RGB to HSV Conversion
Require: R, G, B E [0. 1]
D Input RGB values
Ensure: HE E [0, (6,3)0), S & [0,1)
> Output
miiz
X m) G
(35)
HSV values
Cmaz + max RR, G, B)
Y = clamp X
Sblar + Rotate(Sttar: 180%),0,7
Cmin f- min R, G, B)
(36)
3: A f- Cmaz Cmin
For severity ranging from to 5, the values of j4, a, 200m,
4: A = 0 then
T, T, and m are set to (0.1, 0.3, 3, 0.5, 10, 4, 0.8), (0.2, 0.3, 2, 0.5, 12, 4, 0.7), (0.55, 0.3, 0.9, 12, 8, 0.7), (0.55, 0.3, 4.5, 0.85, 12, 8, 0.65) and (0.55, 0.3, 2.5, 0.85, 12, 12, 0.55), respectively.
5:
H +-0
6: else
if Cmax R then
11 60 G-B mod 360
9:
else if Cmaz
G then
A.11. Contrast
10:
H t- 60
B-R 120 3
11: else
For each sample X5 in input tensor X, calculate the mean value Pe for each channel:
12:
H + 60
R
+ 240
A
13: end if
14: end if
W Σ
He H
Xb,o
(37)
15: Cmaa
0 then
16: S 0
17: else
And Y is the result of stretching or shrinking the pixel value based on the mean value:
18: S + A
Cmaz
19: end if
20: V t Cmar return H,S.V
Y = clampp((X -
11) aa
0,
(38)
For severity ranging from to 5, the value of is set to 0.4,
Algorithm 2 HSV to RGB Conversion
0.3, 0.2 0.1 and 0.05, respectively.
Require: H (0,360), [0, 1], [0, 1]
> Input
HSV values
A.12. Brightness
Ensure: R, G, B [0,
Output RGB values
We first introduce two algorithm rgb2hst and hse2rgh that used for converting color space between RGB and HSV. Then the output Y with brightness corruption can be ob- tained by adding perturbation to the V channel:
I: C .
2: X X (1-
mod 2 - 1l)
3: -++ V
4: if < H < 60 then
(R', Gr, + (C
X rrg2hss((X
(39)
else 60 S H 120 then (R', (R',G',
(X, C,O)
Xhau [; 2, = clamp(X.am)) i 2, 5, 1)
(40)
else if 120 < < 180 then (R',G', + (0, C, 10: else if 1
8:
= clamp((su2rgg((XX 0,
(41)
9:
< H 240 then
For severity ranging from to 5, the value of is set to 0.1,
11:
(R', (R',',BB") + (0, X,C)
0.2, 0.3, 0.4 and 0.5, respectively.
12: else i40 S 300 then
13: (R', "") (X,0,0)
A.13. JPEG Compression
14: else
We give an example algorithm to explain the process of JPEG compression.
15:
(R',G', B') (C,0,X)
16: end if
17: R + R' +m
18: G + G + m
A.14. Pixelate
19: B < B' + m return R, G,
Given an input tensor X, the pixelate corruption are achieved by reducing and enlarging X:
Xreduced = Interpolate(X, (s- s-W), mode = 'bilinear')
Y Interpolate(xredueed, (H, W), mode = 'nearest')
(42)
(43)
14

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- Corruption
Algorithm 3 JPEG Compression Algorithm
Algorithm 4 Elastic Transformation
Require: X: Input tensor
Require: Input image X E ER IBBxXXXXW parameters
Ensure: C: Compressed JPEG data
[c,,C1,0 c2]
1: Step I: Convert to YCbCr (if RGB)
Ensure: Transformed image Y
2: if X is in RGB format then
1: Normalize the input image: Xnoem t- X/255
3:
Convert X to YCbCr color space
Set shape shape <
(B,CHHW) and size
4: end if
shape_size + (H, W)
5: Step 2: Divide image into 8x8 blocks
Step 1: Random Affine Transformation
6: Divide each channel of into non-overlapping 8 x blocks
4: Compute center: Ceenter + - 2
11 W
5: Compute square size: Caquare f min (H.)
7: Step 3: Apply Discrete Cosine Transform (DCT)
6: Define reference points:
8: for each 8 x 8 block B do
9: Compute DCT coefficients D +- DCT(B)
Coenter + Csquare
10: end for
P1 f
Ceenter + (Centerr, + Caquare Cventer.y Caquree
11: Step 4: Quantize DCT coefficients
Ceenter Coquare
12: for each x 8 block D do
b Divide by quantization table Round Q to nearest integer
Q <- DD/Qtable
7: Add random perturbation: P2
P1
+
Uniform(-C2,44
15: end for
8: Compute affine transform matrix: TranffineTTansfommp::::.
M Maline
16: Step 5: Encode the quantized coefficients
17: for each block Q do
9: Apply affine transformation:
Xaftine
18: Perform zigzag scan to convert Q to ID array
warpAffine m Mattine)
19: Apply Run-Length Encoding (RLE) to the zigzag
10: Step 2: Generate Pixel Displacement Fields
array
11: Compute random fields:
Use Huffman coding to encode the RLE data
21: end for
Ag Gaussian(Uniform/
c0
22: Step 6: Combine encoded data
Ag f Dunusiaa(Uniffomm--11
23: Y + Combine encoded data for all blocks with JPEG
headers
12: Reshape displacement fields: Ag. Ay R "xxxx
24: return Y
13: Step 3: Apply Coordinate Mapping
14: Generate original grid:
(x,
meshgrid((0 (0, W), [o, (0,
15: Add displacements: x' + x Az, 1/ + y + Dy
where is scaling factor. For severity ranging from to 5, the value of is set to 0.6, 0.5, 0.4, 0.32 and 0.29, respectively.
16: Map coordinates using interpolation:
Xelastic f- mapCoordinates! Xaffines (x', , : 2), order = 1)
A.15. Elastic Transform
17: Step 4: Normalize and Return
18: Clip values: Y +- clip(X elustic 0, 1) 255
ellssie
We provide example algorithm to explain the process of Elastic Transform. For severity ranging from I to 5, the values of parameters are set to (244 2, 244 0.7, 244 0.1), (244 2, 244 * 0.08, 244 * 0.2), (244 0.05, 244 0.01, 244 * 0.02). (244 0,07, 244 * 0.01, 244 0.02) and (244 * 0.12, 244 * 0.01, 244 0.02), respectively.
19: return Y
For each of our experiments, since the images belong to the same category, so TN FN 0. We defined the accuracy under corruption C' and severity i as Accuracyc. thus the Average Accuracy (Ave.Acc) can be calculated by:
B. Details of Validation Metrics
Accuracyc,
In our experiment, we employed two metrics to assess model performance on corrupted images: accuracy and Corruption Error (CE). Accuracy is defined as the proportion of true positive samples in all of samples:
Average Accuracy
(45)
5
Corruption Error (CE) is proposed to comprchensively eval-
uate a classifier's robustness to a given type of corruption. The first evaluation step is to take a trained classifier f. which has not been trained on IMAGENET-C, and com-
TP
Accuracy
(44)
TP+ PP TN FN
15

---

You Always Recognize Me (YARM): Robust Texture Synthesis Against Multi- View Corruption
Original
8 s 1.0
8 S 5.0
Figure 5. More visualization results of our robust texture.
pute the clean dataset top-1 error rate. Denote this enror rate E The second step is to test the classifier on each corruption type at each level of severity (1 S S 5). This top-1 error is written E..- Before aggregating the clas- sifier's performance across severities and corruption types, error rates should be made more comparable since different corruptions pose different levels of difficulty. We adjust for the varying difficulties by dividing by the errors of target classifier (when using VGG16 for testing, we use VGG16's errors). So Corruption Error computed with the formula:
corresponding results are shown in Fig All results were generated using ResNet-18 as the proxy model.
CE/
Es
Etarett
(46)
The mean CE (or mCE for short) can be calculated by aver- aging the 15 Corruption Error values. The authors further proposed metric indicate the amount that classifier declines on corrupted inputs, which named Relative Corrup- tion Error:
Relative CB/
Ef Eif
E btrrge
parrget
(47)
Averaging these 15 Relative Corruption Errors results in the RelativemC... This measures the relative robustness or the performance degradation when encountering corruption.
C. More Visualization Results
We present additional visualization results to illustrate the differences between the textures generated by our method under varying boundaries and the original textures. The
16


Reviews:
[{"review_id": "0pNSlXqVpm", "reviewer": "Reviewer_rM6D", "summary": "The paper focuses on the reconstruction of a 3D object from a set of low-quality 2D images. The method applies 15 different corruption techniques during training to the respective images just like a data augmentation technique to make the classifier strong enough independent of the noise introduced. Furthermore, this research evaluates the classification performance of the reconstructed objects by transferring knowledge from the surrogate model to a larger architecture.\n\n## update after rebuttal\nI decided to keep my original score (weak accept).", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate the reviewers’ thoughtful feedback and insightful suggestions. We have carefully reviewed all the comments and provide our detailed responses below.\n\n**A1.Regarding experiments on ModelNet40 datasets:** Thanks for your question! Please refer to ***A3 to Reviewer eS8T***.\n\n**A2.Regarding visualization results:**\nThanks for your question! Since VQSA and DCP are finetuning-based methods, we provided visualization results of URIE, Unadv and our method. Please refer to ***A3 to Reviewer eS8T*** for results on ModelNet40 and ***A2 to Reviewer mDnf*** for real scene.\n\n**A3.Regarding ablation study:**\nThanks for your question! In fact, our method does not involve many detachable modules that allow for extensive ablation studies. Therefore, in the ablation study section of the paper, we primarily focused on analyzing the impact of voxel grid resolution and the boundary of texture perturbation on the final results. To further illustrate the superiority of voxel grids as a 3D representation in our framework, we additionally compared the performance of robust textures when using NeRF's MLP as the 3D representation. In this experiment, we selected one object from each category for evaluation. The results on Resnet18 is shown below:\n|Method|none|1|2|3|4|5|random|m.CE|R.mCE|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Clean|0.3611|0.3289|0.2793|0.1855|0.1325|0.1156|0.1602|-|-|\n|MLP|0.4527|0.4078|0.3629|0.2774|0.2168|0.1825|0.2484|0.6873|0.7540|\n|Voxel(Ours)|0.8714|0.8598|0.7994|0.7182|0.6530|0.5796|0.6901|0.2617|0.2984|\n\n**A4.Regarding reference:**\nThank you for your question! However, we would like to clarify that our work is not closely related to transfer learning or style transfer. The reason why the robust textures can be transferred across different classifiers is similar to the phenomenon observed in adversarial examples: different classifiers tend to learn feature spaces with certain similarities. Additionally, image restoration works have a different focus compared to ours. Traditional image restoration aims to recover as much visual detail of the original image as possible, whereas our objective is to enhance the performance of downstreaming models when encountering corrupted images. Image restoration is merely one possible approach that can be incorporated into our framework, but it is not the primary focus of our work.\n\n**A5.Regarding selection of proxy model:**\nThanks for your question! As we explained in section 3.5, employing a proxy model with relatively weaker generalization ability can lead to better transferability to other model architectures. To further clarify this design choice, we consider our task as the reverse of an adversarial attack task. In prior work on adversarial attacks, it has been observed that when the proxy model itself has stronger generalization capability, the generated adversarial examples tend to exhibit higher transferability. Intuitively, this can be likened to a teacher-student scenario: if a question can challenge a very capable student, it is more likely to challenge a less capable one as well. In contrast, our objective is to enable the classifier to correctly recognize the input, which can be viewed as the opposite of adversarial attacks. In this analogy, it is akin to designing questions that students can answer correctly. If a question can be easily answered by a less capable student, it is naturally more likely to be correctly answered by a more capable one as well.\n\n**A6.Regarding universal robust textures:**\nThanks for your question! We proposed universal robust textures because synthesizing robust textures for each individual instance is an inefficient process. However, since the main focus of this paper is on object-specific robust texture synthesis, we only conducted preliminary experiments to validate the feasibility of universal robust texture. We believe that the performance of universal robust textures can be further improved in the following ways: 1. A larger, category-organized multi-view 3D reconstruction dataset. In our current IM3D dataset, each category contains only 10 different objects, and we used only 8 of them to train the robust textures. This clearly limits their generalization capability. 2. More efficient 3D representation. In our current setting, we adopt voxel grids as the 3D representation. However, training universal robust textures on a larger set of objects inevitably requires increasing the capacity of voxel grids, which would significantly raise the GPU cost. NeRF-based representation may be better for scaling up category-level robust texture training.\n\n**A7.Regarding end-to-end training:**\nThanks for your question! Our proposed data-centric approach for enhancing classifier performance is based on the assumption that, in industrial scenarios, deployed classifiers cannot be easily modified or retrained. But we think it's possible to jointly optimize both the textures and the classifier to get better performance.", "claims_and_evidence": "The claims mentioned in the paper are supported by various studies that have explored similar approaches. The paper discusses the use of NeRF methods to justify the adoption of a voxel representation for generating the corresponding reconstruction.\n\nAdditionally, the method introduces universal adversarial perturbations (UAP) as a guiding mechanism for their universal robust texture, developed from a set of objects. The authors reference literature that examines how small perturbations can significantly affect classification outcomes.\n\nHowever, the discussion on transfer learning in relation to the surrogate models is presented but not well supported by prior evidence. While it is well known that transfer learning can enhance the performance of a larger model by training a distilled version, the cited literature focuses on alternative approaches (segmentation models) that are not directly related to this specific method.", "methods_and_evaluation_criteria": "- The experiments for this method were conducted downstream using the IM3D dataset, which has been widely utilized in various applications, including mesh generation and image classification. However,  the method is not tested on other datasets, such as ShapeNet3D, Objaverse, or ModelNet40, to demonstrate its generalization to different objects.\n\n- The paper does not provide visual results for other methods, only the respective metrics. In 3D reconstruction, it is particularly important to present at least one example from other approaches to allow for a proper comparison of the results.", "theoretical_claims": "All the theoretical claims are correct including the ones mentioned in the appendix about the formulas used for each corruption.", "experimental_designs_or_analyses": "The paper includes the ablation study on evaluating the performance of the textures obtained with different hyperparameter combinations and voxel grid resolutions. \n\nThe experimental design is valid for providing insights into the impact of these specific hyper-parameters, but a more comprehensive ablation study could have strengthened the paper's conclusions about optimal parameter settings across different scenarios. In addition, should be important to mention how many objects were run in these experiments and provide some figures where it is possible to visualize the differences.", "relation_to_broader_scientific_literature": "The paper leverages recent advances in neural radiance fields (NeRF) and their accelerated variants using voxel grid representations. The authors adapt these techniques for texture optimization rather than novel view synthesis. This paper is related to NeRF-based editing research, showing how voxel grid-based 3D representations can be used for specific downstream objectives.", "essential_references_not_discussed": "**Transfer Learning**\nThe paper by Gatys et al. (2016), \"Image Style Transfer Using Convolutional Neural Networks,\" is an influential approach for transferring artistic styles between images. This work showed how CNNs previously optimized for object recognition could be repurposed to separate and recombine content and style representations of images. By defining content and style losses based on feature activations and feature correlations in different CNN layers, their method transfers the stylistic elements of artworks like Van Gogh's \"The Starry Night,\" Munch's \"The Scream,\" and Picasso's \"Seated Nude\" onto images.\n\n**Image Restoration**\nSeveral key image restoration papers are missing from the references. Zhang et al. (2017) showed how CNNs could effectively denoise images using residual learning. Dong et al. (2015) was the first major work applying deep learning to super-resolution. Isola et al. (2017) created pix2pix, which handles many image-to-image translation tasks including restoration. Wang et al. (2018) improved GAN-based restoration with ESRGAN, while Ulyanov et al. (2018) found that network architectures inherently contain useful priors for restoration. Including these works would give better context for comparing the paper's approach with restoration-based methods for handling corrupted images.", "other_strengths_and_weaknesses": "Strengths:\n1. The key innovation is making object appearances inherently robust to corruption, rather than trying to repair corrupted images or complicate models. This directly benefits safety-critical systems like autonomous vehicles that must reliably identify objects in varying conditions.\n\n2. This approach solves real-world problems where vision systems must function in harsh conditions. Unlike NeRF and Gaussian Splatting which assume perfect images, this method maintains performance despite weather effects, sensor noise, and motion blur.\n\nWeaknesses: \n\n1. **Missing ablation studies**: There's limited exploration of how different components of their pipeline contribute to the final performance, making it difficult to understand which aspects are most critical.\n\n2. The performance seems highly dependent on the choice of proxy model during optimization, but the paper doesn't provide clear guidelines for selecting optimal proxy models for different scenarios. There are recent CNN's that can be study like ConvNext.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. the results in Figure 3 suggest that smaller models tend to be better surrogates for transferable texture optimization. Could you share insights into why this might be the case?\n\n2. Table 1 shows a performance gap between universal robust textures and object-specific textures. Do you see pathways to improving universal texture performance, or are there fundamental limitations to what universal textures can achieve compared to object-specific ones?\n\n3. Could your approach be extended to jointly optimize both textures and classification models in an end-to-end manner?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GWVXpQRIF8", "reviewer": "Reviewer_eS8T", "summary": "This paper proposes a data-centric approach to enhance the performance of deep learning models in the presence of image degradation by utilizing multi-view 3D reconstruction and optimizing for a robust texture. They have shown that a generalized robust texture exists that can transfer across objects of the same category but with different geometries. From the experiments, they conclude that choosing a surrogate model with weaker performance can better accommodate a broader range of transfer scenarios. They have shown relevant experiments to show the performance of all the subparts. They have a dataset IM3D to show the effectiveness of their method. The dataset contains 40 different classes where each class contains 10 different objects and there are around 100 images for each object.\n\n## Update after rebuttal\nAuthors have addressed my concerns. I keep my original rating 'weak accept'.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewers’ thoughtful feedback and provide our detailed responses below.\n\n**A1.Regarding the specific differences from prior methods:**\nThanks for your question! We acknowledge that our work is inspired by Unadv; however, there are clear differences that distinguish our approach from Unadv: 1.Optimization space: Unadv directly optimizes the pixel values of texture images in the 2D image space, while our method performs optimization in the voxel grid space. We believe the high dimensionality of the voxel grid allows for better optimization outcomes. 2. Visual appearance preservation: Directly optimizing texture images in pixel space often results in highly discrete pixel values, which can manifest as noise-like visual artifacts on the object surface. In contrast, the textures generated by our method exhibit a certain degree of local continuity. This advantage is particularly evident when applied to objects without initial textures (see ***A3***). 3.Efficiency: Our method is approximately 100 times faster than Unadv. Unadv's optimization is based on 3D mesh representations combined with a differentiable rendering framework, which typically requires 6 to 7 hours to optimize a single object. In comparison, our approach takes only 4 to 5 minutes to complete the optimization.\n\n**A2.Regarding Eq.3:**\nThanks for your question! We acknowledge that such a situation is theoretically possible; however, the probability is very low. Specifically, for this to happen, the gradient of the $\\delta$ term obtained through backpropagation during training would need to remain 0 throughout the entire process. Additionally, it would require that the multi-view images of the original object exhibit strong robustness against all types of corruptions. Furthermore, commonly used optimizers incorporate momentum terms, which help prevent the optimization from getting stuck in such a local optimum. Therefore, we believe this situation is unlikely to occur in practice.\n\n**A3.Regarding real-world data and other datasets:**\nThe reason why we only used the IM3D dataset in our experiments is that our method requires datasets with specific characteristics: (1) multi-view images along with camera poses to enable 3D reconstruction; and (2) category labels aligned with ImageNet classes to support the classification task. Therefore, datasets commonly used in NeRF-related tasks are not directly applicable to our pipeline. Nevertheless, to demonstrate the generalization ability of our method, we selected 4 objects from the ModelNet40 dataset—originally designed for point cloud classification—and rendered multi-view images of them using Blender for evaluation. Experimental results based on VGG16 is shown below. Visualization results can be found here https://p.sda1.dev/23/b660fbea4c3a6d471effde89e4b4110f/modelnet.png. For real scene results please see ***A2 to Reviewer mDnf***.\n|Method|none|1|2|3|4|5|random|m.CE|R.mCE|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Clean|0.7229|0.6296|0.6014|0.5693|0.5228|0.4596|0.5381|-|-|\n|URIE|0.3708|0.3235|0.3301|0.3067|0.2844|0.2326|0.3125|1.7991|1.9015|\n|VQSA|0.3854|0.4032|0.4081|0.3949|0.3838|0.3757|0.3851|1.4768|1.5398|\n|DCP|0.2819|0.2652|0.2138|0.1677|0.1429|0.1158|0.1443|2.3419|2.2930|\n|Unadv|0.1794|0.1620|0.1566|0.1283|0.1139|0.1031|0.1123|3.4739|4.6710|\n|Ours|0.9646|0.9334|0.8875|0.8599|0.7971|0.6982|0.8347|0.3463|0.3799|\n\n**A4.Regarding the fairness of the experiments:**\nThanks for your question! For the baseline methods, we first evaluated their publicly released weights (most of which were pretrained on ImageNet) on the IM3D dataset. However, due to distribution differences, most of these methods exhibited suboptimal performance on IM3D. Therefore, we additionally fine-tuned URIE, VQSA, and DCP on the IM3D dataset to ensure a fair comparison. After fine-tuning, VQSA showed significant performance improvement, URIE exhibited a slight improvement, while DCP showed no noticeable improvement.\n\n**A5.Regarding Figure 4:**\nThanks for your question! In Figure 4, we illustrate the appearance of universal robust texture when applied to multiple instances with different shapes within the same category (airplane). We will add further clarification to the caption of Figure 4 in the revised version and ensure that Figures 1, 2, and 4 are explicitly referenced in the main text.\n\n**A6.Regarding the use of ReLU:**\nThis design choice was proposed by [1], where the authors claimed that replacing SoftPlus with ReLU better preserves the discontinuities present in real-world signals.\n\n**A7.Regarding the IM3D dataset:**\nThe IM3D dataset is sourced from [2]. We apologize for the oversight of not citing it in the original submission. We will add the appropriate citation in the revised version.\n\n**A8.Regarding the visualization results:**\nPlease refer to ***A3***.\n\n[1].ReLU Fields: The Little Non-linearity That Could.\n[2].Towards viewpoint-invariant visual recognition via adversarial training.", "claims_and_evidence": "1. In Line 139-140, it is given that some previous methods have explored robustness in 3D objects. And the differences (they were not tested on large-scale datasets and other models, ...) are not convincing. Concepts look similar. Can you please specify what are the exact differences between your method and those methods? The difference is only where you are utilizing 3D reconstruction in your optimization?\n\n2. Is it possible that, in Eq. (3), the optimized $\\delta$ becomes zero, and the classifier predicts the correct class always?", "methods_and_evaluation_criteria": "Did you check the effectiveness of your method on some real data (real-world)? Other than the dataset IM3D you have used? I feel there should be some results on real data also.", "theoretical_claims": "No theoretical claims.", "experimental_designs_or_analyses": "Are the experiments fair? Can you please specify the training settings of the methods compared in Tabl 1 and 2? Have all methods been retrained/finetuned with the same dataset?", "relation_to_broader_scientific_literature": "From the current version of the paper, I feel, the contribution of the paper is good to the scientific literature. But, please specify the exact differences from the previous literature as I have raised in one previous query.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Strengths are\n1. The paper is well-written and it is interesting to read.\n2. Proper experiments are shown.\n\nWeaknesses\n1. Fig. 1, 2, and 4 are not referred to in the texts and these figures are like some independent things in the paper. Readers may not see those figures if they are not cited in the text. \n2. In Fig. 4, what is shown by universal texture? Not clear!\n3. Line 209, column 2, why you have replaced the soft plus activation function with ReLU?\n4. IM3D dataset is from which paper? Is it cited in the paper?\n5. It is better to have more visual results of more different objects and also every method you have compared (if you can show what they have learned).", "other_comments_or_suggestions": "NA", "questions_for_authors": "Against each of the sections, questions are given. Please try to address my concerns to help me make a more favorable decision.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "bq1x3xRvje", "reviewer": "Reviewer_mDnf", "summary": "This paper addresses real-world unknown image degradation that affects deep learning model performance. The authors propose a novel data-centric approach that optimizes the textures of 3D objects to enhance their robustness against corruption. The methodology is based on 3D voxel grid representations reconstructed from multi-view images. A classifier is used as a surrogate model to optimize textures, ensuring robustness against corruption during imaging.\n\n## update after rebuttal\n\nAfter I review the author's response and other reviewers' comments, I maintain my score. I appreciate the authors' efforts. \n\nNo higher score because the contribution doesn't reach the bar of ICML.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate the reviewers’ thoughtful feedback and insightful suggestions. We have carefully reviewed all the comments and provide our detailed responses below.\n\n**A1.Regarding writing issues:**\nThank you for pointing out these issues! We will correct these errors in the revised version of the paper.\n\n**A2.Regarding real-world experiments:**\nThank you for your question! We fully understand the importance of real-world experiments. However, compared to previous methods (such as Unadv), we have already conducted extensive evaluations of our proposed method on a large dataset containing 40 categories and 400 object instances (whereas Unadv evaluated only 5 objects). We believe this is sufficient to demonstrate the generalization capability of our method. Nevertheless, to further address your concern, we have additionally conducted an experiment on a real-world scene. Specifically, we selected a real scene used in [1]. Since our method requires separating the foreground object, we manually segmented the foreground object from the multi-view images and performed 3D reconstruction and texture optimization accordingly. The experimental results based on ResNet-18 are presented in the table below. The visualization results can be found here https://p.sda1.dev/23/b6df0ef9d63f80fba42e36ce11994fed/real_scene.png\n|Method|none|1|2|3|4|5|random|m.CE|R.mCE|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Clean|0.7155|0.7016|0.6373|0.5424|0.4390|0.3382|0.4959|-|-|\n|Ours|1.0000|0.9957|0.9786|0.8932|0.7009|0.5342|0.8417|0.2395|0.3720|\n\n**A3.Regarding scalability:**\nThank you for your question! We believe that large-size images can be downscaled to fit our 3D reconstruction pipeline, and therefore, scalability to larger images is not a major concern in our method. In contrast, images with excessively low resolution may significantly degrade the quality of 3D reconstruction, which could in turn hinder the effectiveness of the optimized textures.\n\n**A4.Regarding universal robust textures:**\nThank you for your question! Indeed, a single object-specific robust texture can only be transferred across different classifiers but cannot be directly transferred to other objects with different shapes, even within the same category. We proposed the concept of universal robust textures because object-specific texture synthesis is an inefficient process. Therefore, our goal is to generate a universal texture for each category, independent of the specific appearance and shape of individual instances. We have validated the feasibility of this idea through preliminary experiments. It is worth noting that the performance of universal robust textures reported in Tables 1 and 2 was evaluated on objects that were not used during training. This demonstrates that these textures indeed provide protection for previously unseen objects within the same category. However, the primary focus of this paper is on object-specific robust textures. As such, we did not devote significant effort to further improve the performance of category-level robust textures, which may explain why their current performance appears unsatisfactory. Nevertheless, we believe that the direction of category-level robust textures is worthy of further exploration. We have also discussed possible ways to improve their performance (see ***A6 to Reviewer rM6D***).\n\n**A5.Regarding selection of proxy model:**\nPlease refer to ***A5 to Reviewer rM6D***.\n\n**A6.Regarding the question about Figure 4:**\nThank you for your question! We apologize for the lack of clarity in the presentation of Figure 4. Specifically, the first row of Figure 4 shows the original appearance of the objects; the second row shows the appearance after applying object-specific robust texture optimization for each object; and the third row shows the appearance when applying the universal robust texture, generated for the \"airplane\" category, to objects of different shapes within the same category. As illustrated in Figure 1, we selected 8 objects from the \"airplane\" category as the training set. We reconstructed voxel grid representations for each of these 8 objects based on their multi-view images. Then, we initialized a random perturbation $\\delta$ and, during each iteration of the optimization process, randomly selected one voxel grid to combine with $\\delta$ and rendered the corresponding view images. In this way, the resulting category-level robust texture can be directly applied to unseen voxel grid representations of other objects belonging to the \"airplane\" category, enabling the rendering of corruption-robust views. We hope this explanation helps clarify your concerns regarding the universal robust texture and the content of Figure 4.", "claims_and_evidence": "moderate, please see details in weaknesses.", "methods_and_evaluation_criteria": "yes, they make sense in the proposed setting.", "theoretical_claims": "limited theoretical analysis", "experimental_designs_or_analyses": "I think the experiment is not solid and enough.", "relation_to_broader_scientific_literature": "see problems", "essential_references_not_discussed": "see problems", "other_strengths_and_weaknesses": "Strengths:\n1.Novel Data-Centric Perspective: Instead of modifying models or preprocessing images, object texture optimization is a new angle for improving robustness.\n2.Transferability: While transferability is a core concern of the article, it indicates how the output of a single model can be generalized to other architectures.\n3.Application of 3d reconstruction: Using voxel-based NeRF for texture optimization aligns well with modern 3D deep learning approaches.\n\nWeaknesses:\n1.Unpolished writing: line 162-163 and 199-200 is repetitive. Formula 3 is cross entropy loss but labeled as mse. Figure captions are \n2.Lack of real-world experiments: The experiments are performed on synthetic datasets rather than real-world scenarios. But whether the method is applicable to real-world data is a key question mentioned in the intro\n3.Scalability: 3d reconstruction makes this method difficult to scale up to larger images.", "other_comments_or_suggestions": "see problems", "questions_for_authors": "1.The article discussed the existence of a universal robust texture. However the experiment results did not support the importance and necessity of this feature. Why do we need this additional computation if the single robust texture is already transferable? It is mentioned that hopefully this facilitates the classification of unseen data, but this is not verified.\n2.Why does some texture generated from a stronger backbone like res152 lead to significant drop in performance for simpler architectures like res18 and res34?\n3.How does the object become robust as the training progresses? Figure 4 is a bit confusing in displaying it.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper received three reviews with mixed initial ratings (2 weak accepts, one weak reject). There was consensus around the importance of the problem considered -- reconstruction and inference from corrupted images -- a timely problem that can especially benefit safety-critical systems in robotics and other applications. There was also appreciation for the novelty of the proposed approach centered around the observation of a robust texture / appearance that is preserved across multiple views. The paper demonstrates the performance of the proposed approaches under a wide range of non-ideal conditions, including weather effects, sensor noise, and motion blur. This could have strong implications for real-world vision systems which must function robustly in challenging conditions. 

There were some concerns raised around presentation, real-world evaluations and scalability, which were appropriately addressed in the authors' response. Given this, an accept decision is recommended.
Decision: Accept (poster)