ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints
Authors: Yinpeng Dong
Shouwei Ruan
Hang Su
Caixin Kang
Xingxing Wei
Jun Zhu
Venue: NeurIPS 2022 Accept (2022)
Keywords: Visual Recognition
Robustness
Viewpoint Changes
OOD Generalization

Abstract: Recent studies have demonstrated that visual recognition models lack robustness to distribution shift. However, current work mainly considers model robustness to 2D image transformations, leaving viewpoint changes in the 3D world less explored. In general, viewpoint changes are prevalent in various real-world applications (e.g., autonomous driving), making it imperative to evaluate viewpoint robustness. In this paper, we propose a novel method called ViewFool to find adversarial viewpoints that mislead visual recognition models. By encoding real-world objects as neural radiance fields (NeRF), ViewFool characterizes a distribution of diverse adversarial viewpoints under an entropic regularizer, which helps to handle the fluctuations of the real camera pose and mitigate the reality gap between the real objects and their neural representations. Experiments validate that the common image classifiers are extremely vulnerable to the generated adversarial viewpoints, which also exhibit high cross-model transferability. Based on ViewFool, we introduce ImageNet-V, a new out-of-distribution dataset for benchmarking viewpoint robustness of image classifiers. Evaluation results on 40 classifiers with diverse architectures, objective functions, and data augmentations reveal a significant drop in model performance when tested on ImageNet-V, which provides a possibility to leverage ViewFool as an effective data augmentation strategy to improve viewpoint robustness.

ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints
Yinpeng Dong Shouwei Ruan", Hang Su S4.55 Caixin Kang", Xingxing Wei?, Jun Zhu 133,4,5+ Dept. of Comp. Sci. and Tech., Institute for AI, Tsinghua-Bosch Joint ML Center, THBI Lab, BNRist Center, Tsinghua University, Beijing 100084, China Institute of Artificial Intelligence, Beihang University, Beijing 100191, China
3 RealAI Peng Cheng Laboratory Pazhou Laboratory (Huangpu), Guangzhou, China (dongyinpeng,
adu. en, (shouzairuan, caixinkang, xxvei Jabuaa, edu.cn
Abstract
Recent studies have demonstrated that visual recognition models lack robustness to distribution shift. However, current work mainly considers model robustness to 2D image transformations, leaving viewpoint changes in the 3D world less explored. In general, viewpoint changes prevalent in various real-world applications (e.g., autonomous driving), making it imperative to evaluate viewpoint robustness. In this paper, propose a novel method called ViewFool to find adversarial viewpoints that mislead visual recognition models. By encoding real-world objects as neural radiance fields (NeRF), ViewFool characterizes distribution of diverse adversarial viewpoints under an entropic regularizer, which helps to handle the fluctuations of the real camera pose and mitigate the reality gap between the real objects and their neural representations. Experiments validate that the common image classifiers are extremely vulnerable the generated adversarial viewpoints, which also exhibit high cross-model transferability. Based on ViewFool, we introduce ImageNet- V, a new out-of-distributtin dataset for benchmarking viewpoint robustness of image classifiers. Evaluation results 40 classifiers with diverse architectures, objective functions, and data augmentations reveal a significant drop model performance when tested on ImageNet-V, which provides possibility to leverage ViewFool an effective data augmentation strategy to improve viewpoint robustness.
Introduction
One of the fundamental challenges of deep learning generalize reliably to unseen or shifted test distributions [16, 23, 44, 58). Typically, deep learning models can be easily deceived by adversarial examples [19, 533, which are crafted by applying small perturbations to natural examples. Although the adversarial perturbations are imperceptible, they quite sophisticated and can hardly exist in the wild [3, 30J. Recent works have revealed the vulnerability visual recognition models to some natural (image) transformations, including rotation and translation [13], geometric transformations [27], image corruptions [23], and others [17, 31, 61, 62]. Out-of--istribuue (OOD) generalization is thus emerging essential research topic in closing the gap between human and machine vision [16, 18].
Despite the progress, most works concentrate on the robustness of visual recognition models to image transformations [13, 16, 23]. while less effort has been made to explore model robustness to 3D variations the physical world, such as viewpoint changes. numerous real-world applications (e.g., autonomous driving, surveillance), viewpoint changes are arguably more natural and prevalent, which can cause severe security and safety consequences if the models cannot deal with such changes.
Corresponning author.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

M 7006
Chair: 78.66%
Keyboard: 47.80%
Street sign: 99.55%
Traffic light: 97.94%
Bourd: 63.50%
Mouse: 37.44%
Cinema: 58.45%
Canoe: 41.01%
Figure 1: An illustration of adversarial viewpoints. Top: images captured from natural viewpoints, which are correctly classified; Bottom: the same objects taken from adversarial viewpoints found by ViewFool, which are wrongly classified. The target model is ResNet-50 [21].
As human vision exhibits a strong ability to robustly recognize objects from varying viewpoints [7], is of significant importance to study the viewpoint robustness of visual recognition models to identify and understand their weaknesses before they are deployed in safety-critie applications.
Some prior works [5, 25] build new image datasets with different viewpoints to benchmark model robustness, but they cannot evaluate the worst-case performance of the model. Other works [2, 64] propose to adversarially estimate the physical conditions (e.g., viewpoints, illumination) that cause misclassification, but these methods can only perform attacks for synthetic 3D object models, which do not necessarily correspond to real-world objects. In general, evaluating the viewpoint robustness of visual recognition models the physical world is considerably challenging, since it requires modeling the real-world 3D objects with high fidelity but there is always a gap between the real-world objects and their digital representations. Moreover, even if the adversarial viewpoints can be generated, is hard to control the pose of the real camera to precisely match a specific adversarial viewpoint, making the captured image fail consistently mislead the model in the physical world.
In this paper, we propose ViewFool, novel method to systematically generate adversarial viewpoints that can mislead visual recognition models in the physical world, as shown in Fig. 1. Motivated by the recent progress of neural rendering, we represent the real-world 3D objects by neural radiance fields (NeRF) [41]. which can synthesize photorealistic images from novel viewpoints. The rendered images are then fed into the target model to obtain the losses. By optimizing a parameterized distribution of adversarial viewpoints under an entropic regularizer, ViewFool can characterize diverse adversarial viewpoints to mitigate the gap between the real objects and their neural representations and improve the resistance camera fluctuations. For optimization, we find that gradient calculation requires unacceptable GPU memory usage despite the differentiability of the rendering process (detailed in Sec. 3.3). Therefore, we resort search gradients that only require forward propagation through the rendering process and the target model, making ViewFool applicable under black-box setting with only query access to the model.
We conduct extensive experiments to evaluate the viewpoint robustness of image classifiers on the ImageNet [45] dataset. Our results demonstrate that ViewFool can effectively generate distribution of adversarial viewpoints against the common image classifiers, which also exhibit high transferability across different models. Moreover, we introduce new OOD benchmark Imagee-e-- for viewpoint robustness evaluation of image classifiers. We provide evaluation results on 40 image classifiers with diverse network architectures (e.g., ResNet [21], vision transformer [12]), training objective functions (e.g., self-super learning [22], adversarial training [46]), and data augmentation strategies (e.g.. AugMix [24], Deepengment [25]). The performance of these classifiers degrades significantly when evaluated on ImageNet-V, demonstrating that the existing classifiers are substantially vulnerable to viewpoint changes, which may motivate future work on improving viewpoint robustness.
2 Related work
Deep learning robustness. A major obstacle of deep learning models towards human-level perfor- mance is the lack of robustness to distribution shift [16, 18, 23, 44, 58]. It has been shown that deep

---

learning models are vulnerable to adversarial examples [19, 53], which are maliciously crafted by perturbing the natural examples with small perturbations. Some methods have successfully generated adversarial examples in the physical world [3, 30], raising severe threat to the deployment of deep learning models. However, these adversarial examples are elaborately designed by humans, that can hardly exist in the wild. Other works have studied the vulnerability of deep learning models to natural transformations. For example, Engstrom et al. [13] find that image translations and rotations suffice to mislead a target model. Hendrycks & Dietterich [23] introduce ImageNet-C/P to benchmark model robustness to natural image corruptions and perturbations. The gap between human and machine vision for issues, various kinds of defense and robustness improvement techniques have been proposed, e.g.. [24, 25, 33, 38, 63, 65], to name few.
generalization has also been analyzed [16, 18]. To address the robustness
Robustness to 3D variations. As deep learning models have been increasingly deployed in numerous real-world applications, it is imperative to study model robustness in the 3D world. The ObjectNet [5] and DeepFashion Remixed [25] datasets have been introduced to evaluate model performance under varying backgrounds, camera viewpoints, and object rotations. However, they cannot evaluate the worst-case performance of the model to 3D variations. Zeng et al. [64] generate adversarial examples by perturbing the 3D physical conditions, including 3D rotations and translations, illuminations, etc. Alcor et al. [2] further generate adversarial poses of the 3D objects, such that the rendered images can mislead deep learning models. However, these methods require synthetic 3D object models that do not correspond to real-world objects, and thus they cannot be utilized in the physical world. Our generate adversarial viewpoints for real-world objects
work differs from them mainly in that by encoding them as neural representations.
Novel view synthesis and neural rendering. It is oong-standing problem to synthesize novel views of an object/scene given a set of captured images. Early methods [20, 32] can construct photorealistic novel views given densely sampled input views. Recently, plenty of works [14, 36, 39, 40, 41, 43, 50, 51] adopt neural networks to model 3D objects and can render high-quality images for sparser sets of input views. Among these approaches, neural radiance fields (NeRF) [39] show promising results by representing 3D objects/scenes as volumetric radiance fields parameterized by a multi-layer perceptron (MLP). In this paper, we adopt NeRF to learn neural representations of real-world 3D objects and then generate adversarial viewpoints based on the rendered images. Although NeRF can synthesize photorealistic images, there is still reality gap between the rendered images and the real images, affecting the effectiveness of the adversarial viewpoints given the real objects. Our proposed method eliminates this issue by learning distribution of adversarial viewpoints, as detailed below.
3 Methodology
In this section, we detail the proposed ViewFool method. ViewFool adopts NeRF to model real-world 3D objects as the digital representation and performs optimization in the search space of viewpoint parameters. In the following, we first introduce the background knowledge of NeRF and then present the problem formulation and optimization algorithm of ViewFool.
3.1 Preliminary: neural radiance fields (NeRF)
NeRF [41] encodes a real-world object/scene as continuous volumetric radiance field F : (x, d) + (c, F' approximated by multi-layer perceptron (MLP) which takes a 3D location x g& and a unit-norm viewing direction d E R as inputs, and outputs an emitted RGB color с E [0, 1]3 and a volume density R+. The volumetric radiance field can then be rendered into a 2D image from specific viewpoint by computing the color of every pixel using volume rendering. Let r(t) denote the camera ray emitted from the camera center o through given pixel on the image plane. The color of this pixel can be approximated by
+ td
N
i-1 (()) -0)
((r) = Σ T(L) a(T(()))))) . 6.) c(li), where T(L) = exp
Σ
(I)
where a set of quadrature points [4:],1 is randomly selected by stratified sampling, c(4)) and 7 ((4)) are the color and density at ((.)),((()) = exp(p=2) (x). and 6; = 4,+1 4, the distance between two adjacent points.
3

---

3D Object
2D Image
Camera
Camera
Rendering
y
Camera
Rotation
Translation
Figure 2: A demonstration of viewpoint changes. The camera is first rotated by (v,0, Φ) angles about the z-y/-X axes and then translated by (Az, Ag, A2). Given the new camera pose, a 2D image is rendered by NeRF and then fed to the target model for optimizing the viewpoint parameters.
To train the volumetric radiance field network F, NeRF minimizes the total squared error between the rendered and true pixel values given a set of images with known camera poses. NeRF also adopts the positional encoding and hierarchical volume sampling strategies improve its performance. The network F can leverage the multiview consistency among the calibrated images to implicitly capture the 3D nature of the underlying object, enabling it to render photorealistic novel views.
3.2 Problem formulation
Given a trained NeRF with the fixed parameters, ViewFool then estimates the adversarial viewpoints such that the rendered images can mislead a target visual recognition model f. As shown in Fig. for a pre-defined coordinate system ryz and the initialized camera pose, we first apply 3D rotations to the camera about the z-y'-X axes in sequence by the Tait-Bryan angles (tb, 0, Φ), which are also known as yaw, pitch, and roll. We then translate the camera position by (Az, Ay, A.) along the three axes. We let v == [ 0, Φ, As, Ay. A2] E R66 denote the transformation parameters of the camera. v is bounded in [Vmin: Vmaz] to make the captured images recognizable by humans. The setting of v Vmin and V maz will be specified in Sec. 4. Given the new camera pose, we can render a 2DD image based on NeRF Note that the rendered image is only determined by the viewpoint parameters v, thus we denote it as I == R(v), where R. is the differentiable rendering process as introduced in Sec. 3.1.
Instead of searching for single adversarial viewpoint, ViewFool captures diverse set of adversarial viewpoints using a distribution p(v) vvv. By optimizing the distribution p(v) (under proper parameteriza- tion), any viewpoint drawn from it is likely to fool the model. Therefore, we formulate ViewFool as solving the following optimization problem:
max p(v)
[ + + H(p(v))
(2)
where / is an image classification model, y is the ground-truth label of the object, Ls the classification loss (c.g.. cross-entropy loss), H(p(v)) -B(v) [log p(v)] is the entropy of the distribution p(v). and A is a balancing hyperparameter between the two loss terms. The entropic regularization is used to avoid the degeneration problem [1]]. i.c.. maxp(v) Ep [[(()) y)1 I max, ((f(R(v)), v). indicating that without the entropic regularization, the optimal distribution would degenerate into Dirac one and cannot capture heterogeneous adversarial viewpoints. Therefore, ViewFool adopts the entropic regularization to address this issue with the following merits.
First, ViewFool can explore the space of adversarial viewpoints by learning the underlying distribution, which could help us better understand model vulnerabilities. Second, as it is hard to precisely control the real camera pose, learning wider range of adversarial viewpoints can be more resistant camera fluctuations, enabling to consistently mislead the target model in the physical world. Third, although NeRF shows promise for synthesizing photorealistic novel views of complex objects, there still a gap between the real object and its neural representation, making the rendered images somewhat different from the real captured images. As a result, the adversarial viewpoint generated based on NeRF may not fool the model given the real object due to the appearance difference (which can be understood as a kind of adversarial noise introduced in NeRF rendering). ViewFool eliminates this issue by optimizing a continuous distribution of ad adversarial viewpoints because it is unlikely that the appearance difference can consistently fool the model under a variety of viewpoints if not optimized to do so [3]. Fourth, the entropic regularizer can help to avoid dropping into poor local optimal of the optimization problem to alleviate overfitting [10], leading to better cross-model transferability of the adversarial viewpoints. These benefits of ViewFool are validated by extensive experiments in Sec. 4.

---

3.3 Optimization algorithm
In ViewFool, we parameterize the distribution of adversarial viewpoints with trainable parameters. To define the distribution p(v) whose support is contained in [Vmin Vmazl we take the transformation of random variable approach as
v a tanh(u) + b, where u ((,,o'D) a Vmar
Vmin
mar + V Yini
(3)
2 where u follows a diagonal Gaussian distribution with mean μ E E and standard deviation o e IR and v is obtained by transforming u via tanh with proper normalization. Note that we utilize the diagonal Gaussian distribution this paper for the sake of simplicity. Although the true distribution of adversarial viewpoints may not be Gaussian or unimodal, we could apply our method multiple times with different initializations or adopt mixture distributions. Our method is generally compatible with more expressive distributions, e.g.. multiplicative normalizing flows [37] or diffusion probabilistic models [52], which we leave future work. Given Eq. (3), problem (2) becomes
max (u (R tanh(u) + b)), 3) A log p(a tanh(u) + b)], nio
(4)
where the second term is the negative log density, whose expectation is the entropy H(p(v)).
To solve problem (4), we need calculate the gradients of the loss w.r.t the distribution parameters
(n, or. A common method to back-propage the gradients from random samples to the distribution parameters is the low-variance reparameterization trick [8, 29]. In particular, we reparameterize by fe + aec, where c is an auxiliary random variable following the standard Gaussian distribution N(O, I). In principle, with the reparameterization, the gradients of the objective function Eq. (4) w.r.t. f and can be calculated, since the NeRF rendering process R. is naturally differentiable. However, we need to render the whole image of all pixels simultaneously, which requires a significant amount of GPU memory with a high image resolution. For example, it consumes more than 300G GPU memory for rendering a 400 x 400 image with N = 128 quadrature points each ray, making impractical to directly calculate the gradients through the rendering process R.
To address this problem, we adopt the search gradients to update the distribution parameters motivated by natural evolution strategies (NES) [60]. The gradients of the first loss in Eq. (4) can be derived as
V Vu N (R(( tanh(u) + b)). v)]
(5)
(N(uu (Ra(( - tanh(u) + b)). Vp. log (u; J4, o'T)]-
Note that the gradients derived in Eq. (5) can be estimated with only forward propagation through the rendering process R and the classifier f, such that we do not need to render all pixels at the same time to reduce the memory usage. Moreover, it enables our method operate in black-box manner with only query access to the model. In practice, we adapt the plain search gradients by natural gradients to stabilize the optimization process [60].
For the second loss (i.e., entropy) in Eq. (4), we still adopt the reparameterization trick to analytically calculate its gradients reduce the variance. Overall, the gradients of the objective function in Eq. (4) w.r.t. μ and o can be derived (in Appendix A) as
Fu = E (R( tanh(u + σEe + b)), v) oe X 2 tanh( + ae)]
(6)
V. E C( tanh( or) + b)), v) o -
1 2 tanh + σe)
ooe
In practice, we approximate the expectation in gradient calculation by l: Monte Carlo (MC) samples. We perform multi-step gradient ascent to update the distribution parameters (μ, σr) until convergence.
4 Experiments
We consider visual recognition models on ImageNet [45] in the experiments. To make the evaluation results fairer and more reproducible, we first conduct experiments on synthetic 3D object models in Sec. 4.1. We then study several aspects of ViewFool in Sec. 4.2. We present the experimental results of ViewFool on real-world 3D objects in Sec. 4.3. Finally, we introduce a new OOD dataset called ImageNet-V to benchmark viewpoint robustness. We provide evaluation results on 40 image classifiers with different architectures, training objective functions, and data augmentation strategies in Sec. 4.4. More results are provided in Appendix C. The code to reproduce the experimental results is publicly available at https:// /tle:///iiie github...... Coom/Hetthhlife saku/ www./aieaauaoooooo /Vineelol...
5

---

Table The attack success rates of ViewFool on ResNet-50 and ViT-B/16. We consider viewpoint changes with camera translations only, camera rotations only, and the composition of camera transla- tions and rotations. We present the attack success rates given the rendered images from the optimal distribution of adversarial viewpoints-Rig (v)), the rendered image from the optimal adversarial viewpoint-RRe (v(v") and the real image from the optimal adversarial viewpoint (va)
ResNet-50
VIT-B/16
Method
R(p"(v))
R(v') Real(v")
R()"(v))
R(v") Real(v")
Random Search
38.08%
26.01%
Translation
ViewFool 0)
54.27%
60% 67% %
44%
46.30%
55%
31% 32 %
ViewFool (A = 0.01)
55.24%
46%
43.10%
59% %
Random Search
51.68%
45.60%
Rotation
ViewFool (A = 0)
89.62% %
94%
84%
83.07 %
87%
78%
ViewFool (A 0.01)
84.25%
96%
92%
79.25%
91 %
85 %
Random Search
53.98%
47.52%
Translation
ViewFool (A 0)
92.01 %
96%
87%
85.02%
91 1
77%
+ Rotation
ViewFool (A 0.01)
88.79%
98 %
91 %
82.14%
92%
88 %
4.1 Performance on synthetic 3D objects
Experimental settings. We collect 100 3D models of rigid objects from BlenderKit belonging to the 1000 ImageNet classes to form our dataset. We do not adopt public datasets such ShapeNet [9]
due to the lack of realistic textures. More details about our dataset (including license, visualization) provided in Appendix B. We provide the experiments on the more realistic Objectron dataset [1] in Appendix C.7. Following [41], we train NeRF model for each 3D object using 100 images from varying viewpoints sampled on the upper hemisphere. We consider two image classification models, including the CNN-based ResNet-50 [21] and the Transformer -based ViT-B/16 [12]. They achieve 80.72% and 79.28% Top-1 accuracy on the naturally sampled images for training NeRF. In ViewFool, we initialize the camera at [0, 4, 0) as shown in Fig. 2. We set the range of rotation angles [-300, 30%] Φ [20", 1.00). and the range of translation distances as A, E 0.5, 0.5], A, E 1-. A, E 0..5, 0.5]. We study viewpoint robustness of these models to camera translations only (with the fixed rotation angles [vs 0, 6] = [0%,0% 0%, 65%),, camera rotations only (with the fixed translation [Az, Ag, A.J [0, O, OJ) and the composition of camera rotations and translations. We also study different ranges of rotation angles adversarial 2D transformations in Appendix C.6. We set A 0.01 in the experiments and conduct an ablation study on À in Sec. 4.2. We approximate the gradients in Eq. (6) with & = 50 MC samples and adopt the Adam optimizer [28] to update the distribution parameters (H, σr) for 100 iterations.
as 1 180 180%).
Appendix C.5 and compare to
Evaluation metrics. After obtaining the optimal parameters (p²" rr)), we have the optimal distribu- tion of adversarial viewpoints p" (v) as well as the mean of the distribution v* with a and b defined in Eq. (3). v can be understood as the optimal adversarial viewpoint. We first measure the attack success rate (i.e., misclassification rate) of the classifier given the rendered image R(v*) by NeRF. We also calculate the attack success rate given the real image taken at the adversarial viewpoint v (denoted as Real(v" (v")) for comparison. Moreover, to evaluate the performance of the learned distribution of adversarial viewpoints, we measure the attack success rate given the rendered images from 100 viewpoints sampled from p² (v). denoted as R(p" (v)). All those attack success rates are averaged over all 100 objects in our dataset.
ttah(("") + b
Experimental results. Table 1 shows the experimental results, where we compare ViewFool using 0.01 with two baselines, including ViewFool without the entropic regularizer (i.e., À = 0) and the random search method. For random search, we only report the results for R(p" (v)) evaluated by 100 random viewpoints per object since there is no optimal viewpoint v*. We have the following findings based on the results.
(1) ViewFool with the entropic regularizer achieves higher attack success rates given the rendered and the real image-Real( Real(v") from the optimal viewpoint v" than that with À 0.
hhttps://www blenderkit.com

---

Real Image from Naturaal Vieapoint
Graany
Warpianc: 94.475
Light: 99.91%
Signr
Rondered Image from Advessar aariria Viepponn
Spatall::
Redl Image from Alversarial Vimpoint
31.8%%
Mortacboard: 96.48% Folding
Sign:
Figure 3: Visualization of the adversarial viewpoints generated by ViewFool against ResNet-55., The
first row shows the real images taken from natural viewpoints that can be correctly classified. The second and third rows show the rendered images and the real images from adversarial viewpoints v*.
because the entropic regularizer enables sufficiently explore the space of adversarial viewpoints and converge to better local optima.
(2) The performance gap between R(v") and Real(v") is smaller when using À 0.01 in most cases, indicating that ViewFool can better mitigate the reality gap between the rendered images and the real images. Thus, the generated adversarial viewpoints
consistently mislead the classifier.
(3) Using the entropic regularizer can result in lower attack success rates of Rpp" (v)), which is mainly because that the learned distributions with À = 0 are more concentrated and cannot capture diverse adversarial viewpoints, as further verified in Table 2.
(4) We can see that optimizing the translation and rotation parameters simultaneously can lead to better performance than optimizing each of them alone. Thus, we consider the composition of camera translations and rotations in the following experiments.
(5) ViT-B/16 is more resistant to viewpoint changes than ResNet-50, showing the superiority of the transformer architecture, which is further validated with more architectures in Sec. 4.4.
Visualization. Fig. 3 shows the visualization results of the adversarial viewpoints v* generated by ViewFool against ResNet-50. can be seen that the real images taken from the natural viewpoints can be correctly classified by the model. By changing the viewpoints to v", the rendered images and the real images are misclassified by the model incorrect classes, while those images are still natural and recognizable for humans. In most cases, the model misclassifies the rendered image and the real image to the same class, although they appear differently in some details. However, there are some counter-examples that the rendered image and the real image are misclassified to different classes (see the second last column), or the real image is not misclassified (see the last column).
4.2 Additional results and ablation studies
The effects of We adopt ResNet-50 as the target and consider X 0.0001, 0.001, 0.01, 0.1, and 1.0, respectively. For each value of X, we optimize the distribution of adversarial viewpoints by solving Eq. (4) for each object in our dataset. We measure the attack success rates given the rendered images from the optimal adversarial viewpoint R(v") and the optimal distribution R(pp" (v)). To measure the diversity of the adversarial viewpoints, we further calculate the standard deviation of viewpoint parameters (sb, 0, o. A.. Ay. A.]. The results are shown in Table 2. On one hand, we can observe that the standard deviation of every parameter increases along with which reasonable since we emphasize more the entropic regularizer with larger X. On the other hand, as the distribution tends to cover larger region of adversarial viewpoints, inevitably contains unsuccessful viewpoints, leading to reduction of attack success rate given Rvp"(v)) However, it does not affect

---

Table The attack success rates and standard deviation of the each viewpoint parameter given À
0, 0.0001, 0.001, 0.01, 0.1, and 1.0 in ViewFool. We choose ResNet- 50 as the target model.
Attack Success Rate (v)"(v))
Standard Deviation
R(v")
%
A
Ay y
A
À O
92.01%
96%
4.554
1.681
2.474
0.031
0.064
0,029
À = 0.0001
90.69%
97%
6.797
2.130
3,385
0.040
0.077
0,037
À 0.001
90.63%
98%
15.718
3.366"
6.607
0.062
0.097
0.060
A 0.01
88.79%
98%
21.644
3,397
7.485
0.065
0.099
0.060
0.1
88.85%
98%
22.179
3.552
8.006
0.066
0.113
0.063
A 1.0
77.00%
92%
23.937
4.193
9.209
0.071
0.141
0.069
Table 3: The cross-model transferability of the adversarial viewpoints against VGG-16, Inception- v3 (Inc-v3), Inception-ResNettv2 (IncRes-v2), DenseNet-121 (DN-121), EfficientNet-BO0 (EN-BO), MobileNet-v2 (MN-v2), DeiT-B, Swin-B, and Mixer-B. B. The adversarial viewpoints are sampled from the distribution learned by ViewFool with À 0 and À 0.01 against ResNet-50 and ViT-B/16.
ViewFool VGG-16
Inc-v3
IncRes-v2 DN-121 EN-BO MN-v2 DeiT-B Swin-B Mixer-B
À = 0 À = 0.01
85.00%
75.94%
80.59%
73.97%
76.73%
76.77%
87.07% 69.35% 59.62% 90.37% %
65.22%
55.81%
ResNet-50
86.52%
82.00 %
82.00%
79.07%
82.62%
79.11% %
À = 0
82.35%
76. 18%
76.62%
74.62%
77.06%
72.14%
69.34%
60.50%
87.80% 59.01% 85.72%
VIT-B/16
À 0.01
82.83% %
78.73%
79.07%
77.45%
74.92%
73.97% %
69.45% %
the attack success rate given the rendered image R(v*) from the optimal viewpoint. As we discussed above, using an appropriate À >> O can achieve a higher attack success rate given R(v*).
Cross-model transferability. We then study the transfcrability of the generated adversarial view- points across different models. Specifically, we adopt 6 CNN-based models including VGG-16 [49], Inception-v3 [54], Inception-ResNet-222 [55], DenseNet- 121 [26), EfficcentNNe--Bl [56], MobileNet- v2 [47], 2 Transformer- based models including DeiT-B [59]. Swin-B [35], and I MLP-based model MLP-Mixer [57]. We test the attack success rates of the adversarial viewpoints sampled from the optimal distribution p" (v) learned by ViewFool with X = 0 and = 0.01 against ResNet-50 and ViT-B/16. We present the results Table The adversarial viewpoints have very high attack success rates against the black-box classifiers with different architectures, showing that the vulnerability of visual recognition models viewpoint changes is prevalent and intrinsic among these models. Besides, using À = 0.01 can achieve better tross-model transferability, since the entropic regularizer can avoid the overfitting problem [10] by escaping from poor local maxima of the optimization landscape.
Resistance to camera fluctuations. In the physical-worke ex- periments, we cannot control the real camera pose to precisely match the adversarial viewpoints v", thus it is important to ensure the resistance of the adversarial viewpoints to camera fluctuations. We simulate the physical-wordh experiments by changing the viewpoints within a percentage of camera fluctu- ations. Given a certain percentage r%, we uniformly sample 20 random viewpoints from [v* (Vmoz V Vmin) r%, v" + (Vmaz Vminn) 7%] and test the attack success rates given the rendered images. Fig. 4 shows the curves of attack success rates of ViewFool against ResNet-50 with the percentage of fluctu- ations ranging from 1% to 10%. The results indicate that using 0.01 can lead to better resistance camera fluctuations that may be encountered in the physical world.
Attack Succes Rate
80
9%
Figure 4: The curves of attack suc- cess rates of ViewFool given = 0 and À 0.01 w.r.t. fluctuations.
4.3 Performance on real-world 3D objects
In this section, we conduct two sets of real-world experiments to evaluate the performance of our method. The first set of experiments involves 8 real-world objects, including 2 warplanes, 1 pincapple,
8

---

Image from Natural Viewpoint
Rendered Imsage Adversarial Viewpoint
Real Image from Adversorial Viewpoint
School Bos 64.76%
Harmanica: 90.7%
Harmonica: 68.2%
Harmosiea: 51.1%%
Harmanira: 90.7%
4M00%
Pincapple:
Keyboard: 63.89%
Crosward: 47.8%%
Crosword: 52.95%
Crosword: 45.7%%
Crosward:: 46.44%
Space llar: 69.48%
Warplane: 60.55%
Plawhedd: 3682%
Chime:: 31,28%
Mower: 24.1%
Mower: 29.59%
Go-kart: 11.6%
Figure 5: Visualization of real-world objects given different viewpoints. The first column shows the real images from natural viewpoints. The second column shows the rendered images from adversarial viewpoints. The 3-7 columns show the real images taken to approximate the adversarial viewpoints.
Table 4: The attack success rates of ViewFool in the physical world.
Warplane #1
Warplane #2
Pineapple
School Bus
Keyboard
Shoe
Orange
French Loaf
100%
81%
95%
100%
100%
100%
0%
99%
1 school bus, keyboard, 1 shoe, orange, and French loaf. We train NeRF model for each object given 100 captured images of resolution 1600 x 900 using a handheld cellphone. We place white paper underneath the object simplify the background for NeRF training. We COLMAP [48] to estimate the camera parameters of each image. After training NeRF, we adopt ViewFool with 0.01 to optimize the distribution of adversarial viewpoints. The rendered images are resized and cropped to match the input size of the target model. We choose ResNet-50 and adopt the same hyperparameterss as the previous experiments.
After obtaining the optimal adversarial viewpoint v* for each object, we aim to take photos in the physical world to approximate v", shown in Fig. 5. Since cannot precisely match the adversarial viewpoint v", we take a video for each object around v". We then extract 100 frames from the video calculate the attack success in the physical world. The results shown in Table 4. ViewFool can successfully mislead the target model on out the 8 objects, showing the effectiveness.
For the second set of experiments, we further consider another 4 objects, including two indoor objects (chair and keyboard) and two outdoor objects (street sign and traffic light). this experiment, we do not place white paper underneath the object be more realistic in the wild. We adopt the same experimental settings. Fig. and Fig. C.4 Appendix C.8 show the visualization results. ViewFool successfully generates adversarial viewpoints for all these objects in the real world.
4.4 ImageNet-V benchmark
In this section, we introduce the ImageNet-V dataset for viewpoint robustness evaluation of image classifiers. Specifically, render 100 images per object from varying viewpoints, which are sampled from the distribution p" p"(v) optimized by ViewFool with À = 0.01. We choose ResNet-50 as the target model since it leads better cross-model transferability than ViT-B/16, shown in Table 3. Therefore, ImageNet- V consists 10000 images of 100 different objects. Note that the background of all I images is white. This is conducive evaluating viewpoint robustness solely.
We evaluate the performance of image classifiers with different network architectures (including VGG [49], ResNet [21], Inception [54, 55], DenseNet [26]. EfficientNet [56], MobilcNet-v2 [47],

---

ImaageNet-V Accuracy
Natural Accuracy
10%
1075
48%
41%
20%
21%
TGL
Figure 6: The classification accuracy of 40 image classifiers on images from natural viewpoints (left) and on ImageNet-V V (right).
VIT [12], DeiT [59], Swin Transformer [35], and MLP Mixer [57]), objective functions (including adversarial training [46] and self-supervised MAE [22], and data augmentation strategies (including AugMix [24] and DugmAngment [25]).
Fig. shows the classification accuracy of these models on ImageNet-V V. For comparison, we also evaluate their performance on 10000 images (100 per object) from natural viewpoints. Most classifiers achieve 70% ~ 80% accuracy on natural images, while none of them exceed 50% accuracy on ImageNet- V, demonstrating that they are vulnerable to viewpoint changes. Among them, transformer- based models achieve the best performance (e.g.. Swin-L. obtains 47.40% accuracy and MAE with ViT-H obtains 49.85% accuracy), showing the superiority of the transformer architectures on OOD generalization [4, 6, 42]. Besides, a larger model size within the same architecture family tends to perform better. Adversarial training and data augmentation techniques, which show promise for adversarial and corruption robustness, do not obtain good results on ImageNet-V, demonstrating that ImageNet-V V performance may not be correlated with that on other OOD robustness benchmarks.
Conclusion
This paper proposes ViewFool to generate adversarial viewpoints against image classification models. ViewFool adopts NeRF to represent real-world 3D objects and learns a distribution of adversarial viewpoints under an entropic regularizer for each object. Extensive experiments demonstrate the effectiveness of ViewFool and also reveal the vulnerability of common image classifiers to viewpoint changes. We successfully generated adversarial viewpoints for real-world 3D objects. Moreover, we established ImageNet-V V for viewpoint robustness evaluation of any classifier. Besides evaluating viewpoint robustness, ViewFool has the possibility to be used as an effective data augmentation strategy to improve viewpoint robustness. A potential negative societal impact of ViewFool is that it could be used by malicious adversaries to cause security/safety issues in real- real-world applications.
Limitations: As an initial attempt for viewpoint robustness, this work also has several limitations. First, this work adopts smaller dataset of 100 synthetic 3D objects for evaluation, which may be biased over all 1000 ImageNet classes, as elaborated in Appendix B. Second, our method requires high computational cost for NeRF training and optimizing adversarial viewpoints. as discussed in Appendix C.I. Third, this work only focuses on generating adversarial viewpoints (i.c., attacks) but does not propose a defense algorithm, which remains an open problem. We will address these limitations in the following work.
Acknowledgement
This work was supported by the National Key Research and Development Program of China (No. (017YFA0700904). NSFC Projects (Nos. 04132000422, 62061 136001, 62076145, 62076147, U19B2034, U181 1461, U19A2081, 61972224), Beijing NSF Project (No. JQ19016), BNRist (BNR2022RC01006 Tsinghua Institute for Guo Qiang, and the High Performance Computing Center, Tsinghua University. Y. Dong was also supported by the China National Postdoctoral Program for Innovative Talents and Shuimu Tsinghua Scholar Program. J. Zhu was also supported by the XPlorer Prize.
10

---

References
[1] Adel Ahmadyan. Liangkai Zhang, Artsiom Ablavatski, Jianing Wei, and Matthias Grundmann. Objectron: A large scale dataset of object-centric videos in the wild with pose annotations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7822 7831, 2021.
[2] Michael A Alcom, Qi Li, Zhitao Gong, Chengfei Wang, Long Mai, Wei-Shinn Ku, and Anh Nguyen. Strike (with) a pose: Neural networks are easily fooled by strange poses of familiar objects. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 4845 4854, 2019.
[3] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In International Conference on Machine Learning (ICML), pages 284-293, 2018.
[4] Yutong Bai, Jieru Mei, Alan L Yuille, and Cihang Xie. Are transformers more robust than cnns? In Advances in Neural Information Processing Systems (NeurIPS), pages 26831-26843, 2021.
[5] Andrei Barbu, David Mayo, Julian Alverio, William Luo, Christopher Wang, Dan Gutfreund, Josh Tenenbaum, and Boris Katz. Objectnet: A large-scale bias-controlled dataset for pushing the limits of object recognition models. In Advances in Neural Information Processing Systems (NeurIPS), pages
2019.
[6] Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and Andreas Veit. Understanding robustness of transformers for image classification. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), pages 10231-10244 2021.
[7] Irving Biederman. Psychological review, 94(2):115, 1987.
a theory of human image understanding.
[8] Charles Blundell, Julien Corneiise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural networks. In International Conference on Machine Learning (ICML), pages 1613- 1622, 2015.
[9] Angel X Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song. Hao Su, et al. Shapenet: An information -ich 3d model repository. arXiv preprint
2015.
[10] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 9185-9193, 2018
[11] Yinpeng Dong, Zhijie Deng, Tianyu Pang, Jun Zhu, and Hang Su. Adversarial distributional training for robust deep learning. In Advances in Neural Information Processing Systems (NeurlPS), pages 8270-8283, 2020.
[12] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR), 2021.
[13] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry. Exploring the landscape of spatial robustness. In International Conference on Machine Learning (ICML), pages 1802-1811. 2019.
[14) SM Ali Eslami, Danilo Jimenez Rezende, Frederic Besse, Fabio Viola, Ari S Morcos, Marta Garnelo, Avraham Ruderman, Andrei A Rusu, Ivo Danihelka, Karol Gregor, et al. Neural scene representation and rendering. Science, 1204
2018.
[15] Stephan J Garbin, Marek Kowalski, Matthew Johnson, Jamie Shotton, and Julien Valentin, Fast- nerf: High-fidelity neural rendering at 200fps. Proceedings of the IEEF/VVF International Conference Computer Vision (ICCV), pages 14346-14355, 2021.

---

[16] Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A Wichmann. Generalisation humans and deep neural networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 7549-7561, 2018.
[17] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations (ICLR), 2019.
[18] Robert Geirhos, Kantharaju Narayanappa, Benjamin Mitzkus, Tizian Thieringer, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Partial success in closing the gap between human and machine vision. In Advances in Neural Information Processing Systems (NeurIPS), pages 23885-23899, 2021.
[19] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In International Conference on Learning Representations (ICLR), 2015.
[20] Steven J Gortler, Radek Grzeszczuk, Richard Szeliski, and Michael F Cohen. The lumigraph. In Proceedings of the 23rd Annual Conference on Computer Graphics and Interactive Techniques (SIGGRAPH), pages 43-54, 1996.
[21] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[22] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16000-16009, 2022.
[23] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference Learning Representations (ICLR), 2019.
[24] Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. In International Conference on Learning Representations (ICLR), 2020.
[25] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robustness: critical analysis of out- out-o--distribution generalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 8340-8344 2021.
[26] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4700-4708, 2017.
[27] Can Kanbak, Seyed-Mohser -ezzsvi- and Pascal Frossard. Geometric robustness of deep networks: analysis and improvement. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4441-4449, 2018.
[28] Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In International Conference Learning Representations (ICLR), 2015.
[29] Diederik P Kingma and Max Welling, Auto-encoding variational bayes. In International Conference on Learning Representations (ICLR), 2014.
[30] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Representations (ICLR) Workshops, 2017.
[31] Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. Advances in Neural Information Processing Systems (NeurlPS), pages 10408-10415 2019.
[32] Marc Levoy and Pat Hanrahan. Light field rendering. In Proceedings of the 23rd Annual Conference on Computer Graphics and Inteructive Techniques (SIGGRAPH), pages 31-42. 1996.
12

---

[33] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1778-1787, 2018.
[34] Lingjie Liu, Jiatao Gu, Kyaw Zaw Lin, Tat-Seng Chua, and Christian Theobalt. Neural sparse voxel fields. In Advances in Neural Information Processing Systems (NeurIPS), pages 15651- 15663, 2020.
[35] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 10012-10022. 2021.
[36] Stephen Lombardi, Tomas Simon, Jason Saragih, Gabriel Schwartz, Andreas Lehrmann, and Yaser Sheikh. Neural volumes: learning dynamic renderable volumes from images. ACM Transactions on Graphics (TOG), 38(4):1-14, 2019.
[37] Christos Louizos and Max Welling, Multiplicative normalizing flows for variational bayesian neural networks. In International Conference on Machine Learning (ICML), pages 2218-2227, 2017.
[38] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In International Conference on Learning Representations (ICLR). 2018.
[39] Ricardo Martin- Bautila Noha Radwan, Mehdi SM Sajjadi, Jonathan T Barron, Alexey Dosovit- skiy, and Daniel Duckworth. Nerf in the wild: Neural radiance fields for unconstrained photo collections. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pages 7210-7219, 2021.
[40] Lars Mescheder, Michael Oechsle, Michael Niemeyer, Sebastian Nowozin, and Andreas Geiger. Occupancy networks: Learning 3d reconstruction in function space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4460-4470, 2019.
[41] Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view synthesis. In European Conference on Computer Vision (ECCV), pages 405-421, 2020.
[42] Muhammad Muzammal Naseer, Kanchana Ranasinghe, Salman H Khan, Munawar Hayat, Fahad Shahbaz. Khan, and Ming-Hsuan Yang. Intriguing properties of vision transformers. In Advances in Neural Information Processing Systems (NeurIPS), pages 23296-23308 2021.
[43] Jeong Joon Park, Peter Florence, Julian Straub, Richard Newcombe, and Steven Lovegrove. Deepsdf: Learning continuous signed distance functions for shape representation. In Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 165-174, 2019.
[44] Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International Conference on Machine Learning (ICML), pages 5389-5400. 2019.
[45] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, (15(3):211-253 2015.
[46] Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? In Advances in Neural Information Processing Systems (NeurIPS), pages 3533-3545, 2020.
[47] Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4510-4520, 2018.
13

---

[48] Johannes L Schonberger and Jan-Michael Frahm. Structure-frood motion revisited. In Pro- ceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). pages 4104 4104-4113, 2016.
[49] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations (ICLR), 2015.
[50] Vincent Sitzmann, Michael Zollhöfer, and Gordon Wetzstein. Scene representation networks: Continuous 3d-struccure-aware neural scene representations. In Advances in Neural Information Processing Systems (NeurIPS), pages 1121-1132, 2019.
[51] Vincent Sitzmann, Julien Martel, Alexander Bergman, David Lindell, and Gordon Wetzstein. Implicit neural representations with periodie activation functions. In Advances in Neural Information Processing Systems (NeurIPS), pages 7462-7473, 2020.
[52] Jascha vised learning using nonequilibrium thermodynamics. International Conference on Machine Learning (ICML), pages 2256-2265, 2015.
Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper-
[53] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014.
[54] Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2818 1826,82,, 2016.
[55] Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander A Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the Thirty-Fire AAAI Conference on Artificial Intelligence (AAAI), pages
2017.
[56] Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning (ICML), pages 6105 61 6114, 2019.
[57] Ilya O Tolstikhin, Neil Houlsby, Alexander Kolesnikov, Lucas Beyer, Xiaohua Zhai, Thomas Unterthiner. Jessica Yung. Andreas Steiner, Daniel Keysers. Jakob Uszkoreit, et al. Mip-mixer: An all-mlp architecture for vision. In Advances in Neural Information Processing Systems (NeurIPS), pages 24261-24272, 2021.
[58] A Torralba and AA Efros. Unbiased look at dataset bias. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1521-1528, 2011.
[59] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning (ICML), pages 10347-10357, 2021.
[60] Daan Wierstra, Tom Schaul, Tobias Glasmachers, Yi Sun, Jan Peters, and Jürgen Schmidhuber. Natural evolution strategies. Journal of Machine Learning Research, 15(1):949-980) 2014.
[61] Eric Wong, Frank Schmidt, and Zico Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. In International Conference on Machine Learning (ICML), pages 6808- 6817, 2019.
[62] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In International Conference Learning Representations (ICLR), 2018
[63] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoe V Le. Adver- sarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 319-828, 2020.
[64] Xiaohui Zeng, Chenxi Liu, Yu-Siang Wang, Weichao Qiu, Lingxi Xie, Yu-Wing Tai, Chi-Keung Tang, and Alan L Yuille. Adversarial attacks beyond the image space. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pages 4302 4311, 2019.
14

---

[65] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference Machine Learning (ICML), pages 7472-7482, 2019.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Sec. 5.
(c) Did you discuss any potential negative societal impacts of your work? [Yes] See Sec. 5.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [Yes] See Appendix A.
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main exper- imental results (either in the supplemental material as a URL)? [Yes] Our code is publicly available at https: / gi thub cwm/ Http/Hhtthhifff-tee Seaff-ssak//iieeeoo....
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [No] Since running ViewFool on all objects in our dataset is time-consuming, we only ran one time.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] See Appendix C.I.
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes] See Appendix B.
(c) Did you include any new assets either in the supplemental material or as a URL? [Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you're 're using/curating? [Yes] See Appendix B.
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [Yes] See Appendix B.
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you deseribe any potential participant risks, with links Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
15


Reviews:
[{"review_id": "oCAPjagtbO", "reviewer": "Reviewer_RtMV", "summary": "This paper studies the viewpoint robustness of trained visual recognition models. People have studied adversarial perturbations on 2D images for a long time, but not all of them are physically plausible. There were some previous efforts that tried to generate adversarial examples in the 3D physical space, but they used synthetic objects and rendering software. This paper proposes to replace these with NeRF, so that it becomes possible to conduct the same study on real-world objects. The authors conducted extensive experiments and demonstrated that trained visual recognition models can still be very vulnerable to simple viewpoint changes.\n\nPOST-REBUTTAL UPDATE:\n\nMake no mistake: I really like and enjoy the paper. However, I am also concerned by the fact that the authors used models trained on ImageNet in their experiments. The big domain gap makes the random attack also very effective, and it is harder to put the proposed approach in perspective. At the very least, I was hoping the authors could train a model on their dataset, and put that in addition to the ImageNet trained one they have been using. In light of this, I have decided to slightly decrease my score from 6 to 5, which is still a positive score.", "questions": "1. In Introduction (say around L39), the authors criticized that previous papers / methods rely on synthetic 3D object models, implying that they are different. However, other than the experiments in Section 4.3, a lot of experiments (say those in Section 4.1) are using BlenderKit, which is still 3D models. Therefore I feel that the writing ought to be improved, otherwise the difference w.r.t. previous papers / methods (say [61]) could be perceived as exaggerated / overrated.\n\n2. I am a bit concerned that the random search baseline in Table 1 also attack the model pretty successfully. By contrast, random search within the pixel RGB neighborhood on 2D images have a very low attack success rate. To me, this raises questions about the quality of the trained model. Maybe sampling 100 images per 3D object on the upper hemisphere is not enough. Maybe the training protocol is not well-tuned. My point is, if a model is full of weaknesses, then we were not going to deploy the model anyway, and the significance of studying its adversarial robustness becomes much smaller. Have you considered training a stronger model that cannot be easily attacked by random search? And is it possible to conduct the experiment on a state-of-the-art published and released checkpoint (so that the quality is guaranteed)?", "limitations": "The authors discussed some limitations in the Conclusion section, but I think they could be expanded. For example, the authors could have discussed whether or not the trained models are strong enough on these datasets newly proposed in this work. Another limitation worth discussing is that I feel the current work still largely fall into the \"synthetic 3D object\" category (e.g. white paper is added etc), and the NeRF-generated images here are still more like ShapeNet than ImageNet (or Block-NeRF for that matter).", "rating": 5, "confidence": 5, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- I believe the problem being studied is an important one. We need to understand how models trained on selective examples (views) generalize to the generic setting.\n- I especially like the experiments in Section 4.3, where the authors showed that it is possible to reproduce the adversarial viewpoints found by NeRF in the real world, and the attack can still be successful.\n- Experiments are very extensive, covering a lot of different axes (architecture, with or without pre-training, various datasets).\n\nWeaknesses:\n- I have some concerns regarding presentation and baseline. See the questions section below.\n\nOverall I think the originality, quality, clarity, significance of this paper are all above average.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "kADM5xUUxKf", "reviewer": "Reviewer_ne6h", "summary": "The authors propose to study viewpoint robustness of image classification models using 3D objects generated from different viewpoints. A new method to find adversarial viewpoints based on NeRF is proposed, and used to create a benchmark (ImageNet-V) for evaluating viewpoint robustness for image classification. The paper evaluates a set of image classifiers covering standard architectures on ImageNet-V, training objectives, and data augmentation strategies, which finding that it is a challenging dataset compared to using natural views only. ", "questions": "I listed some questions above in weaknesses. \n\nSome clarification questions:\n- How dependent are the adversarial viewpoint / classification results on the NeRF training? \n\n- In Figure 4, real-images taken from adversarial viewpoint, why is the lightning so different than the original (real from natural viewpoint)? \n\n- How are the models in BlenderKit generated? Are they real or synthesized objects?\n", "limitations": "Yes the authors included a discussion on limitations in Appendix C. \n\nHowever, I'm not familiar with Royalty Free licensing from BlenderKit (which this benchmark uses assets from) and whether images using these models can be used in a paper/as a benchmark. ", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n- To the best of my knowledge, generating adversarial viewpoints of real objects using NeRF is new. The advantages mentioned by the authors in lines 147 to 160 looks reasonable.\n\n- The authors perform fairly extensive evaluations on their proposed benchmark for evaluating viewpoint robustness (ImageNet-V), covering standard architectures, training objectives, and data augmentations.\n\n- The paper is well-written with clear figures.\n\nWeaknesses\n- Using only 100 objects for benchmarking seems to be on the smaller side to me - maybe the authors can discuss more on the limitations of potential bias in this dataset due to the smaller amount of objects? Seems from the Appendix that all models are from BlenderKit - how were the objects selected?\n\n- How does the 3D viewpoint change studied here compare to simple adversarial 2D transformations (rotation, scaling, cropping)? For example, the street-sign in Figure 2 looks simply rotated. The experiments would be stronger with some comparisons in this direction.\n\n- The results in Figure 5 is not really significant without Figure C3 (which is in Appendix). My understanding is that Figure C3 is the performance under natural viewpoints & Figure 5 is with viewpoint robustness - I recommend that the authors present the bars in C3 with Figure 5, otherwise it is difficult to know how much the performance of each model drops. \n\n- I feel the \"in the Wild\" phrase in the title is not really an accurate representation of this work - I would recommend that the authors reconsider this framing (perhaps \"Adversarial\" should be somewhere in the title instead). The benchmark consists of images from generated view points with a white background (ex: samples in Figure C2), which doesn't look \"in the wild\" - as a result, I'm not sure if this title is accurate. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["Legal Compliance (e.g., GDPR, copyright, terms of use)"]}, "extra_text": {}}, {"review_id": "Zef4ZbJh_Jm", "reviewer": "Reviewer_44qA", "summary": "The paper proposes a technique to generate adversarial viewpoints of multi-view objects for training image classification models. It uses Neural Rendering as an implicit representation to differentiably optimize the viewpoint parameters to synthesize adversarial images. It introduces an entropic regularizer for optimizing a parameterized distribution which leads to higher diversity of content. ", "questions": "1. The maximization function could lead to generation of highly skewed viewpoints. However, looking at the maximum likelihood estimates (v*), it doesn't seem to be the case. How do you constrain the viewpoints to remain within reasonable limits?\n\n2. The gap between the Real(v*) and Rendered(v*) is significant. Why is rendered(v*) always harder to classify than the real(v*). Is it because of some artifacts introduced by the rendering technique. Can you perform some ablation studies to explain this gap? \n\n3. It is not clear if the NeRF weights are updated during training. \nWhat is the effect on the NeRF renderer after the adversarial optimization is performed. \nA comparison between the baseline PSNR (that's given in the appendix) and post-optimization PSNR could be a useful datapoint to see if the NeRF degrades in fidelity.\n", "limitations": "The limitations given in the appendix reasonably capture the issues with the proposed dataset and the baseline NeRF model. The authors should ponder over the limitations of the proposed technique. Perhaps the questions raised in the previous two sections can help guide the authors to find more relevant points. ", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths: \n- The paper shows that Neural Rendering can be used as an implicit representation to create adversarial viewpoints for image classification. \n- A forward propagation technique based on Natural Evolution Strategies is proposed to bypass the expensive NeRF rendering process during optimization.\n\nWeaknesses:\n- The optimization problem is posed as an unbounded maximization function on classification loss and distribution entropy. It is not clear to me if it would work for general, real-world images where the model could diverge to nonsensical neural rendering.\n\n- The results are shown on simple images with white background. Even the real-world dataset used in the paper is not representative of actual image classification datasets such as ImageNet. It is not clear if the method would generalize to real-world images. Recent datasets such as CO3D or Objectron could be easily used to demonstrate the efficacy of the method.\n\n- The method presupposes availability of multi-view images of objects to train the underlying NeRF. It would not work for single shot images of objects. \n\n- Lacks comparison to other SoTA approaches for adversarial generation for training. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "SGZEQq_9YDO", "reviewer": "Reviewer_9ojy", "summary": "The submission proposes a novel task related to NeRF: finding adversarial viewpoints that mislead visual recognition models. When searching adversarial viewpoints, they find search viewpoint distribution rather than one discrete viewpoint and suggest a novel optimization algorithm that fits their objective.", "questions": "Is it critical to the performance to use other ranges of the rotation angles? If so, please report the ablation of that.", "limitations": "This paper is limited to background-free or simple background images, which has room for improvement to use more realistic and complicated datasets such as the dataset suggested by MipNeRF-360.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 2, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- It is the first work to tackle searching adversarial viewpoint on the NeRF-related methodologies.\n- They suggest several effective and reasonable methods, searching the viewpoints via distribution, reducing memory requirements for computing gradients based on NES, and adopting reparameterization tricks to reduce the variance for computing gradients.\n- The experiments are solid.\n- It also shows the resistance to camera fluctuations, demonstrating its effectiveness in real-world scenarios.\n\nWeaknesses:\n\n- Their experiments are limited to background-free or simple background images", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept