Benchmarking Robustness to Adversarial Image Obfuscations
Authors: Florian Stimberg
Ayan Chakrabarti
Chun-Ta Lu
Hussein Hazimeh
Otilia Stretcu
Wei Qiao
Yintao Liu
Merve Kaya
Cyrus Rashtchian
Ariel Fuxman
Mehmet Nejat Tek
Sven Gowal
Venue: NeurIPS 2023 Datasets and Benchmarks Poster (2023)
Keywords: obfuscation
benchmark
imagenet
adversarial
TL;DR: A benchmark simulating bad actors trying to circumvent image content filters by heavily obfuscating the images.

Abstract: Automated content filtering and moderation is an important tool that allows online platforms to build striving user communities that facilitate cooperation and prevent abuse. Unfortunately, resourceful actors try to bypass automated filters in a bid to post content that violate platform policies and codes of conduct. To reach this goal, these malicious actors may obfuscate policy violating images (e.g., overlay harmful images by carefully selected benign images or visual patterns) to prevent machine learning models from reaching the correct decision. In this paper, we invite researchers to tackle this specific issue and present a new image benchmark. This benchmark, based on ImageNet, simulates the type of obfuscations created by malicious actors. It goes beyond Image-Net-C and ImageNet-C-bar by proposing general, drastic, adversarial modifications that preserve the original content intent. It aims to tackle a more common adversarial threat than the one considered by lp-norm bounded adversaries. We evaluate 33 pretrained models on the benchmark and train models with different augmentations, architectures and training methods on subsets of the obfuscations to measure generalization. Our hope is that this benchmark will encourage researchers to test their models and methods and try to find new approaches that are more robust to these obfuscations.

Benchmarking Robustness to Adversarial Image Obfuscations
Florian Stimberg Google DeepMind
Ayan Chakrabarti Google Research
Chun-Ta Lu Google Research
Hussein Hazimeh Google Research
Otilia Stretcu Google Research
Wei Qiao Google Ads Safety
Yintao Liu Google Ads Safety
Merve Kaya Google Research
Cyrus Rashtchian Google Research
Ariel Fuxman Google Research
Mehmet Tek Google Ads Safety
Sven Gowal Google DeepMind
Abstract
Automated content filtering and moderation is an important tool that allows online platforms to build striving user communities that facilitate cooperation and prevent abuse. Unfortunately, resourceful actors try to bypass automated filters in a bid to post content that violate platform policies and codes of conduct. To reach this goal, these malicious actors may obfuscate policy violating images (e.g. overlay harmful images by carefully selected benign images or visual patterns) to prevent machine learning models from reaching the correct decision. In this paper, we invite researchers to tackle this specific issue and present a new image benchmark. This benchmark, based on IMAGENET, simulates the type obfuscations created by malicious actors. It goes beyond IMAGENET-C and IMAGENET-C by proposing general, drastic, adversarial modifications that preserve original content intent. It aims to tackle more common adversarial threat than the one considered by b norm bounded adversaries. We evaluate pretrained models on the benchmark and train models with different augmentations, architectures and training methods on subsets of the obfuscations to measure generalization. Our hope is that this benchmark will encourage researchers test their models and methods and try find new approaches that are more robust to these obfuscations.
1 Introduction
Advances in in computer vision have lead to classifiers that nearly match human performance in many applications. However, while the human visual system is remarkably versatile in extracting semantic meaning out of even degraded and heavily obfuscated images, today's visual classifiers significantly lag behind in emulating the same robustness, and often yield incorrect outputs in the presence of natural and adversarial degradations. This is why evaluating robustness [I] 2 and improving the robustness of visual classifiers has been the subject of considerable research
with multiple benchmarks looking at out of distribution examples [5] o) distribution shift [7.9 or focusing on robustness to "natural degradations". like blur and noise, which are inherent in the imaging process [10] [1]. However, with more and more visual classifiers being deployed in real systems, robustness to adversarial perturbations deliaiirr changes to an image introduced by an adversary to fool classifiers- has emerged as an important research direction 12
Such work adversarial robustness has largely focused perturbations that imperceptible to human observers-oftee cast as an explicit E, -n-rr constraint between the original and perturbed
37th Conference on Neural Information Processing Systems (NeurIPS 2023) Track on Datasets and Benchmarks.

---

image [3] However, for many visual classifiers that are focused on keeping offensive, dangerous, pirated, or other policy-violatinn content off of online platforms. this limited definition does not suffice. In the real world, attackers who want to hide malicious content in images are not prevented by the fact that an image appears obviously perturbed to human observers, as long as the observer is also able to glean the underlying violating content [16]. This scenario is not theoretical such malicious image manipulations are being used today by bad actors daily and at scale on modern online platforms [17
Our work focuses on enabling research into making visual classifiers robust such adversarial obfuscations- dbfuscations-image transformations that can fool classifiers while leaving the underlying semantic content intelligible to human observers, but differing from prior adversarial attacks [12] [5] in allowing it to be obvious that the image is transformed. To this end, we introduce a benchmark to characterize the performance of classifiers on obfuscated images.
Naturally, we do not claim this benchmark to be exhaustive, since the space of adversarial obfuscations limited only by the creativity of attackers and the resilience of the human visual system in inferring the underlying content despite significant manipulation. However, to provide a concrete starting point to make and measure progress in obfuscation robustness, we introduce set of 22 transforms, illustrated in fig. T that (a) are compositions of various transformations available in image editing software geometric and color transformations, image splicing and blending, style transfer, etc.; (b) are strong enough to fool most current classifiers while still leaving the underlying semantic content identifiable; and (c) are diverse enough to allow us to measure generalization of current and future robust training techniques, by measuring performance on obfuscations that are held out during training. Moreover, these transforms are similar to actual obfuscations that we have observed being used in the wild by attackers attempting to bypass Google's 's image policy classifiers.
Overall, our main contributions are as follows:
We create, curate and tune set of 22 strong, diverse, adversarial obfuscations. Compared to other benchmarks our obfuscations imitate methods by bad actors trying to fool content filter models and allowed drastically change the images. Our benchmark is set up to have training and hold-out obfuscations which allows to measure generalization to unknown obfuscations and monitor progress of leveraging known attacks.
We evaluate 38 different pretrained models on our benchmark and train additional models to compare the effects of different augmentation and 4 distribution shift algorithms. Our experiments show that scaling architectures, pretraining on larger datasets and choosing the right augmentations can make models more robust to unseen obfuscations.
We train models on over 60 subsets of our training obfuscations to show relationships between them, which of them have the biggest effect on generalization and that we get diminishing returns when adding obfuscations to the training set.
Finally, we show that training on our training obfuscations increases performance on all of IMAGENET variants and that fn-norm based adversarial training does not help robustness to our obfuscations.
We expect that our analysis, and particularly, this benchmark will stimulate research in the devel- opment of training techniques that make classifiers more robust to adversarial obfuscations. Such techniques promise to be of immediate practical value since they can be used by online platforms to strengthen their automated classification and detection models, thereby helping improve their users' online experience by keeping out unsafe and illegal content.
2 Related Work
Datasets of natural distribution shifts. Characterizing model failures and empirically estimating their consequences often requires collecting and annotating new datasets. Hendrycks et al. [6) collected datasets of natural adversarial examples (IMAGENET-A and IMAGENET-O) to evaluate how model performance degrades when inputs have limited spurious cues. Hendrycks et al. (9] collected real-world datasets (including IMAGENET-R and DEEPFASHION REMIXED) to understand how models behave under large distribution shifts such artistic renditions of various objects. Particular shortcomings can only be explored using synthetic datasets [18) Hendrycks and Dietterich [19]
introduced IMAGENET-CO C, a synthetic set of common corruptions.

---

Figure 1: Example images for obfuscations. From top left bottom right: Clean, IconOverlay, Textur- ize, Oveeevaatem LowContrass/Trinngess for examples of all obfuscations.
Composition. See section appendix A.1
Recently, proposed IMAGENET-C: in a bid to understand whether progress on IMAGENET-C truthful. They sample corruptions that are perceptually dissimilar from IMAGENET-C in feature space and observe that data augmentations may not generalize well.
Extending upon [19. Kar et al. 220] introduce corruptions that capture 3D information. They aim to guard against natural corruptions, such as camera rotation, camera focus change, motion blur.
All of the previously mentioned datasets either collect natural out-of-distribun variations that mimic natural corruptions that occur when capturing images. Our benchmark dataset goes beyond the realistic corruptions considered by above work and includes artificial cortuptions that adversaries could produce using common image editing software.
examples or create
Some examples of datasets that feature less natural transformations are Geirhos et al. 5 who study the propensity of Convolutional Neural Networks (CNNs) to over-emphasize texture cues, by evaluating such models on 4 types of obfuscations focused on texture and shape, as well as a dataset with texture-shape cue conflict. Xiao al. ا Sagawa al. 21 investigate whether models are biased towards background cues by compositing foreground objects with various background images (IMAGENET-9 WATERBIRDS). While these not necessarily try to simulate natural processes, they are focused mostly on understanding how models deal with changes in specific aspects of images.
---ormm adversarial robustness. In some cases, it is possible to discover failures via optimization or brute-force search. fy-norm adversarial attacks introduce small, imperceptible perturbations to input examples, with the aim of causing misclassification the literature assume white-box access (i.c., all model weights are available to the attacker) [2 22 28 another line of work considers the more practical black-box setting where the attacker has limited knowledge about the model [11. While there is a lot of merit in investigating white- or black-box adversarial robustness, most real world attacks machine learning models are not of this form 16 which is why our benchmark tries to include obfuscations that are or realistically could be used by attackers.
2 [2]. While the majority of the attacks in
Beyond lp robustness. Given the practical implications of l, robustness, there has been growing interest in studying broader threat models that allow for large, perceptible perturbations to images. Examples include robustness to spatial transformations [32 [3] and adversarial patches 3438 The majority of the work in this category considers local or simple transformations that retain most of original pixel content. Our benchmark considers wider range of transformations, including ones that cause significant visual changes but do not change the image label.
Benchmark
3.1 Dataset
We choose to base our benchmark the IMAGENET Large Scale Visual Recognition Challenge 2012 (ISVRC20122] dataset [39]. It has been established in the community as the main benchmark for image classification and there already exist several variations of that aim measure different aspects of robustness. This allows us to easily evaluate models trained on IMAGENET and its variants
For simplicity will refer it just "IMAGENET" for the remainder of the paper.
3

---

Colorfatternvverlay
LowContrestTraaggle
Perspectiveoompostion
worst case
incepiion V2
Bashet
Restet
kechet 10)
Senhat 12 151
treqpe Restel V
bills Nocle 5012
bis Se
5/55 Senteb--t22t
BIT.4 Restat S0x3
STM hocficc 252a4
Condinc-Tity
Connlaed Daee
Not/Neat Buse
Canuitie rpe-16
VTTS3
VI-42-
VIT515
MTB8
CUP R2
VTT 532
Accuracy
Accuracy
Accuracy
Accuracy
Figure 2: Accuracy on the hold-out obfuscations for multiple TensorFlow-Hus models trained on clean IMAGENET.
benchmark and vice versa We apply each obfuscation each image from the IMAGENET train and validation split. As the test split includes no labels, we use the validation split as our test set, similar IMAGENET-C [10] and use 10k images of the original training
validation set.
The fine grained 1000-class task of the original IMAGENET set makes hard to apply strong obfuscations as even for humans it is hard to, e.g., distinguish over 100 different breeds of dogs. To make the classification task easier, we use the super-classes introduced by [40]. They encompass 207 of the 1000 IMAGENET classes (see appendix A.7 for detailed listing). We only do this grouping at evaluation time, which allows us to compare models trained on the standard 1000-class IMAGENET scenario. As derived in the appendix of [40] calculate the probability of an image to be part a super-class by using the average probability of all member classes for each super class.
3.2 Obfuscations
Our benchmark includes 22 obfuscations in total: 19 training obfuscations and hold-out obfus- cations. These represent wide range of strong and varied manipulations covering, color changes, transformations, compositions, overlays, machine-learning based obfuscations and combinations of them. To create static benchmark, we do not include manipulations that require access the model prediction.
The obfuscations have number of hyperparameters, which each has allowed range that randomly draw from for each image. This makes the obfuscations more diverse and avoids overfitting. We tune these hyperparameter ranges manually get strong obfuscations, that still keep the label intact. For each obfuscation we did a grid search to find the parameters that get the worst accuracy on Big Transfer model [41) with underlying ResNet 152x4 pretrained IMAGENET-2 21 1K and fine-tuned on IMAGENET-IR We then checked visually that out of 50 example images, a maximum of 2 are not classifiable as the right super-class. If more of the labels were not recognisable checked parameters which resulted in higher accuracy until we found a fitting set. Next, we created the range of the possible parameters around this set to get variation in the applied obfuscation but also consistent performance.
Some of the obfuscations very scale dependent. As the original IMAGENET images of varying sizes, we do a central crop and resizing to 224 x 224 before applying the obfuscations. None of
"The dataset and code to evaluate models can be found at bittps://gtte thub. httptt/c.mmmmaaaaaaa///ggeg pittccattio__bechmarr

---

Inception ResNet Big Transfer
Worst Case Accuracy (Hold Out)
Vision Transformerr
ConvNext
50
CLIP
10a
107
107
GFLOPS
Number Parameters
Figure 3: Worst case accuracy on hold-out obfuscations over GFLOPs (left. log scale) and number of parameters (right, log scale) for the models taken from TensorFlow-Hub. We did include GFLOP numbers for the CLIP models as they are more than 1000x than the largest other models when doing 80 prompts for each the 1000 IMAGENET classes.
the obfuscations change the input size, therefore all our training and evaluation data is 224 X 224. To stay consistent, we also do this to the clean training data, which will reduce the accuracy of the models trained for this paper as random cropping now operates on a smaller pixel space and needs to upsample.
We group the obfuscations into categories: Color Changes, Transformations, Compositions, Overlays, Sicchine-Lerning, based Obfuscations and fig. [ shows the hold-out obfuscations and few examples of training obfuscations. For additional examples and a detailed description of each obfuscation, see appendix A.1 in the supplementary material.
When obfuscation uses other images overlay, merge stylize the original images, make sure that the chosen images do not introduce any objects which could be categorized into one of the 16 super-classes evaluate on.
We chose ColorPattenOOvellyy, LowConerssstrianglls and PerspectiveComposiioon as hold-out obfuscations because they cover multiple obfuscation categories (e.g. ColorPatternOverla being both and overlay and color change), they combine concepts from training obfuscations (Perspective- Composition being combination of PerspectiveTransfun the hardest obfuscations for multiple model families ConnrassTrriangles is the strongest for ResNet models, while PerspectiveCoopositie is the strongest for Bit, ConvNext and ViT models).
and PhotoComposition) and are among
3.3 Metric
Merging the classes into the 16 super-classes introduces a class imbalance the evaluation data. We counteract this by weighting the accuracy by the inverse of the number of images of that super-class, thereby giving each super-class equal contribution.
As described earlier, we have 3 hold-out obfuscations that cannot be used during training. The accuracy on these is our main metric. To simulate adversaries trying out multiple obfuscations, we worst-case basis, i.e., to correctly classify image, model has to
combine the obfuscations correctly classify it under all 3 hold-out obfuscations.
Since our super-classes are very unbalanced (see appendix A.7 calculating the average accuracy across all images would be mostly determined by a model's 's performance on few super-classes. As an example: Just one super-class (Dog) would account for more than half of the overall accuracy, i.e. a classifier who perfectly classifies dogs, but no other images, would get almost 53% accuracy, classifier that perfectly classifies dogs and birds even over 76%. Therefore when we calculate the overall accuracy, we weight each image by the inverse the super-class occurance, i.e. we average the per-class accuracy.
5

---

BEVE Nive-ionn 07E4 09
61.M
17.3%
15
54.6
18.%
1326
913N
65.5%
7.5%
BL.0
14.7%
7L0%
50.4
10.55
16.6
19.20
6..%
60.30
81/75
62-19
18.2%
830%
0135
15.55
M0.7%
CAUN
850%
02.25
BL0%
65.9%
B.
415%
curver Li--000
19.7%
10.5%
1425
9X1%
72.M
03P55
11.1%
BLMM
1475
712N
65.7%
840%
19.4
1L.
N.M
Figure 4: Top accuracy for the best models from the pretrained model collections.
Worst Case
ColorPatternOveriay
LowContrasTTiangles
PersppetiveCooposition
30-
60
n-
50
20
40-
accurcy
accuracy
accuracy
30:
10-
Aughix
Aurohugment
Randfugment
Erasing
Figure 5: Accuracy on hold-out obfuscations and worst case accuracy for models trained with different
augmentation schemes. All models ResNet50 trained only clean images. The augmentations used are color [42), AugMix [43. AutoAugment [4]. RandAugment [45], random erasing [46).
CutMix (47 and MixUp 48
In summary we calculate our final metric by these steps:
1. Load the IMAGENET 2012 validation dataset
2. Filter out all images that do not share a class label with our 16 super classes
3. Obfuscate each image with the hold-out obfuscations
4. For each obfuscated image evaluate the class probabilities for all 1000 IMAGENET classes
5. Calculate probabilities for each super class by averaging probabilities of all member classes
6. For each image check if the highest probability is for the correct super-class for all obfuscated version of that image
7. Calculate the final accuracy by averaging over all images weighted by the inverse of the super-class occurrence in the dataset
4 Experimental Results
We start our experiments by evaluating range of pretrained IMAGENET classification models to analyse the robustness of different architectures to the obfuscations, and the effect of scaling models and pretraining datasets. We then compare 7 data augmentation schemes, and in section 4.3 train models on different subsets of training obfuscations to see their contribution to generalizing to the hold-out obfuscations. We then look models trained on all training obfuscations, evaluate the effect of distribution shift algorithms, and at the end compare with results on other robustness benchmarks.
4.1 Evaluating Pretrained IMAGENET Models
All of the following models evaluated on training and hold-out obfuscations as is, without any fine-tuning. We evaluate models from four different collections on TensorFlow-Hutb Inception

---

CalorPattemOverray
LowCantrastTrangles
PerspecttieCompesston
worst case
Ozan
CighContruu cor
ImapsOvertl ay:
Intotccnt
Percnectian shcl
Phosscamsen Biccs
Try af rander
Teatbvect my
Todurta
26
Accuracy in
Accuracy
Accurady
Accuracy
Figure 6: Accuracy on hold-out obfuscations and worst case for models trained on clean images plus single obfuscations.
and ResNe Big Transfer 5 Vision Transforme and ConvNex 7 We also include several zero- shot models based on CLIP (54 with different image encoder architecture: To obtain the best performance possible for CLIP, we used the best text-prompt configuration reported by [54] for ImageNet, consisting of a combination of 80 curated prompts. The accuracy of all models on the hold-out obfuscations and the worst case accuracy for all the models is plotted in fig. 2 the ViT-B8 performs the best across all models, as does on the standard IMAGENET dataset. The results for the Big Transfer models show the gain in accuracy by pretraining on the IMAGENET-21 2 dataset (BiT-S models are trained on standard IMAGENET, i.e. ILSVRC2012, while BiT-M models, are pretrained on IMAGENET-21 KK). This can be seen in more detail in fig. C.2 in the appendix, where we see accuracy for each individual obfuscation for all BiT models.
We see that
The performance of zero-shot models exhibits an interesting behavior. On some obfuscations such as ColorPattenOverlay and LowContrastTraangles the performance of the zero-shot CLIP model is slightly worse than that of the equivalent trained model with the same vision tower. However, on Soopecciveeooposttiiin it actually performs better than the trained model. This behavior is probably due to the distribution of the pretraining data ClaributionnPPerpeeetiive CoaprettiveCmoostttiiii is a more "natural" looking type of obfuscation, which might have been present CLIP's pretraining dataset.
Figure 3 shows that when comparing models of the same type, scaling them up in terms of parameters or computation leads to increased robustness to the obfuscations. It also shows that ConvNext and ViT models outperform BiT and ResNet models. This might be due to their patchified stem that has been shown to be more robust to ly- -o-ormm adversarial attacks (55). Additionally, both ViT and ConvNext models are all pretrained on IMAGENET-21K In fig. we look at the results for the best model from each category over all obfuscations. While the largest vision transformer model outperforms all other models on the worst-case hold-out accuracy, it does not get the best performance across all obfuscations, e.g. the largest ConvNext model performs better on 8 of the obfuscations, in some cases by large margin (e.g. HighiCnntrastBrid by 8% and PhotoComposition by 8.7%). indicating that different architectures are more robust to different obfuscations.
4.2
Comparing Augmentation Methods
One way to make models robust to out of distribution data is to use general augmentation schemes. In fig. [5] we see that all augmentations help the worst case accuracy, but only CutMix [47] and MixUp 48 improve accuracy across all 3 hold-out obfuscations, with MixUp giving by far the strongest boost overall. AugMix (3), which one of the strongest methods on IMAGENET-CO C, gives big boost on LowContrasfTriangee
but does not improve accuracy on PerspectivCCompostion. which very different from the natural corruptions IMAGENET-C. This highlights that while many augmentations help with obfuscation robustness most are not universally helpful across all of them.
httppp///fttaneeer////o////llalo based on 49 and
based
50
htteer///hhbboe///ooooo/////llla based on 41
transsiforettraaaoommemrr based [5] and 52
based on 53
http:://ggthub..oo///p/////////
7

---

Top accuracy
05.25
33
68.2%
35.7%
68.5%
03.5
21.5%
2-5h
SEAN
62.%%
022%
23.35
85.8%
65.0%
66.2%
66.25
8855
3626
00490
0339
12.551
13.5
ICOM
0-451
13.551
13.7%
(C.0M
6.7h
00.%
3.301
62.7%
21.5%
96.7%
64.3%
69.3%
9326
9236
66.%%
6244%
642%
12.8%
66.5%
66.7%
96.85
92-45
25.5%
36.8
00400
0330
H.251
1C2M
0.45
13.7%
K.4%
(C.MM
6.2
05/
03.7%
11.%%
37.2%
63.3%
62.2%
9336
1328
62.0%
65.4%
65.2%
PL38
33.2%
96.0%
66.2%
63.55
03.35
40.%%
12.2%
31.86
6.5
0336
102N2
16.7M
12.531
13451
ICDM
134551
13.%
K.2%
(CON
23351
132551
12.3
Figure 8: Top I accuracy for 3 different ResNet sizes when training on all training obfuscations.
4.3 Training on Obfuscations
In this section we train models on all or subsets of the 19 training obfuscations to analyse the effects and interactions. Unless specified otherwise, the models use ResNet50 architecture and if error bars are plotted they represent the standard deviation from training identical models with different random seeds. When we train on obfuscated images we always sample clean images with a weight of 0.5 and each obfuscation with equal weights summing up 0.5.
4.3.1 Training on Subsets of Training Obfuscations
To see if there are interactions between differ- ent training obfuscations and how each of them helps with generalizing the hold-out obfusca- tions, we train models only on one obfuscation (and clean data). The results can be seen in fig. 66 There are some clear connections be- tween training and hold out obfuscations, e.g. Halftoning, LineShift, StyleTransfer, TextOver- lay and Texturize all increasing the accuracy on significantly, while Per- Trresfoorm and PhotoComposition lead
CwleTallennerrey LowConcatt anglee
25
25-
6-
to small improvements of PerspectiveComposi tion.
Claan ii
Loveston To
koseetfeck TD
sadereanntiinee (4)
aoneereee Io (B)
Haltowingg (?)
Teate of
crandde 1201
coveene (AU LtD
aestteei roneettte Cael
coseeeeei (19)
In appendix C.4 we also investigate the oppo- site, where we train models all but one of the training obfuscations and observe similar be- haviour for some obfuscations, e.g. that omitting Shift significantly reduces the performance on CotorPatternOverlay but in other cases, like excluding Transfrr,fer, this is compensated by the other training obfuscations.
Figure 7: Accuracy hold-out obfuscations (top) and worst case accuracy (bottom) when training on an increasing number of obfuscations.
To evaluate the effect of compounding training obfuscations, we proceed by sorting the training obfuscations by the mean accuracy on the training obfuscations when training only images from that obfuscation. We then train models by an increasing number of obfuscations starting with the obfuscation that increases the mean accuracy the most. From the results in fig. 7 we can observe that the accuracy makes jumps when adding specific obfuscations that help with one of the hold-out obfuscations but there does not seem to be constant improvement from adding more and more obfuscations to the training data. We also observe that adding the obfuscated images to the training data does not reduce the clean accuracy of the models. We rather see a mild increase in clean accuracy when looking at fig. C.I4
4.3.2 Using All Training Obfuscations
In fig. g we see models, even small ones, can achieve high accuracy on the training obfuscations when they see them during training. However, there is only limited generalization to the hold-out obfuscations even for the bigger models. When comparing results from fig. 2 we see that training a ResNet200 on all 19 training obfuscations is clearly outperformed by the larger BiT, ConyNext and
8

---

20
14
14
Clock
Pag 4e Clars
CM morrted
PerpCCOA
Figure 9: Comparison of vision transformer model trained only on clean or clean and obfus- cated images both with and without pretraining on the IMAGENET-2 K dataset.
Figure 10: Comparing performance of different domain shift algorithms on the hold-out obfusca- tions, when training on all training obfuscations.
www.ya DA
Lantas EATTTAAT
traines clean
trained on erfuacatonn
73
125
30
Imsgudit Real
Im speher
Imspetend
Insyetten
Incaps Bet Skate
Imsoutee
Iniieteed
Hold-out accuracy of models with and without adversarial training both for training only on clean data and training on the training obfuscations. For adversarial training we used an Loo attack with 4/255.
Figure 11:
Figure 12: Comparison of ResNet50 trained with and without the training obfuscations on mul- tiple IMAGENET variants.
ViT models despite them never encountering any of the obfuscations during training. This shows that there is still a lot of potential to better leverage the training obfuscations for generalization.
We also train vision transformer model both only on clean, and obfuscated images. Similar to results in section 4.1 fig. 9 shows that this achieves high accuracy on the hold-out obfuscations even without seeing obfuscations during training. Interestingly, only ColorPatternOverlay and NwwContrasTTrunnlle receive a significant boost from the addition of obfuscations to training. Pretraining on IMAGENET-21K seems to not provide significant benefits in contrast to the effect we see for the BiT models in fig. 2
Evaluating Algorithms Specialized for Distribution Shift To see if we can improve generaliza- tion, we employ several approaches that were proposed to help with distribution shifts. The algorithms we evaluated are standard training using cross-entropy loss, Invariant Risk Minimization (IRM) [4) DeepCORAL. [56],
Neural Network (DANN) (57). and Just Train Twice (JTT) [58). Additional to the image and the label, these algorithms (besides JTT) are given side information about the obfuscation that has been applied to each training image. Similar to the observations in
[59] fig. indicates that none of the algorithms give significant improvements over the baseline.
4.4 Comparing to other benchmarks
In section 2 we gave an overview over existing image robustness benchmarks, many also based on IMAGENET. In this section we investigate how performance on these relates to our image obfuscation benchmark. Not surprisingly, training on our obfuscations does not give any robustness to Lp-norm attacks but figure fig. [1 shows that adversarial training reduces the obfuscation robustness. This in contrast to prior observations on the effect of adversarial training for robustness to common corruptions [60] but understandable because our obfuscations often change the images drastically.

---

We further investigate how models trained on our training observations do on other IMAGENET
variants. fig. 12 shows results for IMAGENET-Rei [6]]. IMAGENET-V2 V2 [62. IMAGENET-A
[6]. IMAGENET-K R [9]. IMAGENET-Sketch 633, Conflict Stimuli 64 IMAGENET-C [I] and
IMAGENET-C [TI. Training on the obfuscations improves accuracy across all of these variants, however, the improvements are relatively small, indicating that our dataset represents a significantly different distribution shift than existing variants. This can also be seen in the fact that the largest improvement is seen on IMAGENET-C, as its corruptions are more similar to our obfuscations compared to the other variants.
5 Conclusion
In this paper, we presented new benchmark that evaluates the robustness of image classifiers to obfuscations. To our knowledge, this the first benchmark that curates obfuscations similar to what bad actors use to circumvent content filter models. We show that when training on obfuscations, even smaller models can achieve high robustness to them, but this does not necessarily lead to strong generalization similar but unseen obfuscations. In experiments, we that newer architectures, larger models, augmentation schemes and pretraining on bigger datasets all can make models more robust to obfuscations, even if they did not have access any during training. But there is still gap to fill to make models robust to unseen attacks and approach human perception. We have shown that models trained other robustness benchmarks. On the other hand, adversarial training does not improve obfuscation robustness. We hope this benchmark gives practitioners guidance on robustifying their models, and can drive research towards finding ways to leverage known attacks into better generalization.
training obfuscations also achieve better performance across multiple
5.1 Limitations
Investigating adversarial obfuscations leads to a large scope of design decisions. In terms of transfor- mations, focus obfuscations that are independent of the model and semantic image category. This allows precomputation of obfuscated images, but also limits the space of attacks. We could further develop obfuscation methods that adapt to the image content (e.g., human-centric images may be treated differently than object-centrie). In terms of data, IMAGENET is far from perfect (see e.g. [65] for an evaluation of errors made by state-of-the-an models) and has the limitation of having single label for each image. One could generate obfuscated versions of other datasets to check the robustness of models trained in multi-class setting or on other vision tasks like segmentation or image retrieval. The main considcration for other datasets should be to ensure that the main target label (or other output) should be very unlikely to altered by any of the introduced obfuscations.
5.2 Ethical Considerations
The specific obfuscations (as in fig. MP that we use in our benchmark may have the potential to fool automatic filters and therefore increase the amount of harmful content on digital platforms. To reduce this risk, we decided against releasing the code create the obfuscations systematically and instead only releasing the precomputed dataset. Furthermore, our obfuscations have been tuned specifically to IMAGENET images of a fixed size. Using the same obfuscations on other images would require a reimplementation and additional tuning. It is already known that cloud based image classifiers can be bypassed with widely available transformations [66] 67 Additionally, the type of obfuscations that we cover in our benchmark are already available in standard image editing software and it is not hard to imagine that adversaries can already think of much more elaborate approaches than the ones we have presented here. Therefore, the benefits of creating publicly available benchmark that can help discover new methods for training robust models and set an objective baseline for the evaluation of safety far outweigh the risks of presenting examples of obfuscations IMAGENET.
Acknowledgments and Disclosure of Funding
We want to thank Chun-Sung Ferng, Dongjin Kwon, Sylvestre-Alvise Rebuffi and Olivia Wiles for their help with this work.
10

---

References
[1] A. Torralba, A. A. Eftos, and others, "Unbiased look dataset bias." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2011.
[2] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Srndié, Laskov, G. Giacinto, and F. Roli, "Evasion attacks against machine learning at test time," " Joint European conference on machine learning and knowledge discovery in databases. Springer, 2013. pp. 387-402
[3] R. Geithos, J.-H. Jacobsen, Michaelis, R. Zemel, W. Brendel, M. Bethge, and E. A, Wichmann, "Shorteut learning in deep neural networks," in Nature Machine Intelligence, 2020.
[4] M. Arjovsky, I., Bottou, I. Guirajani, and Lopez-Paz, "Invariant risk minimization," arXiv preprint arXiv: mwXiv:/90.002890 2019.
[5] R. Geirhos, P. Rubisch, C. Michaclis, M. Bethge, F. A. Wichmann, and W. Brendel, "ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness," in International Conference on Learning Representations 2019. [Online]. Available: http://pppneeiic...eecooouuddddd
[6] D. Hendrycks, K. Zhao, S. Basart, J. Steinhardt, and D. Song. "Natural adversarial examples," CVPR, 2021.
[7] B. Recht, R. Roelofs, L. Schmidt, and V. Shankar, "Do ImageNet Classifiers Generalize to ImageNet?" arXiv preprint arXiv: 2019.
[8] K. Xiao, L. Engstrom, A. Ilyas, and A. Madry, "Noise Signal: The Role of Image Backgrounds in Object Recognition," arXiv preprint arXiv:2006.000 099994 2020.
[9] D. Hendrycks, S. Basart, N. Mu, S. Kadavath, F. Wang, E. Dorundo, R. Desai, T. Zhu, S. Parajuli, Guo, D. Song, Steinhardt, and Gilmer, "The many faces of robustness: critical analysis of nut-of-distribution generalization," ICCV, 2021.
[10] D. Hendrycks and T. Dietterich, "Benchmarking neural network robustness to common corruptions and perturbations," ICLR, 2019.
[11] E. Mintun, A. Kirillov, and S. Xie, "On Interaction Between Augmentations and Corruptions in Natural Cor- ruption Robustness," in Advances in Neural Information Processing Syxtems, M. Ranzato, A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. Curran Associates, Inc., 2021, pp. 3571
[12] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, "Intriguing properties of neural networks," International Conference on Learning Representations, 2014.
[13] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, "On evaluating adversarial robustness." arXiv preprint 192.v:190..06705, 2019.
[14] K. Mahmood, R. Mahmood, and M. van Dijk, "On the robustness of vision transformers to adversarial examples." in Proceedings the IEEE/CVF International Conference on Computer Vision (ICCV), October 2021, pp. 7838-7847.
[15] 1. Goodfellow, Y. Bengio, and A. Courville, Deep Learning. MIT Press, 2016.
[16] G. Apruzzese, H. S. Anderson, S. Dambra, D. Freeman, F. Pierazzi, and K. Roundy, ""real attackers don't compute gradients": Bridging the gap between adversarial ml research and practice." " in 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2023, pp. 339-364.
[17] K. Yuan, D. Tang, X. Liao, X. Wang, X. Feng, Y. Chen, M. Sun, H. Lu, and K. Zhang, "Stealthy porn: Understanding real-world adversarial images for illicit online promotion," " in 2019 IEFF Symposium on Security and Privacy (SP), 2019, pp. 952-966.
[18] M. Cimpoi, S. Maji. I. Kokkinos, S. Mohamed, and A. Vedaldi, "Describing textures in the wild," arXiv preprint 131.::::33113/// 2013.
[19] D. Hendrycks and T. Dietterich, "Benchmarking Neural Network Robustness to Common Corruptions and Perturbations," in International Conference on Learning Representations, 2018.
[20] O. F. Kar, T. Yeo, A. Atanov, and A. Zamir, "3d common corruptions and data augmentation." in Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2022, pp. 18 999--1888 974.
11

---

[21] S. Sagawa, P. W. Koh, T. B. Hashimoto. and P. Liang, "Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization." arXiv preprini 1rXiv:1911.0873] 2020.
[22] J. Goodfellow. Shlens, and C. Szegedy, "Explaining and harnessing adversarial examples." International Conference on Learning Representations, 2015.
[23] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, "The limitations of deep learning in adversarial settings," in 2016 JEEE European symposium on security and privacy (EuroS&PP P). IEEE, 2016, pp. 372-387.
[24] N. Carlini and D. Wagner, "Towards evaluating the robustness of neural networks." in 2017 ieee symposium security and privacy (sp). Icee, 2017, pp. 39-57.
[25] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, "Deepfool: a simple and accurate method to fool deep neural networks," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 2574-2582.
[26] A. Madry, A. Makelov, Schmidt. D. Tsipras, and A. Vladu, "Towards deep learning models resistant to adversarial attacks," in ICLR, 2018.
[27] F. Croce and M. Hein, "Reliable evaluation adversarial robustness with an ensemble of diverse parameter- free attacks," arXiv preprint arXiv:2003.0 01690, 2020.
[28] Y. Liu, Y. Cheng, L. Gao, X. Liu, Q. Zhang, and J. Song, "Practical evaluation of adversarial robustness via adaptive auto attack," in Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), June 2022. pp. 15 105-15 114.
[29] N. Papernot, P. McDaniel, 1. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, "Practical black box attacks against machine learning." in Proceedings of the 2017 ACM Asia conference on computer and communications security, 2017, pp. 506-519.
[30] B. Ru, Cobb, A. Blaas, and Y. Gal. "Bayesopt adversarial attack," in ICLR, 2019.
[31] Chen, Jordan, and M. Wainwright, "Hopskipjumpattack: A query-efficient decision-based based attack." in 2020 ieee symposium on security and privacy (sp). IEEE, 2020, pp. 1297-1294.
[32] A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok, "Synthesizing robust adversarial examples," Interna- tional conference on muchine learning. PMLR, 2018, pp. 284-293..
[33] L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry, "Exploring the landscape of spatial robustness." in International conference on machine learning. PMLR, 2019, pp. 1811-1811.
[34] D. Karmon, D. Zoran, and Y. Goldberg, "Lavan: Localized and visible adversarial noise," in International Conference on Machine Learning. PMLR, 2018, pp. 2507-2515.
[35] T. B. Brown, D. Mané, A. Roy, M. Ahadi, and J. Gilmer, "Adversarial patch," arXiv preprint 2017.
[36] C. Xiang. S. Mahloujifar, and P. Mittal, "(PatchCleanser): Certifiably robust defense against adversarial patches for any image classifier," 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 2065 2082.
[37] H. Salman, S. Jain, Wong, and A. Madry, "Certified patch robustness via smoothed vision transformers," " in Proceedings of the IERF/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp-
15 137-15 147.
[38] M. Pintor, D. Angioni, A. Sotgiu, L. Demetrio, A. Demontis, B. Biggio, and F. Roli, "Imaaenet-paach: A dataset for benchmarking machine learning robustness against adversaria patches," 2022. [Online]. Available: httpss//araiivorr/ab///2: 04411
[39] O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bem- stein, A. C. Berg, and Fei-Fei, "ImageNet Large Scale Visual Recognition Challenge," ," International Journal of Computer Vision (IJC),, vol. 115, no. 3, pp. 211-252, 2015.
[40] R. Geirhos, C. R. M. Temme, J. Rauber, H. H. Schütt,, M. Bethge, and F. A. Wichmann, "Generalisation in humans and deep neural networks," CoRR, vol. hts/1808.08775 2018. [Online]. Available: http:/aarxii.orggaa///888S...
12

---

[41] A. Kolesnikov, L. Beyer, X. Zhai, J. Puigcerver, J. Yung. S. Gelly, and N. Houlsby. "Big transfer (bit): General visual representation learning." " in Computer Vision ECCV 2020, A. Vedaldi, H. Bischof, T. Brox, and J.-M. Frahm, Eds. Springer International Publishing, 2020, pp. 491-507.
[42] A. Krizhevsky, I. Sutskever, and G. E. Hinton, "Imagenet classitication with deep convolutional neural networks." in Advances in neural information processing systems, 2012.
[43] D. Hendrycks, N. Mu, E. D. Cubuk, B. Zoph, J. Gilmer, and B. Lakshminarayanan, "AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty." arXiv preprint arXiv: 02781, 2019.
[44] E. D. Cubuk, B. Zoph. D. Mane, V. Vasudevan, and Q V. Le, "Autoaugment: Learning augmentation policies from data," " arXiv preprint arXiv: (800.08500)) 2018.
[45] E. D. Cubuk, B. Zoph, J. Shlens, and Q. V. Le. "RandAugment: Practical automated data augmentation with a reduced search space," arXiv preprint arXiv: 13719, 2019.
[46] Z. Zhong, L. Zheng, G. Kang. S. Li, and Y. Yang. "Random crasing data augmentation," Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 07. pp. 13 008, Apr. 2020. [Online]. Available: https://ojss.aa aaai www./di.gwdd.......o...mmm.m hat.a//..pppppAAAA/aaacleeee///e
[47] S. Yun, D. Han, J. Oh, Chun, J. Choe, and Y. Yon, "CutMix: Regularization Strategy to Train Strong Classifiers With Localizable Features," in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2019.
[48] H. Zhang, M. Cisse, N. Dauphin, and D. Lopez-Paz, "mixup: Beyond Empirical Risk Minimization," 2017.
arXiv preprint
[49] C. Szegedy, Liu, Y. Jia, Sermanet, Reed, D. Anguelov, Erhan, V. Vanhoucke, and A. Rabinovich, "Going deeper with convolutions," in 2015 IEEE Conference on Computer Vision and Puttern Recognition (CVPR), 2015, pp. 1-9.
[50] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition." in Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition (CVPR), June 2016.
[51] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenbomn, X. Zhai, T. Unterthiner, M. Dehghani, M. Min- derer, G. Heigold. S. Gelly, J. Uszkoreit, and N. Houlsby, "An image is worth 16x16 words: Transformers for image recognition at scale," in ICLR, 2021.
[52] A. P. Steiner, A. Kolesnikov, X. Zhai, R. Wightman, J. Uszkoreit, and L. Beyer, "How to train your vit? data, augmentation, and regularization in vision transformers," Transactions Machine Learning Research, 2022. [Online]. Available: hntps://openevviewnee/ooom http://wwww.ooooooomm/dn/aassnoe Akd=AnswrrIKKPPPP
[53] Z. Liu, H. Mao, C.-Y. Wu, C. Feichtenhofer, T. Darrell, and S. Xie, "A convnet for the 2020s," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2022, pp. 11 976-19 986.
[54] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, Clark, G. Krueger, and Sutskever, "L.carnig Transferable Visual Models From Natural Language Supervision." OpenAl Blog, 2021.
[55] F. Croce and M. Hein, "On the interplay of adversarial robustness and architecture components: patches, convolution and attention," 2022. [Online]. Available: https://ansiv.orr/bb/22220
[56] B. Sun and K. Saenko, "Deep coral: Correlation alignment for deep domain adaptation." in ECCV, 2016.
[57] Y. Ganin, F. Ustinowa, H. Ajakan, Germain, H. Larochelle, F. Laviolette, M. Marchand, and V. Lempitsky, aaversiiadersaarial training of neural networks," " Machine Learning Research, vol. 17, no. 1, pp. 2096- 2030, 2016.
[58] E. Z. Liu, B. Haghgoo, A. S. Chen, A. Raghunathan, W. Koh, S. Sagawa, P. Liang, and Finn, "Just Train Twice: Improving group robustness without training group information," in International Conference on Machine Learning, 2021.
[59] O. Wiles, S. Gowal, F. Stimberg. S.-A. Rebuffi, I. Ktena, K. D. Dvijotham, and A. T. Cemgil, "A fine-grained analysis on distribution shift," in ICLR. 2022. [Online]. Available:
[60] K. Kireev, M. Andriushchenko, and N. Flammarion, "On the effectiveness of adversarial training against common corrpptions." arXiv preprint arXiv:2103.02325: 2021.
13

---

[61] L. Beyer, O. J. Hénaff, A. Kolesnikov, X. Zhai, and A. van den Oord, "Are we done with imagenet?" CoRR, vol. Abs/2006.071559 2020. [Online]. Available: https//aarii.ooaaabb2/000077//
[62] B. Recht, R. Roelofs, L. Schmidt, and V. Shankar, "Do ImageNet classifiers generalize to ImageNet?" in Proceedings of the 36th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, K. Chaudhuri and Salakhutdinov, Eds., 97. PMLR, 09-15 Jun 2019, pp. 5389-5400.
[63] Wang. S. Ge, Z. Lipton, and E. P. Xing, "Learning robust global representations by penalizing local predictive power," in Advances in Neural Information Processing Systems, 2019, pp. 10 506 10050000118 10518.
[64] R. Geirhos, Rubisch, Michaelis, Bethge, F. A. Wichmann, and Brendel, "Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness." in ICLR. OpenReview.net, 2019.
[65] V. Vasudevan, B. Caine, R. Gontijo-Lopes, S. Fridovich-Keil Keil. and R. Roelofs, "When does dough become bagel? analyzing the remaining mistakes on imagenet," 2022. [Online]. Available: https:/amiiv.orr//aam2225.....00 04596
[66] D. Goodman and T. Wei, "Cloud-based image classification service is not robust to simple transformations: A forgotten battlefield," CoRR, vol. abs/1906.07997, 2019. [Online]. Available:
http://arxxvv.rg//abs/ 909977997
[67] D. Goodman and X. Hao, "Attacking and defending machine learning applications of public cloud," CoRR, vol. abs/2008. 02076, 2020. [Online]. Available: bttps://arxiv.org/ab///20 02076
[68] G. Ghiasi, H. Lee. M. Kudlur, V. Dumoulin, and J. Shlens, "Exploring the structure of real-time arbitrary neural artistic stylization network." ArXiv, vol. abs/1705.06830, 2017.
[69] Loshehilov and F. Hutter, "Decoupled weight decay regularization." in ICLR, 2019, [Online]. Available: htpps//pperrvovvwnedfcoodddddBdg
[70] S.-A. Rebuffi, F. Croce, and S. Gowal, "Revisiting adapters with adversarial training." " in
The Eleventh International Conference on Learning Representations, 2023. [Online]. Available:
[71] V. Vasudevan, B. Caine, Gontijo-Loper Fridovich-Ked and Roelofs, "When does dough become bagel? Analyzing the remaining mistakes on ImageNet," arXiv preprint arXiv:2205.04544 2022.
14

---

A Benchmark Details
A.1 Obfuscations
In the following section give description of all 18 training and 3 hold-out obfuscations in the benchmark. The hyperparameters that are drawn randomly drawn from predefined ranges for each image are emphasized. The obfuscations are grouped into categories but these categorizations very loose as some obfuscations, especially the hold-out obfuscations, can cover multiple concepts. Examples of the training and hold-out obfuscations can be seen in fig. A.1 and fig. A.2 respectively,
A.2 Color Changes
The image is separated into blocks of specific block size. Independently for each block, one of the 3 color changes is randomly selected and a uniform random value added to that color channel. We ensure the value is between 0 and 1 by subtracting from it if it goes above.
ColorNoiseBlocks
Halftoning (technique) We randomly apply one of 4 different halftoning techniques to an image. Each technique reproduces the image by separating the image into blocks of equal size and replacing them by some geometric object that has property that is proportional the average intensity in the block. This is done for each color channel independently. The 4 techniques are using circles squares with their size being proportional to the intensity, using zigzag lines whose frequency is proportional to the intensity or using random pixels whose number is proprtional to the intensity.
InvertLines We go along the image either horizontal or vertical lines of a specific width. The lines are alternatively inverted in color or left unchanged.
HowContras(Triangke (hold-out) We divide the image into 3 different areas through triangles of size scale. In each of the 3 areas areas the contrast reduced by a different factor.
A.3 Transformation
LineShift (horizontal, shift length, line thickness) Across either horizontal vertical lines of a specific width we shift the pixels alternatively to the left and right (or top and bottom for vertical lines) by specific length. We wrap around when the shift goes beyond the image borders.
PerspectiveTransfon We choose set of coordinates around the center of each of the quadrants. Then we apply a perspective transformation moving the corners of the image to their respective coordinate. The rest of the image is filled with black.
RotateBlocks We separate the image into blocks of a chosen size. Each of them is separated into blocks of equal size again and their position inside the larger block is permuted by a specified number of rotations.
Rotatelmage
We rotate the image by a specified angle. Corners will be cropped while empty space filled with black.
SwirlWarp
The image is transformed by a swirl warp with specified strength, radius and center coordinates.
WavyColorWarp
We transform the image with a sine wave transformation of a certain wave length and amplitude and modify the color of the image through change in hue..
A.4 Composition
Background BlurgoundBBuCCooo Elllrooopotttion We shrink the image by an independent width and height factor, not necessarily keeping the aspect ratio, and compose this image on top of the original image after applying Gaussian blur of certain strength the latter.
15

---

(c) BackgroundBlurCom
(a) Clean
(b) AdversarialPatches
(d) Bloocks
position
(e) Halftoning
(I) Bigd
(g) IconOverlay
(h) ImageOverlay
(i) Interleave
(i) InvertLines
(k) LineShift
(I) Perspective Transform
(m) PhotoComposition
(n) RotateBlocks
(o) Rotatelmage
(p) StyleTransfer
dee
cated
eddat corussa d0nl Dhéussal Fuscn
(q) SwirlWarp
(r) TextOverlay
(S) Texturize
(U WavyColorWarp
Figure A.l: Examples for the training obfuscations.
16

---

(c)
PerspectixeComposi
Oolerla
(b) Low Tontrrssssss
tion
Figure A.2: Examples for the hold-out obfuscations.
HiggCoontrstBBorerr The image has its contrast reduced by a factor then it resized to have border of certain size around it. The border is made by sampling each pixel uniform randomly.
PerspectieCoomossiion (hold-out) We compose the image into specific location (fixed for each photo). The position also defines a perspective transform that is applied to the image. Small parts of the image can also be overlayed by the photo. We use 14 different photos and the position that the original image is composed into has semantic meaning, e.g. it is the screen of phone or the glass of a window.
The image is shrunk by ffccoo and composed on top of a photo at a random position. There 10 different photos. They are the same photos that are used for ImageOverlay and Interleave. There is no overlap with the photos that are used for PerspectieCoopositio..
PhotoComposition
A.5 Overlay
ColorPatternOverlly (hold-out) The image is turned into grey scale then overlayed by one of 9 patterns in one of 9 colors with low grade of transparency.
IconOverlay A grid of a certain number of one of icons is overlayed on the image with grade of transparency.
ImageOverlay One of 10 different photos is overlayed over the image with grade of transparency. The photos are the same that are used for ImageOverlay and Interleave. There is no overlap with the photos that are used for PerspectiveComposition
The image is interleaved with of 10 photos, either horizontally vertically, in lines of a specific width. There is a low grade of transparency. The photos that are used are are the same as for IvageOverlay and Interleave. There is overlap with the photos that are used for PerspectieCCompostiion.
Interleave
TextOverlay One of 13 text strings is overlayed onto the image repeatedly in one of 9 colors. The text size varied.
A.6 Machine-Learring-Basse Obfuscations
Adversarial Patches The image shrunk and one of 3 different adversarial patches are overlayed onto the corners of the image. The patches are taken from 38
We resize the image by a factor (> 1) and then choose one 7f classical paintings stylize the image. We use a model based on 688 for the style transfer.
Stylize
Taken from https::tpp. t/ http://tte/e/e//aa/a/o/////////a http:///wo/oo/o/ee../////ttaaaaa
17

---

Texturize We resize the image by afactoor (> 1) and then choose one of 10 texture photos to stylize the image. We use a model based on 68 footnotell for the style transfer.
A.7 Class reduction
To allow strong obfuscations reduce the number of classes that need to be distinguished. We follow 40 by using 16 super-classes which encompass 207 of the original 1000 IMAGENET classes.
The 16 super-classes, their IMAGENET label id and the corresponding WordNet terms are listed below. The names given to the super-classes were chosen by us.
Airplane (I)
404 (airliner)
Bear (4)
294 (brown bear, bruin, Ursus arctos), 295 (American black bear, black bear, Ur- sus americanus, Euarctos americanus), 296 (ice bear, polar bear, Ursus Maritimus, Thalarctos maritimus), 297 (sloth bear, Melursus ursinus, Ursus ursinus)
Bicycle (2)
444 siccyll--bill-ff--tie tandem bicycle, tandem), 671 (mountain bike, all-terrain bike, off-roader)
Bird (49)
(hen), 10 (brambling, Fringilla montifringilla), 11 (goldfinch, Carduclis carduelis), 12 (house finch, linnet, Carpodacus mexicanus), 13 (junco, snowbird), 14 (indigo bunting, indigo finch, indigo bird, Passerina cyanea), 15 (robin, American robin, Turdus migratorius), 16 (bulbul), 18 (magpie), 19 (chickadee), 20 (water ouzel, dipper), 22 (bald eagle, American eagle, Haliaeetus leucocephalus), 23 (vulture), 24 (great grey owl, great gray owl, Strix nebulosa), 80 (black grouse), 81 (ptarmigan), 82 (ruffed grouse, partridge, Bonasa umbellus), 83 (prairie chicken, prairie grouse, prairie fowl), 87 (African grey, African gray, Psittacus erithacus), 88 (macaw), 89 (sulphur-crested cockatoo, Kakatoe galerita, Cacatua galerita). 90 (lorikeet), 91 (coucal), 92 (bee eater), 93 (hornbill), 94 (hummingbird), 95 (jacamar), 96 (toucan), 98 (red-bre boee-breateed merganser, Mergus serrator), 99 (goose), 100 (black swan, Cygnus atratus), 127 (white stork, Ciconia ciconia), 128 (black stork, Ciconia nigra), 129 (spoonbill), 130 (flamingo), 131 (little blue heron, Egretta caerulea). 132 (American egret, great white heron, Egretta albus), 133 (bittern), 135 (limpkin, Aramus pictus), 136 (European gallinule, Porphyrio porphyrio), 137 (American coot, marsh hen, mud hen, water hen, Fulica americana), 138 (bustard), 139 (ruddy turnstone, Arenaria interpres), 140 (red-backed sandpiper, dunlin, Erolia alpina), 141 (redshank, Tringa totanus), 142 (dowitcher), 143 (oystcreatcher, oyster catcher), 144 (pelican), 145 (king penguin, Aptenodytes patagonica)
Boat (5)
472 (canoe), 554 (fireboat), 625 (lifeboat), 814 (speedboat), 914 (yawl)
Bottle / Jug (7)
-40 (beer bottle), 720 (pill bottle), 737 (pop bottle, soda bottle), 898 (water bottle), 899 (water jug), 901 (whiskey jug), 907 (wine bottle)
Car (3)
436 (beach wagon, station wagon, wagon, estate car, beach waggon, station waggon, waggon), 511 (convertible), 817 (sports car, sport car)
Cat / Cougar (6)
281 (tabby, tabby cat), 282 (tiger cat), 283 (Persian cat), 284 (Siamese cat, Siamese), 285 (Egyptian cat), 286 (cougar, puma, catamount, mountain lion, painter, panther, Felis concolor)
Chair Throne (4)
423 (barber chair), 559 (folding chair), 765 (rocking chair, rocker), 857 (throne)
Clock (3)
409 (analog clock), 530 (digital clock), 892 (wall clock)
18

---

Dog (109)
152 (Japanese spaniel), 153 (Maltese dog, Maltese terrier, Maltese), 154 (Pekinese, Pekingese, Peke), 155 (Shih-Tzu), 156 (Blenheim spaniel), 157 (papillon), 158 (toy terrier), 159 (Rhodesian ridgeback), 160 (Afghan hound, Afghan), 161 (basset, basset hound), 162 (beagle), 163 (bloodhound, sleuthhound), 164 (bluetick), 165 (black- and-tan coonhound), 166 (Walker hound, Walker foxhound), 167 (English foxhound), 168 (redbone), 169 (borzoi, Russian wolfhound), 170 (Irish wolfhound), 171 (Italian greyhound), 172 (whippet), 173 (Ibizan hound, Ibizan Podenco), 174 (Norwegian elkhound, elkhound), 175 (otterhound, otter hound), 176 (Saluki, gazelle hound), 177 (Scottish deerhound, deerhound), 178 (Weimaraner), 179 (Staffordshire bullterrier, Staffordshire bull terrier), 180 (American Staffordshire terrier, Staffordshire terrier, American pit bull terrier, pit bull terrier), 181 (Bedlington terrier), 182 (Border terrier), 183 (Kerry blue terrier), 184 (Irish terrier), 185 (Norfolk terrier), 186 (Norwich terrier), 187 (Yorkshire terrier), 188 (wire-haired fox terrier), 189 (Lakeland terrier), 190 (Sealyham terrier, Sealyham), 191 (Airedale, Airedale terrier), 193 (Australian terrier), 194 (Dandie Dinmont, Dandie Dinmont terrier). 195 (Boston bull, Boston terrier), 196 (miniature schnauzer), 197 (giant schnauzer), 198 (standard schnauzer), 199 (Scotch terrier, Scottish terrier, Scottie). 200 (Tibetan terrier, chrysanthemum dog). 201 (silky terrier, Sydney silky), 202 (soft-coated wheaten terrier), 203 (West Highland white terrier), 205 (flat-coated retriever), 206 (curly-coated retriever), 207 (golden retriever), 208 (Labrador retriever). 209 (Chesapeake Bay retriever), 210 (German short-haired pointer), 211 (vizsla, Hungarian pointer), 212 (English setter). 213 (Irish setter, red setter), 214 (Gordon setter), 215 (Brittany spaniel), 216 (clumber, clumber spaniel), 217 (English springer. English springer spaniel), 218 (Welsh springer spaniel), 219 (cocker spaniel, English cocker spaniel, cocker), 220 (Sussex spaniel), 221 (Irish water spaniel). 222 (kuvasz). 223 (schipperke), 224 (groenendael), 225 (malinois). 226 (briard), 228 (komondor)) 229 (Old English sheepdog. bobtail), 230 (Shetland sheepdog, Shetland sheep dog, Shetland), 231 (collie), 232 (Border collic), 233 (Bouvier des Flandres, Bouviers des Flandres), 234 (Rottweiler), 235 (German shepherd, German shepherd dog, German police dog, alsatian), 236 (Doberman, Doberman pinscher), 237 (miniature pinscher), 238 (Greater Swiss Mountain dog). 239 (Bernese mountain dog), 240 (Appenzeller), 241 (EntleBucher), 243 (bull mastiff), 244 (Tibetan mastiff), 245 (French bulldog), 246 (Great Dane), 247 (Saint Bernard, St Bernard), 248 (Eskimo dog, husky), 249 (malamute, malemute, Alaskan malamute), 250 (Siberian husky), 252 (affenpinscher, monkey pinscher, monkey dog), 253 (basenji). 254 (pug, pug-dog), 255 (Leonberg). 256 (Newfoundland, Newfoundland dog). 257 (Great Pyrenees), 259 (Pomeranian), 261 (keeshond), 262 (Brabancon griffon). 263 (Pembroke, Pembroke Welsh corgi), 265 (toy poodle), 266 (miniature poodle), 267 (standard poodle), 268 (Mexican hairless)
Elephant (2)
385 (Indian elephant, Elephas maximus), 386 (African elephant, Loxodonta africana)
Keyboard / Typewriter (2)
508 (computer keyboard, keypad), 878 (typewriter keyboard)
Cleaver (1)
499 (cleaver, meat cleaver, chopper)
Rotisserie (1)
766 (rotisserie)
Van Truck (8)
555 (fire engine, fire truck), 569 (garbage truck, dustcart), 656 (minivan). 675 (moving van). 717 (pickup, pickup truck), 734 (police van, police wagon, paddy wagon, patrol wagon, wagon, black Maria), 864 (tow truck, tow car, wrecker), 867 (trailer truck, tractor trailer, trucking rig, rig, articulated lorry, semi)
B Experimental Details
Training Details Unless other specified we trained ResNet50 model for 300 IMAGENET equiv- alent epochs, with 50% of the training data clean (central cropped and resized to 224 x 224) and
19

---

Top ACCLERTY
44.%%
40.35
33.45
53.5%
23.5%
417%
40.0%
35.3%
41.%%
H0.2%
42.7%
+0.3%
26.7%
4677
09.7%
27.4%
2.7%
4.%
64995
53.2%
13.0%
PM
9h
54.9%
23.5%
959%
43355
42
4..% 44.%%
31.95
54.95
520%
50.7%
90
25.5%
170%
0%
42%
M0 592N
45.4%
483%
43.45
43.45
2475%
73.7%
55.9%
19.5%
3038
453%
32 6%
401%
40.7%
50.9%
53.55
560%
42.4%
40.4%
15.1%
34.%
152%
54.0%
455
43.0%
42.3%
42.8%
55.5%
21.95
41.4%
47.0%
52.35
45.4%
96.3%
TeaNe MEL
13.29
41
12.6%
2424
23
M.9
21
141%
1199
19.20
0.79
15.95
$5.7
15.6
11NG
99
19.75
27.7%
1416
10
42M
SAANAVE 152
12.9%
5526
11.7
12
2199
2526
3119
57.8
17.76
0.4%
35.9%
$1.76
57.2
15T6
27.7%
M.99
99.1%
93.9%
2146
55.95
SUNN
Figure C.I: Heatmap of top accuracy for all the obfuscations for multiple Inception and ResNet variants.
the rest being sampled with equal probability from the training obfuscations or a subset of them. As augmentations random crop and color augmentations as in 42 were used.
We trained models in two different frameworks with slightly different parameters. Experiments on the augmentations (fig. () adversarial training (fig. [ the ImageNet variants (fig. [T2 and the vision transformers (fig. (9) used framework For ResNet we used SGD with momentum 0.9 and a cosine learning rate decay with base learning rate 4e after linear ramp-up of 10 epochs and a batch size of 4096.
For the ViTs we used ViT-B16 model with weight decay of 0.3, label smoothing of 0.1, an exponential moving average with momentum 0.9999. We used the AdamW optimizer (69 with momenta 31 = 0.9, 82 = 0.95 and base learning rate 1e-4 with the same learning rate schedule as the ResNet50 above. For data augmentations we used random crops, as well as MixUp, CutMix and RandAugment, the latter using 2 layers, magnitude 9 and random probability of 0.5.
Results all the other experiments used framework 2 which used ADAM optimizer with learning rate le which we chose after comparing experiments with learning rate le-4 and learning rate 1e-2 and batch size of 512.
Adversarial Training For results fig. we used adversarial training that used untargeted for attacks with = 4/255. We follow (70) by creating the adversarial perturbations through 2 step projected gradient descent (PGD²) with a step size of 3e 0.01. We used early stopping to avoid robust overfitting. In case obfuscated images were used the attacks were done both clean and obfuscated images.
C Additional Experimental Results
To give more insights into the experiments add more detailed figures, including both training and hold-out obfuscations, and new analysis for experiments in the main paper.
C.1 Evaluating Baseline Models Trained Clean IMAGENET
we showed results from models taken from TensorFlow hub that were trained on the standard IMAGENET dataset (and pretrained on IMAGENET-22 K in some cases). Figure showed the performance of of all the models, but only on the hold-out obfuscations, while fig. 4 included the accuracy on all obfuscations, training and hold-out, but only for the best models from each type. In figs. to C.4 show the results all obfuscations for Inception and ResNet, BiT, ConvNext and
In section 4.1
20

---

Top 1 DECuracy
STG NANDSEO YANG
PLNG
M.26
MC
557%
18.45
21.35
12
14.5
0555
1L
14.55
15.5
0M
4124
5016
JACS
DESS NARRIOEIOO
950%
41.%
S0.N4
03.44
$4.9
2535
37.25
44.6
15445
0155
2926
53.05
5525
5826
0535
513N
594N
9014
40.8
36.7
A3N CLUN
BEM NANDSESLL
K1/96
ML
6916
1626
2438
1.
022
65.%
A118
9%
11.35
1525
0%
003
6014
25/8
STA4
SKIN
0.94
650%%
42.2%
20.55
15
452%
3856
1675
45
57.05
5925
03
55.25
0.25
038
7LAN
57.6
31,8
ALEN
9706 EM0
0.3%
12.14
730%
547%
24
5715
657%
1555
66
0.
6435
75.6%
TCAM
7024
5008 465 2016
Figure C.2: Heatmap of the top 1 accuracy for all the obfuscations for multiple BiT variants.
accuracy
Grabo-Trp3i 3535 7..%%
12.4%
35.4%
64.3%
03.55
10.5%
50.N%
63.%
53.75
75.% E1
51.5%
05.0%
77.0%
715%
75.5
533%
7925
56.%
67.6%
513%
2E.4
335%
3355
22.5%
04.0%
9615
(6.%%
72355
TEAN
3236
035
95.4%
12.5%
742%
7626
(6.%%
798%
72.5%
535%
93.5%
04.%
422%
On Colkeoareee SEPH
K1.45
29
14.45
74.04
P.36
95
05.7%
18.4
1180
76.16
26.8
5326
71.05
71.5%
72.0%
6%
90.9%
13.2%
21
00AM
12.5%
132%
903%%
01.2%
12.5%
53.2%
12
80.7%
42.4%
17.1%
16.7%
472%
Covites-llageeliiee SEER M..75
14:F%
14.6
92
648%
11.55
11445
15:0
11.00
8.5%
61.75
11.7%
60.0
92
26.7%
10.10
1.00
Lowi Lnwdeeeetttnnn
Figure C.3: Heatmap of top accuracy for all the obfuscations for multiple ConvNext variants.
50.0%
$0.90
71
7..%
71.5%
12.0%
533%
70.5%
515%
11.0%
75.%
215%
43.4%
71.7%
33.5%
(2.0%
1525
733%
55.4%
16.2%
53
37.4
40.4%
5445
07555
AVVD
R1.70
70
92
K1.45
19.%
25
2626
704
13
1388
71/70
4200
V525332
60.00
MEN%
A0.75
45.7%
6/4
14
612h
1.49
1416
1178
19.0
10
30 80A
80.h%
75.7%
718%
17.2%
25.7%
12.%%
65.0%
7533%
132%
92.%
755%
03.0%
722%
751%
Weed
Figure C.4: Heatmap of top accuracy for all the obfuscations for multiple ViT variants.
21

---

ToP scouracy
SuNNN 02% 765
782%
56.66
36.7%
43
SU.K
37.1%
18.3%
13.0%
783N
75.5%
40.0%
9M
63
1.%
93.5%
25.3%
2435
11%
CUPNTES2
9226
92.8
74.h
62.8%
62
43.2%
65.05
M6.25
62
725%
7456
64th
66.55
19.25
6556%
56.25
62.6%
42.5%
42
21.25
CUNTT3SE 92A6
FL-6
$1.0%
18.%
6J.05
633%%
0.96
1036
$1.hh
1105
10.05
$6.05
7648
17.66
7339
00.5
SUPWI La
12.0%
63%
157%
257%
755%
12:
Wome
Figure C.5: Heatmap of top accuracy for all the obfuscations for multiple CLIP models using 80 prompts.
60
Inception & ResNet
Worst Case Accuracy (Hold Out)
Transfer
Vision Transformer ConvNext
CLIP
70.0
72.5
75.0
77.5
80.0
82.5 85.0
ImageNet Top 1 Accuracy
Figure C.6: Worst case accuracy on the hold-out obfuscations over accuracy on standard ImageNet (using all 1000 classes) for all the models taken from TensorFlow Hub.
Top 2 accuracy
935
555
18.%
1.79%
15.50
0.351
0099
1.79
05
0.5%
100%
82
48.44
19.00
14
17.95
2036
27.99
9%
21
9m)
(3.44)
3.40
12
12.9
(3.48)
0..5)
193
2 382
13
13.10
900
(1/90)
Assuggen
00.0%
55.0%
38.%
9m)
13.00 45)
27.5%
25
15
47.4%
680
34.5%
03.98
13.291
63.4%
11240
00.25
30.7%
2.00
23.4%
11890
76.0%
0.490
0355
3385
0./0
1999)
56.%%
2 1.
725%
105%
12.44)
45.5%
25.5%
25.4%
(2270)
21.5%
53
4.5%
3122%
48.9%
25.2%
50.9%
Nedkkrent
0.5%
11138
12380
3.2%
11:00
0.851
322
0.77
13391
02.0%
8.5%
Turda
43.%
2255
87%
292
996
9M1
(2/9)
(1.90
(13/9)
23/9L
2.3%
11.99
(0,9)
(1.9)
11EN)
(3.0)
(g)
(3.5g
(.9%
Figure C.7: Heatmap of the top accuracy for all the obfuscations for cleanly trained ResNet50 models with different augmentation schemes.
22

---

ViT models, respectively. It allows a more detailed look in how robustness to different obfuscations evolves when models are scaled up or are pretrained on IMAGENET-2IK.
In fig. we can see that the different Inception and ResNet models get almost the exact same accuracy on some obfuscations like ImageOverlay or Invertl.nes, while other obfuscations, e.g. Halftoning or Rotatelmage, are easier to classify for the bigger models. Interestingly, this does not hold for the other model types as we see both ImageOverlay and InvertLines get improved performance from larger models in figs.
We can also see in figs. and C.3 how pretraining IMAGENET- 21 helps make models more robust to the obfuscations. When comparing the BiT-S models to their corresponding BiT-M models we see an improvement on all obfuscations while for ConvNext-Bars Base and ConvNext-Ban Battt-Baee-2111 21k models this is more mixed, e.g. IconOverlay Interleave, LowContrus/Traanglee and PerspectiveCompoxiioon show improvement, mirroring our results in fig. 9
We mentioned in section 4.1 that the models that perform strongest on our hold-out obfuscations are also have the highest accuracy on the standard IMAGENET benchmark. This is visualised in fig, C.6 showing a clear correlation between the accuracy on the 1000-class accuracy on standard IMAGENET and the worst-case accuracy on our hold-out obfuscations.
In fig. we can see how the augmentation schemes that we evaluated in the main paper perform on all the obfuscations. As in fig. [ we see that MixUp performs best, increasing the accuracy significantly for 15 of the 19 training obfuscations. You can also see clear connections between the augmentation methods and the obfuscations they do particularly well on. For example, Mix does best on IconOverlay, ImageOverlay and Tex1Ovella, while CutMix does best on Invertlines, ThadgroundBluuCoompssit and PhotoComposition.
C.2 Evaluating Upper Ceiling for Benchmark Metric
While we tried carefully tune our obfuscations be strong and keep the semantic content of the images intact, it is inevitable that there will be cases where the image is obfuscated beyond recognition. This is not unusual, even the clean IMAGENET dataset contains wrong labels and really hard images that even humans fail to label correctly 771. To evaluate the upper ceiling of performance on our benchmark we create an oracle by combining multiple models in best case way, i.e. we use the predictions of the ViT B8 model from fig. C.4 ColorPattemOverlay and LowContrasTTrangge and the predictions of the CLIP ViT L14 from fig. C.5 for Perspective Comppooiiiiooooiiiooin as these models get the best results on these hold-out obfuscations. Doing this we get a worst case hold out accuracy of 69.89 82% which is almost 8% higher than the best model (the ViT B8) gets. If we go further and combine both these models on an one of the models predicts the correct super class. Doing this yields a worst case hold out accuracy of 80.36%. If we extend this to the best model from each of the 5 pretrained groups (Inception ResNet V2, BiT-M ResNet- 152x4, ConyNext-XLargee
basis, i.e. we give the correct prediction if at least
1k, ViT B8 and CLIP ViT L14) we get to 86.89% and when using all 38 pretrained models we get 92% although the later might be discarded as too extreme as obviously we could get arbitarily close to 100% by combining more and more random models. Nontheless, higher than what the best models we evaluated achieved, are realistic for the hold out worst case accuracy.
think this analysis shows that results over 80%. and therefore roughly 20%
C.3 Evaluating Choice of Hold Out Obfuscations
As described in section 3.2 we chose ColorPattemOOvellay LowContrustTriangles and Perspec- cimeoonponn as hold-out obfuscations because of their conceptual diversity and difficulty. To investigate how our choice compares we plot the histogram of the worst case hold out accuracy over all 1540 possible combinations to chose 3 out of 22 obfuscations as hold out. As you can see from figs. C.8 to C.12 our choice is always amongst the lowest in terms of the worst case hold out accuracy, which underlines that we chose one of the hardest sets of hold out obfuscations. The only exception for this seems to be the CLIP models, which is most likely because, as seen in fig. PerspectiveCooppsitiin is one of the easier transformations for it.
23

---

Inception V1
Inception V2
Inception VS
Pestitt V1 50
24-
34-
4.00
0.85
0.30
35
0.28
6.55
6.05
8:38
635
C2> 8:35
Mit elo 035 abd 038 9:5
ele 0.5 #20 6:5 6.c
Redlet V2
50
Beskitt V1
101
Restbet V2 101
ReeNiet VI
5-
<45 030 915
82B 6.25 0.30
cd5 ais ais ca A2E C.5 AdC
0.35 kdo ai
Ci5 alo 013
a25 0.0
C35
Resket V2 152
Inception BesWet V/
34-
635 Lio cit dàc 832
Figure C.8: Histogram of worst case hold out accuracy for all 1540 possible choices of 3 hold out obfuscations for the ResNet models. Our choice is marked with a vertical black line.
SIT-S NusNei-50x.1
BITS hesNei-50x3
BIT-5 ResNet-101xl
BITS hesNei-101x3
nin 628 8T1
02
BIT.S RusMei-152u4
BIT-M Bustltt 50x1
BRT-M R5s
BIT-M Bustltt- -10kll
10
26.
12
82
62
83
BIT-M Rush
BIT-M Rus2
Figure C.9: Histogram of worst case hold out accuracy for all 1540 possible choices of 3 hold out obfuscations for the BiT models. Our choice is marked with vertical black line.
24

---

Condelet--Smal-le
ConvNeat-Base-
6.4
(Ross Coss REcurOcy 2roc Oul
Whist Cass Acorsicy thild DuO
Poust Cose Accurccy brace Out
Worst Cris Accurdcy OuD
Cotw/eect-Bow-221-e
CondWestslarge221..
Conmherst Xlagge-2rggg-
5-
6-
04
AcLurAYy Oul)
Whrui Cate aaay Ouo
ACCUTASS SAANE
Figure C.10: Histogram of worst hold out accuracy for all 1540 possible choices of 3 hold out obfuscations for the ConvNext models. Our choice is marked with vertical black line.
VIT-32
VIT.516
VT:R50-L32
MTB36
36-
9.2
6.4
63
0.5
3.4
05
VITAL16
VIT-88
244
06
Figure C.11: Histogram of worst case hold out accuracy for all 1540 possible choices of 3 hold out obfuscations for the ViT models. Our choice is marked with vertical black line.
C.4 Evaluating Models Trained on Subsets Training Obfuscations
The results for all obfuscations when training on single obfuscation (and clean images) are show in fig. C.I3] corresponding to the hold-out results shown in fig. 6 The heatmap allows us to see relationships between training obfuscations, e.g. training on Interleave giving strong boosts to accuracy on Invertlinnes and LineShifi or training Rotatelmage improving robustness to SwirlWarp. Sometimes this relationships is not symmetric e.g. while training on PhotoComposition gives a very large boost of over 30% less than 10% %.
BankggruunBBurrooopsiitn the reverse only improves performance by
In fig. C. we see what happens to robustness to each obfuscation when adding more and more obfuscations the training data. In fig. i the main paper we saw the the hold-out performance has jumps when certain obfuscations are added but stays mostly flat otherwise. Here we can see are more nuanced picture where there is some clear generalization to other obfuscations initially but when adding obfuscations like TextOverlay later on there is no significant increase in the performance of other training obfuscations. This not surprising as the obfuscations add to the training set were ordered by their average performance across the training obfuscations in fig.
25

---

CUP Reskiet-5 50
CUP RcsNet:101
CLIP MT B32
CLP VTT 916
40-
33-
63
62
KA
CUI L14
OLD
Figure C.12: Histogram of worst case hold out accuracy for all 1540 possible choices of 3 hold out obfuscations for the CLIP models. Our choice is marked with vertical black line.
Top accuracy
577
0.091
10:10
3.39
3.5%
0.151
0.40
0.59
2204
137%
19.7%
13.0%
61.96
509%
1260
15
M.00
1475
75340
13.90
14.0%
07.06
19.1%
19.14
47.00
13.4%
25.05
00.00
11.5%
7.50
0.791
0.4
(1.94
11/9
196
(3.95)
0.800
0.20
(1:00
(15))
0.961
14200
0.8%
11.9
0.051
11.7%
1.99)
0.59
112
192%
19.%%
24.2%
23.25
2185%
32.9%
424%
51.%
3175
7076
24.5%
11.94
33.54
25.%
12.0%
36.2%
52.94
34.96
4334%
51.6
25.7%
0.00
13.5%
26,15
12.092
3.30
0.061
16.10
13.5%
3.20
128M
0.2h1
0.09
(3.99)
0.6h
179
720M
12/19
11.00
2.2
11.74
0.251
0.29%
029
11.2%
25.45
2134
15.1%
0.8%
14.4%
37.2%
35.2%
3125%
25.0%
428%
554%
31.9%
56.7%
1225
12.5
64.90
472%
0.5%
16.%%
70.hh
K1.00
31.0%
19.2%
$1.95
500%
15.70
24.95
50.00
15.95
14th
15.09
2220
0.261
(1.44)
12772
3.99
9.2h1
13.09
0.20
0.091
0.3
(49)
11292
2.80
(194)
(5092
15.04]
12.99)
0.9%
1.24
(199
(119)
17.7%
24.25
234%
21.2%
13.25
52.0%
45.7%
80.7%
J03N
204%
11.%
24.7
2415
348h
21.90
01.24
21.6%
1746
11.7%
M.
01.90
51.44
12200
14.00
11.90
1126
16.16
18192
0.75
0.00
15.90
15.002
115
07-00
13.99
0.00
1199
020
12:94
0.961
12:40
13.44)
11,92)
11092
13.99
0.50
11228
02990
1.79
2.5%
3455
2724
192%
12.0%
43.2%
26.55
3974
6.7%
3375
1225
9C 28
14.%
17.2
6911%
11.2%
21.00
91
1500
15.06
0.00
13.65
1124
10.0
33.00
1379
2,70
0.001
12.00
14.00
0.290
22.41
1227
3.25
0.761
11.00
0220
11.0
12.8%
130
369
03
3.26
250
14.%
0.261
15.9%
0.39
1.740
1.54
1309
8.251
11.92
94
1179
14.1%
15.0%
33.5%
25.55
313%
15.55
1125
24.9%
25.75
206%
22.1%
18.7%
54.6
24.7%
28th
40.7%
25.25
803%%
15.9%
11.%%
51.7
3.75
80.99
25.75
12.5
26/h
PUAM
12392
2,700
0.081
11.44
160M
3/76
0.861
15.90
184
49
001
13.992
2150
01061
14.7%
3.4M
1L
12/
01002
(20)
100
24.5%
224%
23.0%
33/15
20/55
20.
25.2%
20.7%
422%
2425
12.2%
2675
Figure 1.:3: Heatmap of top I accuracy for all the obfuscations for models trained on clean images plus single obfuscations.
26

---

15.7%
7710
1615
832%
03.7%
11.0
11.7
830%
36.8%
8.hh
304%
15.mh
15:85
60.09
11.6
1354
K301
3.891
45
11.9%
6.76
0.50
26.04
3655
12.6
0.09
32%
7ATM
3250
0.29
11200
6250
8:500
02 260
15.%%
1127
14
K,00
2.00
12200
1129
122%
0.50
1350
0100
1577
300
K000
950
190%
(.771
0.26
25%
0.0
13390
400%
131%
13.55
75.7
33.9%
652%
595%
1235
11.%%
00.15
54.5%
38.3%
39.3%
61.9
150%
K0MC
18:70
0000
13.7%
11.00
18.6
87.00
245
5.50
3.591
13.90
18.94
0250
8.501
16.70
1AVM
Kum0
2.531
(3550
11.2%
117M
11/9
0.20
239
1.2%
8750
0.440
13.94
1374
0.50
3:351
0 660
10.2%
11.9%
000
K.00
03250
11.9%
(249))
1596
0.41
0.751
492%
8.2
28.1%
M.00
71.14
100%
0.P9
18:9%
905%
05.05
2.45
6477
36.7%
543%
09.7%
0..4
001%
24
1506
07.%
937%
17.74
65.45
2110
2.00
13.90
118%
DAN
5.3K1
ph 15.7%
1APM
12
Kmth
2.761
16.90
0.8
127M
0550
1350
3.5%
13/90
14.0%
(124
0250
0.250
0 mmh
15.9%
112M
34
6.20
3.201
6200
1279
046
0.29
0.50
260
2250
12
502
01.5
650%
905%
10.25
9.55
03.3
9924
6.89
8.5
234%
092%
9.2
800%
15.5
8.85
05.6
18.%
966%
01.0
0885
03
930%
8.7
564h
10.55
8926
0148
2455
11114
F-00
3.8
034
0196
000%
06.75
06.5%
(8.3%
915%
10.45
930%
400%%
0515
69.2%
91.4
0.78
3075
5.00
11
(579)
3.2%)
11.79
2.00
0100
5.0h
5.00
12.70
5.501
15.23
1829)
2.561
11.7%
192
5.50
22M
(.00
13.00
Aud
Figure C.14: Heatmap of top 1 accuracy for all the obfuscations for models trained on an increasing number of obfuscations.
fig. shows accuracy across obfuscations when training all but one of the training obfuscations. The results on the diagonal show which of the obfuscations can be generalized on from training on the others. Similar to the results the hold-out obfuscations in fig. fig.[8] [eee see that generalization to unseen obfuscations is varied and in some cases, like IconOverlay, extremely limited for ResNet models.
C.5 Comparing Other Models and Training Approaches
In fig. C.16 we see the results on all obfuscations when training with the different distribution shift algorithms from fig. 10 fig. C.17 shows the same heatmap for the ViT models trained and whose hold-out accuracy we plotted in fig. 9 Similar to the results from the ViT models we took from Tensorflow Hub (fig. C.4 can see that even when not training on any of the obfuscations, ViTs can achieve solid performance on most obfuscations. We also again see only small gains from pretraining on IMAGENET-21 K, in contrast to the results we saw when comparing BiT and ConvNext models with and without pretraining. One possible explanation might be that pretraining only has a strong affect when performance is lower than what our ViT achieves already.
Another interesting observation is that the ViTs trained on all the training obfuscations achieve even higher performance than the ResNets we trained for fig. 8 All training obfuscations get an accuracy above 90% most even above 95%, showing that we were successful in tuning our obfuscations to keep the label intact for almost all images.
We see a more detailed view of the effects of adversarial training on the robustness to obfuscations in fig. C.18 This is based on the same experiments shown in fig. [1 but we can see that while adversarial training did not improve the accuracy on any of the hold-out obfuscations, it does offer significantly improved performance some of the training obfuscations when training only on
27

---

Top Joccurccy
13:002
(0.7%)
6535
915%
8704
670%
53555
9655
925%
830%
$8.5%
05.55
00.5%
972%
885%
03.1
503%
130%
345%
8.900
10800
334
133%
18.3%
0.350
11.4
0.350
2.95
902%
825%
0985
125%
04.45
955%
182%
0124
3254
000
8.20
01850
12.
190%
11.20
16200
19830
(07
1A7%
15.7%
16.00
10530
11.44
1629
199
0200
1200
15.76
00:1
400%
00.5%
0724
1515
18.05
10.15
0266
2.00
138k)
02:35
0034
53.1%
840%
50.3%
55.%
15.0%
15.1%
564%
1906
F351
13744
038
19.00
01450
(1P5)
1309%)
15.950
75444
18.90
2150
200
1170
(30%)
13.%
11.70
00455
3390
8929
65.55
69.0%
905%
15.95
1635
827%
18.2%
09.3%
922%
14.2
2504
192h
18.3
19:25
60.5
17.0%
13
60.1%
15.7%
00.1%
07.4%
15.0%
18:hh
10
254%
5726
5:N
(5ah)
11.9%
10.00
15.7M
50.00
1639
15.90
1.9%
12.0
3.900
(5.M0)
(539)
19270
19144
18.00
3.90
150%
F3.5%
0035
13.0%
954%
405% 100
137%
05.55
0099%
906%
1224
67.0%
51.95
06.00
100%
14.%
0025
0065
912%
880%
08.95
91
366%
2004
15/%
K-01
965%
0.5%
0.9%
9.300
(0250
365
132%
18.2%
11000
10300
112%
16.9%
16300
10350
160%
18.76
1.90
25.%%
0251
1979
11.29
5.50
(035)
192%
13.9%
11.50
(045)
160M
15.9
10:50)
107111
11.14
18.70
1199
2100
94N
P5.35
6614
K785
F2.6%
13
500%
117%
576%
15.0%
3.9
19.7%)
0.99
Toe Deik
1351
13.%
055
6495
09244
03.5%
974%
9.75
0.850
17.4%
366
07.7%
190%
11.3%
(0300
130%
00750
84.%
18.2%
(MA
135%
16.9%
47.9%
3400
0374
18.00
336%
2.9
000%
15/6
L22
40%
1.50
15.7%
864%
12.0
12.5%
824%
15.9%
1AT6
2735
176%
Figure C.15: Heatmap of top accuracy for all the obfuscations for models trained on all but one training obfuscation.
Top 1 accuracy
15:50
02500
33
78.2%
867%
9425
79.75
17.34
855%
15.75
15.25
224%
$3.5%
6..0%
07.45
55.25
53.2%
82.5%
53.5%
35.2%
20/5
25.%
35%
03.00
0.50
11.
13.00
(..0
15250
11.2%
0.751
10350
12/754
11.00
3.4M
13.20
13770
1100
13750
57M
11.2%
03.5
0.7%
16.2%
821%
15.50
172h
RUN1
10.9
13.7%
53.95
83311
0.0%
87.2%
8A0%
26
251%
$1.00
5130
19:24
4746
95
9328
M-11
9718
0101
175
272
12.%%
(1O04
(1:00
(.75)
15.50
C
02%
14550
135%)
KJRI
10250
18
3.2%
450
13.2%
0,36
11.
(CP50
0.0
Figure C. Heatmap of top I accuracy for all the obfuscations for models trained on different distribution shift algorithms.
accuracy
Oli-- KLYG
9C 41 P1TN 10.1 15.15
1500
PL.0 P51N 4L.VL
11.20 M5.2%
11.95
ALY4
11.65
ESTS M. NG
Dataade 932%
2175
13.0% KIEN
15.9% K.A
952% 12.4%
$1.5% K.75
12.% 2304 05.75 RUN
1025
155% 21AN
55.7
V125
(495
Ivey 2e Didanderr 1476
9G
147% W:36
06 0..0
18.5%
14.5 901N 60 0124
5172
Figure C. Heatmap of top 1 accuracy for all the obfuscations for ViT-B16 model trained on clean images only or on the training obfuscations with and without pretraining on IMAGENET-21K
28

---

18:1h
26m
27.8
11.%%
11.21
15.%
10.h
Chor Aderred
RLDN 2.000
200%
12.1
30.5
3.750
25.25
1.
8350
59.3%
15
107M
X.3%
06750
0.251
11.2%
59.3%
01201
11250
150%
00350
14.%%
COLECINC Adarmat
04.45
12.45
09.5%
750%
02200
900%
65-06
90AN
53.5
K.0%
(6250)
56.5%
972%
1.55
50.35
19.28
61.7%
6700%
10381
90.%
15.7%
12.25
36.5
4.00
Figure C. 18: Heatmap of top accuracy for all the obfuscations for models trained on clean images only or on the training obfuscations with and without adversarial training.
clean images, namely Halftoning, IconOverlay, Interleave, Liit RotateBlocks, TextOverlay and WavyColorWarp.
C.6 Comparing to Other Benchmarks
In fig. C.19 plot the performance the individual IMAGENET-C corruptions for the models trained on clean and obfuscated images from fig. 12. We see that the gains from training on obfuscations become bigger for the higher corruption strength (each IMAGENET-C corruption has 5 different strength levels) but that this seems to be limited to a few of the corruptions, mainly the ones that apply different kinds of noise the image. This might be because some of our obfuscations force the models to classify images with reduced information similar to adding noise. That these strong performance gains are limited the simpler corruptions further shows that obfuscations are very different from the IMAGENET-C C corruptions. Similar to what we saw in fig, C.13 it might also be the case that the generalization we can see is not reversible, i.c. that models that are trained with data augmented by the noise corruptions will not become significantly more robust to our obfuscations.
C.7 Top-K Accuracy
While the obfuscations drastically reduce the accuracy of the models it might be possible counteract this by being more permissible in assigning a class label to an image it is in the top-k predicted scuper))elasses, We show results for top-1 (same as fig. 4). top-3 and top-5 accuracy for the best model out of each pretrained category in fig. C.20 This leads to a significant increase in accuracy, up 87.6% worst case accuracy for the CLIP VIT model. This is still significant reduction from the almost perfect accuracy that the models now achieve on clean images. Additionally using top-5 accuracy for 16 super-classes will lead to a significant increase of false positives if we e.g. assume these classes were different types of policy violations. Therefore using top-k accuracy for k > 1 will only be a viable defense cases where over-triggering of the classifier not a concern. interesting observation is that the ordering of the models changes in some cases, e.g. the CLIP ViT 1.14 model is the strongest model for top-3 and top-5 accuracy, while the ViT-B8 is stronger for top-1.
C.8 Results Without Class Reweighting
we weight the accuracy per class by the inverse number of image per class as to not have the biggest classes dominate the overall accuracy. In fig. C.2I we show the results for the best pretrained models of each category without reweighting. If you compare the accuracies with the class reweighted ones in the top of fig. yo see there are clear differences, e.g. the worst-case accuracy of the best CLIP model drops from 55.5% to just 28.8% most likely because the clip model does not have good performance on one of the biggest classes. In general the results seem more noisy and extreme without reweighting and there is no clear trend of increase or decreased performance across either obfuscations or models. We can see this as well when looking at the standard deviation of the top accuracy for 5 different random seeds with and without reweighting in fig. C.22
As described in section 3.3
29

---

glaet sioee
beg.
music Puncersy
cresect
ling Propeetie
sloner
swikkas wase
Imsoclo matie
enter tut
rog. seppotent contat
musti crepptene Manios
Jong meeeicaenn
vany
axtuory
motior
thet
(a) Corruption Strength I
(b) Corruption Strength 2
and Clean
Rogand wdfooran
ovinc
dreivs your
plane stae
mutoot tli
plor
evee
fit
overees
ling Phephemmee
ploare
sose pid
for
mastic rranform
(c) Corruption Strength 3
(d) Corruption Strength
53
20
stasii fistioes ntente
bing poprosttoy
plant
musir
(e) Corruption Strength 5
Figure 19 Comparison top accuracy when training on only clean and training on the training obfuscations for individual IMAGENET-C corruptions.
C.9 Class Confusion
To investigate the mistakes models make through obfuscations look class confusion matrices for the ResNet50 v2 taken from Tensorflow Hub section 4.1 figs. CC233 to C.26 show the percentage of images of the true class that were classified as the predicted class for clean images and all training and hold-out obfuscations. While there are some confusions between semantically similar classes like Dog and Bear Car and Van / Truck that are simply amplified by the obfuscations we can see some interesting patterns. Some obfuscations lead to general misclassifications, i.e. classifying large percentage of images as a specific class. Examples of this are PerspectiveTransforr leading to many images being classified as Clock or Texturize leading to many images being classified as Elephant. The former might come from the fact the transformation on the black background makes the original image look like a clock on wall, while the latter most likely comes from the fact that some of the textures are grey like elephant skin.
30

---

Laccuracy
BOM NAMNO 2244--0
11.0%
273M
13.05
1LTH
9%%%
PLOG
MLTH
ALOVC
MI.IN
1024
PEP%
JANN
7777
XTAP WLUN (325
607%
(2.15
18.2%
00.94
15.25
R2ON
03.55
M1NN
4.25
11.0%
MAN
1A0% TLAN
CUPVITLSE MUX 14.2%
612%
13.85
9.2%
83.0%
6316
RL0G ML.
11.28
BL
11.55
0024
15.5
3 3accuracy
AOMMOMI 201 WUNN 8A79
66.00
M..5
43.5%
900%
87.2%
7M6
0375
1511
9034
03.45
14.00
8.2%
19.2%
56.95
91.9%
10.%
16.25
12.46
931%
73
AUVTT W1.0 14.5
812%%
964%
68.55
87.0
6:25
$2.2%
$7.25
152%
$325
552%
913%
50.2%
1420
X.55
82.2%
107%
11.5
100%
Tpp 5 Sarcurayy
1E25
FAT%
51.9
64.2%
B246
50.1
00.5
14.5%
$7.46
05.5
holeo
8A0%
203
55.75
980%
$0.0%
$5.75
9A2N
$E25
PA0S
$5.0%
99.55
61.0%
55.75
102%
012N
1L75
1EAN.
TENO
14th
M.
15.5
SCVG
1226
M0.5%
1128
514G
022
Figure C.20: Top (top), top (middle) and top 5 (bottom) accuracy for the best pretrained models of each category.
accurray
33.75
53.0%
57.4%
57.5%
03.4%
3335
100%
50.%
20.%
33.5%
53.1%
K3EN
55.0% 41.%
(1.%%
22.4%
75.7%
473%%
03.45
00.5%
422%%
17.5%
25.0%
Rarte222044
48
77P%
17.4%
87.8%
96.95
12.9
12.25
11.8%
00.5
07.7
SIERR
66.7%
2%
63.2%
18.2%
012N
18.2%
25.7%
012%
66.%%
12.3%
66.5
21.%%
592%
okay Gae
Figure C.21: Top accuracy for the best pretrained models from each category without class reweighting.
31

---

Reweighting
Rewwighting
Standard accuracy
Badkpmandiila CarlppannntlrrCnnnaalli Compaaatin
Clato
ColerteataBince
teyhheestrnnteeee
Holftaiin
lcanveriay
interleave
Inventnes
Perpeettieianafoo
Linesivt
PooeeConspettion
Astatedlaric
Rotatelmage
Sty StyleTarrferr
SwinHarp
TertDrerbyy
Coler Calerfattemdient
crecoonrrat Flanglen
Figure C.22: Standard Deviation of top 1 accuracy for ResNet50 models with different random seeds trained only on clean images.
32

---

Olein Carfasir Mere
AnvenskoPhiie www.eehhheeess Confee on Merne
PM
KMN
10.
PM
17
cm
PMN
KM
Km
4m
13
HM
130
Bakyrar
Ranc Mira
Nare
PPN
16 Pariing Colfalor N6T3
AMN
3PN
Jmm
4P%
14M
1:mh
416
3M
1m
Figure C.23: Class confusion matrices for the different obfuscations
33

---

HoRCnnterae Corka Mori
Inntweney Confaris Harze
MM
MM
PM
11:
H4h
Trayera by Co Mid44
1det exee
1.4
11
MMN
FORT.OM Carbaton Hal's
PM
1.
PM
4M
HIN
6449
FMN
KM
Lm
PMN
PAM
1Mm
3116
K16
430
Figure C.24: Class confusion matrices for the different obfuscations
34

---

Lie Communltt anden Cark ser' Marka
Fempertec Com aintici Contarce Narz
K3
134
Aggiile lae
Mare
PMN
RAX
KMN
KM
PMN
KM
Iognar Age Ca
41%
J/M
Hm
4m
PUN
Lm
Lm
AM
4M%
416
Figure C.25: Class confusion matrices for the different obfuscations
35

---

Sreef ramaee Confaree Merr
SautWire Corforie Marie
PM
1.
H4
1:
110
XM
Km
KM
THe Dentayy Curtan Mira
Tectakor Rearct Malla
PPN
MMN
Windoma Alc METS
CART JAN
Figure C.26: Class confusion matrices for the different obfuscations
36


Reviews:
[{"review_id": "ILV4JsqNOw", "reviewer": "Reviewer_W7ys", "summary": "", "questions": "", "limitations": "The authors discuss a series of limitations which, however, do not affect the relevance of this work.", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "- The paper is very well motivated, as the usage of this type of obfuscations by malicious users is extremely realistic for systems deployed to the real-world.\n- The paper provides extensive experiments showing how models are poorly robust to these perturbations and how training on a set of obfuscations makes the model robust to a held-out set. They aso observe that adversarial training and distribution shift algorithms do not help.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "A4EkYOvJb9", "reviewer": "Reviewer_hqY3", "summary": "", "questions": "", "limitations": "The authors seem didn't discuss the limitations and potential negative societal impact of their work. Please add this part in the final version.", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "The paper has designed a new benchmark for curating obfuscations approach in image attack. The paper had created, curated and tuned a set of 22 strong, diverse, adversarial obfuscations.  The authors evaluated 33 different pretrained models on our benchmark and trained models on over 60 subsets of our training obfuscations. Hence, the experimental part is very strong. The proposed method is general and broad. ", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "jfusHhtJLk", "reviewer": "Reviewer_Y2nL", "summary": "", "questions": "", "limitations": "Limitations have been adequately discussed. ", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "1. The paper aims to address an important challenge in automated content filtering and moderation, which is crucial for building thriving user communities and preventing abuse.\n2. The paper introduces a new benchmark to measure the performance of classifiers on obfuscated images.\n3. The paper presents comprehensive evaluations.\n", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "ejCCFj3ISp", "reviewer": "Reviewer_jWzW", "summary": "", "questions": "", "limitations": "It’s appreciative that the paper has a section on limitations where it poses some of the limitations of the work and the possible future works for the research community. For the rest, refer to Opportunity for Improvement.", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "S1. They propose an exhaustive set of obfuscations grouped into 5 categories. \n   S2.  They conduct a methodical set of experiments that bring out the intuitions quite succinctly.\n   S3.  The flow and writing of the manuscript is clean and thorough.", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}, {"review_id": "ntC9VVKBRH", "reviewer": "Reviewer_nVKg", "summary": "", "questions": "", "limitations": "Authors adequately addressed the limitations and potential negative societal impact of their work", "rating": 7, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "- The dataset aims to benchmark a real-life issue (robustness to image obfuscations that aim to bypass safety systems) and is thus of significant interest to the NeurIPS community\n- The dataset design is inspired by real-life attacks that the authors experience of Google systems \n- The authors additionally provide thorough benchmarks of various pretrained ImageNet models, perform analyses of different augmentation/OOD techniques, adversarial training, and show interactions between the subsets.\n- The authors demonstrate that the explored problem is not yet solved (as shown by the low test accuracy of tested approaches) and remains an active research field in which this dataset can be used for benchmarking. \n- I deeply value and respect the authors' choice to be upfront about their prior CVPR23 rejection and a summary of changes. It looks to me as if all \"issues\" were resolved.\n- Datasheet included\n- Public repo for dataset", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": ""}]

Author rebuttal:

Meta-review: This paper provides a benchmark for image obfuscations carried out by attackers aiming to fool some image classifier/detector. The benchmark provides a dataset of images obfuscated using 22 different different obfuscation, with 19 used in training and 3 held-out. They evaluate the effectiveness of training with obfuscations across different architectures, and resultant performance on the held-out obfuscations. While there were some concerns around the generalizability of the obfuscations and the use of only $\ell_p$ attacks in the adversarial example setting, the reviewers largely agreed the paper represents a good new benchmark for training models robust to varied obfuscations in the future, along with good preliminary exploration of baselines.
Decision: Accept (Poster)