ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints
Anonymous Author(s)
AffiliationAddress email
Abstract
Recent studies have demonstrated that visual recognition models lack robustness todistribution shift.
However, current work mainly considers model robustness to 2Dimage transformations, leaving viewpoint changes in the 3D world less explored.
In general, viewpoint changes are prevalent in various real-world applications (e.g.,autonomous driving), making it imperative to evaluate viewpoint robustness.
In thispaper, we propose a novel method called ViewFool to find adversarial viewpointsthat mislead visual recognition models.
By encoding real-world objects as neuralradiance fields (NeRF), ViewFool characterizes a distribution of diverse adversarialviewpoints under an entropic regularizer, which helps to handle the fluctuations ofthe real camera pose and mitigate the reality gap between the real objects and theirneural representations.
Experiments validate that the common image classifiers areextremely vulnerable to the generated adversarial viewpoints, which also exhibithigh cross-model transferability.
Based on ViewFool, we introduce ImageNet-V, anew out-of-distribution dataset for benchmarking viewpoint robustness of imageclassifiers.
Evaluation results on 40 classifiers with diverse architectures, objectivefunctions, and data augmentations reveal a significant drop in model performancewhen tested on ImageNet-V, which provides a possibility to leverage ViewFool asan effective data augmentation strategy to improve viewpoint robustness.
Introduction
One of the fundamental challenges of deep learning is to generalize reliably to unseen or shifted testdistributions [15, 22, 42, 56].
Typically, deep learning models can be easily deceived by adversarialexamples [18, 51], which are crafted by applying small perturbations to natural examples.
Althoughthe adversarial perturbations are imperceptible, they are quite sophisticated and can hardly exist in thewild [3, 29].
Recent works have revealed the vulnerability of visual recognition models to some natural(image) transformations, including rotation and translation [13], geometric transformations [26],image corruptions [22], and others [16, 30, 59, 60].
Out-of-distribution (OOD) generalization is thusemerging as an essential research topic in closing the gap between human and machine vision [15, 17].
Despite the progress, most works concentrate on the robustness of visual recognition models to 2Dimage transformations [13, 15, 22], while less effort has been made to explore model robustness to3D variations in the physical world, such as viewpoint changes .
In numerous real-world applications(e.g.
, autonomous driving, surveillance), viewpoint changes are arguably more natural and prevalent,which can cause severe security and safety consequences if the models cannot deal with such changes.
As human vision exhibits a strong ability to robustly recognize objects from varying viewpoints [7], itis of significant importance to study the viewpoint robustness of visual recognition models to identifyand understand their weaknesses before they are deployed in safety-critical applications.
Some prior works [5, 24] build new image datasets with different viewpoints to benchmark modelrobustness, but they cannot evaluate the worst-case performance of the model.
Other works [2, 62] propose to adversarially estimate the physical conditions (e.g., viewpoints, illumination) that causemisclassification, but these methods can only perform attacks for synthetic 3D object models, whichdo not necessarily correspond to real-world objects.
In general, evaluating the viewpoint robustness ofvisual recognition models in the physical world is considerably challenging, since it requires modelingthe real-world 3D objects with high fidelity but there is always a gap between the real-world objectsand their digital representations.
Moreover, even if the adversarial viewpoints can be generated, itis hard to control the pose of the real camera to precisely match a specific adversarial viewpoint,making the captured image fail to consistently mislead the model in the physical world.
In this paper, we propose ViewFool , a novel method to systematically generate adversarial viewpointsthat can mislead visual recognition models in the physical world, as shown in Fig. 4.
Motivated by therecent progress of neural rendering, we represent the real-world 3D objects by neural radiance fields(NeRF) [39], which can synthesize photorealistic images from novel viewpoints.
The rendered imagesare then fed into the target model to obtain the losses.
By optimizing a parameterized distribution ofadversarial viewpoints under an entropic regularizer, ViewFool can characterize diverse adversarialviewpoints to mitigate the gap between the real objects and their neural representations and improvethe resistance to camera fluctuations.
For optimization, we find that gradient calculation requiresunacceptable GPU memory usage despite the differentiability of the rendering process (detailed in
Sec. 3.3).
Therefore, we resort to search gradients that only require forward propagation through therendering process and the target model, making ViewFool applicable under a black-box setting withonly query access to the model.
We conduct extensive experiments to evaluate the viewpoint robustness of image classifiers on the
ImageNet [43] dataset.
Our results demonstrate that ViewFool can effectively generate a distributionof adversarial viewpoints against the common image classifiers, which also exhibit high transferabilityacross different models.
Moreover, we introduce a new OOD benchmark— ImageNet-V for viewpointrobustness evaluation of image classifiers.
We provide evaluation results on 40 image classifiers withdiverse network architectures (e.g., ResNet [20], vision transformer [12]), training objective functions(e.g.
, self-supervised learning [21], adversarial training [44]), and data augmentation strategies (e.g.,
AugMix [23], DeepAugment [24]).
The performance of these classifiers degrades significantly whenevaluated on ImageNet-V, demonstrating that the existing classifiers are substantially vulnerable toviewpoint changes, which may motivate future work on improving viewpoint robustness.
Related work
Deep learning robustness.
A major obstacle of deep learning models towards human-level performance is the lack of robustness to distribution shift [15, 17, 22, 42, 56].
It has been shown that deeplearning models are vulnerable to adversarial examples [18, 51], which are maliciously crafted byperturbing the natural examples with small perturbations.
Some methods have successfully generatedadversarial examples in the physical world [3, 29], raising a severe threat to the deployment of deeplearning models.
However, these adversarial examples are elaborately designed by humans, that canhardly exist in the wild.
Other works have studied the vulnerability of deep learning models to naturaltransformations.
For example, Engstrom et al.
[13] find that image translations and rotations sufficeto mislead a target model.
Hendrycks & Dietterich [22] introduce ImageNet-C/P to benchmark modelrobustness to natural image corruptions and perturbations.
The gap between human and machinevision for out-of-distribution generalization has also been analyzed [15, 17].
To address the robustnessissues, various kinds of defense and robustness improvement techniques have been proposed, e.g.,[23, 24, 32, 36, 61, 63], to name a few.
Robustness to 3D variations.
As deep learning models have been increasingly deployed in numerousreal-world applications, it is imperative to study model robustness in the 3D world.
The ObjectNet [5]and DeepFashion Remixed [24] datasets have been introduced to evaluate model performance undervarying backgrounds, camera viewpoints, and object rotations.
However, they cannot evaluate theworst-case performance of the model to 3D variations.
Zeng et al.
[62] generate adversarial examplesby perturbing the 3D physical conditions, including 3D rotations and translations, illuminations, etc.
Alcorn et al.
[2] further generate adversarial poses of the 3D objects, such that the rendered imagescan mislead deep learning models.
However, these methods require synthetic 3D object models thatdo not correspond to real-world objects, and thus they cannot be utilized in the physical world.
Ourwork differs from them mainly in that we can generate adversarial viewpoints for real-world objectsby encoding them as neural representations.
Camera
Rotation ! "
Camera
Translation
[Figure]
Rendering Δ , ,Δ . ,Δ / 3D
[Figure]
2D Image
Novel view synthesis and neural rendering.
It is a long-standing problem to synthesize novel viewsof an object/scene given a set of captured images.
Early methods [19, 31] can construct photorealisticnovel views given densely sampled input views.
Recently, plenty of works [14, 34, 37, 38, 39, 41,48, 49] adopt neural networks to model 3D objects and can render high-quality images for sparsersets of input views.
Among these approaches, neural radiance fields (NeRF) [37] show promisingresults by representing 3D objects/scenes as volumetric radiance fields parameterized by a multi-layerperceptron (MLP).
In this paper, we adopt NeRF to learn neural representations of real-world 3Dobjects and then generate adversarial viewpoints based on the rendered images.
Although NeRF cansynthesize photorealistic images, there is still a reality gap between the rendered images and the realimages, affecting the effectiveness of the adversarial viewpoints given the real objects.
Our proposedmethod eliminates this issue by learning a distribution of adversarial viewpoints, as detailed below.
Methodology
In this section, we detail the proposed ViewFool method.
ViewFool adopts NeRF to model real-world3D objects as the digital representation and performs optimization in the search space of viewpointparameters.
In the following, we first introduce the background knowledge of NeRF and then presentthe problem formulation and optimization algorithm of ViewFool.
3.1 Preliminary: neural radiance fields (NeRF)
[Figure]
NeRF [39] encodes a real-world object/scene as a continuous volumetric radiance field F : ( x , d ) →( c , τ ) .
F is approximated by a multi-layer perceptron (MLP) which takes a 3D location x ∈ R 3 anda unit-norm viewing direction d ∈ R 3 as inputs, and outputs an emitted RGB color c ∈ [0 , 1] 3 and avolume density τ ∈ R + .
The volumetric radiance field can then be rendered into a 2D image from aspecific viewpoint by computing the color of every pixel using volume rendering.
Let r ( t )
=
o
+ t ddenote the camera ray emitted from the camera center o through a given pixel on the image plane.
The color of this pixel can be approximated byˆ C ( [Equation] =
N (cid:88) i = T
[Equation]
i
[Equation] ( t i [Equation] · δ i ) ·
c ( t i ) , where T ( t i ) =
exp   − i − 1 (cid:88)
j = τ ( t j ) ·
δ j   , (1) where a set of quadrature points { t i } Ni =1 is randomly selected by stratified sampling,
c ( t i ) and τ ( t i )are the color and density at r ( t i ) , α ( x ) = 1 − exp( − x ) , and δ i =
t i +1 − t
i is the distance betweentwo adjacent points.
To train the volumetric radiance field network F , NeRF minimizes the total squared error betweenthe rendered and true pixel values given a set of images with known camera poses.
NeRF also adoptsthe positional encoding and hierarchical volume sampling strategies to improve its performance.
Thenetwork F can leverage the multiview consistency among the calibrated images to implicitly capturethe 3D nature of the underlying object, enabling it to render photorealistic novel views.
3.2 Problem formulation
Given a trained NeRF with the fixed parameters, ViewFool then estimates the adversarial viewpointssuch that the rendered images can mislead a target visual recognition model f .
As shown in Fig.
1, for a pre-defined coordinate system xyz and the initialized camera pose, we first apply 3D rotationsto the camera about the z - y ′ - X axes in sequence by the Tait–Bryan angles ( ψ, θ, ϕ ) , which are alsoknown as yaw, pitch, and roll.
We then translate the camera position by (∆ x , ∆ y , ∆ z ) along the threeaxes.
We let v :=
[ ψ, θ, ϕ, ∆ x , ∆ y , ∆ z ] ∈ R 6 denote the transformation parameters of the camera.
vis bounded in [ v min , v max ] to make the captured images recognizable by humans.
The setting ofv min and v max will be specified in Sec. 4.
Given the new camera pose, we can render a 2D imagebased on NeRF.
Note that the rendered image is only determined by the viewpoint parameters v , thuswe denote it as I :=
R ( v ) , where R is the differentiable rendering process as introduced in Sec. 3.1.
Instead of searching for a single adversarial viewpoint, ViewFool captures a diverse set of adversarialviewpoints using a distribution p ( v ) .
By optimizing the distribution p ( v ) (under proper parameterization), any viewpoint v drawn from it is likely to fool the model.
Therefore, we formulate ViewFoolas solving the following optimization problem:
[Equation]
where f is an image classification model, y is the ground-truth label of the object, L is the classificationloss (e.g., cross-entropy loss), H ( p ( v ))
=
− E p ( v ) [log p ( v )] is the entropy of the distribution p ( v ) ,and λ is a balancing hyperparameter between the two loss terms.
The entropic regularization is used toavoid the degeneration problem [11], i.e., max p ( v ) E p ( v )
[ L ( f ( R ( v )) , y )] ≤ max v L ( f ( R ( v )) , y ) ,indicating that without the entropic regularization, the optimal distribution would degenerate into a
Dirac one and cannot capture heterogeneous adversarial viewpoints.
Therefore, ViewFool adopts theentropic regularization to address this issue with the following merits.
First , ViewFool can explore the space of adversarial viewpoints by learning the underlying distribution,which could help us better understand model vulnerabilities.
Second , as it is hard to precisely controlthe real camera pose, learning a wider range of adversarial viewpoints can be more resistant to camerafluctuations, enabling to consistently mislead the target model in the physical world.
Third , although
NeRF shows promise for synthesizing photorealistic novel views of complex objects, there is stilla gap between the real object and its neural representation, making the rendered images somewhatdifferent from the real captured images.
As a result, the adversarial viewpoint generated based on
NeRF may not fool the model given the real object due to the appearance difference (which can beunderstood as a kind of adversarial noise introduced in NeRF rendering).
ViewFool eliminates thisissue by optimizing a continuous distribution of adversarial viewpoints because it is unlikely that theappearance difference can consistently fool the model under a variety of viewpoints if not optimizedto do so [3].
Fourth , the entropic regularizer can help to avoid dropping into poor local optimal of theoptimization problem to alleviate overfitting [10], leading to better cross-model transferability of theadversarial viewpoints.
These benefits of ViewFool are validated by extensive experiments in Sec. 4.
3.3 Optimization algorithm
In ViewFool, we parameterize the distribution of adversarial viewpoints with trainable parameters.
Todefine the distribution p ( v ) whose support is contained in [ v min , v max ] , we take the transformationof random variable approach asv = a · tanh( u ) + b , where u ∼ N ( µ , σ 2 I ) , a = v max − v min, b = v max + v min
[Equation]
where u follows a diagonal Gaussian distribution with mean µ ∈ R 6 and standard deviation σ ∈ R 6 ,and v is obtained by transforming u via tanh with proper normalization.
Note that we utilize thediagonal Gaussian distribution in this paper for the sake of simplicity.
Although the true distribution ofadversarial viewpoints may not be Gaussian or unimodal, we could apply our method multiple timeswith different initializations or adopt mixture distributions.
Our method is generally compatible withmore expressive distributions, e.g., multiplicative normalizing flows [35] or diffusion probabilisticmodels [50], which we leave to future work.
Given Eq.
(3), problem (2) becomes
[Equation]
where the second term is the negative log density, whose expectation is the entropy H ( p ( v )) .
To solve problem (4), we need to calculate the gradients of the loss w.r.t.
the distribution parameters( µ , σ ) .
A common method to back-propagate the gradients from random samples to the distribution parameters is the low-variance reparameterization trick [8, 28].
In particular, we reparameterize u byu = µ + σϵ , where ϵ is an auxiliary random variable following the standard Gaussian distribution
N ( 0 , I ) .
In principle, with the reparameterization, the gradients of the objective function in Eq.
(4)w.r.t.
µ and σ can be calculated, since the NeRF rendering process R is naturally differentiable.
However, we need to render the whole image of all pixels simultaneously, which requires a significantamount of GPU memory with a high image resolution.
For example, it consumes more than 300G
GPU memory for rendering a 400 × 400 image with N = 128 quadrature points each ray, making itimpractical to directly calculate the gradients through the rendering process R .
To address this problem, we adopt the search gradients to update the distribution parameters motivatedby natural evolution strategies (NES) [58].
The gradients of the first loss in Eq.
(4) can be derived as
[Equation]
Note that the gradients derived in Eq.
(5) can be estimated with only forward propagation through therendering process R and the classifier f , such that we do not need to render all pixels at the same timeto reduce the memory usage.
Moreover, it enables our method to operate in a black-box manner withonly query access to the model.
In practice, we adapt the plain search gradients by natural gradientsto stabilize the optimization process [58].
For the second loss (i.e., entropy) in Eq.
(4), we still adopt the reparameterization trick to analyticallycalculate its gradients to reduce the variance.
Overall, the gradients of the objective function in Eq.
(4)w.r.t.
µ and σ can be derived (in Appendix A) as
[Equation]
In practice, we approximate the expectation in gradient calculation by k Monte Carlo (MC) samples.
We perform multi-step gradient ascent to update the distribution parameters ( µ , σ ) until convergence.
Experiments
We consider visual recognition models on ImageNet [43] in the experiments.
To make the evaluationresults fairer and more reproducible, we first conduct experiments on synthetic 3D object modelsin Sec. 4.1.
We then study several aspects of ViewFool in Sec.
We present the experimentalresults of ViewFool on real-world 3D objects in Sec. 4.3.
Finally, we introduce a new OOD datasetcalled ImageNet-V to benchmark viewpoint robustness.
We provide evaluation results on 40 imageclassifiers with different architectures, training objective functions, and data augmentation strategiesin Sec. 4.4.
More results are provided in Appendix C.
4.1 Performance on synthetic 3D objects
Experimental settings.
We collect 100 3D models of rigid objects from BlenderKit 1 belonging tothe 1000 ImageNet classes to form our dataset.
We do not adopt public datasets such as ShapeNet [9]due to the lack of realistic textures.
More details about our dataset (including license, visualization)are provided in Appendix B.
We provide the experiments on the more realistic Objectron dataset [1]in Appendix C.7.
Following [39], we train a NeRF model for each 3D object using 100 imagesfrom varying viewpoints sampled on the upper hemisphere.
We consider two image classificationmodels, including the CNN-based ResNet-50 [20] and the Transformer-based ViT-B/16 [12].
Theyachieve 80 .
72% and 79 .
28% Top-1 accuracy on the naturally sampled images for training NeRF.
In
ViewFool, we initialize the camera at [0 , 4 , 0] as shown in Fig.
We set the range of rotation anglesas ψ ∈ [ − 180 ◦ , 180 ◦ ] , θ ∈ [ − 30 ◦ , 30 ◦ ] , ϕ ∈ [20 ◦ , 160 ◦ ] , and the range of translation distances as∆ x ∈ [ − 0 .
5 , 0 . 5] , ∆ y ∈ [ − 1 , 1] , ∆ z ∈ [ − 0 .
We study viewpoint robustness of these modelsto camera translations only (with the fixed rotation angles [ ψ, θ, ϕ ] =
[0 ◦ , 0 ◦ , 65 ◦ ] ), camera rotationsonly (with the fixed translation [∆ x , ∆ y , ∆ z ] =
[0 , 0 , 0] ), and the composition of camera rotationsand translations.
We set λ = 0 .
01 in the experiments and conduct an ablation study on λ in Sec.
We approximate the gradients in Eq.
(6) with k = 50 MC samples and adopt the Adam optimizer [27]to update the distribution parameters ( µ , σ ) for 100 iterations.
[Table]
Evaluation metrics.
After obtaining the optimal parameters ( µ ∗ , σ ∗ )
[Table]
we have the optimal distribution of adversarial viewpoints p ∗ ( v ) as well as the mean of the distribution v ∗ = a · tanh( µ ∗ ) + bwith a and b defined in Eq.
v ∗ can be understood as the optimal adversarial viewpoint .
We firstmeasure the attack success rate (i.e., misclassification rate) of the classifier given the rendered image
R ( v ∗ ) by NeRF.
We also calculate the attack success rate given the real image taken at the adversarialviewpoint v ∗ (denoted as Real( v ∗ ) ) for comparison.
Moreover, to evaluate the performance of thelearned distribution of adversarial viewpoints, we measure the attack success rate given the renderedimages from 100 viewpoints sampled from p ∗ ( v ) , denoted as R ( p ∗ ( v )) .
All those attack successrates are averaged over all 100 objects in our dataset.
Experimental results.
Table 1 shows the experimental results, where we compare ViewFool usingλ = 0 .
01 with two baselines, including ViewFool without the entropic regularizer (i.e., λ = 0 )
andthe random search method.
For random search, we only report the results for R ( p ∗ ( v )) evaluated by100 random viewpoints per object since there is no optimal viewpoint v ∗ .
We have the followingfindings based on the results.
(1) ViewFool with the entropic regularizer achieves higher attack success rates given the renderedimage— R ( v ∗ ) and the real image— Real( v ∗ ) from the optimal viewpoint v ∗ than that with λ = 0 ,because the entropic regularizer enables to sufficiently explore the space of adversarial viewpointsand converge to better local optima.
(2) The performance gap between R ( v ∗ ) and Real( v ∗ ) is smaller when using λ = 0 .
01 in mostcases, indicating that ViewFool can better mitigate the reality gap between the rendered images andthe real images.
Thus, the generated adversarial viewpoints can consistently mislead the classifier.(3)
Using the entropic regularizer can result in lower attack success rates of R ( p ∗ ( v )) , which is
mainly because that the learned distributions with λ = 0 are more concentrated and cannot capture diverse adversarial viewpoints, as further verified in Table 2.
(4) We can see that optimizing the translation and rotation parameters simultaneously can lead to
better performance than optimizing each of them alone.
Thus, we consider the composition of cameratranslations and rotations in the following experiments.
(5) ViT-B/16 is more resistant to viewpoint changes than ResNet-50, showing the superiority of thetransformer architecture, which is further validated with more architectures in Sec. 4.4.
Visualization.
Fig.
2 shows the visualization results of the adversarial viewpoints v ∗ generated by
ViewFool against ResNet-50.
It can be seen that the real images taken from the natural viewpointscan be correctly classified by the model.
By changing the viewpoints to v ∗ , the rendered images andthe real images are misclassified by the model to incorrect classes, while those images are still naturaland recognizable for humans.
In most cases, the model misclassifies the rendered image and the realimage to the same class, although they appear differently in some details.
However, there are somecounter-examples that the rendered image and the real image are misclassified to different classes( see the second last column), or the real image is not misclassified (see the last column).
Granny Smith:83.71%
TennisBall:97.81%
TennisBall:73.09%
Studio Couch :97.56%
Wallet:90.24%
Wallet:93.13%
Warplane:94.42%
Hatchet:81.23%
Hatchet:31.01%
Notebook:72.50%
Scale:93.82%
Scale:45.23%
TrafficLight:99.91%
Mortarboard:91.97%
Mortarboard:86.48%
Forklift:97.27%
RockingChair:58.98%
FoldingChair:36.51%
StreetSign:95.00%
Spatula:40.98%
StreetSign:11.74%
R e a l I m ag e f r o m
N a t u r a l
V i e w p
o i n t
R e nd ere d I m ag
e f r o m
A d v er s a r i a l V i e w p
o i n t
R e a l I m ag e f r o m
A d v er s a r i a l V i e w p
o i n t
[Table]
4.2 Additional results and ablation studies
[Table]
The effects of λ .
We adopt ResNet-50 as the target and consider λ = 0 , 0 . 0001 , 0 . 001 , 0 . 01 , 0 . 1 ,and 1 . 0 , respectively.
For each value of λ , we optimize the distribution of adversarial viewpoints bysolving Eq.
(4) for each object in our dataset.
We measure the attack success rates given the renderedimages from the optimal adversarial viewpoint R ( v ∗ ) and the optimal distribution R ( p ∗ ( v )) .
Tomeasure the diversity of the adversarial viewpoints, we further calculate the standard deviation ofviewpoint parameters [ ψ, θ, ϕ, ∆ x , ∆ y , ∆ z ] .
The results are shown in Table 2.
On one hand, we canobserve that the standard deviation of every parameter increases along with λ , which is reasonablesince we emphasize more on the entropic regularizer with a larger λ .
On the other hand, as thedistribution tends to cover a larger region of adversarial viewpoints, it inevitably contains unsuccessfulviewpoints, leading to a reduction of attack success rate given R ( p ∗ ( v )) .
However, it does not affectthe attack success rate given the rendered image R ( v ∗ ) from the optimal viewpoint.
As we discussedabove, using an appropriate λ > 0 can achieve a higher attack success rate given R ( v ∗ ) .
Cross-model transferability.
We then study the transferability of the generated adversarial viewpoints across different models.
Specifically, we adopt 6 CNN-based models including VGG-16 [47],
Inception-v3 [52], Inception-ResNet-v2 [53], DenseNet-121 [25], EfficientNet-B0 [54], MobileNetv2 [45], 2 Transformer-based models including DeiT-B [57], Swin-B [33], and 1 MLP-based model
MLP-Mixer [55].
We test the attack success rates of the adversarial viewpoints sampled from theoptimal distribution p ∗ ( v ) learned by ViewFool with λ = 0 and λ = 0 .
01 against ResNet-50 and
ViT-B/16.
We present the results in Table 3.
The adversarial viewpoints have very high attack successrates against the black-box classifiers with different architectures, showing that the vulnerabilityof visual recognition models to viewpoint changes is prevalent and intrinsic among these models.
Besides, using λ = 0 .
01 can achieve better cross-model transferability, since the entropic regularizercan avoid the overfitting problem [10] by escaping from poor local maxima of the optimizationlandscape.
[Table] [Table]
[Figure]
RealImagefromNaturalViewpoint
RenderedImagefromAdversarialViewpoint
[Figure]
[Figure]
Resistance to camera fluctuations.
In the physical-world experiments, we cannot control the real camera pose to preciselymatch the adversarial viewpoints v ∗ , thus it is important toensure the resistance of the adversarial viewpoints to camerafluctuations.
We simulate the physical-world experiments bychanging the viewpoints within a percentage of camera fluctuations.
Given a certain percentage r % , we uniformly sample20 random viewpoints from [ v ∗ − ( v max − v min ) · r % , v ∗ +( v max − v min ) · r %] and test the attack success rates given therendered images.
Fig.
3 shows the curves of attack success ratesof ViewFool against ResNet-50 with the percentage of fluctuations ranging from 1% to 10% .
The results indicate that usingλ = 0 .
01 can lead to better resistance to camera fluctuationsthat may be encountered in the physical world.
4.3 Performance on real-world 3D objects
In this section, we conduct experiments on 8 real-world objects, including 2 warplanes, 1 pineapple,1 school bus, 1 keyboard, 1 shoe, 1 orange, and 1 French loaf.
We train a NeRF model for each objectgiven 100 captured images of resolution 1600 × 900 using a handheld cellphone.
We place whitepaper underneath the object to simplify the background for NeRF training.
More experiments withoutthe white paper are in Appendix C.8.
We use COLMAP [46] to estimate the camera parameters ofeach image.
After training NeRF, we adopt ViewFool with λ = 0 .
01 to optimize the distribution ofadversarial viewpoints.
The rendered images are resized and cropped to match the input size of thetarget model.
We choose ResNet-50 and adopt the same hyperparameters as the previous experiments. [Table]
After obtaining the optimal adversarial viewpoint v ∗ for each object, we aim to take photos in thephysical world to approximate v ∗ , as shown in Fig.
Since we cannot precisely match the adversarialviewpoint v ∗ , we take a video for each object around v ∗ .
We then extract 100 frames from the videoto calculate the attack success rate in the physical world.
The results are shown in Table 4.
ViewFoolcan successfully mislead the target model on 7 out of the 8 objects, showing the effectiveness.
4.4 ImageNet-V benchmark
In this section, we introduce the ImageNet-V dataset for viewpoint robustness evaluation of imageclassifiers.
Specifically, we render 100 images per object from varying viewpoints, which are sampledfrom the distribution p ∗ ( v ) optimized by ViewFool with λ = 0 .
We choose ResNet-50 as thetarget model since it leads to better cross-model transferability than ViT-B/16, as shown in Table 3.
Therefore, ImageNet-V consists of 10000 images of 100 different objects.
Note that the backgroundof all ImageNet-V images is white.
This is conducive to evaluating viewpoint robustness solely.
We evaluate the performance of 40 image classifiers with different network architectures (including
VGG [47], ResNet [20], Inception [52, 53], DenseNet [25], EfficientNet [54], MobileNet-v2 [45],
ViT [12], DeiT [57], Swin Transformer [33], and MLP Mixer [55]), objective functions (includingadversarial training [44] and self-supervised MAE [21]), and data augmentation strategies (including
AugMix [23] and DeepAugment [24]).
Fig.
5 shows the classification accuracy of these modelson ImageNet-V.
For comparison, we also evaluate their performance on 10000 images ( 100 perobject) from natural viewpoints.
Most classifiers achieve 70% ∼ 80% accuracy on natural images,while none of them exceed 50% accuracy on ImageNet-V, demonstrating that they are vulnerableto viewpoint changes.
Among them, transformer-based models achieve the best performance (e.g., Swin-L obtains 47 .
40% accuracy and MAE with ViT-H obtains 49 .
85% accuracy), showing thesuperiority of the transformer architectures on OOD generalization [4, 6, 40].
Besides, a larger modelsize within the same architecture family tends to perform better.
[Figure]
[Table]
g M i x + D ee p
A u g m e n t
N a t u r a l A cc u r a c y
I m ag e
N e tVA cc u r a c y
Conclusion
This paper proposes ViewFool to generate adversarial viewpoints against image classification models.
ViewFool adopts NeRF to represent real-world 3D objects and learns a distribution of adversarialviewpoints under an entropic regularizer for each object.
Extensive experiments demonstrate theeffectiveness of ViewFool and also reveal the vulnerability of common image classifiers to viewpointchanges.
Moreover, we established ImageNet-V for viewpoint robustness evaluation of any classifier.
Besides evaluating viewpoint robustness, ViewFool has the possibility to be used as an effectivedata augmentation strategy to improve viewpoint robustness.
The limitations of this work includehigh computational cost, small dataset size, and no defense techniques, which we hope to address infuture work.
A potential negative societal impact of ViewFool is that it could be used by maliciousadversaries to cause security/safety issues in real-world applications.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] See Appendix C.
(c) Did you discuss any potential negative societal impacts of your work?
[Yes] See Sec. 5.
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes] See supplemen-
tary material.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running experi-
ments multiple times)?
[No] Since running ViewFool on all objects in our dataset is
time-consuming, we only ran one time.
(d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes] See Appendix C.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes] See Appendix B.
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[Yes] See Appendix B.
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[Yes] See Appendix B.
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]