Exploring the Landscape of Spatial Robustness

Abstract

The study of adversarial robustness has so far largely focused on perturbations bound in p-norms. However, state-of-the-art models turn out to be also vulnerable to other, more natural classes of perturbations such as translations and rotations. In this work, we thoroughly investigate the vulnerability of neural network--based classifiers to rotations and translations. While data augmentation offers relatively small robustness, we use ideas from robust optimization and test-time input aggregation to significantly improve robustness. Finally we find that, in contrast to the p-norm case, first-order methods cannot reliably find worst-case perturbations. This highlights spatial robustness as a fundamentally different setting requiring additional study. Code available at https://github.com/MadryLab/adversarial_spatial and https://github.com/MadryLab/spatial-pytorch.

ICML 2019. Presented in NIPS 2017 Workshop on Machine Learning and Computer Security as "A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations."

Cited by in corpus (90)

• CovidGAN: Data Augmentation Using Auxiliary Classifier GAN for Improved Covid-19 Detection
• Robustness May Be at Odds with Accuracy
• Out-of-Distribution Generalization via Risk Extrapolation (REx)
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Measuring Robustness to Natural Distribution Shifts in Image Classification
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• RobustBench: a standardized adversarial robustness benchmark
• Rethinking the Trigger of Backdoor Attack
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• The Pitfalls of Simplicity Bias in Neural Networks
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patches
• Supporting DNN Safety Analysis and Retraining through Heatmap-based Unsupervised Learning
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Adversarial Distributional Training for Robust Deep Learning
• Monitoring and explainability of models in production
• SLAP: Improving Physical Adversarial Examples with Short-Lived Adversarial Perturbations
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Assaying Out-Of-Distribution Generalization in Transfer Learning
• Exposing Previously Undetectable Faults in Deep Neural Networks
• Unadversarial Examples: Designing Objects for Robust Vision
• Deep Stable Learning for Out-Of-Distribution Generalization
• Scale-invariant scale-channel networks: Deep networks that generalise to previously unseen scales
• BREEDS: Benchmarks for Subpopulation Shift
• Investigating Shift-Variance of Convolutional Neural Networks in Ultrasound Image Segmentation
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• Towards Analyzing Semantic Robustness of Deep Neural Networks
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• 3DB: A Framework for Debugging Computer Vision Models
• Adversarial Image Color Transformations in Explicit Color Filter Space
• Defending Against Physically Realizable Attacks on Image Classification
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• An Analysis of Deep Object Detectors For Diver Detection
• Towards Security Threats of Deep Learning Systems: A Survey
• Realistic Adversarial Data Augmentation for MR Image Segmentation
• Generalizing Graph Neural Networks on Out-Of-Distribution Graphs
• Latent Adversarial Debiasing: Mitigating Collider Bias in Deep Neural Networks
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Analyzing and Improving Neural Networks by Generating Semantic Counterexamples through Differentiable Rendering
• Alias-Free Convnets: Fractional Shift Invariance via Polynomial Activations
• Identifying Statistical Bias in Dataset Replication
• Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness
• Adv-watermark: A Novel Watermark Perturbation for Adversarial Examples
• Relative stability toward diffeomorphisms indicates performance in deep nets
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Efficiently Learning Adversarially Robust Halfspaces with Noise
• Scaling Graph-based Deep Learning models to larger networks
• Robustness in Compressed Neural Networks for Object Detection
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Toward Adversarial Robustness via Semi-supervised Robust Training
• Anti-aliasing Deep Image Classifiers using Novel Depth Adaptive Blurring and Activation Function
• Grounding inductive biases in natural images:invariance stems from variations in data
• Source-Free Adaptation to Measurement Shift via Bottom-Up Feature Restoration
• A Game Theoretic Analysis of Additive Adversarial Attacks and Defenses
• Using Synthetic Corruptions to Measure Robustness to Natural Distribution Shifts
• Ensembling with Deep Generative Views
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Adversarial and Natural Perturbations for General Robustness
• Adversarial Feature Desensitization
• Can 3D Adversarial Logos Cloak Humans?
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Adversarially Robust Learning with Unknown Perturbation Sets
• Natural Perturbed Training for General Robustness of Neural Network Classifiers
• Contemplating real-world object classification
• Adversarial Heart Attack: Neural Networks Fooled to Segment Heart Symbols in Chest X-Ray Images
• Enabling Data Diversity: Efficient Automatic Augmentation via Regularized Adversarial Training
• Using Anomaly Feature Vectors for Detecting, Classifying and Warning of Outlier Adversarial Examples
• Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks
• Out-of-Distribution Generalization in Kernel Regression
• Exploring Data Pipelines through the Process Lens: a Reference Model forComputer Vision
• Characterizing Generalization under Out-Of-Distribution Shifts in Deep Metric Learning
• Learning Transferable 3D Adversarial Cloaks for Deep Trained Detectors
• Generating Unrestricted Adversarial Examples via Three Parameters
• Pull-back Geometry of Persistent Homology Encodings
• Affine-Invariant Robust Training
• Robustifying ${\ell }_{\infty }$ Adversarial Training to the Union of Perturbation Models
• Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition
• Human Imperceptible Attacks and Applications to Improve Fairness
• Training or Architecture? How to Incorporate Invariance in Neural Networks
• Semantics-Preserving Adversarial Training
• On the alpha-loss Landscape in the Logistic Model
• Oriole: Thwarting Privacy against Trustworthy Deep Learning Models
• Built-in Elastic Transformations for Improved Robustness
• Wiggling Weights to Improve the Robustness of Classifiers
• A novel network training approach for open set image recognition
• An Empirical Review of Adversarial Defenses
• Achieving Adversarial Robustness Requires An Active Teacher
• Understanding (Non-)Robust Feature Disentanglement and the Relationship Between Low- and High-Dimensional Adversarial Attacks