Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Abstract

Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose the direct perturbation of physical parameters that underly image formation: lighting and geometry. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.

Cited by in corpus (17)

• Learning to Predict 3D Objects with an Interpolation-based Differentiable Renderer
• Differentiable Rendering: A Survey
• Adversarial Examples in Modern Machine Learning: A Review
• Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Models
• Exposing Previously Undetectable Faults in Deep Neural Networks
• Image GANs meet Differentiable Rendering for Inverse Graphics and Interpretable 3D Neural Rendering
• Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blink
• Towards Analyzing Semantic Robustness of Deep Neural Networks
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Finding Physical Adversarial Examples for Autonomous Driving with Fast and Differentiable Image Compositing
• MeshAdv: Adversarial Meshes for Visual Recognition
• SMART: Skeletal Motion Action Recognition aTtack
• Internal Wasserstein Distance for Adversarial Attack and Defense
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Differentiable Visual Computing
• Messing Up 3D Virtual Environments: Transferable Adversarial 3D Objects
• Training Efficiency and Robustness in Deep Learning