Analysis of Deep Networks for Monocular Depth Estimation Through Adversarial Attacks with Proposal of a Defense Method

Abstract

In this paper, we consider adversarial attacks against a system of monocular depth estimation (MDE) based on convolutional neural networks (CNNs). The motivation is two-fold. One is to study the security of MDE systems, which has not been actively considered in the community. The other is to improve our understanding of the computational mechanism of CNNs performing MDE. Toward this end, we apply the method recently proposed for visualization of MDE to defending attacks. It trains another CNN to predict a saliency map from an input image, such that the CNN for MDE continues to accurately estimate the depth map from the image with its non-salient part masked out. We report the following findings. First, unsurprisingly, attacks by IFGSM (or equivalently PGD) succeed in making the CNNs yield inaccurate depth estimates. Second, the attacks can be defended by masking out non-salient pixels, indicating that the attacks function by perturbing mostly non-salient pixels. However, the prediction of saliency maps is itself vulnerable to the attacks, even though it is not the direct target of the attacks. We show that the attacks can be defended by using a saliency map predicted by a CNN trained to be robust to the attacks. These results provide an effective defense method as well as a clue to understanding the computational mechanism of CNNs for MDE.

References in corpus (6)

• Distilling the Knowledge in a Neural Network
• What Uncertainties Do We Need in Bayesian Deep Learning for Computer Vision?
• Axiomatic Attribution for Deep Networks
• Depth Map Prediction from a Single Image using a Multi-Scale Deep Network
• SmoothGrad: removing noise by adding noise
• Biologically inspired protection of deep networks from adversarial attacks

Cited by in corpus (5)

• Universal Adversarial Perturbations: A Survey
• Adversarial Attacks on Monocular Depth Estimation
• Boosting Light-Weight Depth Estimation Via Knowledge Distillation
• Monocular Depth Estimators: Vulnerabilities and Attacks
• Black-box Adversarial Attacks on Monocular Depth Estimation Using Evolutionary Multi-objective Optimization