2018

Strike (with) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects

Alcorn, Michael A., Li, Qi, Gong, Zhitao et al.

Understand

Despite excellent performance on stationary test sets, deep neural networks (DNNs) can fail to generalize to out-of-distribution (OoD) inputs, including natural, non-adversarial ones, which are common in real-world settings.

In this paper, we present a framework for discovering DNN failures that harnesses 3D renderers and 3D models.
That is, we estimate the parameters of a 3D renderer that cause a target DNN to misbehave in response to the rendered image.
Using our framework and a self-assembled dataset of 3D objects, we investigate the vulnerability of DNNs to OoD poses of well-known objects in ImageNet.

Built on

Inverse Kinematics Problem in Robotics Using Neural Networks
B. B. Choi and C. Lawrence · 1992
Earlier work this paper cites.
OpenGL programming guide: the official guide to learning OpenGL, version 1.2
M. Woo, J. Neider, T. Davis, and D. Shreiner · 1999
Earlier work this paper cites.
Synergistic Face Detection and Pose Estimation with Energy-Based Models
M. Osadchy, M. L. Miller, and Y. LeCun · 2005
Earlier work this paper cites.
Ovvv: Using virtual worlds to design and evaluate surveillance systems
G. R. Taylor, A. J. Chosak, and P. C. Brewer · 2007
Earlier work this paper cites.
Anomaly detection: A survey
V. Chandola, A. Banerjee, and V. Kumar · 2009
Earlier work this paper cites.
Pose estimation for category specific multiview object localization
M. Ozuysal, V. Lepetit, and P. Fua · 2009
Earlier work this paper cites.
How far can you get with a modern face recognition test set using only simple features?
N. Pinto, J. J. DiCarlo, and D. D. Cox · 2009
Earlier work this paper cites.
Unbiased look at dataset bias
A. Torralba and A. A. Efros · 2011
Earlier work this paper cites.
ImageNet Classification with Deep Convolutional Neural Networks
A. Krizhevsky, I. Sutskever, and G. E. Hinton · 2012
Earlier work this paper cites.
Toward open set recognition
W. J. Scheirer, A. de Rezende Rocha, A. Sapkota, and T. E. Boult · 2013
Earlier work this paper cites.
Microsoft coco: Common objects in context
T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick · 2014
Earlier work this paper cites.
Intriguing properties of neural networks
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus · 2014
Earlier work this paper cites.
Deepdriving: Learning affordance for direct perception in autonomous driving
C. Chen, A. Seff, A. Kornhauser, and J. Xiao · 2015
Earlier work this paper cites.
Explaining and harnessing adversarial examples
I. Goodfellow, J. Shlens, and C. Szegedy · 2015
Earlier work this paper cites.
Foveation-based Mechanisms Alleviate Adversarial Examples
Y. Luo, X. Boix, G. Roig, T. Poggio, and Q. Zhao · 2015
Earlier work this paper cites.
Fundamentals of computer graphics
S. Marschner and P. Shirley · 2015
Earlier work this paper cites.
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
A. Nguyen, J. Yosinski, and J. Clune · 2015
Earlier work this paper cites.
Imagenet large scale visual recognition challenge
O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, et al · 2015
Earlier work this paper cites.
ilab-20m: A large-scale controlled object dataset to investigate deep learning
A. Borji, S. Izadi, and L. Itti · 2016
Earlier work this paper cites.

Similar

Deep Residual Learning for Image Recognition
K. He, X. Zhang, S. Ren, and J. Sun · 2016
Cited alongside, same era.
Understanding the fatal tesla accident on autopilot and the nhtsa probe
F. Lambert · 2016
Cited alongside, same era.
Rethinking the inception architecture for computer vision
C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna · 2016
Cited alongside, same era.
Rethinking the Inception Architecture for Computer Vision
C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna · 2016
Cited alongside, same era.
Objectnet3d: A large scale database for 3d object recognition
Y. Xiang, W. Kim, W. Chen, J. Ji, C. Choy, H. Su, R. Mottaghi, L. Guibas, and S. Savarese · 2016
Cited alongside, same era.
Object recognition with and without objects
Original
Z. Zhu, L. Xie, and A. L. Yuille · 2016
Cited alongside, same era.
Towards Evaluating the Robustness of Neural Networks
N. Carlini and D. Wagner · 2017
Cited alongside, same era.
Robust physical-world attacks on machine learning models
Original
I. Evtimov, K. Eykholt, E. Fernandes, T. Kohno, B. Li, A. Prakash, A. Rahmati, and D. Song · 2017
Cited alongside, same era.
Learning to fly by crashing
D. Gandhi, L. Pinto, and A. Gupta · 2017
Cited alongside, same era.
A baseline for detecting misclassified and out-of-distribution examples in neural networks
D. Hendrycks and K. Gimpel · 2017
Cited alongside, same era.
NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
J. Lu, H. Sibai, E. Fabry, and D. Forsyth · 2017
Cited alongside, same era.
Standard detectors aren’t (currently) fooled by physical adversarial stop signs
Original
J. Lu, H. Sibai, E. Fabry, and D. A. Forsyth · 2017
Cited alongside, same era.

Then

Adversarial Examples: Attacks and Defenses for Deep Learning
X. Yuan, P. He, Q. Zhu, and X. Li · 2017
Later among the works it cites.
https://moderngl.readthedocs.io/en/stable/index.html
Moderngl — moderngl 5.4.1 documentation · 2018
Closest in time.
https://slate.com/technology/2018/05/uber-car-in-fatal-arizona-crash-perceived-pedestrian-1-3-seconds-before-impact.html
The self-driving uber that killed a pedestrian didn’t brake. here’s why · 2018
Closest in time.
https://www.straitstimes.com/world/united-states/tesla-car-on-autopilot-crashes-killing-driver
Tesla car on autopilot crashes, killing driver, united states news & top stories - the straits times · 2018
Closest in time.
Geometric image synthesis
Original
H. A. Alhaija, S. K. Mustikovela, A. Geiger, and C. Rother · 2018
Closest in time.
Synthesizing robust adversarial examples
A. Athalye, L. Engstrom, A. Ilyas, and K. Kwok · 2018
Closest in time.
Why do deep convolutional networks generalize so poorly to small image transformations?
Original
A. Azulay and Y. Weiss · 2018
Closest in time.
Lavan: Localized and visible adversarial noise
Original
D. Karmon, D. Zoran, and Y. Goldberg · 2018
Closest in time.
Neural 3D Mesh Renderer
H. Kato, Y. Ushiku, and T. Harada · 2018
Closest in time.
Adversarial Geometry and Lighting using a Differentiable Renderer
H.-T. D. Liu, M. Tao, C.-L. Li, D. Nowrouzezahrai, and A. Jacobson · 2018
Closest in time.
torchvision.models — pytorch master documentation
PyTorch · 2018
Closest in time.
YOLOv3: An Incremental Improvement
J. Redmon and A. Farhadi · 2018
Closest in time.
The elephant in the room
Original
A. Rosenfeld, R. Zemel, and J. K. Tsotsos · 2018
Closest in time.
A fully-autonomous aerial robot for search and rescue applications in indoor environments using learning-based techniques
C. Sampedro, A. Rodriguez-Ramos, H. Bavle, A. Carrio, P. de la Puente, and P. Campoy · 2018
Closest in time.
Pix3d: Dataset and methods for single-image 3d shape modeling
X. Sun, J. Wu, X. Zhang, Z. Zhang, C. Zhang, T. Xue, J. B. Tenenbaum, and W. T. Freeman · 2018
Closest in time.
Deeptest: Automated testing of deep-neural-network-driven autonomous cars
Y. Tian, K. Pei, S. Jana, and B. Ray · 2018
Closest in time.
Spatially transformed adversarial examples
C. Xiao, J.-Y. Zhu, B. Li, W. He, M. Liu, and D. Song · 2018
Closest in time.
A rotation and a translation suffice: Fooling CNNs with simple transformations, 2019
L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry · 2019
Closest in time.
Making convolutional networks shift-invariant again, 2019
R. Zhang · 2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…