Papperoni

2018

Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects

M. A. Alcorn, Q. Li, Z. Gong, Caitlin Wang, L. Mai, W. S. Ku, Anh Nguyen

Open PDF Google Scholar

citations

Cite Score

19

AI summary

This paper introduces a framework using 3D renderers and models to discover failure in DNNs due to out-of-distribution poses on ImageNet. The method shows that DNNs misclassify 97% of the pose space and that adversarial poses transfer across models like AlexNet, ResNet-50, and the MS COCO-trained YOLOv3.

Main Contributions

Introduces a framework for discovering DNN failures using 3D renderers and models.
Shows that DNNs misclassify 97% of their pose space.
Shows that adversarial poses transfer across models and datasets.
Introduces a dataset of 3D objects corresponding to 30 ImageNet classes relevant to the self-driving car application.
The ImageNet classifiers only correctly label 3.09% of the entire 6D pose space of a 3D object, and misclassify many generated adversarial examples (AXs) that are human-recognizable.

Abstract

Despite excellent performance on stationary test sets, deep neural networks (DNNs) can fail to generalize to out-of-distribution (OoD) inputs, including natural, non-adversarial ones, which are common in real-world settings. In this paper, we present a framework for discovering DNN failures that harnesses 3D renderers and 3D models. That is, we estimate the parameters of a 3D renderer that cause a target DNN to misbehave in response to the rendered image. Using our framework and a self-assembled dataset of 3D objects, we investigate the vulnerability of DNNs to OoD poses of well-known objects in ImageNet. For objects that are readily recognized by DNNs in their canonical poses, DNNs incorrectly classify 97% of their pose space. In addition, DNNs are highly sensitive to slight pose perturbations. Importantly, adversarial poses transfer across models and datasets. We find that 99.9% and 99.4% of the poses misclassified by Inception-v3 also transfer to the AlexNet and ResNet-50 image classifiers trained on the same ImageNet dataset, respectively, and 75.5% transfer to the YOLOv3 object detector trained on MS COCO.

Citation Graph

Loading graph...

References [56]

Sort:

Filter:

[1]Deep Residual Learning for Image Recognition

K. He, X. Zhang, S. Ren, Jian Sun - 2016

20 papers in library cite

This is simply amazing. Very very simple idea, totally revolutionary. No maths, just "it works!". Amazing.

[2]ImageNet Classification With Deep Convolutional Neural Networks

Alex Krizhevsky, Ilya Sutskever, Geoffrey E. Hinton - 2012

71 papers in library cite

I'm giving this a 5 just because of the impact, but this is VEEERY derivative of earlier work. Kudos for them for putting it all together, but really there's nothing revolutionary here.

[3]Microsoft COCO: Common Objects in Context

T. Y. Lin, M. Maire, S. Belongie, James Hays, Pietro Perona, D. Ramanan, Piotr Dollar, C. L. Zitnick - 2014

14 papers in library cite

I liked this paper a lot. It's a bit long and I was already a bit tired, but it was nice overall.

[4]Rethinking the Inception Architecture for Computer Vision

Zbigniew Wojna - 2015

5 papers in library cite

It's nice to see all of the performance optimizations they do, but it's very derivative

[5]Explaining and Harnessing Adversarial Examples

Ian J. Goodfellow, J. Shlens, Christian Szegedy - 2015

4 papers in library cite

It feels that it is an extension of the previous paper, which is nice. It is less original but also easier to read!

[6]Intriguing Properties of Neural Networks

Rob Fergus - 2014

7 papers in library cite

Very nice, and the first to notice how flaky NNs are. I think the end they went overboard with math, but the rest of the paper is very good.

[7]Imagenet Large Scale Visual Recognition Challenge

O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Zhongqiang Huang, A. Karpathy, A. Khosla, M. Bernstein - 2014

18 papers in library cite

Imagenet dataset challenge paper

[8]YOLOv3: An Incremental Im Provement

Joseph Redmon, Ali Farhadi - 2018

1 paper in library cites

[9]Object Recognition With and Without Objects

Z. Zhu, L. Xie, A. L. Yuille - 2016

1 paper in library cites

You can predict objects from the background alone

[10]Dataset Shift in Machine Learning

J. Q. Candela, M. Sugiyama, A. Schwaighofer, N. D. Lawrence - 2009

4 papers in library cite

Book, 250 pages

[11]Unbiased Look at dataset Bias

Antonio Torralba, A. Efros - 2011

5 papers in library cite

[12]A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Net Works

Dan Hendrycks, Kevin Gimpel - 2017

4 papers in library cite

[13]Synergistic Face Detection and Pose Estimation With Energy-Based Models

M. Osadchy, Yann Lecun, M. Miller - 2007

4 papers in library cite

[14]Deep Neural Networks Are Easily Fooled: High Confidence Predictions for Unrec Ognizable Images

Anh Nguyen, Jason Yosinski, J. Clune - 2015

3 papers in library cite

[15]A Fully-Autonomous Aerial Robot for Search and Rescue Applications in Indoor Environ ments Using Learning-Based Techniques

C. Sampedro, A. R. Ramos, H. Bavle, A. Carrio, P. D. L. Puente, P. Campoy - 2018

1 paper in library cites

[16]A Rotation and a Translation Suffice: Fooling CNNs With Sim ple Transformations

L. Engstrom, B. Tran, D. Tsipras, Ludwig Schmidt, A. Madry - 2019

1 paper in library cites

[17]Adversarial Examples: Attacks and Defenses for Deep Learning

X. Yuan, Pengcheng He, Qihao Zhu, Xiang Lisa Li - 2017

1 paper in library cites

Missing year

[18]Adversarial Geometry and Lighting Using a Differentiable Renderer

H. T. D. Liu, M. Tao, Chun-Liang Li, D. Nowrouzezahrai, A. Jacobson

1 paper in library cites

[19]Anomaly Detec Tion: A Survey

V. Chandola, A. Banerjee, V. Kumar - 2009

1 paper in library cites

[20]Deep Neuroevolution: Genetic Algorithms Are a Competitive Alternative for Training Deep Neural Networks for Reinforcement Learning

Felipe Petroski Such, V. Madhavan, E. Conti, J. Lehman, K. O. Stanley, J. Clune - 2017

1 paper in library cites

[21]Deepdriving: Learning Affordance for Direct Perception in Autonomous Driving

C. C. Chen, A. Seff, A. Kornhauser, Jianxiong Xiao - 2015

1 paper in library cites

[22]Deeptest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars

Yuandong Tian, K. Pei, S. Jana, B. Ray - 2018

1 paper in library cites

[23]Foveation Based Mechanisms Alleviate Adversarial Examples

Y. Luo, X. Boix, G. Roig, T. Poggio, Q. Zhao - 2015

1 paper in library cites

[24]Fundamentals of Computer Graphics

S. Marschner, P. Shirley - 2015

1 paper in library cites

[25]Geometric Image Synthesis

H. A. Alhaija, S. K. Mustikovela, A. Geiger, C. Rother - 2018

1 paper in library cites

[26]How Far Can You Get With a Modern Face Recognition Test Set Using Only Simple

N. Pinto, J. J. Dicarlo, D. D. Cox - 2009

1 paper in library cites

[27]ilab-20m: A Large-Scale Con Trolled Object Dataset to Investigate Deep Learning

A. Borji, S. Izadi, L. Itti - 2016

1 paper in library cites

[28]Inverse Kinematics Problem in Robotics Using Neural Networks

B. B. Choi, C. Lawrence - 1992

1 paper in library cites

[29]Lavan: Lo Calized and Visible Adversarial Noise

D. Karmon, D. Zoran, Y. Goldberg - 2018

1 paper in library cites

[30]Learning From Simulated and Unsupervised Images Through Adversarial Training

A. Shrivastava, Tomas Pfister, O. Tuzel, J. Susskind, Wenyi Wang, R. Webb - 2017

1 paper in library cites

[31]Learning to Fly by Crashing

D. Gandhi, L. Pinto, Aman Gupta - 2017

1 paper in library cites

[32]Making Convolutional Networks Shift-Invariant Again

Robert Zhang - 2019

1 paper in library cites

Missing author listMissing year

[33]Moderngl 5.4.1 Documentation

1 paper in library cites

[34]Neural 3D Mesh Renderer

H. Kato, Y. Ushiku, T. Harada - 2018

1 paper in library cites

[35]NO Need to Worry About Adversarial Examples in Object Detection in Autonomous Vehicles

J. Lu, H. Sibai, E. Fabry, David Forsyth - 2017

1 paper in library cites

[36]Objectnet3d: A Large Scale Database for 3d Object Recognition

Y. Xiang, W. Kim, Weizhu Chen, Jiaming Ji, C. Choy, H. Su, R. M. Taghi, L. Guibas, Silvio Savarese - 2016

1 paper in library cites

[37]One Pixel Attack for Fooling Deep Neural Networks

Jianlin Su, D. V. Vargas, S. Kouichi - 2017

1 paper in library cites

[38]Opengl Programming Guide: The Official Guide to Learning Opengl, Ver Sion 1.2

M. Woo, J. Neider, T. Davis, D. Shreiner - 1999

1 paper in library cites

[39]Ovvv: Using Virtual Worlds to Design and Evaluate Surveillance Systems

G. R. Taylor, A. J. Chosak, P. C. Brewer - 2007

1 paper in library cites

[40]Pix3d: Dataset and Methods for Single-Image 3d Shape Modeling

X. Sun, Jeffrey Wu, X. Zhang, Zhengyou Zhang, Chiyuan Zhang, T. Xue, Joshua B. Tenenbaum, William T. Freeman - 2018

1 paper in library cites

[41]Plug & Play Generative Networks: Conditional Iterative Generation of Images in Latent Space

Anh Nguyen, J. Clune, Yoshua Bengio, Alexey Dosovitskiy, Jason Yosinski - 2017

1 paper in library cites

[42]Pose Estimation for cate gory Specific Multiview Object Localization

M. Ozuysal, V. Lepetit, P. Fua - 2009

1 paper in library cites

[43]Posecnn: A Convolutional Neural Network for 6d Object Pose Estimation in Cluttered Scenes

Y. Xiang, T. Schmidt, V. Narayanan, D. Fox - 2017

1 paper in library cites

[44]Robust Physical World Attacks on Machine Learning Models

I. Evtimov, K. Eykholt, E. Fernandes, T. Kohno, Boxuan Li, A. Prakash, A. Rahmati, Dawn Song - 2017

1 paper in library cites

[45]Spatially Transformed Adversarial Examples

C. Xiao, J. Y. Zhu, Boxuan Li, Weiran He, Mickel Liu, Dawn Song - 2018

1 paper in library cites

[46]Standard de Tectors Aren’t (Currently) Fooled by Physical Adversarial Stop Signs

J. Lu, H. Sibai, E. Fabry, D. A. Forsyth - 2017

1 paper in library cites

[47]Synthesizing Robust Adversarial Examples

A. Athalye, L. Engstrom, A. Ilyas, K. Kwok - 2018

1 paper in library cites

Missing author listMissing year

[48]Tesla Car on Autopilot Crashes, Killing Driver, united states news & Top Stories - The Straits Times

1 paper in library cites

[49]The Elephant in the Room

A. Rosenfeld, R. Zemel, J. K. Tsotsos - 2018

1 paper in library cites

Missing author listMissing year

[50]The Self-Driving Uber That Killed a Pedestrian Didn’t Brake. Here’s Why

1 paper in library cites

Missing author listMissing year

[51]torchvision.models pytorch Master Documen Tation

1 paper in library cites

[52]Toward Open Set Recognition

W. J. Scheirer, A. D. R. Rocha, A. Sapkota, T. E. Boult - 2013

1 paper in library cites

[53]Towards Evaluating the Robust Ness of Neural Networks

Nicholas Carlini, D. Wagner - 2017

1 paper in library cites

[54]Understanding the Fatal Tesla Accident on autopi Lot and the Nhtsa Probe

F. Lambert - 2016

1 paper in library cites

[55]Unrealcv: Virtual Worlds for Computer Vision

Y. Z. S. Q. Z. X. T. S. K. Y. W. A. Y. W. Qiu, F. W. Zhong - 2017

1 paper in library cites

[56]Why Do Deep Convolutional Net Works Generalize So Poorly to Small Image Transformations?

A. Azulay, Y. Weiss - 2018

1 paper in library cites

Cited by

1

papers in your library

Cites

10

papers in your library

Read

on November 9, 2025

Very cool the way that they propagate the parameters back to the renderer and it's nice that this is way more applicable than just plain adversarial examples

Tags

Paper Aliases

No aliases