Robustness of 3D Deep Learning in an Adversarial Setting
This addresses safety concerns for deploying 3D deep learning in real-world applications like autonomous navigation, though it is incremental as it focuses on analysis rather than new defenses.
The paper tackles the problem of evaluating the robustness of 3D deep learning models in adversarial settings, showing that current methods overestimate robustness and that state-of-the-art models can be reduced to 0% classification accuracy by occluding just 6.5% of the input space.
Understanding the spatial arrangement and nature of real-world objects is of paramount importance to many complex engineering tasks, including autonomous navigation. Deep learning has revolutionized state-of-the-art performance for tasks in 3D environments; however, relatively little is known about the robustness of these approaches in an adversarial setting. The lack of comprehensive analysis makes it difficult to justify deployment of 3D deep learning models in real-world, safety-critical applications. In this work, we develop an algorithm for analysis of pointwise robustness of neural networks that operate on 3D data. We show that current approaches presented for understanding the resilience of state-of-the-art models vastly overestimate their robustness. We then use our algorithm to evaluate an array of state-of-the-art models in order to demonstrate their vulnerability to occlusion attacks. We show that, in the worst case, these networks can be reduced to 0% classification accuracy after the occlusion of at most 6.5% of the occupied input space.