ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpoints
This addresses a critical vulnerability in visual recognition for real-world applications like autonomous driving, though it is incremental in extending adversarial robustness from 2D to 3D viewpoints.
The paper tackles the problem of visual recognition models lacking robustness to viewpoint changes in 3D by proposing ViewFool, a method to find adversarial viewpoints using neural radiance fields, which reveals that common classifiers are extremely vulnerable, with experiments showing a significant performance drop on the new ImageNet-V dataset.
Recent studies have demonstrated that visual recognition models lack robustness to distribution shift. However, current work mainly considers model robustness to 2D image transformations, leaving viewpoint changes in the 3D world less explored. In general, viewpoint changes are prevalent in various real-world applications (e.g., autonomous driving), making it imperative to evaluate viewpoint robustness. In this paper, we propose a novel method called ViewFool to find adversarial viewpoints that mislead visual recognition models. By encoding real-world objects as neural radiance fields (NeRF), ViewFool characterizes a distribution of diverse adversarial viewpoints under an entropic regularizer, which helps to handle the fluctuations of the real camera pose and mitigate the reality gap between the real objects and their neural representations. Experiments validate that the common image classifiers are extremely vulnerable to the generated adversarial viewpoints, which also exhibit high cross-model transferability. Based on ViewFool, we introduce ImageNet-V, a new out-of-distribution dataset for benchmarking viewpoint robustness of image classifiers. Evaluation results on 40 classifiers with diverse architectures, objective functions, and data augmentations reveal a significant drop in model performance when tested on ImageNet-V, which provides a possibility to leverage ViewFool as an effective data augmentation strategy to improve viewpoint robustness.