A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations

By Logan Engstrom, Dimitris Tsipras, Ludwig Schmidt, Aleksander Madry. 2017

386 citations recorded by the source corpus.

Recent work has shown that neural network-based vision classifiers exhibit a significant vulnerability to misclassifications caused by imperceptible but adversarial perturbations of their inputs. These perturbations, however, are purely pixel-wise and built out of loss function gradients of either the attacked model or its surrogate. As a result, they tend to look pretty artificial and contrived. This might suggest that vulnerability to misclassification of slight input perturbations can only arise in a truly adversarial setting and thus is unlikely to be a problem in more benign contexts. In this paper, we provide evidence that such a belief might be incorrect. To this end, we show that neural networks are already vulnerable to significantly simpler - and more likely to occur naturally - transformations of the inputs. Specifically, we demonstrate that rotations and translations alone suffice to significantly degrade the classification performance of neural network-based vision models across a spectrum of datasets. This remains to be the case even when these models are trained using appropriate data augmentation and are already robust against the canonical, pixel-wise perturbations. Also, finding such "fooling" transformation does not even require having any special access to the model or its surrogate - just trying out a small number of random rotation and translation combinations already has a significant effect. These findings suggest that our current neural network-based vision models might not be as reliable as we tend to assume.

Subfields: Computer Vision and Pattern Recognition, Global and Planetary Change, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Vision and Pattern Recognition

In Global and Planetary Change

In Safety, Robustness & Interpretability

Citations in the corpus

On Robustness and Transferability of Convolutional Neural Networks (2020, methodology): “Creating synthetic datasets by inserting objects onto backgrounds has been used for training [75, 16, 21] and evaluating models [36], but previous works do not systematically vary object size, location or orientation, or analyze translation and rotation robustness only at the image level [18].”
Do Image Classifiers Generalize Across Time? (2019, methodology): “By contrast, our PM-k metric is inspired by the “worst-of-k” metric used in prior work [6], highlighting the sensitivity of models to natural perturbations.”
Making Convolutional Networks Shift-Invariant Again (2019, background): “However, max-pooling does not provide the same anti-aliasing capability, and a curious, recently uncovered phenomenon emerges – small shifts in the input can drastically change the output (Engstrom et al., 2017; Azulay & Weiss, 2019).”
Do ImageNet Classifiers Generalize to ImageNet? (2019, background): “However, we note that more forms of adversarial robustness such as spatial transformations or color space changes have been studied [12, 14, 24, 30, 57].”
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “2 (2)Note that the sensitivity of classifiers and object detectors to 2D translations has been observed in concurrent work [35, 12, 56, 6].”
Unsolved Problems in ML Safety (2021, background): “[51] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry.”
Why do deep convolutional networks generalize so poorly to small image transformations? (2018, methodology): “Engstrom et al. (Engstrom et al., 2017b) suggested another possible solution for the lack of translation invariance: increased data augmentation.”
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, background): “For example, simple rotations and translations form a fairly limited set of perturbations that can be quite large in (cid:96) p norm, but are sometimes sufﬁcient in order to fool classiﬁers (Engstrom et al., 2017).”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “Of course, we could augment the training set with such perturbations (see Engstrom et al. (2017)).”
Training verified learners with learned verifiers (2018, methodology): “Robust optimization techniques, like those developed by Engstrom et al. [8], Madry et al. [22], overcome this problem since they attempt to ﬁnd the worst case adversarial examples at each step during training which they then augment the training batch with.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “Very recent work however has shown that small rotations [15] or spatial transformations [4] can also fool classiﬁers.”
Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning (2018, background): “However, phenomena like adversarial examples— especially those produced by feature adversaries [33], which we cover extensively in Section VII-C—or the lack of invariance to translations [78] indicate that representations learned by DNNs are not as robust as the technical community initially expecte”
Robustness May Be at Odds with Accuracy (2018, background): “These include rotations and translations (Fawzi & Frossard, 2015; Engstrom et al., 2017), and smooth spatial deformations (Xiao et al.”
Adversarially Robust Generalization Requires More Data (2018, background): “[15] Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, and Aleksander Madry.”