[Paper Review] Adversarial Geometry and Lighting using a Differentiable Renderer

Hsueh‐Ti Derek Liu, Michael Tao+3 more|arXiv (Cornell University)|Aug 8, 2018

Adversarial Robustness in Machine Learning13 citations

TL;DR

This paper proposes adversarial attacks that directly perturb physical parameters—lighting and geometry—rather than pixel values, using a differentiable renderer to enable gradient-based optimization. The key contribution is a physically grounded evaluation framework using parametric norm-balls, demonstrating more realistic and secure adversarial robustness assessment in vision models.

ABSTRACT

Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose the direct perturbation of physical parameters that underly image formation: lighting and geometry. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.

Motivation & Objective

• To address the limitation of current adversarial attacks that operate solely in pixel space, which lack correspondence to real-world image formation processes.
• To develop a physically meaningful adversarial evaluation framework that reflects real-world phenomena such as lighting and geometry.
• To enable gradient-based optimization of adversarial examples by differentiating through a physically-based renderer.
• To improve the practical relevance and security motivation of adversarial robustness evaluations in machine learning.
• To balance computational efficiency and accuracy in adversarial data augmentation using differentiable rendering.

Proposed method

• The authors introduce a differentiable renderer based on models from interactive rendering, enabling backpropagation from pixel space to lighting and geometry parameters.
• They define parametric norm-balls as the set of perturbations within a specified range of physical parameters (lighting and geometry), replacing traditional pixel-norm constraints.
• The method uses gradient descent to generate adversarial examples by optimizing lighting and geometric parameters directly.
• The differentiable renderer computes gradients of pixel-level losses with respect to lighting direction, intensity, and scene geometry.
• The approach supports scalable and memory-efficient adversarial data augmentation by leveraging efficient rendering techniques.
• The framework enables end-to-end training and evaluation of models under physically plausible perturbations.

Experimental results

Research questions

• RQ1 Can adversarial attacks be made more realistic by operating in physical parameter space rather than pixel space?
• RQ2 How does the performance of adversarial attacks change when perturbing lighting and geometry instead of pixels?
• RQ3 To what extent do parametric norm-balls provide a more secure and practical evaluation of model robustness?
• RQ4 Can a differentiable renderer enable efficient and accurate gradient-based optimization for physical parameter perturbations?
• RQ5 How does the proposed method compare to standard pixel-based adversarial training in terms of robustness and generalization?

Key findings

• The proposed method enables physically grounded adversarial attacks that are more aligned with real-world image formation processes.
• Parametric norm-balls provide a more meaningful and secure evaluation metric than traditional pixel-norm constraints.
• The differentiable renderer successfully propagates gradients from pixels to lighting and geometry parameters, enabling effective optimization.
• The approach achieves scalable and memory-efficient adversarial data augmentation through efficient rendering techniques.
• Adversarial examples generated via lighting and geometry perturbations demonstrate higher practical relevance and robustness to real-world corruptions.
• The method improves model robustness under realistic physical perturbations compared to standard pixel-based attacks.