[Paper Review] Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Hsueh‐Ti Derek Liu, Michael Tao+3 more|arXiv (Cornell University)|Aug 8, 2018

Adversarial Robustness in Machine Learning60 references65 citations

TL;DR

The paper proposes parametric norm-balls by perturbing physical image-formation parameters (lighting and geometry) using a physically based differentiable renderer, enabling realistic adversarial examples and rendering-based data augmentation.

ABSTRACT

Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose the direct perturbation of physical parameters that underly image formation: lighting and geometry. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.

Motivation & Objective

• Motivate moving beyond pixel-space adversaries to physically grounded perturbations that reflect real-world image formation.
• Introduce a differentiable renderer that analytically differentiates pixel colors with respect to scene parameters.
• Demonstrate adversarial attacks in the parametric space for lighting and geometry and assess their realism and effectiveness.
• Explore rendered adversarial data augmentation to improve robustness against real-world perturbations.

Proposed method

• Develop a physically based differentiable renderer with analytical derivatives for lighting and geometry.
• Represent lighting via spherical harmonics to enable efficient gradient computation with respect to lighting coefficients.
• Model geometry perturbations through triangle-mesh vertex adjustments and compute analytic derivatives of vertex normals.
• Define parametric adversarial objectives by chaining gradients through the renderer and the classifier via C(I)= -CrossEntropy(f(I),Ld) + CrossEntropy(f(I),Li).
• Perform adversarial lighting and geometry attacks and extend to multi-view and subspace lighting (e.g., skylight).

Experimental results

Research questions

• RQ1 Can parametric (physically grounded) perturbations in lighting and geometry produce effective adversarial examples for image classifiers?
• RQ2 Do parametric adversaries generalize across models and viewing conditions better or differently than pixel-space attacks?
• RQ3 Can differentiable physically based rendering enable scalable adversarial data augmentation that improves robustness to real-world image formation variations?

Key findings

• Parametric norm-balls enable realistic adversarial perturbations in lighting and geometry that significantly affect classifier decisions.
• The analytically differentiable renderer provides fast, scalable derivatives with respect to lighting and geometry, outperforming prior differentiable renderers in speed and memory usage.
• Parametric adversaries show cross-model transferability and can fool unseen views, indicating broader applicability of parametric attacks.
• Rendered adversarial examples can be used for data augmentation to improve robustness on real photographs, not just computer-generated images.
• Multi-view adversarial lighting can combine losses from several views to craft perturbations that fool the classifier from multiple perspectives.