[Paper Review] Houdini: Fooling Deep Structured Prediction Models

Moustapha Cissé, Yossi Adi+2 more|arXiv (Cornell University)|Jul 17, 2017

Adversarial Robustness in Machine LearningComputer Science33 references165 citations

TL;DR

The paper presents Houdini loss and an adversarial attack that disrupts deep structured prediction, notably pose estimation, causing misaligned joints and mixed parts while sometimes remaining visually plausible, leading to metric failure.

ABSTRACT

Generating adversarial examples is a critical step for evaluating and improving the robustness of learning machines. So far, most existing methods only work for classification and are not designed to alter the true performance measure of the problem at hand. We introduce a novel flexible approach named Houdini for generating adversarial examples specifically tailored for the final performance measure of the task considered, be it combinatorial and non-decomposable. We successfully apply Houdini to a range of applications such as speech recognition, pose estimation and semantic segmentation. In all cases, the attacks based on Houdini achieve higher success rate than those based on the traditional surrogates used to train the models while using a less perceptible adversarial perturbation.

Motivation & Objective

• Motivate study of robustness in deep structured prediction and pose estimation models.
• Demonstrate that Houdini loss enables adversarial perturbations that disrupt structured outputs.
• Analyze how such perturbations impact evaluation metrics and model behavior.
• Highlight types of failures such as joint shifts, part mixing, and left-right confusion.

Proposed method

• Propose and apply an adversarial attack that exploits Houdini loss to perturb structured predictions.
• Induce disruptions in pose estimation including shifts in joint positions and mixing body parts.
• Produce adversarial examples that look visually plausible but cause metric failures.
• Use visual demonstrations (e.g., Figure 1) to illustrate disrupted poses.

Experimental results

Research questions

• RQ1 What vulnerabilities does Houdini loss introduce in deep structured prediction models?
• RQ2 How do adversarial perturbations affect pose estimation outputs and associated metrics?
• RQ3 To what extent do generated adversarial poses look plausible despite incorrect predictions?
• RQ4 Can we characterize the types of errors (e.g., joint shifts, part mixing, left-right confusion) caused by Houdini-based attacks?

Key findings

• Adversarial attacks exploiting Houdini loss disrupt pose estimation.
• Perturbations cause shifts in joint positions and mixing of body parts.
• Attacks can confuse right and left joints, sometimes reversing apparent orientation.
• Target metrics fail even when altered poses look visually plausible.
• Figure 1 illustrates additional examples of disrupted poses due to the Houdini-based attack.