One Noise to Rule Them All: Multi-View Adversarial Attacks with Universal Perturbation

TL;DR

The paper tackles adversarial vulnerabilities in 3D object recognition by introducing a universal perturbation that produces a single noise pattern applicable across multiple object views. It reframes perturbation optimization to operate on the noise itself, stacking multiple 2D views into a composite input and updating via $\mathbb{X}_{N+1}^{adv}= \text{Clip}_{X,\epsilon}\{\mathbb{X}_{N}^{adv} + \epsilon \cdot \text{sign}(\nabla_{\mathbb{X}_{N}} J(\mathbb{X}_{N}^{adv}, y_{true}))\}$, with initialization $\mathbb{X}_0^{adv} = X + r$ and $r \sim U(-0.01,0.01)$. Through Blender-based multi-view rendering and MobileNetV2 evaluation, the universal perturbation demonstrates stronger cross-view transferability and robustness at low $\epsilon$ compared to FGSM and BIM, while reducing the computational burden of per-view attacks. The work highlights the practical feasibility of multi-view adversarial threats and provides a public implementation to stimulate further research on robustness and defense in 3D perception systems.

Abstract

This paper presents a novel universal perturbation method for generating robust multi-view adversarial examples in 3D object recognition. Unlike conventional attacks limited to single views, our approach operates on multiple 2D images, offering a practical and scalable solution for enhancing model scalability and robustness. This generalizable method bridges the gap between 2D perturbations and 3D-like attack capabilities, making it suitable for real-world applications. Existing adversarial attacks may become ineffective when images undergo transformations like changes in lighting, camera position, or natural deformations. We address this challenge by crafting a single universal noise perturbation applicable to various object views. Experiments on diverse rendered 3D objects demonstrate the effectiveness of our approach. The universal perturbation successfully identified a single adversarial noise for each given set of 3D object renders from multiple poses and viewpoints. Compared to single-view attacks, our universal attacks lower classification confidence across multiple viewing angles, especially at low noise levels. A sample implementation is made available at https://github.com/memoatwit/UniversalPerturbation.

Figures (4)

• Figure 1: Top-1 and top-5 accuracies of MobileNetV2, after adversarial attacks with $\epsilon$ values ranging from 0.5 to 50, were compared with those for clean Images—unmodified images from the dataset. The accuracies were calculated using a set of 25 train images, which were rendered from 5 distinct 3D object models.
• Figure 2: Top-1 and top-5 accuracies of MobileNetV2, after adversarial attacks with epsilon $\epsilon$ values ranging from 0.5 to 50, were compared with those for clean images—unmodified images from our dataset. The accuracies were calculated using a set of 25 test images, which were rendered from 5 distinct 3D object models.
• Figure 3: Comparison of adversarial attacks on the lemon object, each with an $\epsilon$ value of 15. MobileNetV2 misclassifies these adversarial images in both top-1 and top-5 predictions. The noise level generated by BIM appears smoother than the other methods.
• Figure 4: Training images for the shovel object as attacked by FGSM, BIM, and Universal algorithms, respectively, at $\epsilon=0.05$. The prediction confidence of the correct label for each image is indicated on top.