Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition

Christian Green, Mehmet Ergezer, Abdurrahman Zeybey

TL;DR

The paper tackles adversarial vulnerability in 3D object recognition under multi-view conditions. It proposes View-Invariant Adversarial Perturbations (VIAP), enabling a single universal perturbation that remains effective across viewpoints and supports targeted attacks. Empirical evidence on 1,210 images from 121 objects shows strong untargeted robustness and high targeted success, with top-1 accuracies exceeding $95\%$ for multiple $\epsilon$ values, outperforming FGSM and BIM. The findings underscore the practicality of view-invariant robustness assessment for 3D recognition systems and establish VIAP as a new benchmark for cross-view adversarial perturbations.

Abstract

Adversarial attacks pose significant challenges in 3D object recognition, especially in scenarios involving multi-view analysis where objects can be observed from varying angles. This paper introduces View-Invariant Adversarial Perturbations (VIAP), a novel method for crafting robust adversarial examples that remain effective across multiple viewpoints. Unlike traditional methods, VIAP enables targeted attacks capable of manipulating recognition systems to classify objects as specific, pre-determined labels, all while using a single universal perturbation. Leveraging a dataset of 1,210 images across 121 diverse rendered 3D objects, we demonstrate the effectiveness of VIAP in both targeted and untargeted settings. Our untargeted perturbations successfully generate a singular adversarial noise robust to 3D transformations, while targeted attacks achieve exceptional results, with top-1 accuracies exceeding 95% across various epsilon values. These findings highlight VIAPs potential for real-world applications, such as testing the robustness of 3D recognition systems. The proposed method sets a new benchmark for view-invariant adversarial robustness, advancing the field of adversarial machine learning for 3D object recognition.

Targeted View-Invariant Adversarial Perturbations for 3D Object Recognition

TL;DR

The paper tackles adversarial vulnerability in 3D object recognition under multi-view conditions. It proposes View-Invariant Adversarial Perturbations (VIAP), enabling a single universal perturbation that remains effective across viewpoints and supports targeted attacks. Empirical evidence on 1,210 images from 121 objects shows strong untargeted robustness and high targeted success, with top-1 accuracies exceeding for multiple values, outperforming FGSM and BIM. The findings underscore the practicality of view-invariant robustness assessment for 3D recognition systems and establish VIAP as a new benchmark for cross-view adversarial perturbations.

Abstract

Adversarial attacks pose significant challenges in 3D object recognition, especially in scenarios involving multi-view analysis where objects can be observed from varying angles. This paper introduces View-Invariant Adversarial Perturbations (VIAP), a novel method for crafting robust adversarial examples that remain effective across multiple viewpoints. Unlike traditional methods, VIAP enables targeted attacks capable of manipulating recognition systems to classify objects as specific, pre-determined labels, all while using a single universal perturbation. Leveraging a dataset of 1,210 images across 121 diverse rendered 3D objects, we demonstrate the effectiveness of VIAP in both targeted and untargeted settings. Our untargeted perturbations successfully generate a singular adversarial noise robust to 3D transformations, while targeted attacks achieve exceptional results, with top-1 accuracies exceeding 95% across various epsilon values. These findings highlight VIAPs potential for real-world applications, such as testing the robustness of 3D recognition systems. The proposed method sets a new benchmark for view-invariant adversarial robustness, advancing the field of adversarial machine learning for 3D object recognition.

Paper Structure

This paper contains 19 sections, 9 equations, 3 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Problem and Contributions
  3. Related Work
  4. Fast Gradient Sign Method (FGSM):
  5. The Basic Iterative Method (BIM)
  6. Untargeted View-Invariant Adversarial Perturbations:
  7. Multi-Object vs Single-Object Universal Perturbations:
  8. Methodology
  9. Dataset and Preprocessing
  10. Mathematical Formalization of View-Invariance
  11. Targeted View-Invariant Adversarial Perturbations
  12. Experimental Setup
  13. Evaluation Metrics
  14. Results
  15. Untargeted Attack Confidence
  16. ...and 4 more sections

Figures (3)

  • Figure 1: The top row consists of three rendered camera angles of a pineapple from the 3D object dataset. The bottom row consists of three rendered images of a tractor from Blender.
  • Figure 2: FGSM attacks at increasing $\epsilon$ values.
  • Figure 3: Figure consists of four rendered images of a strawberry with each adversarial attack at the same epsilon value. The target label (oscilloscope) soft-max prediction for each image is also listed. The clean image is included as a basis. The perturbation is still quite transparent at $\epsilon$ = 3.0.