Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow. Research in adversarial examples continues to contribute to the development of robust (semi-)supervised learning (Miyato et al., 2018) , data augmentation BID14 Sun et al., 2018) , and machine learning understanding BID24 . One important caveat of the approach pursued by much of the literature in adversarial machine learning, as discussed recently (Goodfellow, original image parametric (lighting) texture color [Athalye 17] multi-step pixel [Moosavi Dezfooli 16] parametric (geometry) one-step pixel [Goodfellow 14] Figure 1: Traditional pixel-based adversarial attacks yield unrealistic images under a larger perturbation (L ∞ -norm ≈ 0.82), however our parametric lighting and geometry perturbations output more realistic images under the same norm (more results in Appendix A).
Enabled by a novel differentiable renderer, we propose a new metric that has real-world implications for evaluating adversarial machine learning algorithms, resolving the lack of realism of the existing metric based on pixel norms.
{"src": "scitldr-AIC_train", "paper_id": "SJl2niR9KQ"}