Source-linked AI summary
Exploring the Landscape of Spatial Robustness
Logan Engstrom, Brandon Tran, Dimitris Tsipras, Ludwig Schmidt, Aleksander Madry
TL;DR
The paper asks whether classifiers remain reliable under natural rotations and translations, beyond conventional p-norm perturbations. It studies these vulnerabilities and develops robust optimization and test-time aggregation methods. Spatial attacks can sharply degrade accuracy, while first-order methods do not reliably find worst cases and the proposed defenses improve robustness.
Problem
Neural classifiers can suffer severe worst-case degradation from visually subtle adversarial inputs, while robustness research has largely focused on contrived ℓp-bounded pixel perturbations.
Method
The paper evaluates rotations and translations, parameterizes them directly, and compares first-order, random, and grid-based attacks alongside robust optimization and input aggregation defenses.
Results
Small random spatial transformations can reduce accuracy by up to 30%, while the best ImageNet model reaches 56% top1 accuracy against the strongest adversary versus 34% for standard training with augmentation.
Takeaways & Limitations
Spatial robustness requires broader similarity notions and evaluation methods beyond pixel-wise distances and first-order optimization.
Takeaways & Limitations
Random rotation and translation augmentation improves robustness against random transformations but does not significantly improve worst-case robustness and can reduce unperturbed-image accuracy.
Abstract
from arXiv · showhide
The study of adversarial robustness has so far largely focused on perturbations bound in p-norms. However, state-of-the-art models turn out to be also vulnerable to other, more natural classes of perturbations such as translations and rotations. In this work, we thoroughly investigate the vulnerability of neural network--based classifiers to rotations and translations. While data augmentation offers relatively small robustness, we use ideas from robust optimization and test-time input aggregation to significantly improve robustness. Finally we find that, in contrast to the p-norm case, first-order methods cannot reliably find worst-case perturbations. This highlights spatial robustness as a fundamentally different setting requiring additional study. Code available at https://github.com/MadryLab/adversarial_spatial and https://github.com/MadryLab/spatial-pytorch.
1 Introduction
The paper studies how image classifiers fail under natural spatial transformations and develops methods to improve robustness beyond pixel-norm defenses.
- Small rotations and translations alone can significantly degrade classifier accuracy because real-world objects are not always perfectly centered.
- 1.1 Our Methodology and Results: Random spatial transformations can reduce accuracy by up to 30%, suggesting classifier unreliability even in benign settings.
- 1.1 Our Methodology and Results: The study compares first-order, random, and grid-based adversaries, finding exhaustive grid search much more powerful than first-order attacks.
- 1.1 Our Methodology and Results: The spatial loss landscape is highly non-concave with many spurious maxima, making first-order methods unable to reliably find misclassifications.
- 1.1 Our Methodology and Results: Robust optimization and random-input aggregation substantially improve robustness, with ImageNet top1 accuracy reaching 56% against the strongest adversary versus 34% for augmented standard training.
- Spatial robustness is largely orthogonal to ℓ∞ robustness: pixel-based robustness does not imply spatial robustness, and combined attacks have cumulative effects.
2 Related Work
Prior work established spatial adversarial examples, while this paper emphasizes attack optimization and evaluates simple transformations against a broader range of models and defenses.
- Earlier work measured the minimum transformation needed to fool classifiers and compared architectures and training procedures on MNIST and CIFAR10.
- This paper instead studies optimization, showing that a few random queries often suffice while first-order methods are ineffective.
- A concurrent geodesic-distance first-order method uses a harder-to-interpret metric, whose closeness to exhaustive enumeration is unclear given the non-concave landscape.
- Other work uses more involved spatial transformations, whereas this paper shows that simple translations and rotations can break diverse classifiers.
3 Adversarial Rotations and Translations
The paper parameterizes spatial attacks by rotation and translation variables, optimizes classifier loss over them, and compares gradient, exhaustive, and random-search strategies.
- The attack searches for translation parameters (δu, δv) and rotation θ that rotate an image around its center and then translate it to induce misclassification.
- The transformation is parameterized as T(x; δu, δv, θ), producing an adversarial image x′ by applying those spatial parameters to x.
- The optimization maximizes the classifier loss L(x′, y) over δu, δv, and θ, where y is the correct label.
- The first-order method starts from random parameters and iteratively follows the loss gradient in the latent rotation-translation space.
- Grid search exhaustively evaluates a discretized, low-dimensional parameter space, making it computationally feasible for these attacks.
- Worst-of-k samples k attack parameters and selects the one producing the model's worst performance, interpolating between random choice and grid search.
4 Improving Invariance to Spatial Transformations
The section presents practical methods for improving robustness to spatial transformations despite the difficulty of fully optimizing over translations and rotations. It combines worst-of-10 robust training with majority-vote inference over random transformations.
- Data augmentation improves robustness to random transformations but does not significantly improve robustness against worst-case attacks and can reduce accuracy on unperturbed images.
- Robust optimization is hindered because grid search can increase training time by factors of 100 or 1,000, while non-convexity impedes first-order methods.
- Worst-of-10 training samples 10 allowed transformations, evaluates their losses, and trains on the transformation producing the highest loss.
- The worst-of-10 adversary provides a coarse approximation when full optimization over translations and rotations is infeasible.
- Majority inference predicts the label occurring most often across a small number of randomly transformed versions of an input image.
- Robust training and majority inference are complementary methods that can be combined to further increase model robustness.
5 Experiments
Experiments across MNIST, CIFAR10, and ImageNet show severe vulnerability to spatial transformations, while robust training and aggregation improve worst-case performance. First-order attacks underperform grid and limited-query random attacks because spatial loss landscapes are non-concave.
- Evaluating Model Robustness: Grid search reduced standard-model accuracy from 99% to 26% on MNIST, 93% to 3% on CIFAR10, and 76% to 31% on ImageNet.The attack space allowed translations of roughly 10% of image size and rotations up to ±30°.
- Evaluating Model Robustness: Random rotations and translations during training increased grid-adversary accuracy by 60% to 70% on MNIST and CIFAR10 but by less than 3% on ImageNet.The same augmentation improved both random and adversarial accuracy, with a smaller effect on ImageNet.
- Fine-grained Analysis: A significant fraction of images was fooled by 20% or more of the evaluated transformations, although most images had only a small number of adversarial transformations.The analysis measured the percentage of misclassified grid points for each example.
- Comparing Attack Methods: Worst-of-10 substantially reduced accuracy despite only 10 non-adaptive queries, whereas first-order attacks performed worse than both grid search and worst-of-10.The first-order adversary failed to approximate ground-truth accuracy even with many optimization steps.
- Failure of First-Order Methods: Spatial loss landscapes were highly non-concave with many low-value local maxima, explaining why first-order methods failed to reliably find worst-case transformations.This differs from the experimentally well-behaved ℓp-bounded setting.
- Combining Perturbation Families: Combining ℓ∞-bounded perturbations with spatial transformations reduced classification accuracy in an approximately additive manner, indicating orthogonality between the perturbation families.Models trained for ℓ∞ robustness did not achieve higher spatial robustness.
- Robustness Improvements: Combining the two defenses improved worst-case accuracy from 26% to 98% on MNIST, 3% to 82% on CIFAR10, and 31% to 56% on ImageNet.The result concerns majority-based inference combined with worst-of-10 training.
6 Conclusions
The study finds that even a few random translations or rotations can considerably degrade state-of-the-art classifier performance. These vulnerabilities extend beyond malicious worst-case settings and motivate broader similarity notions and additional architectural or training techniques.
- Conclusions: A small number of randomly chosen translations or rotations was sufficient to considerably degrade state-of-the-art classifier performance.The study examined robustness across image classifiers and these two spatial transformations.
- Conclusions: Because these transformations are natural and easily found, adversarial robustness should also concern benign environments, not only fully worst-case security settings.The authors connect this observation to reliability concerns outside explicitly malicious attacks.
- Conclusions: The results motivate incorporating additional architectural and training techniques and considering similarity notions that combine pixel-wise distances with rotations and translations.The authors present this combination as a next step toward an appropriate image-similarity notion.
A Omitted Tables and Figures
The omitted materials document attack comparisons, padding-controlled evaluations, and visual evidence that spatial attack landscapes are difficult for first-order optimization. Across examples and datasets, rotations and translations are evaluated within bounded transformation ranges.
- Table 3 compares attack methods across datasets and models.
- Rotations are restricted to 30° and translations to 3 pixels per direction for MNIST and CIFAR10, while ImageNet permits translations up to 24 pixels per direction.
- The visualizations show successful adversarial transformations for MNIST, CIFAR10, ImageNet, black-canvas inputs, and reflection-padding inputs.
- Angles that fool classifiers form a highly non-convex set across 50 random CIFAR and MNIST examples.
- Approximately 10% of correctly classified MNIST examples are misclassified under 1/5 of the grid-point transformations in the illustrated CDF.
- The loss landscape for bounded translations and rotations is significantly non-concave, weakening first-order methods for adversarial example generation.
- Figure 13 combines PGD with random or grid-searched rotations and translations to identify transformations that are most adversarial alongside ℓ∞ perturbations.
B Mirror Padding
Padding choice materially affects spatial robustness evaluations and training. Using both padding methods randomly during training roughly matches the better single-padding result.
- Mirror padding replaces empty pixels by reflecting the image around its border.
- Training with one padding method and evaluating with the other causes a significant accuracy drop.
- Randomly alternating zero and mirror padding during training roughly matches the best-case accuracy of either individual method.
- Table 6 evaluates CIFAR10 models trained with zero padding, mirror padding, or both under the Section 5 setup.