Towards Understanding Adversarial Robustness of Optical Flow Networks

TL;DR

This paper investigates the causes of adversarial vulnerabilities in optical flow networks, identifies architectural issues linked to the aperture problem, and proposes solutions to enhance robustness against physical patch attacks.

Contribution

It analyzes the root causes of adversarial fragility in optical flow networks and introduces architectural improvements to improve their robustness against physical attacks.

Findings

Optical flow networks are vulnerable to physical patch-based adversarial attacks due to architectural flaws.

Rectifying these flaws can significantly improve robustness against such attacks.

Universal attacks are less effective, indicating some inherent robustness in the networks.

Abstract

Recent work demonstrated the lack of robustness of optical flow networks to physical patch-based adversarial attacks. The possibility to physically attack a basic component of automotive systems is a reason for serious concerns. In this paper, we analyze the cause of the problem and show that the lack of robustness is rooted in the classical aperture problem of optical flow estimation in combination with bad choices in the details of the network architecture. We show how these mistakes can be rectified in order to make optical flow networks robust to physical patch-based attacks. Additionally, we take a look at global white-box attacks in the scope of optical flow. We find that targeted white-box attacks can be crafted to bias flow estimation models towards any desired output, but this requires access to the input images and model weights. However, in the case of universal attacks, we find that optical flow networks are robust. Code is available at https://github.com/lmb-freiburg/understanding_flow_robustness.