Patch Attack Invariance: How Sensitive are Patch Attacks to 3D Pose?

TL;DR

This paper introduces a new metric to evaluate the robustness of patch attacks against 3D pose variations, systematically analyzes their sensitivity, and offers insights into their invariance properties to inform future attack and defense strategies.

Contribution

It develops the mean Attack Success over Transformations (mAST) metric and provides a systematic analysis of patch attack robustness to 3D pose changes, revealing key invariance properties and limits.

Findings

Increasing training support improves attack success for certain rotations.

A fundamental cutoff limit exists for attack effectiveness based on out-of-plane rotation.

Insights into 3D invariance properties guide future attack and defense design.

Abstract

Perturbation-based attacks, while not physically realizable, have been the main emphasis of adversarial machine learning (ML) research. Patch-based attacks by contrast are physically realizable, yet most work has focused on 2D domain with recent forays into 3D. Characterizing the robustness properties of patch attacks and their invariance to 3D pose is important, yet not fully elucidated, and is the focus of this paper. To this end, several contributions are made here: A) we develop a new metric called mean Attack Success over Transformations (mAST) to evaluate patch attack robustness and invariance; and B), we systematically assess robustness of patch attacks to 3D position and orientation for various conditions; in particular, we conduct a sensitivity analysis which provides important qualitative insights into attack effectiveness as a function of the 3D pose of a patch relative to the camera (rotation, translation) and sets forth some properties for patch attack 3D invariance; and C), we draw novel qualitative conclusions including: 1) we demonstrate that for some 3D transformations, namely rotation and loom, increasing the training distribution support yields an increase in patch success over the full range at test time. 2) We provide new insights into the existence of a fundamental cutoff limit in patch attack effectiveness that depends on the extent of out-of-plane rotation angles. These findings should collectively guide future design of 3D patch attacks and defenses.