Stereoscopic Universal Perturbations across Different Architectures and Datasets

TL;DR

This paper introduces a universal adversarial perturbation method that significantly degrades the performance of stereo matching networks across different architectures and datasets, revealing vulnerabilities and proposing robustness improvements.

Contribution

The authors develop a universal perturbation technique for stereo networks that generalizes across models and datasets, and identify architectural features that enhance robustness.

Findings

Perturbations increase D1-error from 1% to 87% on benchmark datasets.

Architectural components can reduce adversarial effects by up to 60.5%.

Designing robust architectures improves resistance to both adversarial attacks and image corruptions.

Abstract

We study the effect of adversarial perturbations of images on deep stereo matching networks for the disparity estimation task. We present a method to craft a single set of perturbations that, when added to any stereo image pair in a dataset, can fool a stereo network to significantly alter the perceived scene geometry. Our perturbation images are "universal" in that they not only corrupt estimates of the network on the dataset they are optimized for, but also generalize to different architectures trained on different datasets. We evaluate our approach on multiple benchmark datasets where our perturbations can increase the D1-error (akin to fooling rate) of state-of-the-art stereo networks from 1% to as much as 87%. We investigate the effect of perturbations on the estimated scene geometry and identify object classes that are most vulnerable. Our analysis on the activations of registered points between left and right images led us to find architectural components that can increase robustness against adversaries. By simply designing networks with such components, one can reduce the effect of adversaries by up to 60.5%, which rivals the robustness of networks fine-tuned with costly adversarial data augmentation. Our design principle also improves their robustness against common image corruptions by an average of 70%.