title: A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations
abstract: We show that simple spatial transformations, namely translations and rotations alone, suffice to fool neural networks on a significant fraction of their inputs in multiple image classification tasks. Our results are in sharp contrast to previous work in adversarial robustness that relied on more complicated optimization ap- proaches unlikely to appear outside a truly adversarial context. Moreover, the misclassifying rotations and translations are easy to find and require only a few black-box queries to the target model. Overall, our findings emphasize the need to design robust classifiers even for natural input transformations in benign settings.
  
authors: Logan Engstrom Brandon Tran Dimitris Tsipras Ludwig Schmidt Aleksander Madry
hIndex: Aleksander Madry 41