Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer
Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.
 Quality of the paper: The paper is quite clear on the background literature on adversarial examples, physics based rendering, and the core idea of generating adversarial perturbations as a function of illumination and geometric changes. Originality and Significance: The idea of using differential renderers to produce physically consistent adversarial perturbations is novel. References: The references in the paper given its scope is fine. It is recommended to explore references to other recent papers that use simulation for performance enhancement in the context of transfer learning, performance characterization (e.g. veerasavarappu et al in arxiv, WACV, CVPR (2015 - 17)) Pros: Good paper , illustrates the utility of differentiable rendering and simulations to generate adversarial examples and to use them for improving robustness. Cons: The experimental section needs to be extended and the results are limited to simulations on CIFAR-100 and evaluation on lab experimental data. Inclusion of images showing CIFAR-100 images augmented with random lighting, adversarial lighting would have been good. The details of the image generation process for that experiment is vague and not reproducible.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer
Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose a novel evaluation measure, parametric norm-balls, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 Quality of the paper: The paper is quite clear on the background literature on adversarial examples, physics based rendering, and the core idea of generating adversarial perturbations as a function of illumination and geometric changes. Originality and Significance: The idea of using differential renderers to produce physically consistent adversarial perturbations is novel. References: The references in the paper given its scope is fine. It is recommended to explore references to other recent papers that use simulation for performance enhancement in the context of transfer learning, performance characterization (e.g. veerasavarappu et al in arxiv, WACV, CVPR (2015 - 17)) Pros: Good paper , illustrates the utility of differentiable rendering and simulations to generate adversarial examples and to use them for improving robustness. Cons: The experimental section needs to be extended and the results are limited to simulations on CIFAR-100 and evaluation on lab experimental data. Inclusion of images showing CIFAR-100 images augmented with random lighting, adversarial lighting would have been good. The details of the image generation process for that experiment is vague and not reproducible.
assistant
 Quality of the paper: The paper is quite clear on the background literature on adversarial examples, physics based rendering, and the core idea of generating adversarial perturbations as a function of illumination and geometric changes. Originality and Significance: The idea of using differential renderers to produce physically consistent adversarial perturbations is novel. References: The references in the paper given its scope is fine. It is recommended to explore references to other recent papers that use simulation for performance enhancement in the context of transfer learning, performance characterization (e.g. veerasavarappu et al in arxiv, WACV, CVPR (2015 - 17)) Pros: Good paper , illustrates the utility of differentiable rendering and simulations to generate adversarial examples and to use them for improving robustness. Cons: The experimental section needs to be extended and the results are limited to simulations on CIFAR-100 and evaluation on lab experimental data. Inclusion of images showing CIFAR-100 images augmented with random lighting, adversarial lighting would have been good. The details of the image generation process for that experiment is vague and not reproducible.