Cited by 1,090Adversarial Robustness in Machine LearningMachine Learning and Data ClassificationAdvanced Neural Network Applications

Natural Adversarial Examples

Open access
Hendrycks, Dan, Zhao, Kevin, Basart, Steven, Steinhardt, Jacob, Song, Dawn·2021·2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Abstract

We introduce two challenging datasets that reliably cause machine learning model performance to substantially degrade. The datasets are collected with a simple adversarial filtration technique to create datasets with limited spurious cues. Our datasets’ real-world, unmodified examples transfer to various unseen models reliably, demonstrating that computer vision models have shared weaknesses. The first dataset is called IMAGENET-A and is like the ImageNet test set, but it is far more challenging for existing models. We also curate an adversarial out-of-distribution detection dataset called IMAGENET-O, which is the first out-of-distribution detection dataset created for ImageNet models. On IMAGENET-A a DenseNet-121 obtains around 2% accuracy, an accuracy drop of approximately 90%, and its out-of-distribution detection performance on IMAGENET-O is near random chance levels. We find that existing data augmentation techniques hardly boost performance, and using other public training datasets provides improvements that are limited. However, we find that improvements to computer vision architectures provide a promising path towards robust models.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/cvpr46437.2021.01501

Cites

13 of 13 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • MEMO is the first adaptation method to improve performance, by 1-4% over standard model evaluation, on the ImageNet-A test set.

    “Also, MEMO is, to the best of our knowledge, the first adaptation method to improve performance (by 1-4% over standard model evaluation) on the ImageNet-A test set [15].”

    From MEMO: Test Time Robustness Via Adaptation and Augmentation (2022) · cites this paper as [15]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Part of this paper’s reference list could not be split into single entries.

Flagged first, then by citations

Research works printed but not linked: 47

  1. Faruk Ahmed and Aaron C. Courville. Detecting semantic anomalies. ArXiv, abs/1908.04388, 2019. · arXiv
  2. Martín Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. ArXiv, abs/1907.02893, 2019. · arXiv
  3. David Bau, B. Zhou, A. Khosla, A. Oliva, and A. Torralba. Network dissection: Quantifying interpretability of deep vi- sual representations. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3319-3327, 2017.
  4. Chandra Bhagavatula, Ronan Le Bras, Chaitanya Malaviya, Keisuke Sakaguchi, Ari Holtzman, Hannah Rashkin, Doug Downey, Scott Yih, and Yejin Choi. Abductive common- sense reasoning. ArXiv, abs/1908.05739, 2019. · arXiv
  5. Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. Piqa: Reasoning about physical common- sense in natural language. ArXiv, abs/1911.11641, 2019. · arXiv
  6. Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. Piqa: Reasoning about physical common- sense in natural language. ArXiv, abs/1911.11641, 2020. · arXiv
  7. Wieland Brendel and Matthias Bethge. Approximating cnns with bag-of-local-features models works surprisingly well on imagenet. CoRR, abs/1904.00760, 2018. · arXiv
  8. Zheng Cai, Lifu Tu, and Kevin Gimpel. Pay attention to the ending: Strong neural baselines for the roc story cloze task. In ACL, 2017.
  9. Jia Deng, Wei Dong, Richard Socher, Li jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. CVPR, 2009.
  10. Terrance Devries and Graham W. Taylor. Improved regular- ization of convolutional neural networks with Cutout. arXiv preprint arXiv:1708.04552, 2017. · arXiv
  11. Terrance Devries and Graham W. Taylor. Learning confi- dence for out-of-distribution detection in neural networks. ArXiv, abs/1802.04865, 2018. · arXiv
  12. A. Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, M. De- hghani, Matthias Minderer, Georg Heigold, S. Gelly, Jakob Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2021.
  13. L. Engstrom, Andrew Ilyas, Shibani Santurkar, D. Tsipras, J. Steinhardt, and A. Madry. Identifying statistical bias in dataset replication. ArXiv, abs/2005.09619, 2020. · arXiv
  14. Shanghua Gao, Ming-Ming Cheng, Kai Zhao, Xinyu Zhang, Ming-Hsuan Yang, and Philip H. S. Torr. Res2net: A new multi-scale backbone architecture. IEEE transactions on pattern analysis and machine intelligence, 2019.
  15. Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. ICLR, 2019.
  16. Robert Geirhos, Carlos R. M. Temme, Jonas Rauber, Heiko H. Schütt, Matthias Bethge, and Felix A. Wich- mann. Generalisation in humans and deep neural networks. NeurIPS, 2018.
  17. Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel R. Bowman, and Noah A. Smith. An- notation artifacts in natural language inference data. ArXiv, abs/1803.02324, 2018. · arXiv
  18. Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross B. Girshick. Mask r-cnn. In CVPR, 2018.
  19. Dan Hendrycks, Steven Basart, Mantas Mazeika, Moham- madreza Mostajabi, J. Steinhardt, and D. Song. Scaling out-of-distribution detection for real-world settings. arXiv: 1911.11132, 2020. · arXiv
  20. Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kada- vath, F. Wang, Evan Dorundo, Rahul Desai, Tyler Lixuan Zhu, Samyak Parajuli, M. Guo, D. Song, J. Steinhardt, and J. Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. ArXiv, abs/2006.16241, 2020. · arXiv
  21. Dan Hendrycks, C. Burns, Steven Basart, Andrew Critch, Jerry Li, D. Song, and J. Steinhardt. Aligning ai with shared human values. ArXiv, abs/2008.02275, 2020. · arXiv
  22. Dan Hendrycks and Thomas Dietterich. Benchmarking neu- ral network robustness to common corruptions and perturba- tions. ICLR, 2019.
  23. Dan Hendrycks and Kevin Gimpel. A baseline for detect- ing misclassified and out-of-distribution examples in neural networks. ICLR, 2017.
  24. Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. ICLR, 2019.
  25. Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in Neural In- formation Processing Systems (NeurIPS), 2019.
  26. Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and D. Song. Using self-supervised learning can improve model ro- bustness and uncertainty. In NeurIPS, 2019.
  27. Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. ICLR, 2020.
  28. Jie Hu, Li Shen, Samuel Albanie, Gang Sun, and Andrea Vedaldi. Gather-excite : Exploiting feature context in convo- lutional neural networks. In NeurIPS, 2018.
  29. Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation net- works. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018.
  30. Jonathan Huang, Vivek Rathod, Chen Sun, Menglong Zhu, Anoop Korattikara Balan, Alireza Fathi, Ian Fischer, Zbig- niew Wojna, Yang Song, Sergio Guadarrama, and Kevin Murphy. Speed/accuracy trade-offs for modern convolu- tional object detectors. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017.
  31. Simon Kornblith, Jonathon Shlens, and Quoc V. Le. Do bet- ter imagenet models transfer better? CoRR, abs/1805.08974, 2018. · arXiv
  32. A. Kumar, P. Liang, and T. Ma. Verified uncertainty calibra- tion. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
  33. Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting out- of-distribution samples. ICLR, 2018.
  34. Bo-Yi Li, Felix Wu, Ser-Nam Lim, Serge J. Belongie, and Kilian Q. Weinberger. On feature normalization and data augmentation. ArXiv, abs/2002.11102, 2020. · arXiv
  35. Alexander Meinke and Matthias Hein. Towards neural net- works that provably know when they don't know. ArXiv, abs/1909.12180, 2019. · arXiv
  36. Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to im- agenet? ArXiv, abs/1902.10811, 2019. · arXiv
  37. Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adversarial winograd schema challenge at scale. ArXiv, abs/1907.10641, 2019. · arXiv
  38. Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Ba- tra. Grad-cam: Visual explanations from deep networks via gradient-based localization. International Journal of Com- puter Vision, 128:336 -359, 2019.
  39. Pierre Stock and Moustapha Cissé. Convnets and imagenet beyond accuracy: Understanding mistakes and uncovering biases. In ECCV, 2018.
  40. D. Su, Huan Zhang, H. Chen, Jinfeng Yi, P. Chen, and Yu- peng Gao. Is robustness the cost of accuracy? -a comprehen- sive study on the robustness of 18 deep image classification models. In ECCV, 2018.
  41. Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers and distillation through at- tention. arXiv preprint arXiv:2012.12877, 2020. · arXiv
  42. Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020. · arXiv
  43. Jianxiong Xiao, James Hays, Krista A. Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. 2010 IEEE Computer Soci- ety Conference on Computer Vision and Pattern Recognition, pages 3485-3492, 2010.
  44. Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. CVPR, 2016.
  45. Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, E. Cubuk, and J. Gilmer. A fourier perspective on model ro- bustness in computer vision. ArXiv, abs/1906.08988, 2019. · arXiv
  46. Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regu- larization strategy to train strong classifiers with localizable features. 2019 IEEE/CVF International Conference on Com- puter Vision (ICCV), pages 6022-6031, 2019.
  47. Hongyi Zhang, Moustapha Cissé, Yann Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. ArXiv, abs/1710.09412, 2018. · arXiv

Cited by

Sorted by citations

Authors
Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., & Song, D.
Affiliations
  • University of California, Berkeley (US)
  • University of Washington (US)
  • University of Chicago (US)
Venue
2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)
Publisher
IEEE
Published
2021-06
Pages
15257-15266
ISSN
1063-6919 (ISSN-L)
OpenAlex
W3177096435
Cited by
1,090
References
13
Citations by year
2026: 135 · 2025: 252 · 2024: 203 · 2023: 196 · 2022: 102 · 2021: 119 · 2020: 73 · 2019: 10
FWCI
69.04
Type
conference paper
Language
en
Open access
Locations
  • IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Machine Learning and Data Classification
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Neural Network Applications
Keywords
adversarial examples, transferability, out-of-distribution detection, ImageNet, data augmentation, model weaknesses, DenseNet121

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review