{"type":"ScholarlyArticle","title":"Spatially Constrained Adversarial Attack Detection and Localization in the Representation Space of Optical Flow Networks","authors":[{"name":"Hannah Kim","slug":"hannah-kim","given":"Hannah","family":"Kim","affiliation":"Duke University; IBM Research Africa"},{"name":"Celia Cintas","slug":"celia-cintas","given":"Celia","family":"Cintas","affiliation":"IBM Research Africa"},{"name":"Girmaw Abebe Tadesse","slug":"girmaw-abebe-tadesse","given":"Girmaw Abebe","family":"Tadesse","affiliation":"IBM Research Africa"},{"name":"Skyler Speakman","slug":"skyler-speakman","given":"Skyler","family":"Speakman","affiliation":"IBM Research Africa"}],"abstract":"Optical flow estimation have shown significant improvements with advances in deep neural networks. However, these flow networks have recently been shown to be vulnerable to patch-based adversarial attacks, which poses security risks in real-world applications, such as self-driving cars and robotics. We propose SADL, a Spatially constrained adversarial Attack Detection and Localization framework, to detect and localize these patch-based attack without requiring a dedicated training. The detection of an attacked input sequence is performed via iterative optimization on the features from the inner layers of flow networks, without any prior knowledge of the attacks. The novel spatially constrained optimization ensures that the detected anomalous subset of features comes from a local region. To this end, SADL provides a subset of nodes within a spatial neighborhood that contribute more to the detection, which will be utilized to localize the attack in the input sequence. The proposed SADL is validated across multiple datasets and flow networks. With patch attacks 4.8% of the size of the input image resolution on RAFT, our method successfully detects and localizes them with an average precision of 0.946 and 0.951 for KITTI-2015 and MPI-Sintel datasets, respectively. The results show that SADL consistently achieves higher detection rates than existing methods and provides new localization capabilities.","doi":"10.24963/ijcai.2023/107","url":"https://ijcai.org/proceedings/2023/107","pdf":"https://ijcai.org/proceedings/2023/0107.pdf","markdown":"https://ijcai.org/proceedings/2023/107.md","bibtex":"https://ijcai.org/proceedings/2023/bibtex/107","volume":{"slug":"2023","title":"Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2023","url":"https://ijcai.org/proceedings/2023/","year":2023,"location":"Macao, SAR","dates":"19-25 August 2023","editors":"Edith Elkind","isbn":"978-1-956792-03-4","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2023"},"section":"Computer Vision","track":"Main Track","number":107,"pages":{"first":965,"last":973},"keywords":["Computer Vision: CV: Motion and tracking","Computer Vision: CV: Adversarial learning, adversarial attack and defense methods"],"videos":[],"references":[{"position":1,"raw":"[Agarwal et al., 2009] Sameer Agarwal, Noah Snavely, Ian Simon, Steven Seitz, and Richard Szeliski. Building Rome in a day. Proceedings of the IEEE International Confer- ence on Computer Vision, pages 72-79, 2009.","title":"Building Rome in a day","authors":"Sameer Agarwal, Noah Snavely, Ian Simon, Steven Seitz, Richard Szeliski","year":"2009","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Akhtar and Mian, 2018] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access, 6:14410-14430, 2018.","title":"Threat of adversarial attacks on deep learning in computer vision: A survey","authors":"Naveed Akhtar, Ajmal Mian","year":"2018","venue":"Ieee Access","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Akinwande et al., 2020] Victor Akinwande, Celia Cintas, Skyler Speakman, and Srihari Sridharan. Identifying au- dio adversarial examples via anomalous pattern detection. arXiv preprint arXiv:2002.05463, 2020.","title":"Identifying audio adversarial examples via anomalous pattern detection","authors":"Celia Victor Akinwande, Skyler Cintas, Srihari Speakman, Sridharan","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Berk and Jones, 1979] Robert H. Berk and Douglas H. Jones. Goodness-of-fit test statistics that dominate the kol- mogorov statistics. Probability Theory and Related Fields, 47(1):47-59, January 1979.","title":"Goodness-of-fit test statistics that dominate the kolmogorov statistics","authors":"Robert H Berk, Douglas H Jones","year":"1979","venue":"Probability Theory and Related Fields","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Butler et al., 2012] Daniel J. Butler, Jonas Wulff, Garrett B. Stanley, and Michael J. Black. A naturalistic open source movie for optical flow evaluation. In A. Fitzgibbon et al. (Eds.), editor, Proceedings of the European Conference on Computer Vision, Part IV, LNCS 7577, pages 611-625. Springer-Verlag, October 2012.","title":"A naturalistic open source movie for optical flow evaluation","authors":"J Daniel, Jonas Butler, Garrett B Wulff, Michael J Stanley, Black","year":"2012","venue":"Proceedings of the European Conference on Computer Vision, Part IV, LNCS","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen and Koltun, 2016] Qifeng Chen and Vladlen Koltun. Full flow: Optical flow estimation by global optimization over regular grids. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4706- 4714. IEEE Computer Society, 2016.","title":"Full flow: Optical flow estimation by global optimization over regular grids","authors":"Chen, Koltun ;, Qifeng Chen, Vladlen Koltun","year":"2016","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Cintas et al., 2020] Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, and Edward McFowland. Detecting ad- versarial attacks via subset scanning of autoencoder ac- tivations and reconstruction error. In Christian Bessiere, editor, International Joint Conference on Artificial Intelli- gence, pages 876-882. International Joint Conferences on Artificial Intelligence Organization, 7 2020. Main track. [Cintas et al., 2022]","title":"Detecting adversarial attacks via subset scanning of autoencoder activations and reconstruction error","authors":"Celia Cintas, Skyler Speakman, Victor Akinwande, William Ogallo, Komminist Weldemariam, Srihari Sridharan, Edward Mcfowland","year":"2020","venue":"International Joint Conferences on Artificial Intelligence Organization","doi":null,"url":null,"internal_url":"/proceedings/2020/122"},{"position":8,"raw":"Celia Cintas, Payel Das, Girmaw Abebe Tadesse, Brian Quanz, Skyler Speakman, and Pin-Yu Chen. Towards creativity characterization of generative models via group-based subset scanning. In International Joint Conference on Artificial Intelligence, pages 4929- 4935, 2022.","title":"Towards creativity characterization of generative models via group-based subset scanning","authors":"Celia Cintas, Payel Das, Girmaw Abebe Tadesse, Brian Quanz, Skyler Speakman, Pin-Yu Chen","year":"2022","venue":"International Joint Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":"/proceedings/2022/683"},{"position":9,"raw":"[Diba et al., 2017] Ali Diba, Mohsen Fayyaz, Vivek Sharma, Amir Hossein Karami, Mohammad Mahdi Arzani, Rah- man Yousefzadeh, and Luc Van Gool. Temporal 3d con- vnets: New architecture and transfer learning for video classification. CoRR, abs/1711.08200, 2017.","title":"Temporal 3d convnets: New architecture and transfer learning for video classification","authors":"Ali Diba, Mohsen Fayyaz, Vivek Sharma, Amir Hossein Karami, Mohammad Mahdi Arzani, Rahman Yousefzadeh, Luc Van Gool","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Dosovitskiy et al., 2015] Alexey Dosovitskiy, Philipp Fis- chery, Eddy Ilg, Philip Hausser, Caner Hazirbas, Vladimir Golkov, Patrick van der Smagt, Daniel Cremers, and Thomas Brox. Flownet: Learning optical flow with con- volutional networks. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, ICCV '15, pages 2758-2766, Washington, DC, USA, 2015. IEEE Computer Society.","title":"Flownet: Learning optical flow with convolutional networks","authors":"Alexey Dosovitskiy, Philipp Fischery, Eddy Ilg, Philip Hausser, Caner Hazirbas, Vladimir Golkov, Patrick Van Der Smagt, Daniel Cremers, Thomas Brox","year":"2015","venue":"Proceedings of the IEEE International Conference on Computer Vision, ICCV '15","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Geiger et al., 2013] Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets robotics: The kitti dataset. International Journal of Robotics Research, 2013.","title":"Vision meets robotics: The kitti dataset","authors":"Geiger","year":"2013","venue":"International Journal of Robotics Research","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Ilg et al., 2017] Eddy Ilg, N. Mayer, Tonmoy Saikia, Mar- gret Keuper, A. Dosovitskiy, and T. Brox. Flownet 2.0: Evolution of optical flow estimation with deep networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1647-1655, 2017.","title":"Flownet 2.0: Evolution of optical flow estimation with deep networks","authors":"N Eddy Ilg, Tonmoy Mayer, Margret Saikia, A Keuper, T Dosovitskiy, Brox","year":"2017","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kim et al., 2021] Hannah Halin Kim, Shuzhi Yu, and Carlo Tomasi. Joint detection of motion boundaries and occlu- sions. In British Machine Vision Conference, 2021.","title":"Joint detection of motion boundaries and occlusions","authors":"Kim Hannah Halin, Shuzhi Yu, Carlo Tomasi","year":"2021","venue":"British Machine Vision Conference","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Kim et al., 2022a] Hannah Kim, Girmaw Abebe Tadesse, Celia Cintas, Skyler Speakman, and Kush Varshney. Out- of-distribution detection in dermatology using input per- turbation and subset scanning. In IEEE 19th International Symposium on Biomedical Imaging, pages 1-4, 2022.","title":"Outof-distribution detection in dermatology using input perturbation and subset scanning","authors":"Kim","year":"2022","venue":"IEEE 19th International Symposium on Biomedical Imaging","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Kim et al., 2022b] Hannah Halin Kim, Shuzhi Yu, Shuai Yuan, and Carlo Tomasi. Cross-attention transformer for video interpolation. In Asian Conference on Computer Vi- sion Workshops, pages 320-337, 2022.","title":"Cross-attention transformer for video interpolation","authors":"Kim","year":"2022","venue":"Asian Conference on Computer Vision Workshops","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Le Gall, 1991] Didier Le Gall. Mpeg: A video compression standard for multimedia applications. Commun. ACM, 34(4):46-58, April 1991.","title":"Mpeg: A video compression standard for multimedia applications","authors":"Le Didier, Gall","year":"1991","venue":"Commun. ACM","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Liu et al., 2019] Pengpeng Liu, Michael Lyu, Irwin King, and Jia Xu. Selflow: Self-supervised learning of optical flow. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4571-4580, 2019.","title":"Selflow: Self-supervised learning of optical flow","authors":"Liu","year":"2019","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[McFowland et al., 2013] Edward McFowland, Skyler Speakman, and Daniel B. Neill. Fast generalized subset scan for anomalous pattern detection. Journal of Machine Learning Research, 14(12):1533-1561, 2013.","title":"Fast generalized subset scan for anomalous pattern detection","authors":"Edward Mcfowland, Skyler Speakman, Daniel B Neill","year":"2013","venue":"Journal of Machine Learning Research","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Menze and Geiger, 2015] Moritz Menze and Andreas Geiger. Object scene flow for autonomous vehicles. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2015.","title":"Object scene flow for autonomous vehicles","authors":"Geiger Menze, Moritz Menze, Andreas Geiger","year":"2015","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Neill, 2012] Daniel B. Neill. Fast subset scan for spatial pattern detection. Journal of the Royal Statistical Society: Series B (Statistical Methodology), 74(2):337-360, 2012.","title":"Fast subset scan for spatial pattern detection","authors":"B Daniel, Neill","year":"2012","venue":"Journal of the Royal Statistical Society: Series B (Statistical Methodology)","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Papernot et al., 2017] Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia Con- ference on Computer and Communications Security, ASIA CCS '17, page 506-519, New York, NY, USA, 2017. As- sociation for Computing Machinery.","title":"Practical black-box attacks against machine learning","authors":"Nicolas Papernot, Patrick Mcdaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, Ananthram Swami","year":"2017","venue":"Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, ASIA CCS '17","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Ranjan et al., 2019] Anurag Ranjan, Joel Janai, Andreas Geiger, and Michael J. Black. Attacking optical flow. Pro- ceedings of the IEEE International Conference on Com- puter Vision, 2019.","title":"Attacking optical flow","authors":"Anurag Ranjan, Joel Janai, Andreas Geiger, Michael J Black","year":"2019","venue":"Proceedings of the IEEE International Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Rhemann et al., 2013] Christoph Rhemann, Asmaa Hosni, Michael Bleyer, Carsten Rother, and Margrit Gelautz. Fast cost-volume filtering for visual correspondence and be- yond. IEEE transactions on Pattern Analysis and Machine Intelligence, 35(2):504-511, February 2013.","title":"Fast cost-volume filtering for visual correspondence and beyond","authors":"Christoph Rhemann, Asmaa Hosni, Michael Bleyer, Carsten Rother, Margrit Gelautz","year":"2013","venue":"IEEE transactions on Pattern Analysis and Machine Intelligence","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Schmalfuss et al., 2022] Jenny Schmalfuss, Philipp Scholze, and Andrés Bruhn. A perturbation constrained adversarial attack for evaluating the robustness of optical flow. In Proceedings of the European Conference on Computer Vision, 2022.","title":"A perturbation constrained adversarial attack for evaluating the robustness of optical flow","authors":"Jenny Schmalfuss, Philipp Scholze, Andrés Bruhn","year":"2022","venue":"Proceedings of the European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Schrodi et al., 2021] Simon Schrodi, Tonmoy Saikia, and Thomas Brox. What causes optical flow networks to be vulnerable to physical adversarial attacks. CoRR, abs/2103.16255, 2021.","title":"What causes optical flow networks to be vulnerable to physical adversarial attacks","authors":"Simon Schrodi, Tonmoy Saikia, Thomas Brox","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Schrodi et al., 2022] Simon Schrodi, Tonmoy Saikia, and Thomas Brox. Towards understanding adversarial robust- ness of optical flow networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2022.","title":"Towards understanding adversarial robustness of optical flow networks","authors":"Simon Schrodi, Tonmoy Saikia, Thomas Brox","year":"2022","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Shi and Tomasi, 1994] Jianbo Shi and Carlo Tomasi. Good features to track. In 1994 IEEE Computer Society Confer- ence on Computer Vision and Pattern Recognition, pages 593-600, Seattle, WA, USA, 1994. IEEE Comput. Soc. Press.","title":"Good features to track","authors":"Jianbo Shi, Carlo Tomasi","year":"1994","venue":"IEEE Computer Society Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Sun et al., 2018] Deqing Sun, Xiaodong Yang, Ming-Yu Liu, and Jan Kautz. Pwc-net: Cnns for optical flow us- ing pyramid, warping, and cost volume. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018.","title":"Pwc-net: Cnns for optical flow using pyramid, warping, and cost volume","authors":"Deqing Sun, Xiaodong Yang, Ming-Yu Liu, Jan Kautz","year":"2018","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Teed and Deng, 2020] Zachary Teed and Jun Deng. Raft: Recurrent all-pairs field transforms for optical flow. Pro- ceedings of the European Conference on Computer Vision, 2020.","title":"Raft: Recurrent all-pairs field transforms for optical flow","authors":"Deng Teed, Zachary Teed, Jun Deng","year":"2020","venue":"Proceedings of the European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Wortman, 2021] Benjamin Wortman. Hidden patch attacks for optical flow. In ICML 2021 Workshop on Adversarial Machine Learning, 2021.","title":"Hidden patch attacks for optical flow","authors":"Benjamin Wortman","year":"2021","venue":"ICML 2021 Workshop on Adversarial Machine Learning","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Xu et al., 2017] Jia Xu, Rene Ranftl, and Vladlen Koltun. Accurate optical flow via direct cost volume processing. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 5807-5815, Honolulu, HI, 2017.","title":"Accurate optical flow via direct cost volume processing","authors":"Jia Xu, Rene Ranftl, Vladlen Koltun","year":"2017","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Yamanaka et al., 2021] Koichiro Yamanaka, Keita Taka- hashi, Toshiaki Fujii, and Ryuraroh Matsumoto. Simul- taneous attack on cnn-based monocular depth estimation and optical flow estimation. IEICE Transactions on Infor- mation and Systems, E104.D(5):785-788, 2021.","title":"Simultaneous attack on cnn-based monocular depth estimation and optical flow estimation","authors":"Koichiro Yamanaka, Keita Takahashi, Toshiaki Fujii, Ryuraroh Matsumoto","year":"2021","venue":"IEICE Transactions on Information and Systems, E","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Yu et al., 2022] Shuzhi Yu, Hannah H Kim, Shuai Yuan, and Carlo Tomasi. Unsupervised flow refinement near mo- tion boundaries. In British Machine Vision Conference. BMVA Press, 2022.","title":"Unsupervised flow refinement near motion boundaries","authors":"Yu","year":"2022","venue":"British Machine Vision Conference","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Yuan et al., 2022] Shuai Yuan, Xian Sun, Hannah Kim, Shuzhi Yu, and Carlo Tomasi. Optical flow training under limited label budget via active learning. In Proceedings of the European Conference on Computer Vision, 2022.","title":"Optical flow training under limited label budget via active learning","authors":"Shuai Yuan, Xian Sun, Hannah Kim, Shuzhi Yu, Carlo Tomasi","year":"2022","venue":"Proceedings of the European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Yuan et al., 2023] Shuaihang Yuan, Shuzhi Yu, Hannah Kim, and Carlo Tomasi. Semarflow: Injecting semantics into unsupervised optical flow estimation for autonomous driving. ArXiv, abs/2303.06209, 2023.","title":"Semarflow: Injecting semantics into unsupervised optical flow estimation for autonomous driving","authors":"Yuan","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}