Back

Natural Adversarial Examples

Dan HendrycksKevin ZhaoSteven BasartJacob SteinhardtDawn Song

article2019CVPR2,039 citations

Introduces ImageNet-A and ImageNet-O, two benchmarks of unmodified real-world images that expose shared blind spots in computer vision models by causing severe performance drops without synthetic pixel perturbations.

computer visiondata augmentationdetection algorithmExamplesIMAGENET-AImages
arXiv: 1907.07174
Cover for Natural Adversarial Examples

Abstract

We introduce two challenging datasets that reliably cause machine learning model performance to substantially degrade. The datasets are collected with a simple adversarial filtration technique to create datasets with limited spurious cues. Our datasets' real-world, unmodified examples transfer to various unseen models reliably, demonstrating that computer vision models have shared weaknesses. The first dataset is called ImageNet-A and is like the ImageNet test set, but it is far more challenging for existing models. We also curate an adversarial out-of-distribution detection dataset called ImageNet-O, which is the first out-of-distribution detection dataset created for ImageNet models. On ImageNet-A a DenseNet-121 obtains around 2% accuracy, an accuracy drop of approximately 90%, and its out-of-distribution detection performance on ImageNet-O is near random chance levels. We find that existing data augmentation techniques hardly boost performance, and using other public training datasets provides improvements that are limited. However, we find that improvements to computer vision architectures provide a promising path towards robust models.

Topics

computer visiondata augmentationdetection algorithmdetection performanceout-of-distribution detectiontest samples

Keywords

ExamplesIMAGENET-AImagesImageNetClassiAccuracyModelsAdversarialClassi ErsIMAGENET-O

Table of Contents

  • 1 Introduction
  • 2 Related Work
  • 3 ImageNet-A and ImageNet-O
  • 3.1 Design
  • 3.2 Illustrative Failure Modes
  • 4 Experiments
  • 5 Conclusion
  • References
  • 6 Appendix
  • 7 Expanded Results
  • 7.1 Full Architecture Results
  • 7.2 More OOD Detection Results and Background
  • 7.3 Calibration
  • 8 ImageNet-A Classes
  • 9 ImageNet-O Classes

Knowls

  1. Knowl 1 — ImageNet-A Benchmark for Natural Adversarial Classification

    definition

    ImageNet-A is an image classification benchmark consisting of 7,5007{,}500 real-world, unmodified natural images spanning a curated 200200-class subset of ImageNet-1K. The dataset is designed to evaluate classifier robustness to natural distribution shift and spurious cues without relying on artificial ℓp\ell_p norm perturbations or synthetic image corruptions.

    The distribution shift between ImageNet-A and the original ImageNet dataset is quantitatively measured using the Fréchet Inception Distance (FID). While the FID between ImageNet's validation and test sets is approximately 0.990.99, the FID between ImageNet-A and ImageNet's validation set is 50.4050.40 (and 50.2550.25 against the test set). Despite this distributional divergence, the estimated human classification accuracy on ImageNet-A is approximately 90%90\%, whereas standard deep convolutional neural networks suffer severe performance degradation (e.g., standard ResNet-50 achieves 2.17%2.17\% top-1 accuracy).

  2. Knowl 2 — ImageNet-O Benchmark for Adversarial Out-of-Distribution Detection

    definition

    ImageNet-O is an out-of-distribution (OOD) detection benchmark consisting of 2,0002{,}000 unmodified, real-world images curated to test ImageNet classifiers' uncertainty and anomaly detection capabilities under semantic distribution shifts.

    The dataset is drawn from ImageNet-22K by selecting images from classes outside of ImageNet-1K that are mistaken as in-distribution classes with high confidence by standard classifiers. In-distribution data corresponds to a matched 200200-class subset of ImageNet-1K. Detection performance is evaluated using the Area Under the Precision-Recall Curve (AUPR) based on anomaly scores derived from the negative maximum softmax probability (MSP). For ImageNet-O, random chance AUPR is approximately 16.67%16.67\%, and the ceiling is 100%100\%.

  3. Knowl 3 — Adversarial Filtration Pipeline for Natural Adversarial Examples

    algorithm

    Adversarial filtration is a data curation procedure that removes simple examples solved by shortcut cues and retains clean, unmodified natural images that induce confident misclassifications across vision models.

    Input: Candidate image collection Draw\mathcal{D}_{raw} corresponding to target classes C\mathcal{C}
    Ensemble classifiers f1,f2f_1, f_2 (ResNet-50 fine-tuned on C\mathcal{C} and ResNet-50 evaluated on C\mathcal{C} logits)
    Confidence threshold τ=0.15\tau = 0.15
    Maximum confusion frequency K=15K = 15
    Output: Adversarially filtered dataset Dadv\mathcal{D}_{adv}
    Initialize shortlist S←∅\mathcal{S} \leftarrow \emptyset, confusions counter C[ytrue,ypred]←0C[y_{true}, y_{pred}] \leftarrow 0, Dadv←∅\mathcal{D}_{adv} \leftarrow \emptyset
    for each image x∈Drawx \in \mathcal{D}_{raw} with ground truth label y∈Cy \in \mathcal{C} do
        Generate 10 standard spatial crops {x(1),…,x(10)}\{x^{(1)}, \dots, x^{(10)}\} from xx
        Predict classes y^m(i)=arg⁡max⁡fm(x(i))\hat{y}_m^{(i)} = \arg\max f_m(x^{(i)}) and confidences pm(y∣x(i))p_m(y \mid x^{(i)}) for m∈{1,2},i∈{1,…,10}m \in \{1, 2\}, i \in \{1, \dots, 10\}
        if ∀m,i:y^m(i)≠y\forall m, i: \hat{y}_m^{(i)} \neq y and ∀m,i:pm(y∣x(i))≤τ\forall m, i: p_m(y \mid x^{(i)}) \le \tau then
            S←S∪{(x,y,y^1(1))}\mathcal{S} \leftarrow \mathcal{S} \cup \{(x, y, \hat{y}_1^{(1)})\}
        end if
    end for
    Initialize diversified list Ddiv←∅\mathcal{D}_{div} \leftarrow \emptyset
    for each (x,y,y^)∈S(x, y, \hat{y}) \in \mathcal{S} do
        if C[y,y^]<KC[y, \hat{y}] < K then
            Ddiv←Ddiv∪{x}\mathcal{D}_{div} \leftarrow \mathcal{D}_{div} \cup \{x\}
            C[y,y^]←C[y,y^]+1C[y, \hat{y}] \leftarrow C[y, \hat{y}] + 1
        end if
    end for
    for each candidate x∈Ddivx \in \mathcal{D}_{div} do
        Perform human inspection to confirm single-class presence, image clarity, and label correctness
        if human validates xx then
            Dadv←Dadv∪{x}\mathcal{D}_{adv} \leftarrow \mathcal{D}_{adv} \cup \{x\}
        end if
    end for
    return Dadv\mathcal{D}_{adv}

  4. Knowl 4 — Benchmark Results of Deep Vision Architectures on ImageNet-A and ImageNet-O

    data/table

    The performance of diverse computer vision architectures evaluated on ImageNet-A (top-1 accuracy in %) and ImageNet-O (Area Under the Precision-Recall curve, AUPR in %) reveals substantial vulnerabilities across convolutional architectures, attention-augmented networks, and vision Transformers.

    Model ImageNet-A (Acc %) ImageNet-O (AUPR %)
    AlexNet 1.77 15.44
    SqueezeNet 1.1 1.12 15.31
    VGG-16 2.63 16.58
    VGG-19 2.11 16.80
    VGG-19 + BN 2.95 16.57
    DenseNet-121 2.16 16.11
    ResNet-18 1.15 15.23
    ResNet-34 1.87 16.00
    ResNet-50 2.17 16.20
    ResNet-101 4.72 17.20
    ResNet-152 6.05 18.00
    ResNet-50 + Squeeze-and-Excite 6.17 17.52
    ResNet-101 + Squeeze-and-Excite 8.55 17.91
    ResNet-152 + Squeeze-and-Excite 9.35 18.65
    ResNet-50 + DeVries Confidence Branch 0.35 14.34
    ResNet-50 + Rotation Prediction Branch 2.17 16.20
    Res2Net-50 (v1b) 14.59 19.50
    Res2Net-101 (v1b) 21.84 22.69
    Res2Net-152 (v1b) 22.40 23.90
    ResNeXt-50 (32×4d32 \times 4\text{d}) 4.81 17.60
    ResNeXt-101 (32×4d32 \times 4\text{d}) 5.85 19.60
    ResNeXt-101 (32×8d32 \times 8\text{d}) 10.20 20.51
    DPN 68 3.53 17.78
    DPN 98 9.15 21.10
    DeiT-tiny 7.25 17.40
    DeiT-small 19.10 20.90
    DeiT-base 28.20 24.80

    Standard classifiers achieve near-random performance on out-of-distribution detection on ImageNet-O (random baseline ≈16.67%\approx 16.67\%) and drops of around 90%90\% in classification accuracy on ImageNet-A relative to standard ImageNet validation (where models typically attain ≥90%\ge 90\% on these 200 classes). Performance gains scale with model capacity, multi-scale residual blocks (Res2Net), and self-attention/Transformers (DeiT).

  5. Knowl 5 — Cross-Architecture Transferability of Natural Adversarial Examples

    empirical result

    Natural adversarial examples selected by filtering against a standard ResNet-50 architecture transfer effectively to unseen, black-box model families that were not involved in dataset creation.

    DenseNet-121, SqueezeNet, VGG-19, and AlexNet all achieve lower than 3%3\% top-1 accuracy on ImageNet-A (DenseNet-121 achieves 2.16%2.16\%, VGG-19 achieves 2.11%2.11\%, AlexNet achieves 1.77%1.77\%, and SqueezeNet achieves 1.12%1.12\%). On ImageNet-O out-of-distribution detection, these models attain AUPR scores near or below random chance levels (16.67%16.67\%), ranging from 15.31%15.31\% for SqueezeNet to 16.80%16.80\% for VGG-19. Furthermore, the examples transfer to architectures with completely distinct inductive biases, including Vision Transformers (DeiT).

  6. Knowl 6 — Effect of Data Augmentation Techniques on Natural Adversarial Robustness

    empirical result

    Standard data augmentation methods that improve robustness against synthetic corruptions or ℓp\ell_p-norm bounded adversarial perturbations provide minimal improvements on ImageNet-A accuracy relative to a baseline ResNet-50 (2.17%2.17\% top-1 accuracy):

    • Fast ℓp\ell_p Adversarial Training: decreases accuracy to 1.68%1.68\%.
    • Style Transfer (texture-debiasing): yields 2.30%2.30\% (+0.13%+0.13\% over baseline).
    • AugMix: yields 3.8%3.8\%.
    • Cutout: yields 4.4%4.4\%.
    • Moment Exchange (MoEx): yields 5.5%5.5\%.
    • Mixup: yields 6.6%6.6\%.
    • CutMix: yields 7.3%7.3\%.

    Even the best-performing augmentation (CutMix) improves accuracy by only ≈5.13%\approx 5.13\% over the baseline ResNet-50.

  7. Knowl 7 — Influence of Training Data Scale and Scene Pre-training on Robustness

    empirical result

    Scaling training data and pre-training across alternative distributions impacts robustness to natural adversarial examples in distinct ways:

    1. Scene Recognition Pre-training: Pre-training a ResNet-50 on Places365 and fine-tuning on ImageNet-1K results in 1.56%1.56\% accuracy on ImageNet-A and an AUPR of 14.88%14.88\% on ImageNet-O, indicating that feature representations learned from scene contexts do not reduce natural adversarial error modes.
    2. In-Distribution Fine-Tuning: Fine-tuning a baseline ResNet-50 directly on an 80%80\% split of ImageNet-A fails to generalize to the remaining 20%20\%, yielding top-1 accuracy below 2%2\% and top-5 accuracy below 5%5\%.
    3. Large-Scale Web Pre-training: Pre-training ResNet-50 on ImageNet-21K (≈21,000\approx 21{,}000 classes and 1414 million images) followed by fine-tuning on ImageNet-1K increases ImageNet-A accuracy from 2.17%2.17\% to 11.41%11.41\% (+9.24%+9.24\%) and ImageNet-O AUPR from 16.20%16.20\% to 21.86%21.86\%.

  8. Knowl 8 — Impact of Architecture Design, Capacity, and Multi-Scale Hierarchies on Natural Robustness

    empirical result

    Architectural modifications systematically improve resilience against natural adversarial shifts on ImageNet-A and ImageNet-O:

    1. Network Depth and Width: Scaling standard ResNet depth increases ImageNet-A accuracy from 2.17%2.17\% (ResNet-50) to 4.72%4.72\% (ResNet-101) and 6.05%6.05\% (ResNet-152), with ImageNet-O AUPR increasing from 16.20%16.20\% to 18.00%18.00\%.
    2. Grouped Convolutions: ResNeXt-50 (32×4d32 \times 4\text{d}) improves accuracy to 4.81%4.81\% (AUPR 17.60%17.60\%), and ResNeXt-101 (32×8d32 \times 8\text{d}) attains 10.20%10.20\% accuracy (AUPR 20.51%20.51\%).
    3. Squeeze-and-Excitation (SE) Self-Attention: Adding SE blocks to ResNet-50 raises ImageNet-A accuracy to 6.17%6.17\%, while ResNet-152+SE reaches 9.35%9.35\%.
    4. Multi-Scale Hierarchical Features (Res2Net): Replacing residual blocks in ResNet-50 with Res2Net v1b blocks yields 14.59%14.59\% accuracy (AUPR 19.50%19.50\%). Scaling to Res2Net-152 v1b achieves 22.40%22.40\% accuracy and 23.90%23.90\% AUPR.

  9. Knowl 9 — Generalization of Vision Transformers to Natural Adversarially Filtered Benchmarks

    empirical result

    Convolution-free Vision Transformers (DeiT) trained on ImageNet-1K exhibit higher robustness than standard convolutional networks, yet remain susceptible to transfer errors from natural adversarial examples:

    • DeiT-tiny achieves 7.25%7.25\% top-1 accuracy on ImageNet-A and 17.40%17.40\% AUPR on ImageNet-O.
    • DeiT-small (with parameter counts comparable to Res2Net-50) achieves 19.10%19.10\% top-1 accuracy on ImageNet-A and 20.90%20.90\% AUPR on ImageNet-O (compared to 14.59%14.59\% accuracy and 19.50%19.50\% AUPR for Res2Net-50).
    • DeiT-base attains 28.20%28.20\% top-1 accuracy on ImageNet-A and 24.80%24.80\% AUPR on ImageNet-O.

  10. Knowl 10 — Area Under the Response Rate Accuracy Curve (AURRA) for Selective Classification

    definition

    The Area Under the Response Rate Accuracy curve (AURRA) evaluates a classifier's uncertainty estimation and selective classification capability by measuring accuracy when the model is allowed to abstain on low-confidence predictions.

    For a response rate p∈(0,1]p \in (0, 1], the classifier responds only to the top pp fraction of the test set ranked by maximum softmax probability max⁡cp(c∣x)\max_{c} p(c \mid x) and abstains from the remaining 1−p1 - p fraction. The Response Rate Accuracy curve plots the classifier's top-1 accuracy on this selected subset as a function of pp. AURRA is the area under this curve. A calibrated classifier that successfully identifies its potential mistakes achieves high accuracy at low response rates, leading to a higher AURRA score.

  11. Knowl 11 — Systematic Qualitative Failure Modes of Deep Classifiers on Natural Adversarial Examples

    empirical result

    Qualitative evaluation of candidate adversarial examples on ImageNet-A isolates three systematic failure modes in modern deep convolutional neural networks:

    1. Visual Concept Overgeneralization: Classifiers over-abstract low-level or geometric primitives (e.g., classifying unrelated metallic objects as sundials, radiating linear patterns as harvestman bugs, circular structures as bicycles/tricycles, and numeric grid displays as calculators or keyboards).
    2. Color and Texture Overreliance: Classifiers heavily prioritize local color and texture distributions over structural or global shape cues (e.g., misclassifying colored dragonfly bodies as bananas).
    3. Spurious Background and Co-occurrence Shortcuts: Classifiers bind entire background contexts to object categories rather than isolating the target entity (e.g., wood textures triggering nails, bird feeders triggering hummingbirds, snow triggering shovels, and dumpsters triggering garbage trucks). In dynamic scenes (such as an alligator swimming), sequential video frames trigger erratic transitions across semantically disjoint classes such as cliff, lynx, and fox squirrel.

Coverage note — The comprehensive listing of the 200 class names and WordNet synset IDs for ImageNet-A and ImageNet-O was omitted as exhaustive lexical data not required for conceptual or procedural reconstruction.

References

  1. 1.Faruk Ahmed and Aaron C. Courville. Detecting semantic anomalies. ArXiv, abs/1908.04388, 2019.
  2. 2.Mart´ın Arjovsky, L´eon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. ArXiv, abs/1907.02893, 2019.
  3. 3.P. Bartlett and M. Wegkamp. Classification with a reject option using a hinge loss. J. Mach. Learn. Res., 9:1823–1840, 2008.
  4. 4.David Bau, B. Zhou, A. Khosla, A. Oliva, and A. Torralba. Network dissection: Quantifying interpretability of deep visual representations. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3319–3327, 2017.
  5. 5.Chandra Bhagavatula, Ronan Le Bras, Chaitanya Malaviya, Keisuke Sakaguchi, Ari Holtzman, Hannah Rashkin, Doug Downey, Scott Yih, and Yejin Choi. Abductive commonsense reasoning. ArXiv, abs/1908.05739, 2019.
  6. 6.Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. Piqa: Reasoning about physical commonsense in natural language. ArXiv, abs/1911.11641, 2019.
  7. 7.Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. Piqa: Reasoning about physical commonsense in natural language. ArXiv, abs/1911.11641, 2020.
  8. 8.Wieland Brendel and Matthias Bethge. Approximating cnns with bag-of-local-features models works surprisingly well on imagenet. CoRR, abs/1904.00760, 2018.
  9. 9.Zheng Cai, Lifu Tu, and Kevin Gimpel. Pay attention to the ending: Strong neural baselines for the roc story cloze task. In ACL, 2017.
  10. 10.Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. Computer Vision and Pattern Recognition, 2014.
  11. 11.Jia Deng, Wei Dong, Richard Socher, Li jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. CVPR, 2009.
  12. 12.Terrance Devries and Graham W. Taylor. Improved regularization of convolutional neural networks with Cutout. arXiv preprint arXiv:1708.04552, 2017.
  13. 13.Terrance Devries and Graham W. Taylor. Learning confidence for out-of-distribution detection in neural networks. ArXiv, abs/1802.04865, 2018.
  14. 14.A. Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, M. Dehghani, Matthias Minderer, Georg Heigold, S. Gelly, Jakob Uszkoreit, and N. Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. ICLR, 2021.
  15. 15.Dheeru Dua, Yizhong Wang, Pradeep Dasigi, Gabriel Stanovsky, Sameer Singh, and Matt Gardner. Drop: A reading comprehension benchmark requiring discrete reasoning over paragraphs. In NAACL-HLT, 2019.
  16. 16.L. Engstrom, Andrew Ilyas, Shibani Santurkar, D. Tsipras, J. Steinhardt, and A. Madry. Identifying statistical bias in dataset replication. ArXiv, abs/2005.09619, 2020.
  17. 17.Shanghua Gao, Ming-Ming Cheng, Kai Zhao, Xinyu Zhang, Ming-Hsuan Yang, and Philip H. S. Torr. Res2net: A new multi-scale backbone architecture. IEEE transactions on pattern analysis and machine intelligence, 2019.
  18. 18.Robert Geirhos, J¨orn-Henrik Jacobsen, Claudio Michaelis, Richard S. Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut learning in deep neural networks. ArXiv, abs/2004.07780, 2020.
  19. 19.Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. ICLR, 2019.
  20. 20.Robert Geirhos, Carlos R. M. Temme, Jonas Rauber, Heiko H. Sch¨utt, Matthias Bethge, and Felix A. Wichmann. Generalisation in humans and deep neural networks. NeurIPS, 2018.
  21. 21.Ian Goodfellow, Nicolas Papernot, Sandy Huang, Yan Duan, , and Peter Abbeel. Attacking machine learning with adversarial examples. OpenAI Blog, 2017.
  22. 22.Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel R. Bowman, and Noah A. Smith. Annotation artifacts in natural language inference data. ArXiv, abs/1803.02324, 2018.
  23. 23.Kaiming He, Georgia Gkioxari, Piotr Doll´ar, and Ross B. Girshick. Mask r-cnn. In CVPR, 2018.
  24. 24.Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CVPR, 2015.
  25. 25.Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. 2015 IEEE International Conference on Computer Vision (ICCV), pages 1026–1034, 2015.
  26. 26.Dan Hendrycks, Steven Basart, Mantas Mazeika, Mohammadreza Mostajabi, J. Steinhardt, and D. Song. Scaling out-of-distribution detection for real-world settings. arXiv: 1911.11132, 2020.
  27. 27.Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, F. Wang, Evan Dorundo, Rahul Desai, Tyler Lixuan Zhu, Samyak Parajuli, M. Guo, D. Song, J. Steinhardt, and J. Gilmer. The many faces of robustness: A critical analysis of out-of-distribution generalization. ArXiv, abs/2006.16241, 2020.
  28. 28.Dan Hendrycks, C. Burns, Steven Basart, Andrew Critch, Jerry Li, D. Song, and J. Steinhardt. Aligning ai with shared human values. ArXiv, abs/2008.02275, 2020.
  29. 29.Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. ICLR, 2019.
  30. 30.Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. ICLR, 2017.
  31. 31.Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. ICLR, 2019.
  32. 32.Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. Advances in Neural Information Processing Systems (NeurIPS), 2019.
  33. 33.Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and D. Song. Using self-supervised learning can improve model robustness and uncertainty. In NeurIPS, 2019.
  34. 34.Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. ICLR, 2020.
  35. 35.Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and S. Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In NIPS, 2017.
  36. 36.Jie Hu, Li Shen, Samuel Albanie, Gang Sun, and Andrea Vedaldi. Gather-excite : Exploiting feature context in convolutional neural networks. In NeurIPS, 2018.
  37. 37.Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation networks. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2018.
  38. 38.Jonathan Huang, Vivek Rathod, Chen Sun, Menglong Zhu, Anoop Korattikara Balan, Alireza Fathi, Ian Fischer, Zbigniew Wojna, Yang Song, Sergio Guadarrama, and Kevin Murphy. Speed/accuracy trade-offs for modern convolutional object detectors. 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017.
  39. 39.Simon Kornblith, Jonathon Shlens, and Quoc V. Le. Do better imagenet models transfer better? CoRR, abs/1805.08974, 2018.
  40. 40.Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. ImageNet classification with deep convolutional neural networks. NIPS, 2012.
  41. 41.A. Kumar, P. Liang, and T. Ma. Verified uncertainty calibration. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
  42. 42.Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. ICLR, 2017.
  43. 43.Sebastian Lapuschkin, Stephan W¨aldchen, Alexander Binder, Gr´egoire Montavon, Wojciech Samek, and KlausRobert M¨uller. Unmasking clever hans predictors and assessing what machines really learn. In Nature Communications, 2019.
  44. 44.Kimin Lee, Honglak Lee, Kibok Lee, and Jinwoo Shin. Training confidence-calibrated classifiers for detecting outof-distribution samples. ICLR, 2018.
  45. 45.Bo-Yi Li, Felix Wu, Ser-Nam Lim, Serge J. Belongie, and Kilian Q. Weinberger. On feature normalization and data augmentation. ArXiv, abs/2002.11102, 2020.
  46. 46.Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don’t know. ArXiv, abs/1909.12180, 2019.
  47. 47.Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? ArXiv, abs/1902.10811, 2019.
  48. 48.Takaya Saito and Marc Rehmsmeier. The precision-recall plot is more informative than the ROC plot when evaluating binary classifiers on imbalanced datasets. In PLoS ONE. 2015.
  49. 49.Keisuke Sakaguchi, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Winogrande: An adversarial winograd schema challenge at scale. ArXiv, abs/1907.10641, 2019.
  50. 50.Ramprasaath R. Selvaraju, Abhishek Das, Ramakrishna Vedantam, Michael Cogswell, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. International Journal of Computer Vision, 128:336 – 359, 2019.
  51. 51.Pierre Stock and Moustapha Ciss´e. Convnets and imagenet beyond accuracy: Understanding mistakes and uncovering biases. In ECCV, 2018.
  52. 52.D. Su, Huan Zhang, H. Chen, Jinfeng Yi, P. Chen, and Yupeng Gao. Is robustness the cost of accuracy? - a comprehensive study on the robustness of 18 deep image classification models. In ECCV, 2018.
  53. 53.Kah Kay Sung. Learning and example selection for object and pattern detection. 1995.
  54. 54.Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014.
  55. 55.Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Herv´e J´egou. Training data-efficient image transformers and distillation through attention. arXiv preprint arXiv:2012.12877, 2020.
  56. 56.Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.03994, 2020.
  57. 57.Jianxiong Xiao, James Hays, Krista A. Ehinger, Aude Oliva, and Antonio Torralba. Sun database: Large-scale scene recognition from abbey to zoo. 2010 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, pages 3485–3492, 2010.
  58. 58.Saining Xie, Ross Girshick, Piotr Doll´ar, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. CVPR, 2016.
  59. 59.Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, E. Cubuk, and J. Gilmer. A fourier perspective on model robustness in computer vision. ArXiv, abs/1906.08988, 2019.
  60. 60.Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pages 6022–6031, 2019.
  61. 61.Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence? In ACL, 2019.
  62. 62.Hongyi Zhang, Moustapha Ciss´e, Yann Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. ArXiv, abs/1710.09412, 2018.
  63. 63.Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba. Places: A 10 million image database for scene recognition. PAMI, 2017.

Citation

MLA
Hendrycks, D., et al. “Natural Adversarial Examples”. arXiv, 2019, http://arxiv.org/abs/1907.07174v4.
APA
Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., & Song, D. (2019). Natural Adversarial Examples. arXiv. http://arxiv.org/abs/1907.07174v4
Chicago
Hendrycks, D., K. Zhao, S. Basart, J. Steinhardt, and D. Song. 2019. “Natural Adversarial Examples”. arXiv. http://arxiv.org/abs/1907.07174v4.
Harvard
Hendrycks, D. et al. (2019) “Natural Adversarial Examples”, arXiv [Preprint]. Available at: http://arxiv.org/abs/1907.07174v4.
Vancouver
1. Hendrycks D, Zhao K, Basart S, Steinhardt J, Song D (2019) Natural Adversarial Examples. arXiv

BibTeX

@article{hendrycks2019natural,
  title = {Natural Adversarial Examples},
  author = {Hendrycks, Dan and Zhao, Kevin and Basart, Steven and Steinhardt, Jacob and Song, Dawn},
  year = {2019},
  journal = {arXiv},
  url = {http://arxiv.org/abs/1907.07174v4},
  eprint = {1907.07174}
}
Metadata:arXiv

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: IEEE