Recent studies have demonstrated that visual recognition models lack robustness to distribution shift. However, current work mainly considers model robustness to 2D image transformations, leaving viewpoint changes in the 3D world less explored. In general, viewpoint changes are prevalent in various real-world applications (e.g., autonomous driving), making it imperative to evaluate viewpoint robustness. In this paper, we propose a novel method called ViewFool to find adversarial viewpoints that mislead visual recognition models. By encoding real-world objects as neural radiance fields (NeRF), ViewFool characterizes a distribution of diverse adversarial viewpoints under an entropic regularizer, which helps to handle the fluctuations of the real camera pose and mitigate the reality gap between the real objects and their neural representations. Experiments validate that the common image classifiers are extremely vulnerable to the generated adversarial viewpoints, which also exhibit high cross-model transferability. Based on ViewFool, we introduce ImageNet-V, a new out-of-distribution dataset for benchmarking viewpoint robustness of image classifiers. Evaluation results on 40 classifiers with diverse architectures, objective functions, and data augmentations reveal a significant drop in model performance when tested on ImageNet-V, which provides a possibility to leverage ViewFool as an effective data augmentation strategy to improve viewpoint robustness.

通过创建一种新的方法，称为ViewFool，将真实世界的物体编码为神经辐射场（NeRF），该方法表征了多样化的对抗性视角分布，这些分布应用于图像分类器的评估中，进一步证明常见的图像分类器对生成的对抗性视角的脆弱性，并提出了一种新的超出分布数据集ImageNet-V，其中包含在各种各样的架构，客观函数和数据增强中进行的40种分类器的评估结果揭示了模型在ImageNet-V上的表现大幅下降。

ViewFool: 对视觉识别在对抗视角下的稳健性进行评估