Monocular Depth Estimation (MDE) plays a vital role in applications such as
autonomous driving. However, various attacks target MDE models, with physical
attacks posing significant threats to system security. Traditional adversarial
training methods, which require ground-truth labels, are not directly
applicable to MDE models that lack ground-truth depth. Some self-supervised
model hardening techniques (e.g., contrastive learning) overlook the domain
knowledge of MDE, resulting in suboptimal performance. In this work, we
introduce a novel self-supervised adversarial training approach for MDE models,
leveraging view synthesis without the need for ground-truth depth. We enhance
adversarial robustness against real-world attacks by incorporating
L_0-norm-bounded perturbation during training. We evaluate our method against
supervised learning-based and contrastive learning-based approaches
specifically designed for MDE. Our experiments with two representative MDE
networks demonstrate improved robustness against various adversarial attacks,
with minimal impact on benign performance.

我们提出了一种新颖的自监督对抗训练方法，通过利用视图合成以增强单眼深度估计模型对真实世界攻击的对抗鲁棒性，而无需真实深度的地面真值。我们的方法在两个代表性的单眼深度估计网络上进行实验证明，相比于特别设计用于单眼深度估计的监督学习和对比学习方法，具有更好的鲁棒性，对良性性能影响最小。

自监督对抗训练单目深度估计抵抗现实世界攻击

Self-supervised Adversarial Training of Monocular Depth Estimation  against Physical-World Attacks

Adversarial examples can cause catastrophic mistakes in Deep Neural Network
(DNNs) based vision systems e.g., for classification, segmentation and object
detection. The vulnerability of DNNs against such attacks can prove a major
roadblock towards their real-world deployment. Transferability of adversarial
examples demand generalizable defenses that can provide cross-task protection.
Adversarial training that enhances robustness by modifying target model's
parameters lacks such generalizability. On the other hand, different input
processing based defenses fall short in the face of continuously evolving
attacks. In this paper, we take the first step to combine the benefits of both
approaches and propose a self-supervised adversarial training mechanism in the
input space. By design, our defense is a generalizable approach and provides
significant robustness against the \textbf{unseen} adversarial attacks (\eg by
reducing the success rate of translation-invariant \textbf{ensemble} attack
from 82.6\% to 31.9\% in comparison to previous state-of-the-art). It can be
deployed as a plug-and-play solution to protect a variety of vision systems, as
we demonstrate for the case of classification, segmentation and detection. Code
is available at: {\smallhttps://github.com/Muzammal-Naseer/NRP}.

本文首次提出了一种自我监督的对抗训练机制，在输入空间中防御对抗性攻击，并提供极大的鲁棒性，可以作为即插即用的解决方案来保护各种视觉系统，包括分类、分割和检测，同时极大降低了未知攻击的成功率。