Natural Adversarial Objects

7 Nov 2021  ·  Felix Lau, Nishant Subramani, Sasha Harrison, Aerin Kim, Elliot Branson, Rosanne Liu ·

Although state-of-the-art object detection methods have shown compelling performance, models often are not robust to adversarial attacks and out-of-distribution data. We introduce a new dataset, Natural Adversarial Objects (NAO), to evaluate the robustness of object detection models. NAO contains 7,934 images and 9,943 objects that are unmodified and representative of real-world scenarios, but cause state-of-the-art detection models to misclassify with high confidence. The mean average precision (mAP) of EfficientDet-D7 drops 74.5% when evaluated on NAO compared to the standard MSCOCO validation set. Moreover, by comparing a variety of object detection architectures, we find that better performance on MSCOCO validation set does not necessarily translate to better performance on NAO, suggesting that robustness cannot be simply achieved by training a more accurate model. We further investigate why examples in NAO are difficult to detect and classify. Experiments of shuffling image patches reveal that models are overly sensitive to local texture. Additionally, using integrated gradients and background replacement, we find that the detection model is reliant on pixel information within the bounding box, and insensitive to the background context when predicting class labels. NAO can be downloaded at

PDF Abstract


Introduced in the Paper:


Used in the Paper:


Results from the Paper

Task Dataset Model Metric Name Metric Value Global Rank Result Benchmark
Object Detection NAO EfficientDet-D7 mAP 13.6 # 3
mAP w/o OOD 26.6 # 2
mAR 40.8 # 4
Object Detection NAO EfficientDet-D4 mAP 15.0 # 2
mAP w/o OOD 29.6 # 1
mAR 42.7 # 2
Object Detection NAO EfficientDet-D2 mAP 12.8 # 5
mAP w/o OOD 25.4 # 3
mAR 40.2 # 5
Object Detection NAO Mask RCNN R50 mAP 15.2 # 1
mAP w/o OOD 24.6 # 4
mAR 43.8 # 1
Object Detection NAO YOLOv3 mAP 10.0 # 7
mAP w/o OOD 17.5 # 7
mAR 28.4 # 7
Object Detection NAO RetinaNet-R50 mAP 11.1 # 6
mAP w/o OOD 19.5 # 6
mAR 37.2 # 6
Object Detection NAO Faster RCNN mAP 13.5 # 4
mAP w/o OOD 22.8 # 5
mAR 41.4 # 3


No methods listed for this paper. Add relevant methods here