http://pralab.diee.unica.it @biggiobattista 2
The iCub is the humanoid robot developed at the
Italian Institute of Technology as part of the EU
project RobotCub and adopted by more than 20
It has 53 motors that move the head, arms and hands,
waist, and legs. It can see and hear, it has the sense of
proprioception (body configuration)
and movement (using accelerometers and gyroscopes).
The object recognition system of iCub uses visual features
extracted with CNN models trained on the ImageNet dataset
[G. Pasquale et al. MLIS 2015]
The iCub Humanoid
Crafting the Adversarial Examples
• Key idea: shift the attack sample towards the decision boundary
– under a maximum input perturbation (Euclidean distance)
• Multiclass boundaries are obtained as the difference between
the competing classes (e.g., one-vs-all multiclass classification)
Why ML is Vulnerable to Evasion?
• Attack samples far from training data are anyway assigned to
• Rejecting such blind-spot evasion points should improve security!
1 0 1
SVM-RBF (higher rejection rate)
1 0 1
SVM-RBF (no reject)
Conclusions and Future Work
• Adversarial Examples against iCub
• Countermeasure based on rejecting blind-spot evasion attacks
• Main open issue: instability of deep features
small changes in input space (pixels)
aligned with the gradient direction...
... correspond to large changes in
deep feature space!