Pith. sign in

REVIEW 4 major objections 6 minor 67 references

On the Robustness of Human Pose Estimation

T0 review · 4 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that heatmap-based pose estimation is notably more robust to adversarial attacks than direct regression, and that models which encode body structure are the hardest to fool.

desk verdict A genuinely useful first systematic robustness study for HPE; the main findings are plausible, but the re-implementation fidelity and missing statistical rigor keep it from being definitive. read the letter →

arxiv 1908.06401 v2 pith:SRLOSYQ2 submitted 2019-08-18 cs.CV

Sahil Shah , Naman Jain , Abhishek Sharma , Arjun Jain This is my paper · ORCID
classification cs.CV
keywords humanposeestimationadversarialattacksheatmapregressiondirectuniversalperturbationsrobustnessMPIICOCO
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that human pose estimation systems have a distinctive adversarial-robustness profile, different from image classification and semantic segmentation, and that this profile is shaped by design choices. The paper benchmarks five single-person 2D pose architectures, plus multi-person and 3D variants, under gradient-based, iterative, targeted, and universal attacks on MPII and COCO. Its central claim is that heatmap-based pose models are notably more robust than direct-regression models, and that explicitly modeling the body's anthropometric structure, such as limb composition and chained joint conditioning, makes models still harder to fool. If true, the result gives practitioners a concrete design rule: prefer heatmap outputs and body-structure constraints when deployment may face adversaries.

What carries the argument

The central mechanism is the output representation of the pose model. Heatmap-based systems predict a per-joint spatial probability map with a Gaussian bump centered at each joint location, so the loss is a per-pixel classification loss and the predicted coordinates are implicitly bounded to valid image positions. Direct-regression systems output the $(x,y)$ coordinates directly, so the regression loss translates almost immediately into coordinate error after thresholding. The paper argues that this difference explains why heatmap models are more robust: a Gaussian-bump heatmap loss is less tightly coupled to the PCKh evaluation metric than direct coordinate regression is. A second mechanism is the stacked-hourglass architecture, whose successive down-sampling and up-sampling acts as multi-scale processing, previously linked to adversarial robustness. A third is the explicit anthropometric modeling in models like DLCM and Chained Predictions, which constrains the output toward plausible body compositions, though the paper finds that the chained conditional structure is itself a point of weakness. Universal perturbations work through a distinct mechanism visible in visualizations: they hallucinate body-like parts, especially limbs, across the image, which confuses the joint detectors even though the perturbation image itself contains no explicit human shape.

What would settle it

Run the same attack suite, with identical perturbations and evaluation metrics, on the original released implementations of DeepPose, Chained Predictions, and the stacked-hourglass models rather than the authors' re-implementations; if the original direct-regression model proves as robust as the heatmap models, or if the anthropometric models no longer lead, the claimed design-based ordering is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is an empirical ordering that holds across attack types and datasets: direct-regression pose models, exemplified by DeepPose, are the most easily fooled, while heatmap-based models are notably more robust, and among heatmap models those that explicitly encode the body's compositional structure, such as DLCM, resist attacks best. The paper also finds that human pose estimation is relatively robust compared to classification and semantic segmentation, that single-step attacks are surprisingly ineffective, that targeted attacks require many more iterations than untargeted ones, and that universal perturbations are extremely effective, degrading all tested systems and transferring across networks. A joint-level analysis shows hips and lower-body joints are the most vulnerable, while head and neck are the most robust. The paper additionally reports that bottom-up multi-person systems can be driven to predict a large number of spurious humans, that attacking the depth-regression branch of a 3D pose model causes a six-fold error increase, and that adversarial perturbations remain largely imperceptible to human viewers at the attack strengths used.

Load-bearing premise

The robustness ordering rests on the authors' re-implementations of DeepPose, Chained Predictions, and 2-SHG being faithful to the original designs, within 5% of their reported accuracy; if those re-implementations differ in important ways, the observed ordering could reflect implementation artifacts rather than design choices.

Editorial extensions

If this is right

  • If the claimed ordering is correct, pose-estimation practitioners should expect heatmap-based models to retain accuracy under small imperceptible perturbations better than direct-regression models, making them the safer choice for deployment in adversarial settings.
  • The paper's finding that single-step FGSM attacks are ineffective on pose models means that evaluating HPE robustness requires iterative attacks with many steps, and that previous classification-oriented attack budgets may underestimate HPE robustness.
  • Universal perturbations that generalize across networks imply that a single image-agnostic noise pattern can degrade a variety of pose estimators, so defenses against universal perturbations are a priority for real-world HPE systems.
  • The per-joint vulnerability pattern, hips and legs most vulnerable and head and neck most robust, suggests that downstream applications relying on lower-body joint accuracy should be considered especially exposed to adversarial manipulation.
  • The heatmap quality analysis implies that simply inspecting the shape of predicted heatmaps cannot reliably detect an adversarial attack, since attacked heatmaps remain close to ideal Gaussian bumps.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If direct regression is inherently less robust than heatmap regression, then the popular class of 3D pose estimators that regress relative depth on top of 2D joint estimates is likely to be the most attack-prone part of a pose pipeline; the paper's 3D experiment points in that direction.
  • The body-joint vulnerability gradient could be used to design attack-aware evaluation metrics that weight lower-body joints more heavily, or to build defenses that focus capacity on the hip, knee, and ankle predictions.
  • The hallucinated-body appearance of universal perturbations suggests that pose models rely on learned body-part templates; a testable extension would be to check whether adversarial perturbations constrained to avoid body-like patterns transfer less effectively across networks.
  • The paper's evidence that ImageNet pre-training improves robustness aligns with findings in other vision tasks and suggests that transfer learning may be a general robustness lever for structured-output models beyond pose estimation.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents an empirical study of gradient-based adversarial attacks on human pose estimation (HPE). It benchmarks six single-person 2D HPE systems (DeepPose, 2- and 8-stack Hourglass, Chained Predictions, Attention Hourglass, DLCM) on MPII and COCO under FGSM, iterative IGSM, targeted, universal, and black-box attacks; it also adds experiments on multi-person 2D HPE and single-person 3D HPE, a heatmap-quality analysis, a perceptibility user study, and simple defenses. The main claims are that HPE systems are relatively robust to single-step attacks, heatmap-based models are more robust than direct-regression models, explicit anthropometric modeling improves robustness, universal perturbations generalize across networks and appear to work by hallucinating body parts, and hips/lower-body joints are more vulnerable than head/neck joints.

Significance. If the headline ordering is correct, this would be a useful reference for the community: the paper identifies design choices (heatmap losses, multi-scale processing, explicit body structure) that correlate with resistance to gradient attacks, and it is one of the first systematic evaluations of adversarial attacks on pose estimation. The breadth is a strength: targeted and universal attacks, black-box transfer, multi-person and 3D settings, and a user study are all included. The universal-perturbation visualization as body-part hallucination is a striking and falsifiable finding. However, the evidence for the headline ordering is not yet at the level of a definitive comparative study: most numbers come from single runs, the re-implemented baselines are not documented with accuracy tables or released checkpoints, and the controlled ResDec experiment that supports the central heatmap-vs-regression claim is reported only briefly.

major comments (4)
  1. [Section 3.1] The fidelity of the re-implemented DeepPose and Chained Predictions models is asserted but not documented. The text says the authors made sure to get within 5% of the original reported accuracy, but no per-model PCKh numbers, training hyperparameters, data splits, or checkpoints are given. This matters because DeepPose is re-implemented with a ResNet-34 backbone and without the multi-stage feedback of the original, and Chained Predictions uses a ResNet-34 backbone; a 5% PCKh agreement does not guarantee a similar loss landscape or gradient behavior under attack. The central heatmap-vs-regression comparison in Fig. 4(a,b) and the transferability matrix in Table 1 depend on these models. Please provide accuracy tables and training details, or clearly restrict the claims to the actual implementations used.
  2. [Section 4.6 / Fig. 4] The headline claim that heatmap-based models are notably more robust than direct regression is confounded in the main analysis: DeepPose differs from the heatmap models in backbone, depth, multi-scale processing, training data, and optimization, not only in the loss function. The ResDec experiments are the right controlled comparison, but they are reported only as two points in Fig. 4(b,d), with no architecture details, training schedule, hyperparameters, or error bars. Please present the ResDec experiment as a dedicated table with full settings and repeat each condition multiple times; this is the load-bearing evidence for the heatmap-versus-regression claim.
  3. [Section 4 (quantitative results)] No error bars, confidence intervals, or statistical tests are reported anywhere. Since both model training and attack procedures are stochastic, the qualitative robustness ordering (e.g., DLCM 21.6 vs 8-SHG 18.5 vs 2-SHG 15.6 relative-PCKh under IGSM-U-10 at epsilon=8 in Section 4.6) could lie within run-to-run variation. Please provide repeated runs or significance tests for the main claims, or explicitly state that the results come from a single run and avoid strong comparative language.
  4. [Section 3.4.1 / Section 4.1] The targeted-attack protocol selects target poses randomly from the validation set among poses with PCKh=0 relative to the input, with a single random draw per image. The conclusion that targeted attacks are more difficult than untargeted attacks may depend on the difficulty of the sampled targets. Please either repeat targeted attacks over multiple target poses per image and report the distribution, or note that the reported effectiveness is conditional on the chosen target-selection heuristic.
minor comments (6)
  1. [Section 3.5 vs Section 4.2] The number of iterations for targeted attacks is inconsistent: Section 3.5 states that 20 iterations were used for IGSM-T, while Section 4.2 compares IGSM-T-10 and IGSM-T-100. Please correct the inconsistency.
  2. [Section 3.1] The phrase 'deception layers' appears to be a typo for 'deconvolution layers' in the description of the Chained Predictions implementation.
  3. [Fig. 4 caption] The caption labels several panels inconsistently: panels (e) and (f) are both described as IGSM-T-20 while the text refers to relative-PCKh and absolute-PCKh respectively; please make the caption match the figure and the text.
  4. [Table 1] The table is difficult to interpret: the header says 'Rows represent the relative degradation in the target network when attacked by the network in the column,' but the diagonal entries and the 'Doubly' column are not defined unambiguously. Please clarify the direction of the mapping and what the values represent.
  5. [Section 4.10] The user study reports MOS values and Gaussian-assumption probabilities but no confidence intervals; with 36 participants and 31 image pairs, please report the number of ratings per cell and a measure of uncertainty.
  6. [Various appendix references] Several appendix references are unresolved placeholders (e.g., 'see appendix Sec. ??' in Sections 4.2, 4.3, and 4.6.2). These need to be resolved in the final version.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an empirical evaluation whose conclusions are measured against external benchmarks and standard attack algorithms, not derived from fitted inputs or self-citations.

full rationale

The paper makes no formal derivation and fits no predictive model; its claims are empirical observations of measured robustness across existing and re-implemented pose-estimation architectures under standard adversarial attack procedures. The central conclusions, such as heatmap-based models being more robust than direct-regression models, are supported by experiments on MPII and COCO with relative-PCKh and OKS metrics, and the later ResDec experiments provide a matched-pair comparison that is itself an experiment rather than a construction. The only self-citation, the prior workshop version [28], is presented as the origin of the extended study and is not used to justify any load-bearing claim about robustness ordering. The concern raised by the skeptic about re-implementation fidelity is a correctness or validity risk, not a circularity risk: even if the re-implementations were unfaithful, the conclusion would be empirically wrong or unrepresentative, not true by definition. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from the authors' prior work, and no ansatz is smuggled in via citation. The paper is self-contained against external benchmarks, so the appropriate circularity finding is none.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claims rest on empirical evaluations. The key free parameters are attack hyperparameters chosen by hand; the axioms are standard benchmark assumptions plus the faithfulness of re-implemented models.

free parameters (4)
  • epsilon perturbation bound = 0.25 to 32
    Attack strength l-infinity bound; varied across this range and chosen by hand for all experiments.
  • IGSM step size alpha = epsilon/2 to epsilon/3 untargeted, epsilon/7 to epsilon/9 targeted
    Optimal ranges found by hand and used for iterative attacks.
  • number of iterations N = 10, 20, 100
    Iterative attack iterations; 20 for targeted attacks, 10 and 100 for untargeted.
  • universal perturbation delta and norm = delta = epsilon/200, norm in {8, 16}
    Settings for universal perturbation generation, fixed across all architectures.
assumptions (4)
  • domain assumption The validation sets of MPII and COCO are representative for evaluating robustness.
    All results are computed on validation sets; there is no discussion of domain shift or selection effects.
  • domain assumption L-infinity bounded additive perturbations are the appropriate threat model.
    The paper only studies l-infinity bounded noise, not other distortions such as rotation, scaling, or physical-world attacks.
  • domain assumption PCKh and OKS metrics capture meaningful pose estimation accuracy.
    Robustness is measured via these standard metrics; the paper itself notes that metric leniency can affect the comparison to segmentation (Section 4.5).
  • domain assumption Re-implemented models are faithful to original architectures within 5% accuracy.
    Section 3.1 states that re-implementations are validated to be within 5% of reported accuracy; the robustness comparisons rely on this equivalence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Robustness of Human Pose Estimation." pith.science (2026). https://pith.science/paper/SRLOSYQ2

@misc{pith2026190806401,
  author       = {Pith},
  title        = {Pith review of: On the Robustness of Human Pose Estimation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SRLOSYQ2}},
  note         = {Machine review of arXiv:1908.06401}
}
read the original abstract

This paper provides a comprehensive and exhaustive study of adversarial attacks on human pose estimation models and the evaluation of their robustness. Besides highlighting the important differences between well-studied classification and human pose-estimation systems w.r.t. adversarial attacks, we also provide deep insights into the design choices of pose-estimation systems to shape future work. We benchmark the robustness of several 2D single person pose-estimation architectures trained on multiple datasets, MPII and COCO. In doing so, we also explore the problem of attacking non-classification networks including regression based networks, which has been virtually unexplored in the past. \par We find that compared to classification and semantic segmentation, human pose estimation architectures are relatively robust to adversarial attacks with the single-step attacks being surprisingly ineffective. Our study shows that the heatmap-based pose-estimation models are notably robust than their direct regression-based systems and that the systems which explicitly model anthropomorphic semantics of human body fare better than their other counterparts. Besides, targeted attacks are more difficult to obtain than un-targeted ones and some body-joints are easier to fool than the others. We present visualizations of universal perturbations to facilitate unprecedented insights into their workings on pose-estimation. Additionally, we show them to generalize well across different networks. Finally we perform a user study about perceptibility of these examples.

Figures

Figures reproduced from arXiv: 1908.06401 by the authors.

Figure 1
Figure 1. Example of various targeted adversarial attacks of different networks on the [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Overview of direct regression and heatmap regression based approaches. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Overview of different adversarial perturbation schemes w.r.t. the access to the [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Performance of all the models under different types of attacks. First two rows [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Examples of predictions after adding image-agnostic universal perturbations [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Visualization of image-agnostic universal perturbations, with [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Examples of predictions after performing IGSM-U-10 attacks for the Stacked [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Visualization of the various heatmaps produced by the 8-Stack-Hourglass for [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]
Figure 9
Figure 9. Figure 9: Attacking multi-person 2D-HPE systems – attack on both top-down and [PITH_FULL_IMAGE:figures/full_fig_p022_9.png]
Figure 10
Figure 10. Figure 10: Iterative attacks on bottom up network – Originally the network correctly [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]
Figure 11
Figure 11. Figure 11: Visualization of adversarial examples of an image at different epsilons. As [PITH_FULL_IMAGE:figures/full_fig_p025_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 54 canonical work pages

  1. [1]

    In: IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR)

    Andriluka M, Pishchulin L, Gehler P, Schiele B (2014) 2d human pose estima- tion: New benchmark and state of the art analysis. In: IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR)

    work page 2014

  2. [2]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Arnab A, Miksik O, Torr PH (2018) On the robustness of semantic segmentation models to adversarial attacks. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2018

  3. [3]

    In: Proceedings of the Thirty-Second AAAI Conference on Artificial In- telligence, (AAAI-18), pp 2687–2695

    Baluja S, Fischer I (2018) Learning to attack: Adversarial transformation net- works. In: Proceedings of the Thirty-Second AAAI Conference on Artificial In- telligence, (AAAI-18), pp 2687–2695

    work page 2018

  4. [4]

    Bastani O, Ioannou Y , Lampropoulos L, Vytiniotis D, Nori A, Crim- inisi A (2016) Measuring neural net robustness with constraints. In: Lee DD, Sugiyama M, Luxburg UV , Guyon I, Garnett R (eds) Ad- vances in Neural Information Processing Systems 29, Curran Asso- ciates, Inc., pp 2613–2621, URL http://papers.nips.cc/paper/ 6339-measuring-neural-net-robustn...

    work page 2016

  5. [5]

    In: Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh, Scotland, UK, June 26 - July 1, 2012

    Biggio B, Nelson B, Laskov P (2012) Poisoning attacks against support vec- tor machines. In: Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh, Scotland, UK, June 26 - July 1, 2012

    work page 2012

  6. [6]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Cao Z, Simon T, Wei SE, Sheikh Y (2017) Realtime multi-person 2d pose es- timation using part affinity fields. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2017

  7. [7]

    In: IEEE Symposium on Security and Privacy, IEEE Computer Society, pp 39–57

    Carlini N, Wagner DA (2017) Towards evaluating the robustness of neural net- works. In: IEEE Symposium on Security and Privacy, IEEE Computer Society, pp 39–57

    work page 2017

  8. [8]

    Carreira J, Agrawal P, Fragkiadaki K, Malik J (2015) Human pose estimation with iterative error feedback

    work page 2015

Show all 67 references
  1. [9]

    CoRR abs/1804.05810

    Chen S, Cornelius C, Martin J, Chau DH (2018) Robust physical adversarial attack on faster R-CNN object detector. CoRR abs/1804.05810

    2018 arXiv

  2. [10]

    In: The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) On the Robustness of Human Pose Estimation 27

    Chen T, Liu S, Chang S, Cheng Y , Amini L, Wang Z (2020) Adversarial ro- bustness: From self-supervised pre-training to fine-tuning. In: The IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) On the Robustness of Human Pose Estimation 27

    2020

  3. [11]

    In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Chen Y , Wang Z, Peng Y , Zhang Z, Yu G, Sun J (2018) Cascaded pyramid net- work for multi-person pose estimation. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  4. [12]

    1908.10357

    Cheng B, Xiao B, Wang J, Shi H, Huang TS, Zhang L (2019) Higherhr- net: Scale-aware representation learning for bottom-up human pose estimation. 1908.10357

    2019 arXiv

  5. [13]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Chu X, Yang W, Ouyang W, Ma C, Yuille AL, Wang X (2017) Multi-context attention for human pose estimation. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2017

  6. [14]

    Cisse MM, Adi Y , Neverova N, Keshet J (2017) Houdini: Fooling deep structured visual and speech recognition models with adversarial examples. In: Guyon I, Luxburg UV , Bengio S, Wallach H, Fergus R, Vishwanathan S, Garnett R (eds) Advances in Neural Information Processing Sys...

    2017

  7. [15]

    In: ECCV

    Dabral R, Mundhada A, Kusupati U, Afaque S, Sharma A, Jain A (2018) Learn- ing 3d human pose from structure and motion. In: ECCV

    2018

  8. [16]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Dong Y , Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversar- ial attacks with momentum. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  9. [17]

    URL http://cocodataset.org/#keypoints-eval

    http://cocodatasetorg/#keypoints eval (????) Oks metric for keypoint detection evaluation. URL http://cocodataset.org/#keypoints-eval

  10. [18]

    In: Conference on Com- puter Vision and Pattern Recognition (CVPR)

    Fabbri M, Lanzi F, Calderara S, Alletto S, Cucchiara R (2020) Compressed vol- umetric heatmaps for multi-person 3d pose estimation. In: Conference on Com- puter Vision and Pattern Recognition (CVPR)

    2020

  11. [19]

    In: 2019 Eleventh In- ternational Conference on Quality of Multimedia Experience (QoMEX)

    Fezza SA, Bakhti Y , Hamidouche W, D ´eforges O (2019) Perceptual evaluation of adversarial attacks for cnn-based image classification. In: 2019 Eleventh In- ternational Conference on Quality of Multimedia Experience (QoMEX)

    2019

  12. [20]

    CoRR abs/1703.01101, URL http://arxiv

    Fischer V , Kumar MC, Metzen JH, Brox T (2017) Adversarial examples for se- mantic image segmentation. CoRR abs/1703.01101, URL http://arxiv. org/abs/1703.01101, 1703.01101

    2017 arXiv

  13. [21]

    Gkioxari G, Toshev A, Jaitly N (2016) Chained predictions using convolutional neural networks

    2016

  14. [22]

    CoRR abs/1412.6572

    Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversar- ial examples. CoRR abs/1412.6572

    2014 arXiv

  15. [23]

    In: The IEEE International Conference on Computer Vision (ICCV)

    Hendrik Metzen J, Chaithanya Kumar M, Brox T, Fischer V (2017) Universal adversarial perturbations against semantic image segmentation. In: The IEEE International Conference on Computer Vision (ICCV)

    2017

  16. [24]

    Hendrycks D, Lee K, Mazeika M (2019) Using pre-training can improve model robustness and uncertainty. arXiv

    2019

  17. [25]

    IEEE Transactions on Pattern Analysis and Machine Intelligence 36(7):1325– 1339 28 Sahil Shah †, Naman Jain†, Abhishek Sharma, Arjun Jain

    Ionescu C, Papava D, Olaru V , Sminchisescu C (2014) Human3.6m: Large scale datasets and predictive methods for 3d human sensing in natural environments. IEEE Transactions on Pattern Analysis and Machine Intelligence 36(7):1325– 1339 28 Sahil Shah †, Naman Jain†, Abhishek Shar...

    2014

  18. [26]

    In: International Conference on Computer Vision (ICCV)

    Iskakov K, Burkov E, Lempitsky V , Malkov Y (2019) Learnable triangulation of human pose. In: International Conference on Computer Vision (ICCV)

    2019

  19. [27]

    CoRR abs/1312.7302

    Jain A, Tompson J, Andriluka M, Taylor GW, Bregler C (2014) Learning human pose estimation features with convolutional networks. CoRR abs/1312.7302

    2014 arXiv

  20. [28]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops

    Jain N, Shah S, Kumar A, Jain A (2019) On the robustness of human pose esti- mation. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops

    2019

  21. [29]

    Krizhevsky A, Sutskever I, Hinton GE (2012) Imagenet classification with deep convolutional neural networks. In: Pereira F, Burges CJC, Bottou L, Weinberger KQ (eds) Advances in Neural Information Processing Systems 25, Curran Associates, Inc., pp 1097–1105, URL http://papers.n...

    2012

  22. [30]

    CoRR abs/1607.02533, URL http://arxiv.org/abs/1607

    Kurakin A, Goodfellow IJ, Bengio S (2016) Adversarial examples in the phys- ical world. CoRR abs/1607.02533, URL http://arxiv.org/abs/1607. 02533, 1607.02533

    2016 arXiv

  23. [31]

    CoRR abs/1611.01236, URL http://arxiv.org/abs/1611

    Kurakin A, Goodfellow IJ, Bengio S (2016) Adversarial machine learning at scale. CoRR abs/1611.01236, URL http://arxiv.org/abs/1611. 01236, 1611.01236

    2016 arXiv

  24. [32]

    In: Fleet D, Pajdla T, Schiele B, Tuytelaars T (eds) Computer Vision – ECCV 2014, Springer International Publishing, Cham, pp 740–755

    Lin TY , Maire M, Belongie S, Hays J, Perona P, Ramanan D, Doll´ar P, Zitnick CL (2014) Microsoft coco: Common objects in context. In: Fleet D, Pajdla T, Schiele B, Tuytelaars T (eds) Computer Vision – ECCV 2014, Springer International Publishing, Cham, pp 740–755

    2014

  25. [33]

    CoRR abs/1611.02770, URL http://arxiv

    Liu Y , Chen X, Liu C, Song D (2016) Delving into transferable adversarial ex- amples and black-box attacks. CoRR abs/1611.02770, URL http://arxiv. org/abs/1611.02770, 1611.02770

    2016 arXiv

  26. [34]

    In: The IEEE CVPR

    Lu J, Sibai H, Fabry E, Forsyth D (2017) No need to worry about adversarial examples in object detection in autonomous vehicles. In: The IEEE CVPR

    2017

  27. [35]

    In: ICCV, DOI 10.1109/ICCV .2017.288

    Martinez J, Hossain R, Romero J, Little JJ (2017) A simple yet effective baseline for 3d human pose estimation. In: ICCV, DOI 10.1109/ICCV .2017.288

    2017 doi

  28. [36]

    In: The IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR)

    Moosavi-Dezfooli SM, Fawzi A, Frossard P (2016) Deepfool: A simple and ac- curate method to fool deep neural networks. In: The IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR)

    2016

  29. [37]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Moosavi-Dezfooli SM, Fawzi A, Fawzi O, Frossard P (2017) Universal adver- sarial perturbations. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2017

  30. [38]

    Newell A, Deng J, Huang Z (2016) Associative embedding:end-to-end learning for joint detection and grouping

    2016

  31. [39]

    In: Computer Vision - ECCV 2016 - 14th European Conference, Am- sterdam, The Netherlands, October 11-14, 2016, Proceedings, Part VIII, pp 483– 499

    Newell A, Yang K, Deng J (2016) Stacked hourglass networks for human pose estimation. In: Computer Vision - ECCV 2016 - 14th European Conference, Am- sterdam, The Netherlands, October 11-14, 2016, Proceedings, Part VIII, pp 483– 499

    2016

  32. [40]

    In: The IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR) On the Robustness of Human Pose Estimation 29

    Nguyen A, Yosinski J, Clune J (2015) Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In: The IEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR) On the Robustness of Human Pose Estimation 29

    2015

  33. [41]

    arXiv preprint arXiv:180601484

    Nibali A, He Z, Morgan S, Prendergast L (2018) 3d human pose estimation with 2d marginal heatmaps. arXiv preprint arXiv:180601484

    2018

  34. [42]

    CoRR abs/1605.07277, URL http://arxiv.org/abs/1605.07277, 1605

    Papernot N, McDaniel PD, Goodfellow IJ (2016) Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. CoRR abs/1605.07277, URL http://arxiv.org/abs/1605.07277, 1605. 07277

    2016 arXiv

  35. [43]

    In: IEEE European Sympo- sium on Security and Privacy, EuroS&P 2016, Saarbr ¨ucken, Germany, March 21-24, 2016, pp 372–387

    Papernot N, McDaniel PD, Jha S, Fredrikson M, Celik ZB, Swami A (2016) The limitations of deep learning in adversarial settings. In: IEEE European Sympo- sium on Security and Privacy, EuroS&P 2016, Saarbr ¨ucken, Germany, March 21-24, 2016, pp 372–387

    2016

  36. [44]

    pp 459–468, DOI 10.1109/CVPR

    Pavlakos G, Zhu L, Zhou X, Daniilidis K (2018) Learning to estimate 3d human pose and shape from a single color image. pp 459–468, DOI 10.1109/CVPR. 2018.00055

    2018

  37. [45]

    In: Con- ference on Computer Vision and Pattern Recognition (CVPR)

    Pavllo D, Feichtenhofer C, Grangier D, Auli M (2019) 3d human pose estima- tion in video with temporal convolutions and semi-supervised training. In: Con- ference on Computer Vision and Pattern Recognition (CVPR)

    2019

  38. [46]

    In: The IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR)

    Poursaeed O, Katsman I, Gao B, Belongie S (2018) Generative adversarial per- turbations. In: The IEEE Conference on Computer Vision and Pattern Recogni- tion (CVPR)

    2018

  39. [47]

    CoRR abs/1801.08926, URL http: //arxiv.org/abs/1801.08926, 1801.08926

    Prakash A, Moran N, Garber S, DiLillo A, Storer JA (2018) Deflecting ad- versarial attacks with pixel deflection. CoRR abs/1801.08926, URL http: //arxiv.org/abs/1801.08926, 1801.08926

    2018 arXiv

  40. [48]

    In: Interna- tional Conference on Computer Vision (ICCV), URLhttp://flowattack

    Ranjan A, Janai J, Geiger A, Black MJ (2019) Attacking optical flow. In: Interna- tional Conference on Computer Vision (ICCV), URLhttp://flowattack. is.tue.mpg.de/

    2019

  41. [49]

    In: The European Conference on Computer Vision (ECCV)

    Rayat Imtiaz Hossain M, Little JJ (2018) Exploiting temporal information for 3d human pose estimation. In: The European Conference on Computer Vision (ECCV)

    2018

  42. [50]

    Ren S, He K, Girshick R, Sun J (2015) Faster r-cnn: Towards real- time object detection with region proposal networks. In: Cortes C, Lawrence ND, Lee DD, Sugiyama M, Garnett R (eds) Ad- vances in Neural Information Processing Systems 28, Curran Asso- ciates, Inc., pp 91–99, UR...

    2015

  43. [51]

    International Journal of Computer Vision (IJCV) 115(3):211–252, DOI 10.1007/s11263-015-0816-y

    Russakovsky O, Deng J, Su H, Krause J, Satheesh S, Ma S, Huang Z, Karpathy A, Khosla A, Bernstein M, Berg AC, Fei-Fei L (2015) ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) 115(3):211–252, DOI 10.1007/s11263-015-0816-y

    2015 doi

  44. [52]

    CoRR abs/1707.01159, URL http: //arxiv.org/abs/1707.01159, 1707.01159

    Sarkar S, Bansal A, Mahbub U, Chellappa R (2017) UPSET and ANGRI : Break- ing high performance image classifiers. CoRR abs/1707.01159, URL http: //arxiv.org/abs/1707.01159, 1707.01159

    2017 arXiv

  45. [53]

    In: WOOT @ USENIX Security Symposium, USENIX Association 30 Sahil Shah †, Naman Jain†, Abhishek Sharma, Arjun Jain

    Song D, Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Tram `er F, Prakash A, Kohno T (2018) Physical adversarial examples for object detectors. In: WOOT @ USENIX Security Symposium, USENIX Association 30 Sahil Shah †, Naman Jain†, Abhishek Sharma, Arjun Jain

    2018

  46. [54]

    In: The European Conference on Computer Vision (ECCV)

    Su D, Zhang H, Chen H, Yi J, Chen PY , Gao Y (2018) Is robustness the cost of accuracy? – a comprehensive study on the robustness of 18 deep image classifi- cation models. In: The European Conference on Computer Vision (ECCV)

    2018

  47. [55]

    In: 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp 5686–5696

    Sun K, Xiao B, Liu D, Wang J (2019) Deep high-resolution representation learn- ing for human pose estimation. In: 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp 5686–5696

    2019

  48. [56]

    In: The IEEE International Conference on Computer Vision (ICCV)

    Sun X, Shang J, Liang S, Wei Y (2017) Compositional human pose regression. In: The IEEE International Conference on Computer Vision (ICCV)

    2017

  49. [57]

    CoRR abs/1312.6199

    Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow IJ, Fergus R (2013) Intriguing properties of neural networks. CoRR abs/1312.6199

    2013 arXiv

  50. [58]

    In: The European Conference on Computer Vision (ECCV)

    Tang W, Yu P, Wu Y (2018) Deeply learned compositional models for human pose estimation. In: The European Conference on Computer Vision (ECCV)

    2018

  51. [59]

    Tompson JJ, Jain A, LeCun Y , Bregler C (2014) Joint training of a convolutional network and a graphical model for human pose estimation. In: Advances in Neural Information Processing Systems 27: Annual Conference on Neural Information Processing Systems 2014, December 8-13 20...

    2014

  52. [60]

    In: 2014 IEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2014, Columbus, OH, USA, June 23-28, 2014, pp 1653–1660

    Toshev A, Szegedy C (2014) Deeppose: Human pose estimation via deep neural networks. In: 2014 IEEE Conference on Computer Vision and Pattern Recogni- tion, CVPR 2014, Columbus, OH, USA, June 23-28, 2014, pp 1653–1660

    2014

  53. [61]

    In: Computer Vision and Pattern Recognition (CVPR)

    Wandt B, Rosenhahn B (2019) Repnet: Weakly supervised training of an adver- sarial reprojection network for 3d human pose estimation. In: Computer Vision and Pattern Recognition (CVPR)

    2019

  54. [62]

    In: The European Conference on Computer Vision (ECCV)

    Xiao C, Deng R, Li B, Yu F, Liu M, Song D (2018) Characterizing adversarial examples based on spatial consistency information for semantic segmentation. In: The European Conference on Computer Vision (ECCV)

    2018

  55. [63]

    Xiao C, Li B, yan Zhu J, He W, Liu M, Song D (2018) Generating ad- versarial examples with adversarial networks. In: Proceedings of the Twenty- Seventh International Joint Conference on Artificial Intelligence, IJCAI-18, In- ternational Joint Conferences on Artificial Intelligen...

    2018 doi

  56. [64]

    In: The IEEE International Conference on Computer Vision (ICCV)

    Xie C, Wang J, Zhang Z, Zhou Y , Xie L, Yuille A (2017) Adversarial exam- ples for semantic segmentation and object detection. In: The IEEE International Conference on Computer Vision (ICCV)

    2017

  57. [65]

    In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    Xu X, Chen X, Liu C, Rohrbach A, Darrell T, Song D (2018) Fooling vision and language models despite localization and attention mechanism. In: The IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2018

  58. [66]

    In: IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR), pp 3425–3435

    Zhao L, Peng X, Tian Y , Kapadia M, Metaxas DN (2019) Semantic graph convo- lutional networks for 3d human pose regression. In: IEEE Conference on Com- puter Vision and Pattern Recognition (CVPR), pp 3425–3435

    2019

  59. [67]

    In: ICCV

    Zhou X, Huang Q, Sun X, Xue X, Wei Y (2017) Towards 3d human pose esti- mation in the wild: A weakly-supervised approach. In: ICCV

    2017

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.