  We study the effect of adversarial perturbations of images on deep stereo
matching networks for the disparity estimation task. We present a method to
craft a single set of perturbations that, when added to any stereo image pair
in a dataset, can fool a stereo network to significantly alter the perceived
scene geometry. Our perturbation images are "universal" in that they not only
corrupt estimates of the network on the dataset they are optimized for, but
also generalize to different architectures trained on different datasets. We
evaluate our approach on multiple benchmark datasets where our perturbations
can increase the D1-error (akin to fooling rate) of state-of-the-art stereo
networks from 1% to as much as 87%. We investigate the effect of perturbations
on the estimated scene geometry and identify object classes that are most
vulnerable. Our analysis on the activations of registered points between left
and right images led us to find architectural components that can increase
robustness against adversaries. By simply designing networks with such
components, one can reduce the effect of adversaries by up to 60.5%, which
rivals the robustness of networks fine-tuned with costly adversarial data
augmentation. Our design principle also improves their robustness against
common image corruptions by an average of 70%.
