Small, carefully crafted changes to an image can fool deep neural networks into completely wrong classifications. A bus might be labeled an ostrich. Random noise doesn't work, but adversarial noise does, and researchers are testing this on datasets like MNIST.
Dear fellow scholars, this is two minute Papers with Artificial neural networks are computer programs that try to approximate what the human brain does to solve problems like recognizing objects in images. In this piece of work, the authors analyze the properties of these neural networks and try to unveil what exactly makes them think that the paper towel is a paper towel. And building on this knowledge, try to fool these programs. Let's have a look at this example. One can grab this input image and this noise pattern and add these two images together. Similarly, as one would add two numbers together, the operation yields the image you see here. I think it's fair to say that the difference is barely perceptible for the human eye. Not so much for neural networks, because the input image we started with is classified correctly as a bus and the image that you see on the right is classified as an ostrich. In simple terms, bus noise equals an ostrich. These two images look almost exactly the same, but the neural networks see them quite differently. We call these examples adversarial examples because they are designed to fool these image recognition programs. In machine learning research there are common data sets to test different classification techniques on. One of the best known example is the MNIST handwriting dataset. It is basically a bunch of images depicting handwritten numbers that machine learning algorithms have to recognize. Long ago this used to be a difficult problem, but nowadays any half decent algorithm can guess the numbers correctly more than 99% of the time after learning for just a few seconds. Now we'll see that these adversarial examples are not created by chance. If we add a lot of random noise to these images, they get quite difficult to recognize. Let's engage in modesty and say that I myself am as a human can recognize approximately half of them, but only if I look closely and maybe even squint. A neural network can guess this correctly approximately 50% of the time as well, which is a quite respectable result. Therefore, adding random noise is not really fooling the neural networks. However, if you look at these adversarial examples in the even columns, you see how carefully they are crafted as they look very similar to the original images. But the classification accuracy of the neural network on these examples is 0%. You heard it correctly, it gets it wrong basically all the time. The take home message is that carefully crafted adversarial examples can be used to fool deep neural networks reliably. You can watch them flounder on many hilarious examples to your enjoyment. My dear sir. The queen wears a shower cap, you say? I beg your pardon. If you would like to support two minute papers. We are available on Patreon and offer really cool perks for our fellow scholars. For instance, you can watch each episode around 24 hours in advance or even decide the topic of the next episodes. How cool is that? If you are interested, just click on the box below on the screen. Thanks for watching and for your generous support and I'll see you next time.
