Researchers show how tiny, carefully designed noise can trick neural networks into misidentifying images. Even stranger: some of these adversarial patterns fool human eyes too, making a cat look like a dog.
Dear fellow scholars, this is two minute. Papers with neural networks are amazing at recognizing objects when being shown an image. And in some cases, like traffic sign recognition, their performance can reach superhuman levels. But as we discussed in the previous episode, most of these networks have an interesting property where we can add small changes to an input photo and have the network misclassify it to something completely different. A super effective neural network can be reduced to something that is less accurate than a coin flip with a properly crafted adversarial attack. So of course we may think that neural networks are much smaller and simpler than the human brain. And because of that, of course, we cannot perform such an adversarial attack on the human vision system, right? Or is it possible that some of the properties of machine vision systems can be altered to fool the human vision? And now hold on to your papers. I think you know what's coming. This algorithm performs an adversarial attack on you. This image depicts a cat. And this image depicts a dog. Surely it's a dog, right? Well, no. This is an image of the previous cat, plus some carefully crafted noise that makes it look like a dog. This is such a peculiar effect. I am staring at it and I know for a fact that this is not a dog. This is cat plus noise, but I cannot not see it as a dog. Wow, this is certainly something that you don't see every day. So let's look at what changes were made to the image. Clearly, the nose appears to be longer and thicker, so that's a dog like feature. But it is of utmost importance that we don't overlook the fact that several cat specific features still remain in the image. For, for instance, the whiskers are very catlike. And despite that, we still see it as a dog. This is insanity. This technique works by performing an adversarial attack against an AI model and modifying the noise generator model to better match the human visual system. Of course, the noise we have to add depends on the architecture of the neural network. And by this I mean the number of layers and the number of neurons within these layers and many other parameters. However, a key insight of the paper is that there are still features that are shared between most architectures. This means that if we create an attack that works against five different neural network architectures, it is highly likely that it will also work on an arbitrary sixth network that we haven't seen yet. And it turns out that some of these noise distributions are also useful against the human visual system. Make sure to have a look at the paper. I have found it to be an easy read and quite frankly, I am stunned by the result. It is clear that machine learning research is progressing at a staggering pace, but I haven't expected this. I haven't expected this at all. If you are enjoying the series, please make sure to have a look at our Patreon page to pick up cool perks like watching these episodes in early access or getting your name displayed in the video description as a key supporter. Details are available in the video description. Thanks for watching and for your generous support and I'll see you next time.
