4 ms·
Interesting, can this be prevented by simply random blurring images first? The NN should still be able to recognise something partially blurred if trained that
by jaimex2 9y ago
Interesting, can this be prevented by simply random blurring images first?
The NN should still be able to recognise something partially blurred if trained that way.
- draugadrotten 9y agoor perhaps adding random pixel noise to the image before attempting training/recognition to prevent "smoothness" in an area from being a recognized property
- viraptor 9y agoAlternatively eliminate the noise by low-pass filtering in freq domain. Even a small LED light will bleed to more than one pixel in a real photo.
- mattkrause 9y agoI don't want to totally brush off the security implications, but I think focusing on ways to mitigate this exact "attack" is almost missing the point. You could trivially thwart this attack by rate-limiting--it needs many passes through the network to evolve an image--or by caching the classifier's output and returning it for all similar (e.g., by hamming distance) images. Instead, I think this work is interesting because it shows the limits of the network's generalization abilities.