4 ms·
Or, simply with better machine learning. > The border between “truth” and “false” is almost linear. The first cool thing we can derive from it is that when you
by azernik 9y ago
Or, simply with better machine learning.
> The border between “truth” and “false” is almost linear. The first cool thing we can derive from it is that when you follow the gradient, once you find the area where the predicted class changes, you can be fairly confident that the attack is successful. On the other hand, it tells us that the structure the decision function is far simpler that most researchers thought it to be.
Humans can be fooled by optical illusions as well; but those illusions are much more limited and much more noticeable than most of these. My (very non-specialist) interpretation of the italicize clause is that a) vulnerability to these attacks is a continuum, not a binary, and b) the current ease of these attacks reflects the crudity of our current ML techniques.
- ben_w 9y agoHabe you seen the Monroe-Einstein illusion? There is a continuous transition from one image to the other, depending on the angular size. This feels relevant to your point. https://static.independent.co.uk/s3fs-public/styles/article_small/public/thumbnails/image/2015/04/03/14/einstein.jpg https://static.independent.co.uk/s3fs-public/styles/article_...
- tambourine_man 9y agoI wouldn't call that an illusion, but more a consequence of a high-pass/low-pass filter at different distances with limited resolution. What I find much more disturbing is that even though I measured and known those lines are parallel or that those shades of gray are the same, I can't "unsee" the illusion.
- theptip 9y agoAgree, it seems to me that there's a sense in which this is a trivial issue; just throw more adversarial examples into the training set, and turn the crank until the classifier understands how to correctly handle those cases too. There's also a sense in which this is extremely non-trivial; any agent (human or machine) can be subjected to adversarial attacks. They just look different right now, and our current systems are vulnerable to very simple ones. It seems to me that improving an algorithm's resistance to adversarial attacks is much more feasible than improving a human's resistance to their own class of adversarial attacks.