6 ms·
It's also interesting whether there are people with apperceptive visual agnosia who are susceptible to adversarial examples.
by red75prime 9y ago
It's also interesting whether there are people with apperceptive visual agnosia who are susceptible to adversarial examples.
- taeric 9y agoAgreed it is an interesting question. Humans are just far less likely to build a mono culture of vision capabilities. Such that the applicability of any adversarial examples is likely far more limited.
- sharemywin 9y agoaren't optical illusions human adversarial examples?
- hackinthebochs 9y agoIt's probably fair to see them as such, but they operate in the semantic domain rather than the pixel domain.
- taeric 9y agoDo they? Specifically the graffiti style illusions that appear 3d to people. Those seem to work by specifically lining up the "pixels" you see.
- hackinthebochs 9y agoIt's not a seemingly random (meaningless) perturbations that cause misclassification/misrecognition, but a very specific (meaningful) tuning of features that serve to trigger some misrecognition. The distinction here is whether the modified features themselves have semantic information (i.e. have a representation in the semantic domain with respect to the content of the image). In the case of graffiti illusions, it seems that it does: the misrecognition is due to a particular kind of coherence with the observers perspective and the relative positioning/alignment of the features in the image. Both perspective and relative alignment of features is meaningful.
- moultano 9y agoThere's no semantic reason why we see this image as moving, but everyone does, even animals. http://24.p3k.hu/app/uploads/2014/05/Rotsnake1.gif http://24.p3k.hu/app/uploads/2014/05/Rotsnake1.gif
- hackinthebochs 9y ago>There's no semantic reason It's hard to be certain because we don't know the details of our visual system.
- taeric 9y agoI think you are somewhat shifting the goalposts, though. For adversarial images, you are changing what you know the system is looking at. In such a way that confuses it to "see" something else. For humans, we just happen to somewhat understand the image that is being used against us. How is this different?
- hackinthebochs 9y agoThe difficulty here is operationalizing the terms involved to make the point of semantic domain vs pixel domain meaningful at all. But I think this point makes it a substantive distinction: have a representation in the semantic domain with respect to the content of the image. There are various semantic features of an image and we presume that our visual system is extracting and operating on these semantic features. So it seems important to ask whether the features causing the misclassification can be represented in a semantic domain of the image. Shapes, (relative) sizes, gradients, high level patterns, etc are examples of semantic domains. There seems to be a distinction between the kinds of optical illusions humans are susceptible to and the kinds CNNs are. In the graffiti illusions, the placement of the image that causes our 3D object recognition system to kick in can be described through angles, lines, focal points, focal lengths, etc. These are all semantic features of the scene depicted in an image. Contrast this with CNN adversarial perturbations which have zero semantic features that we recognize. This seems like an important result. It means that our visual system is robust against certain classes of adversarial images, namely the small imperceptible deltas that trip up CNNs. To trip up our visual system requires certain combinations of semantic input which are harder to exploit (larger delta is harder to exploit).