there's a lot of bullshit in this article. To start, it should be clear to everyone that it is possible to actually transform a picture of a cat into a picture

there's a lot of bullshit in this article. To start, it should be clear to everyone that it is possible to actually transform a picture of a cat into a picture of a dog. The argument that the author is trying to make is not, in fact, that the human brain is hackable with adversarial images, but that the kinds of strategies which allow you to hack a wide range of deep learning models (to turn cats into dogs) require the introduction of "features" that a human would recognize as being doglike. The leading image is not evidence of this, however. We have to keep track of the what figures correspond to which claims, because the article jumps around. The first figure shows us a mask which people agree turns a cat into a dog. This is not evidence of any claim because such masks are guaranteed to exist. The second figure shows a mask which people don't even detect which causes a computer to claim that a panda is a gibbon. This is basically the null hypothesis of the paper, it demonstrates that you can attack a single computer with a subtle mask. The third figure shows us an example of an attack that is robust across deep learning models and also to perspective shifts. The argument being defended by this figure is that humans recognize the mistakes that the machine is making as being non-superficial features of laptops and toasters. The author undermines his own argument here, by requiring that the attack be robust to perspective shifts. The point he/she is trying to make is that in order to be robust to many neural nets you have to include non-superficial features, but then convolutes that claim by also requiring the features to be robust to other types of transformation as well. Does the "featuriness" of the attack come from the multiple neural network requirement or for the transformational robustness requirement? The answer is unknown. Furthermore, I think this argument falls short pretty quickly if you simply hide the computer's answer. Would you guess that the computer guessed laptop for the first image, even if you knew it got it wrong? How far down your list would that have been? Or toaster for the second? The features offered in the second image definitely look like they have some features that are similar to the corner of a rounded metal cube, but this is exactly a superficial image statistic which is robust to change of perspective transformations. My classifier might as well be looking for that exactly. This is not evidence for the authors case. The fourth and fifth figures are more interesting, but still do not provide any evidence in defense of machine learning. It's important, for some reason, to point out that the accuracy on image tasks is NOT measured linearly with error rate. 99.9% accuracy is 10 times better than 99% accuracy. The difference between 65 and 75% is about 1000 times less than the difference between 75% and 99% Allow me to submit, without evidence, that humans can differentiate between a cat and a dog with >99% accuracy when given as much time as they need to make a decision about whether or not they are looking at a cat or a dog (with no adversarial mask applied). This means that the difference between human performance on the task without the time constraint, versus human performance on the task with the time constraint, is about 1000 times larger than the difference between human performance on the task with the time constraint and the task with the time constraint and the filter. This means that if you really want people to fail on the cats versus dogs task, spending time coming up with the filter to apply after you've somehow managed to present the image that you're trying to get the person to misclassify for 1/20 of a second, followed by a noise mask, is >100 times less valuable at getting them to misclassify the picture than figuring out how to add the time constraint. Not to mention the fact that transformations that actually take cats to dogs and vice versa are necessarily possible, and that differentiation between cats and dogs is an image recognition task with a much clearer limit on human performance than differentiation between cats and laptops, which we are nevertheless amazingly good at. Cats are very close to dogs, and it seems like this paper has completely forgotten this fact, and is deeply surprised to learn it. Overall this is a very poor defense of deep learning.