2 ms·

The trick is later in the article where he disguised it as a tie-dye patch with only marginally reduced toaster classification probability. This could be usefu

The trick is later in the article where he disguised it as a tie-dye patch with only marginally reduced toaster classification probability. This could be useful to make networks hallucinate all sorts of things where humans would not suspect; imagine I made stickers that made surveillance cameras see the face of the FBI’s most wanted, and stuck them on a person I wanted to harass. Or imagine I could make a “sticker” large enough to make a drone surveillance system hallucinate a tank. There are enough humans in the loop today where this is hopefully not a serious attack vector, but this is a good thing to keep in mind when designing new systems.

web007 9y ago
The problem I'm arguing is that this feels like "picture of a tank". Of course you can have a system think it sees a tank if it sees a tank. The tie-dye example is a lot more interesting, but still feels like the other adversarial image fooling examples where you can perturb an image slightly and have the result change (or can see a turtle and the computer sees a gun, even in 3D). Is the novelty in the size of the patch, since you can perturb an area of N and have an effect over an area N * M for some large M? Edit: I missed https://adriancolyer.files.wordpress.com/2018/03/adversarial-patch-fig-3.jpeg https://adriancolyer.files.wordpress.com/2018/03/adversarial... (and the video posted by @jwilk) - the answer is "Yes, it's the small size versus the total effect".