The problem I'm arguing is that this feels like "picture of a tank". Of course you can have a system think it sees a tank if it sees a tank. The tie-dye example

The problem I'm arguing is that this feels like "picture of a tank". Of course you can have a system think it sees a tank if it sees a tank. The tie-dye example is a lot more interesting, but still feels like the other adversarial image fooling examples where you can perturb an image slightly and have the result change (or can see a turtle and the computer sees a gun, even in 3D). Is the novelty in the size of the patch, since you can perturb an area of N and have an effect over an area N * M for some large M? Edit: I missed https://adriancolyer.files.wordpress.com/2018/03/adversarial-patch-fig-3.jpeg https://adriancolyer.files.wordpress.com/2018/03/adversarial... (and the video posted by @jwilk) - the answer is "Yes, it's the small size versus the total effect".