A trained deep neural net can be viewed as -- indeed, it is -- a program that accepts some input data and produces some output. The idea here, at a very high l

A trained deep neural net can be viewed as -- indeed, it is -- a program that accepts some input data and produces some output. The idea here, at a very high level, is to use other neural nets that (a) accept different input data and learn to 'adversarially embed it' into the input data accepted by the first neural net, and (b) extract from the output of the first neural net the actual output desired by the attacker... without ever touching the first neural net. The authors demonstrate adversarial neural nets that target a deep convnet trained to classify ImageNet data. They are able alter this convnet's function from ImageNet classification to counting squares in an image, classifying MNIST digits, and classifying CIFAR-10 images... without ever touching the convnet. Great work.