3 ms·

Speaking of similarity between CV and human visual systems; it was kinda striking to me just how psychedelic/"trippy" the "universal adversarial perturbations"

by zkms 8y ago

Speaking of similarity between CV and human visual systems; it was kinda striking to me just how psychedelic/"trippy" the "universal adversarial perturbations" (see page 5 in https://arxiv.org/pdf/1610.08401.pdf https://arxiv.org/pdf/1610.08401.pdf) look. Indeed, the look of visual hallucination "form constants" is intimately related to the machinery in the visual cortex that detects edges/contours/surfaces: https://www.math.uh.edu/~dynamics/reprints/papers/nc.pdf https://www.math.uh.edu/~dynamics/reprints/papers/nc.pdf and such visual hallucinations can be elicited without any drugs or physiological interventions/defects -- just via diffuse flickering light: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3182860/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3182860/

shoo 8y ago
There's a video demo of the first paper here: https://www.youtube.com/watch?v=jhOu5yhe0rc https://www.youtube.com/watch?v=jhOu5yhe0rc i was trying to build a bit of intuition about this paper by considering a trivial case where there are two classes, and the classifier is linear, in very low dimension. consider the following trivial example: https://en.wikipedia.org/wiki/Linear_classifier#/media/File:Svm_separating_hyperplanes.png https://en.wikipedia.org/wiki/Linear_classifier#/media/File:... in this example, the decision boundary from different classifiers is shown as H_1, H_2, H_3. The "universal" perturbation for each of the three classifiers would be a small vector normal to the each classifier's decision boundary. This paper defines "universal" perturbation with respect to the choice of input from the population of inputs, but each "universal" perturbation is optimised specifically to target a single model (aka classifier). both H_1 and H_2 do a reasonable job of separating the two classes, but the H_1 decision boundary with the smaller margin is more vulnerable to misclassification if inputs are perturbed by a small vector normal to its decision boundary. You can imagine translating the input space a bit to the right -- this would result in H_1 misclassifying say 2 out of the 18 data points shown, whereas H_2 (the SVM generated decision boundary with maximal margin) classifier would not experience any errors.

by zkms 8y ago

shoo 8y ago

There's a video demo of the first paper here: https://www.youtube.com/watch?v=jhOu5yhe0rc https://www.youtube.com/watch?v=jhOu5yhe0rc i was trying to build a bit of intuition about this paper by considering a trivial case where there are two classes, and the classifier is linear, in very low dimension. consider the following trivial example: https://en.wikipedia.org/wiki/Linear_classifier#/media/File:Svm_separating_hyperplanes.png https://en.wikipedia.org/wiki/Linear_classifier#/media/File:... in this example, the decision boundary from different classifiers is shown as H_1, H_2, H_3. The "universal" perturbation for each of the three classifiers would be a small vector normal to the each classifier's decision boundary. This paper defines "universal" perturbation with respect to the choice of input from the population of inputs, but each "universal" perturbation is optimised specifically to target a single model (aka classifier). both H_1 and H_2 do a reasonable job of separating the two classes, but the H_1 decision boundary with the smaller margin is more vulnerable to misclassification if inputs are perturbed by a small vector normal to its decision boundary. You can imagine translating the input space a bit to the right -- this would result in H_1 misclassifying say 2 out of the 18 data points shown, whereas H_2 (the SVM generated decision boundary with maximal margin) classifier would not experience any errors.