23 ms·

Adversarial.io – Fighting mass image recognition

249 points by petecooper 6y ago

endisneigh 6y ago
Couldn't you easily infer the attacking noise by comparing the original and the changed images? Once you have the attacking noise it would be pretty trivial to beat this, no? I also don't see how this would do much against object recognition or face recognition. More insight to the types of recognition this actually fights against would be helpful.
- alexchamberlain 6y ago
  I think the idea is that the AI doesn't have access to the original. That being said, I'm not sure what would stop such AIs from being _trained_ on images that have been attacked.
  - capableweb 6y ago
    We'll end up in a similar cat&mouse game as online "pirates" been at for a long time. Developers create something to break the AI, the AI adopt because they figure out the noise profile, developers change the noise profile and the AI has to adopt again.
- xondono 6y ago
  > I also don't see how this would do much against object recognition or face recognition. That’s precisely the point, you are creating noise that humans are insensitive to, but that severely affects AI. The idea as I understand is that if you need to upload an image (of yourself for instance), you can use this to complicate matters to AIs by uploading the modified picture.
CivBase 6y ago
Begun, the AI wars have.
- djabatt 6y ago
  sadly there will be a lot of time and machine power spent on this war.
- ibraheemdev 6y ago
  AI already controls the world through social media. It knows everything you do and decides what you see and when you see it.
nerdponx 6y ago
Switching the result from "tabby" to "catamount" is not nearly as "adversarial" as I expected. Is that really worth it? Is the idea that it's useful if you're trying to stop targeted facial recognition of individual people?
- TazeTSchnitzel 6y ago
  Perhaps the algorithm they're using doesn't know that those are similar things and just knows they're different, so it optimises towards them.
JohnPDickerson 6y ago
Folks interested in this kind of work should check out an upcoming ICLR paper, "LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition", from Tom Goldstein's group at Maryland. Similar pitch -- use a small adversarial perturbation to trick a classifier -- but LowKey is targeted at industry-grade black-box facial recognition systems, and also takes into account the "human perceptibility" of the perturbation used. Manages to fool both Amazon Rekognition and the Azure face recognition systems almost always. Paper: https://arxiv.org/abs/2101.07922 https://arxiv.org/abs/2101.07922
sly010 6y ago
Can't wait to read about Inception V4 being trained on adversarial.io for better noise resistance :)
- _the_inflator 6y ago
  Yes, the irony: this app makes image recognition even more effective.
  - Imnimo 6y ago
    I don't really think this is true for two reasons. First, the app doesn't add anything that someone training a classifier couldn't just do themselves. If I want to train my network against adversarial inputs, I can just generate them myself at training time on my own training data - it's not particularly helpful for me to have a bunch adversarially-perturbed but unlabeled images. Second, and more importantly, it's not sufficient to just train on adversarial examples taken from another network. You might learn to be robust against the specific weaknesses of that other network, but your new network will have its own idiosyncratic weaknesses. To be effective, adversarial training (https://arxiv.org/pdf/1706.06083.pdf https://arxiv.org/pdf/1706.06083.pdf) needs an adversary that adapts to the network as it trains. In other words, you need your adversary to approximate your current weaknesses at each step of training.
bspammer 6y ago
I love how you can almost see a lynx in the attacking noise. I'd be interested to know if that's my brain spotting a pattern that isn't there, or if that's genuinely just the mechanism for the disruption.
- Imnimo 6y ago
  I think it's unlikely that the noise will generally have any relation to the target class. I can't find anywhere they say exactly which attack method they use, so it's hard to say for certain, but all of the attacks I'm aware of don't generate noise that has any human-interpretable structure. See for example Figure 1 in the seminal paper on adversarial attacks: https://arxiv.org/pdf/1412.6572.pdf https://arxiv.org/pdf/1412.6572.pdf
- 40four 6y ago
  Makes me think of those old ‘magic eye’ stereogram images that used to be so popular.
djabatt 6y ago
Absolutely the coolest project I read about this year. It will be an arms race between hiding and finding. I went through this with web and email spam.
forrestthewoods 6y ago
If my human eyes can identify a picture then, eventually, so too will algorithms. This is fundamentally a dead end concept. > it works best with 299 x 299px images that depict one specific object. Wow. How incredibly useful.
- car 6y ago
  How do we know that mammalian visual systems aren’t fundamentally different from AI? What you predict is nothing but an assumption.
  - deleted 6y ago
    [deleted]
  - pelorat 6y ago
    The poster is not wrong. This attack only works against a specific model trained against a specific dataset. It does not work against models that understand that a animal face is made up of sub features like a nose, two eyes and a mouth. In the end, this is a completely useless exercise and will not have any impact on mass image recognition. For this to even work the attack needs to be tailored to the exact weights in the neural network that is being attacked.
car 6y ago
It’s really surprising to me how easily AI can be fooled. Maybe there is a fundamental difference between our visual system and what is represented in a visual recognition CNN. Could it be the complexity of billions of cells vs. the simplification of an AI, or something about the biology we haven’t yet accounted for?
- iujjkfjdkkdkf 6y ago
  We compare what we see against our internal model of the world, a CNN pattern matches, it doesn't think critically about the result that comes out.
- TaylorAlexander 6y ago
  Our CNN models are not meant to replicate the human visual system. They are a convenient mathematical tool that is quite unlike our brain. It’s not even necessary to use convolutions, though they remain the most popular method.
- yumraj 6y ago
  Because there is no I in AI. At a mile high conceptual level, AI is nothing but a program created by a computer based on the data it is provided Which is why it is extremely easy to fool using techniques that it is not trained to handle, today, but might be able to handle tomorrow. It is a race...
  - car 6y ago
    Right. I’m naive in assigning more capability to these models than they posess. I found a quote from Geoff Hinton where he talked about this last year. From [1]: “I can take an image and a tiny bit of noise and CNNs will recognize it as something completely different and I can hardly see that it’s changed. That seems really bizarre and I take that as evidence that CNNs are actually using very different information from us to recognize images,” Hinton said in his keynote speech at the AAAI Conference. “It’s not that it’s wrong, they’re just doing it in a very different way, and their very different way has some differences in how it generalizes,” Hinton says. [1] https://bdtechtalks.com/2020/03/02/geoffrey-hinton-convnets-cnn-limits/ https://bdtechtalks.com/2020/03/02/geoffrey-hinton-convnets-...
telesilla 6y ago
I'd pay for API access for this, are there any plans for this?
loser777 6y ago
What happens when the perturbed images are processed by some noise removal method? On the crude end, even something like aggressive JPEG compression will tend to remove high frequency noise. There's also more sophisticated work like Deep Image Prior [1], which can reconstruct images while discarding noise in a more "natural" way. Finally, on the most extreme end, what happens when someone hires an artist or builds a sufficiently good robot artist to create a photorealistic "painting" of the perturbed image? There's a lot of work on compressing/denoising images so that only the human-salient parts are preserved, and without seeing this working past that I think it's better to interpret "adversarial" in the machine learning sense only. Where "adversarial" means useful for understanding how models work, but not with any strong security implications. [1] https://arxiv.org/abs/1711.10925 https://arxiv.org/abs/1711.10925
nickvincent 6y ago
There's a theme in this discussion that ML operators will just train new models on adversarially perturbed data. I don't think this is necessarily true at all! The proliferation of tools like this and the "LowKey" paper/tool linked below (an awesome paper!) will fundamentally change the distribution of image data that exists. I think that widespread usage of this kind of tool should trend towards increasing the irreducible error of various computer vision tasks (in the same way that long term adoption of mask wearing might change the maximum accuracy of facial recognition). Critically, while right now the people who do something like manipulate their images will probably be very privacy conscious or tech-interested people, tools like this seriously lower the barrier to entry. It's not hard to imagine a browser extension that helps you perturb all images you upload to a particular domain, or something similar.
- yumraj 6y ago
  > It's not hard to imagine a browser extension that helps you perturb all images you upload to a particular domain, or something similar. Ideally I’d like to see something like this be part of the camera filter itself. Why can’t Apple, if they choose to do so, just add something like this as part of their camera app itself?
  - LockAndLol 6y ago
    If it's opensource, there's no need to wait on the business interests of a trillion dollar company to align with your wishes. Camera app developers can be made aware of it and add it to their apps. If there are app developers on HN, they can create pull requests to their favorite apps and add the feature. That's the power of opensource.
    - yumraj 6y ago
      Yes, for you and me, but not for ordinary folks..
- lmeyerov 6y ago
  The adversarial ML arms race seems similar to the rest of the security/privacy arms race, where these endeavors will make recognition stronger, not weaker, similar to how any other manual red team attacks ultimately get (a) automated and (b) incorporated into blue team's automatic defenses. Hard to see why that wouldn't be the case, esp. for techniques that are general, vs. exploiting bugs in individual models. As long as a person can quickly tell the difference, it's in the grasp of deep learning for ~perception problems, and the economics of the arms race determines the rest of what happens when..
kaoD 6y ago
Why does this page request access to my VR devices?
colincooke 6y ago
It's interesting that they only tackle a single model architecture (a pretty common one). It makes me think that is is likely an attack technique which uses knowledge of the model weights to mess up image recognition (if you know the weights, there are some really nice techniques that can find the minimum change necessary to mess up the classifier). Pretty cool stuff, but also if my assumption is correct it means that if you _didn't_ use the widely available ImageNet weights for inception v3 then this attack would be less effective (or not even work). Given that most actors who you don't want recognizing your images don't open source their weights this may not scale/or be very helpful...
- fantod 6y ago
  This was my first thought as well. The question is: How robust are adversarial perturbations? In other words: Given such a perturbation that was generated using one model, how well can we expect to work on a similar model (in the sense that both models are fooled)? I would be curious to know if any research has been done on this question.
  - iujjkfjdkkdkf 6y ago
    My feeling is that even inception trained on imagenet with a different random initialization would probably not fail (or at least be much less likely to fail) when exposed to these adversarial examples. If these are hacking the specific, underspecified, realization of the classifier (I.e. the set of public weights trained from a specific seed and visit order through the data), the adversarial examples are probably just as fragile as the classifier.
    - Filligree 6y ago
      What makes me think is that, in principle, there should be similar adversarial examples for the human optical system. Practically speaking it wouldn't fool anyone for more than a split second, not least since our input is video instead of snapshots, but it's an interesting thing to wonder about. Maybe we could build an AI which would be in most senses as smart as us, but which would be more vulnerable to such things?
puttycat 6y ago
Great idea. Please consider distributing this as open an source downloadable app to avoid privacy concerns.
oneweekwonder 6y ago
This 2017 article "Google’s AI thinks this turtle looks like a gun[0]" made me realise ai in the near future, might need to take lethal action, based on flawed data. But then I just comfort myself with the following quote: "The ai does not love you, the ai does not hate you. But you are made out of atoms, it can use for something else." [0]: https://www.theverge.com/2017/11/2/16597276/google-ai-image-attacks-adversarial-turtle-rifle-3d-printed https://www.theverge.com/2017/11/2/16597276/google-ai-image-...
zaik 6y ago
Given that the most likely input is privacy sensitive, I would prefer a small CLI tool over uploading files to some server.
mijail 6y ago
As a thought experiment this is cool but from a practical perspective it’s too focused on a specific architecture and if anything adding perturbations might (slightly) help the training process. From the thought experiment side. I think the moral implications cut both ways. Mass image recognition is not always bad - think about content moderation or the transfer of images of abuse. As a society we want AI to flag these things.
ignoranceprior 6y ago
We're still in the phase where different models can play cat and mouse, but I wouldn't count on this lasting very long. Given that we know it's possible to correctly recognize these perturbed images (proof: humans can), it's only a matter of time until AI catches up and there's nothing you can do to prevent an image of your face from being identified immediately.
Chris2048 6y ago
I'm skeptical - what happens when NNs are no longer susceptible to simple adversarial examples, or they take proportionally more power to compute? I'd sooner spend the effort on legal challenges.
dijksterhuis 6y ago
If folks are interested in this stuff, check out Fawkes: https://sandlab.cs.uchicago.edu/fawkes/ https://sandlab.cs.uchicago.edu/fawkes/ https://github.com/Shawn-Shan/fawkes https://github.com/Shawn-Shan/fawkes http://people.cs.uchicago.edu/%7Eravenben/publications/pdf/fawkes-usenix20.pdf http://people.cs.uchicago.edu/%7Eravenben/publications/pdf/f...
hivacruz 6y ago
Just tested on some movie snapshots, doesn't seem to do the trick to me on Google Images (and the noise is very noticeable). Shame, I thought I would be able to trick Google Images and stop giving away answers for my movie quiz game that easily. The only method that works randomly as an anti-cheat measure is to revert horizontally the image. It fools Google Images a lot of times.

249 points by petecooper 6y ago

Couldn't you easily infer the attacking noise by comparing the original and the changed images? Once you have the attacking noise it would be pretty trivial to beat this, no? I also don't see how this would do much against object recognition or face recognition. More insight to the types of recognition this actually fights against would be helpful.

alexchamberlain 6y ago
I think the idea is that the AI doesn't have access to the original. That being said, I'm not sure what would stop such AIs from being _trained_ on images that have been attacked.
- capableweb 6y ago
  We'll end up in a similar cat&mouse game as online "pirates" been at for a long time. Developers create something to break the AI, the AI adopt because they figure out the noise profile, developers change the noise profile and the AI has to adopt again.
xondono 6y ago
> I also don't see how this would do much against object recognition or face recognition. That’s precisely the point, you are creating noise that humans are insensitive to, but that severely affects AI. The idea as I understand is that if you need to upload an image (of yourself for instance), you can use this to complicate matters to AIs by uploading the modified picture.

CivBase 6y ago

Begun, the AI wars have.

djabatt 6y ago
sadly there will be a lot of time and machine power spent on this war.
ibraheemdev 6y ago
AI already controls the world through social media. It knows everything you do and decides what you see and when you see it.

nerdponx 6y ago

Switching the result from "tabby" to "catamount" is not nearly as "adversarial" as I expected. Is that really worth it? Is the idea that it's useful if you're trying to stop targeted facial recognition of individual people?

TazeTSchnitzel 6y ago
Perhaps the algorithm they're using doesn't know that those are similar things and just knows they're different, so it optimises towards them.

JohnPDickerson 6y ago

Folks interested in this kind of work should check out an upcoming ICLR paper, "LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition", from Tom Goldstein's group at Maryland. Similar pitch -- use a small adversarial perturbation to trick a classifier -- but LowKey is targeted at industry-grade black-box facial recognition systems, and also takes into account the "human perceptibility" of the perturbation used. Manages to fool both Amazon Rekognition and the Azure face recognition systems almost always. Paper: https://arxiv.org/abs/2101.07922 https://arxiv.org/abs/2101.07922

sly010 6y ago

Can't wait to read about Inception V4 being trained on adversarial.io for better noise resistance :)

_the_inflator 6y ago
Yes, the irony: this app makes image recognition even more effective.
- Imnimo 6y ago
  I don't really think this is true for two reasons. First, the app doesn't add anything that someone training a classifier couldn't just do themselves. If I want to train my network against adversarial inputs, I can just generate them myself at training time on my own training data - it's not particularly helpful for me to have a bunch adversarially-perturbed but unlabeled images. Second, and more importantly, it's not sufficient to just train on adversarial examples taken from another network. You might learn to be robust against the specific weaknesses of that other network, but your new network will have its own idiosyncratic weaknesses. To be effective, adversarial training (https://arxiv.org/pdf/1706.06083.pdf https://arxiv.org/pdf/1706.06083.pdf) needs an adversary that adapts to the network as it trains. In other words, you need your adversary to approximate your current weaknesses at each step of training.

bspammer 6y ago

I love how you can almost see a lynx in the attacking noise. I'd be interested to know if that's my brain spotting a pattern that isn't there, or if that's genuinely just the mechanism for the disruption.

Imnimo 6y ago
I think it's unlikely that the noise will generally have any relation to the target class. I can't find anywhere they say exactly which attack method they use, so it's hard to say for certain, but all of the attacks I'm aware of don't generate noise that has any human-interpretable structure. See for example Figure 1 in the seminal paper on adversarial attacks: https://arxiv.org/pdf/1412.6572.pdf https://arxiv.org/pdf/1412.6572.pdf
40four 6y ago
Makes me think of those old ‘magic eye’ stereogram images that used to be so popular.

djabatt 6y ago

Absolutely the coolest project I read about this year. It will be an arms race between hiding and finding. I went through this with web and email spam.

forrestthewoods 6y ago

If my human eyes can identify a picture then, eventually, so too will algorithms. This is fundamentally a dead end concept. > it works best with 299 x 299px images that depict one specific object. Wow. How incredibly useful.

car 6y ago
How do we know that mammalian visual systems aren’t fundamentally different from AI? What you predict is nothing but an assumption.
- deleted 6y ago
  [deleted]
- pelorat 6y ago
  The poster is not wrong. This attack only works against a specific model trained against a specific dataset. It does not work against models that understand that a animal face is made up of sub features like a nose, two eyes and a mouth. In the end, this is a completely useless exercise and will not have any impact on mass image recognition. For this to even work the attack needs to be tailored to the exact weights in the neural network that is being attacked.

car 6y ago

It’s really surprising to me how easily AI can be fooled. Maybe there is a fundamental difference between our visual system and what is represented in a visual recognition CNN. Could it be the complexity of billions of cells vs. the simplification of an AI, or something about the biology we haven’t yet accounted for?

iujjkfjdkkdkf 6y ago
We compare what we see against our internal model of the world, a CNN pattern matches, it doesn't think critically about the result that comes out.
TaylorAlexander 6y ago
Our CNN models are not meant to replicate the human visual system. They are a convenient mathematical tool that is quite unlike our brain. It’s not even necessary to use convolutions, though they remain the most popular method.
yumraj 6y ago
Because there is no I in AI. At a mile high conceptual level, AI is nothing but a program created by a computer based on the data it is provided Which is why it is extremely easy to fool using techniques that it is not trained to handle, today, but might be able to handle tomorrow. It is a race...
- car 6y ago
  Right. I’m naive in assigning more capability to these models than they posess. I found a quote from Geoff Hinton where he talked about this last year. From [1]: “I can take an image and a tiny bit of noise and CNNs will recognize it as something completely different and I can hardly see that it’s changed. That seems really bizarre and I take that as evidence that CNNs are actually using very different information from us to recognize images,” Hinton said in his keynote speech at the AAAI Conference. “It’s not that it’s wrong, they’re just doing it in a very different way, and their very different way has some differences in how it generalizes,” Hinton says. [1] https://bdtechtalks.com/2020/03/02/geoffrey-hinton-convnets-cnn-limits/ https://bdtechtalks.com/2020/03/02/geoffrey-hinton-convnets-...

telesilla 6y ago

I'd pay for API access for this, are there any plans for this?

loser777 6y ago

What happens when the perturbed images are processed by some noise removal method? On the crude end, even something like aggressive JPEG compression will tend to remove high frequency noise. There's also more sophisticated work like Deep Image Prior [1], which can reconstruct images while discarding noise in a more "natural" way. Finally, on the most extreme end, what happens when someone hires an artist or builds a sufficiently good robot artist to create a photorealistic "painting" of the perturbed image? There's a lot of work on compressing/denoising images so that only the human-salient parts are preserved, and without seeing this working past that I think it's better to interpret "adversarial" in the machine learning sense only. Where "adversarial" means useful for understanding how models work, but not with any strong security implications. [1] https://arxiv.org/abs/1711.10925 https://arxiv.org/abs/1711.10925

nickvincent 6y ago

There's a theme in this discussion that ML operators will just train new models on adversarially perturbed data. I don't think this is necessarily true at all! The proliferation of tools like this and the "LowKey" paper/tool linked below (an awesome paper!) will fundamentally change the distribution of image data that exists. I think that widespread usage of this kind of tool should trend towards increasing the irreducible error of various computer vision tasks (in the same way that long term adoption of mask wearing might change the maximum accuracy of facial recognition). Critically, while right now the people who do something like manipulate their images will probably be very privacy conscious or tech-interested people, tools like this seriously lower the barrier to entry. It's not hard to imagine a browser extension that helps you perturb all images you upload to a particular domain, or something similar.

yumraj 6y ago
> It's not hard to imagine a browser extension that helps you perturb all images you upload to a particular domain, or something similar. Ideally I’d like to see something like this be part of the camera filter itself. Why can’t Apple, if they choose to do so, just add something like this as part of their camera app itself?
- LockAndLol 6y ago
  If it's opensource, there's no need to wait on the business interests of a trillion dollar company to align with your wishes. Camera app developers can be made aware of it and add it to their apps. If there are app developers on HN, they can create pull requests to their favorite apps and add the feature. That's the power of opensource.
  - yumraj 6y ago
    Yes, for you and me, but not for ordinary folks..
lmeyerov 6y ago
The adversarial ML arms race seems similar to the rest of the security/privacy arms race, where these endeavors will make recognition stronger, not weaker, similar to how any other manual red team attacks ultimately get (a) automated and (b) incorporated into blue team's automatic defenses. Hard to see why that wouldn't be the case, esp. for techniques that are general, vs. exploiting bugs in individual models. As long as a person can quickly tell the difference, it's in the grasp of deep learning for ~perception problems, and the economics of the arms race determines the rest of what happens when..

kaoD 6y ago

Why does this page request access to my VR devices?

colincooke 6y ago

It's interesting that they only tackle a single model architecture (a pretty common one). It makes me think that is is likely an attack technique which uses knowledge of the model weights to mess up image recognition (if you know the weights, there are some really nice techniques that can find the minimum change necessary to mess up the classifier). Pretty cool stuff, but also if my assumption is correct it means that if you _didn't_ use the widely available ImageNet weights for inception v3 then this attack would be less effective (or not even work). Given that most actors who you don't want recognizing your images don't open source their weights this may not scale/or be very helpful...

fantod 6y ago
This was my first thought as well. The question is: How robust are adversarial perturbations? In other words: Given such a perturbation that was generated using one model, how well can we expect to work on a similar model (in the sense that both models are fooled)? I would be curious to know if any research has been done on this question.
- iujjkfjdkkdkf 6y ago
  My feeling is that even inception trained on imagenet with a different random initialization would probably not fail (or at least be much less likely to fail) when exposed to these adversarial examples. If these are hacking the specific, underspecified, realization of the classifier (I.e. the set of public weights trained from a specific seed and visit order through the data), the adversarial examples are probably just as fragile as the classifier.
  - Filligree 6y ago
    What makes me think is that, in principle, there should be similar adversarial examples for the human optical system. Practically speaking it wouldn't fool anyone for more than a split second, not least since our input is video instead of snapshots, but it's an interesting thing to wonder about. Maybe we could build an AI which would be in most senses as smart as us, but which would be more vulnerable to such things?

puttycat 6y ago

Great idea. Please consider distributing this as open an source downloadable app to avoid privacy concerns.

oneweekwonder 6y ago

This 2017 article "Google’s AI thinks this turtle looks like a gun[0]" made me realise ai in the near future, might need to take lethal action, based on flawed data. But then I just comfort myself with the following quote: "The ai does not love you, the ai does not hate you. But you are made out of atoms, it can use for something else." [0]: https://www.theverge.com/2017/11/2/16597276/google-ai-image-attacks-adversarial-turtle-rifle-3d-printed https://www.theverge.com/2017/11/2/16597276/google-ai-image-...

zaik 6y ago

Given that the most likely input is privacy sensitive, I would prefer a small CLI tool over uploading files to some server.

mijail 6y ago

As a thought experiment this is cool but from a practical perspective it’s too focused on a specific architecture and if anything adding perturbations might (slightly) help the training process. From the thought experiment side. I think the moral implications cut both ways. Mass image recognition is not always bad - think about content moderation or the transfer of images of abuse. As a society we want AI to flag these things.

ignoranceprior 6y ago

We're still in the phase where different models can play cat and mouse, but I wouldn't count on this lasting very long. Given that we know it's possible to correctly recognize these perturbed images (proof: humans can), it's only a matter of time until AI catches up and there's nothing you can do to prevent an image of your face from being identified immediately.

Chris2048 6y ago

I'm skeptical - what happens when NNs are no longer susceptible to simple adversarial examples, or they take proportionally more power to compute? I'd sooner spend the effort on legal challenges.

dijksterhuis 6y ago

If folks are interested in this stuff, check out Fawkes: https://sandlab.cs.uchicago.edu/fawkes/ https://sandlab.cs.uchicago.edu/fawkes/ https://github.com/Shawn-Shan/fawkes https://github.com/Shawn-Shan/fawkes http://people.cs.uchicago.edu/%7Eravenben/publications/pdf/fawkes-usenix20.pdf http://people.cs.uchicago.edu/%7Eravenben/publications/pdf/f...

hivacruz 6y ago

Just tested on some movie snapshots, doesn't seem to do the trick to me on Google Images (and the noise is very noticeable). Shame, I thought I would be able to trick Google Images and stop giving away answers for my movie quiz game that easily. The only method that works randomly as an anti-cheat measure is to revert horizontally the image. It fools Google Images a lot of times.