3 ms·
The logic works both ways. Given a recognition system you should be able to build/train another system to find and amplify errors in the former. The more robust
by tigerBL00D 5y ago
The logic works both ways. Given a recognition system you should be able to build/train another system to find and amplify errors in the former. The more robust the former is the more likely the latter adversarial system is to be of lower complexity (cheaper) giving it some advantage.
- dmos62 5y agoI'm not sure I follow the point about robust facial recognition being cheaper to break. Like others pointed out, I don't see how this could be a scalable tactic.
- undreren 5y agoI think the better word is “trained”, not “robust”. By making almost invisible (to humans) distortions to a picture, a previously well-trained algorithm is now facing a completely unknown problem.
- flqn 5y agoThat implies the amount of training is the only factor. It may be that new architectures or training methodologies could be developed to reject large swathes of these types of advesarial examples. Though of course, if adversarial training is used avdersarial examples will obviously exist at some level, and so the arms race continues.
- undreren 5y agoBut for every adversarial distortion algorithm, you’d in theory have to double your training set, wouldn’t you?
- monocasa 5y agoBut there's an upper limit since the photos still need to be recognizable to people.
- ravi-delia 5y agoThe problem is that when you put a file out into the world, you can't continuously update it with the latest advances in adversarial machine learning. It'll have a reprieve ranging from months to years, then be vulnerable forever more.