4 ms·
Can someone please ELI5 why we can't just blur every image before passing it to the classifier? Wouldn't this defeat this sort of attack? Obviously you lose s
by TheDudeMan 5y ago
Can someone please ELI5 why we can't just blur every image before passing it to the classifier? Wouldn't this defeat this sort of attack? Obviously you lose some accuracy, but that seems acceptable.
Edit: I guess that's similar to "image quilting" (whatever that is) in this slide deck. This is the first time I've seen something like this mentioned. Seems like a straight-forward solution.
- sebzim4500 5y agoAssuming the attacker knows how you are blurring the image they could do exactly the same attack.
- orange3xchicken 5y agoIt turns out that a similar technique, where you basically apply noise multiple times to a single image, and average predictions over all noisy images- equivalent to convolving your nn with Gaussian noise yields near state of the art bounds on provable robustness (under a specific class of attacks). The issue is the magnitude of noise you need in order to get practically robust networks is quite large relative to the data you are dealing with. https://arxiv.org/abs/1902.02918 https://arxiv.org/abs/1902.02918 https://arxiv.org/abs/1906.04584 https://arxiv.org/abs/1906.04584
- TheDudeMan 5y agoThese are the papers I've been wondering why didn't exist ;) Thanks!