I don't have much experience with deep learning but with old school machine learning and neutral nets. But it seems this kind of attack mode is unavoidable sinc

I don't have much experience with deep learning but with old school machine learning and neutral nets. But it seems this kind of attack mode is unavoidable since DNNs are fundamentally overtrained. Of course you can then introduce misleading data during training. If they would properly generalize, then by definition they would recognize the desired features and not some other desired features. Personally I have a hunch that this is because we do end-to-end learning. We train low-level feature together with high level features. Basically the cross product of low x high, which takes a ton of resources not train and only has become feasible in the last decade. I think nature does it differently, and trains or develops layers separately. I remember a talk about 20 years ago about how the animal brain has low level cell clusters that detect Features such as lines, patterns, flows, and then feeds this into dedicated networks that detect faces, or other salient features. Basically "low + high" instead of "low x high", and you have the benefits that the space is much smaller, and that "unperceptable" features cannot influence the output. The downside is that features that are lost in the first stage cannot be used again. I now wonder if "retrained" DNNs, that learned the low level features on say fruits and cars, would be less susceptible to this kind of poisoning?