One thing I'd be curious about is how many of these perturbations can you stack up? A picture of a cat still retains an obvious cat-ness to humans, even when i

One thing I'd be curious about is how many of these perturbations can you stack up? A picture of a cat still retains an obvious cat-ness to humans, even when it's been tainted by "truck-ness", but they're slightly more likely to agree it's more truck-y. That response scales with how perturbed it is. (Fig 3 in paper.) If you added the perturbations for "vehicle-ness", would that response be stronger while affecting the image less than cracking up the intensity on the effect? Could you start combining separate concepts, and pick them out individually as like... "activation scores" or something? If so, feels like compression all of a sudden. I know there's a ton of other ML compression things out there, but that just feels like it could be really information dense.