3 ms·

I copied the image on the right into all possible AIs that i found on the net. They all told the that it is a vase with flowers. Even the most primitive. Someth

I copied the image on the right into all possible AIs that i found on the net. They all told the that it is a vase with flowers. Even the most primitive. Something seems off here. Maybe they trained a model that is able to see "hidden" patterns and then they found that they can influence its mind with hidden patterns. For the rest of the general population (both humans and AIs) both images are the same.

graypegg 3y ago
Compression possibly? I'm seeing .webps on the paper. Putting them into webpinfo gives me: File: /.../41467_2023_40499_Fig3_HTML.png.webp RIFF HEADER: File size: 671810 Chunk VP8 at offset 12, length 671798 Width: 2000 Height: 2255 Alpha: 0 Animation: 0 Format: Lossy (1) No error detected. So since they're lossy, maybe the subtly is lost? Edit: The image on the article itself is an SVG, containing 3 jpegs. So that's absolutely mangled in comparison to the paper's lossy images. https://deepmind.google/api/blob/website/images/Figure0_svg.original.svg https://deepmind.google/api/blob/website/images/Figure0_svg....
sweezyjeezy 3y ago
I'm not sure that screen-shotting the image will work FWIW - any rescaling interpolation in rendering the image on the page or loading it for a model will likely reduce or nullify the effect. Also these perturbation based adversarial attacks are often model specific. You take the model's gradient at each pixel and iteratively perturbate the image to make it more and more confident that it's e.g. a cat.
- pixl97 3y ago
  So what you're saying run your images via a filter/resizer before feeding them into your AI.
  - sweezyjeezy 3y ago
    haha that's an interesting point! Recompress as a jpeg maybe.
janalsncm 3y ago
Adversarial examples depend strongly on the classifier used because the researchers are directly analyzing the responses of the network. You would need to use the same model. This is also why the “anti-facial recognition” shirts are silly. If they had adversarial noise at all, you likely won’t know about or have access to the model you’re trying to fool.

graypegg 3y ago

Compression possibly? I'm seeing .webps on the paper. Putting them into webpinfo gives me: File: /.../41467_2023_40499_Fig3_HTML.png.webp RIFF HEADER: File size: 671810 Chunk VP8 at offset 12, length 671798 Width: 2000 Height: 2255 Alpha: 0 Animation: 0 Format: Lossy (1) No error detected. So since they're lossy, maybe the subtly is lost? Edit: The image on the article itself is an SVG, containing 3 jpegs. So that's absolutely mangled in comparison to the paper's lossy images. https://deepmind.google/api/blob/website/images/Figure0_svg.original.svg https://deepmind.google/api/blob/website/images/Figure0_svg....

sweezyjeezy 3y ago

I'm not sure that screen-shotting the image will work FWIW - any rescaling interpolation in rendering the image on the page or loading it for a model will likely reduce or nullify the effect. Also these perturbation based adversarial attacks are often model specific. You take the model's gradient at each pixel and iteratively perturbate the image to make it more and more confident that it's e.g. a cat.

pixl97 3y ago
So what you're saying run your images via a filter/resizer before feeding them into your AI.
- sweezyjeezy 3y ago
  haha that's an interesting point! Recompress as a jpeg maybe.

janalsncm 3y ago

Adversarial examples depend strongly on the classifier used because the researchers are directly analyzing the responses of the network. You would need to use the same model. This is also why the “anti-facial recognition” shirts are silly. If they had adversarial noise at all, you likely won’t know about or have access to the model you’re trying to fool.