Hacker News Reader

I think the better word is “trained”, not “robust”.

By making almost invisible (to humans) distortions to a picture, a previously well-trained algorithm is now facing a completely unknown problem.

View on HN

That implies the amount of training is the only factor. It may be that new architectures or training methodologies could be developed to reject large swathes of these types of advesarial examples. Though of course, if adversarial training is used avdersarial examples will obviously exist at some level, and so the arms race continues.

But for every adversarial distortion algorithm, you’d in theory have to double your training set, wouldn’t you?

Reply on news.ycombinator.com