> altering an image’s pixels in a way that wreaks havoc to computer vision but leaves the image unaltered to a human’s eyes

Can someone who understands the original paper give an ELI5 on how that's possible?

I understand how labeling an image of a cat as "dog" could poison a dataset.

I also understand how adding images of a toaster (which sort of looks like a handbag) to a dataset of handbags could poison a dataset.

But I don't understand what's happening in Figure 6 in the original paper. The pairs of pictures of the dogs, cars, etc. look absolutely identical. What exactly is happening there?