Hacker News Reader

Comment by Habgdnv | Hacker News Reader

I copied the image on the right into all possible AIs that i found on the net. They all told the that it is a vase with flowers. Even the most primitive. Something seems off here. Maybe they trained a model that is able to see "hidden" patterns and then they found that they can influence its mind with hidden patterns. For the rest of the general population (both humans and AIs) both images are the same.

View on HN

I'm not sure that screen-shotting the image will work FWIW - any rescaling interpolation in rendering the image on the page or loading it for a model will likely reduce or nullify the effect.

Also these perturbation based adversarial attacks are often model specific. You take the model's gradient at each pixel and iteratively perturbate the image to make it more and more confident that it's e.g. a cat.

So what you're saying run your images via a filter/resizer before feeding them into your AI.

haha that's an interesting point! Recompress as a jpeg maybe.

Compression possibly? I'm seeing .webps on the paper. Putting them into webpinfo gives me:

    File: /.../41467_2023_40499_Fig3_HTML.png.webp
    RIFF HEADER:
      File size: 671810
    Chunk VP8  at offset     12, length 671798
      Width: 2000
      Height: 2255
      Alpha: 0
      Animation: 0
      Format: Lossy (1)
    No error detected.

So since they're lossy, maybe the subtly is lost?

Edit: The image on the article itself is an SVG, containing 3 jpegs. So that's absolutely mangled in comparison to the paper's lossy images.

https://deepmind.google/api/blob/website/images/Figure0_svg....

Adversarial examples depend strongly on the classifier used because the researchers are directly analyzing the responses of the network. You would need to use the same model.

This is also why the “anti-facial recognition” shirts are silly. If they had adversarial noise at all, you likely won’t know about or have access to the model you’re trying to fool.

Reply on news.ycombinator.com