Slashdot Mirror
Researchers Create 'Psychedelic' Stickers That Confuse AI Image Recognition (techcrunch.com)
"Researchers at Google were able to create little stickers with 'psychedelic'-looking patterns on them that could trick computer AI image-classifying algorithms into mis-classifying images of objects that it would normally be able to recognize," writes amxcoder:
The patterned stickers work by tricking the image recognition algorithm into focusing on, and studying, the little pattern on the small sticker -- and ignoring the rest of the image, including the actual object in the picture... The images on the stickers were created by the researchers using knowledge of features and shapes, patterns, and colors that the image recognition algorithms look for and focus on.
These stickers were created so that the algorithm finds them 'more interesting' than the rest of the image and will focus most of it's attention on analyzing the pattern, while giving the rest of the image content a lower importance, thus ignoring it or confusing it.
The technique "works in the real world, and can be disguised as an innocuous sticker," note the researchers -- describing them as "targeted adversarial image patches."
These stickers were created so that the algorithm finds them 'more interesting' than the rest of the image and will focus most of it's attention on analyzing the pattern, while giving the rest of the image content a lower importance, thus ignoring it or confusing it.
The technique "works in the real world, and can be disguised as an innocuous sticker," note the researchers -- describing them as "targeted adversarial image patches."
AI image recognition systems will recognize what, and only what, they have been trained to recognize. If you train a system with a million pictures of dogs, and a million pictures of cats, it can learn to tell a cat from a dog. But if you then give it a picture of a goat, it will not classify it correctly, because that isn't what it was trained to do.
Similarly, current image recognition systems are not (yet) designed to resist the intentional spoofing described in TFA. In the future, they will become more robust. An obvious way to do this is to use a GAN, with one NN generating spoofs, while another NN learns to resist them.
Humans do suffer from similar problem, however we have compensatory mechanisms to correct visual errors.
Ever glanced at something, seen something weird and had to do a double-take? This is exactly what happened to you. Quick neural nets misidentified something and you had to do full image processing to clear the confusion up.
The reason Humans know to do a double-take is because we have many other neural nets sitting on top of image identification nets. So when our image identification malfunctions, other nets red-flag it and do error-correction. Sometimes it takes long time to process. Sometimes we decide it is just safer to get the hello out of there (e.g. seeing ghosts).