Breaking Deep Learning Systems With Adversarial Examples | Two Minute Papers #43

Key Takeaways

dear fellow Scholars this is 2minute papers with Caro artificial neural networks are computer programs that try to approximate what the human brain does to solve problems like recognizing objects in images in this piece of work the authors analyze the properties of these neural networks and try to unveil what exactly makes them think that the paper towel is a paper towel and building on this knowledge try to fool these programs let's have a look at this example one can grab this input image and this noise pattern and add these two images together similarly as one would add two numbers together the operation yields the image you see here I think it's fair to say that the difference is barely perceptible for the human eye not so much for neural networks because the input image we started with is classified correctly as a bus and the image that you see on the right is classified as an ostrich in simple terms Bus Plus noise equals an ostrich these two images look almost exactly the same but the neural networks see them quite differently we call these examples adversarial examples because they are designed to fool these image recognition programs in machine learning research there are common data sets to test different classification techniques on one of the best known example is the amist handwriting data set it is basically a bunch of images depicting handwritten numbers that machine learning algorithms have to recognize long ago this used to be a difficult problem but nowadays any half decent algorithm can guess the numbers correctly more than 99% of the time after learning for just a few seconds now we'll see that these adversarial examples are not created by chance if we add a lot of random noise to these images they get quite difficult to recognize let's engage in modesty and say that I myself as a human can recognize approximately half of them but only if I look closely and maybe even squint a neural network can guess this correctly approximately 50% of the time as well which is a quite respectable result therefore adding random noise is not really fooling the neural networks however if you look at these adversarial examples in the even columns you see how carefully they are crafted as they look very similar to the original images but the classification accuracy of the neural network on these examples is 0% sent you heard it correctly it gets it wrong basically all the time the take-home message is that carefully crafted adversarial examples can be used to fool deep neural networks reliably you can watch them flounder on many hilarious examples to your enjoyment my dear sir the queen wears a shower cap you say I beg your pardon if you would like to support 2-minute papers we are available on patreon and offer really cool perks for our fellow Scholars for instance you can watch each episode around 24 hours in advance or even decide the topic of the next episodes how cool is that if you're interested just click on the box below on the screen thanks for watching and for your generous support and I'll see you next time