Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adversarial image attacks are no joke

unite.ai

Post reply on HN
Print view View original

31–40 of 196 posts

Re: Adversarial image attacks are no joke

#31

Post by marcosdumay »

mgraczyk wrote: post #14
pixelgeek wrote: post #12

Earlier quoted context omitted.

> For example, consider the case of pasting a sticker on a speed limit sign that causes Teslas to swerve off the road. If your vision system can be caused to swerve off a road by a sticker then maybe it shouldn't be used?

I bet I could cause a significant fraction of human vision systems to get in a crash with a well placed sticker. I'd replace " ".

I'm pretty sure this would fail to kill people on almost every place you could try it. And if it works somewhere, it's because there are other problems with the road that should be fixed.

Human driving is full of redundancies, and there is a clear hierarchy of information. People will not rush into a road full of cars going on the other way, it doesn't matter what the signs say.

If your automated driving system doesn't have those same features, it's not ready for use.

Re: Adversarial image attacks are no joke

#32

Post by dhosek »

Whenever these discussions come up, I often think of a time I was driving on a two-lane road in rural Ohio in the 90s and at one point the center stripe curved into the lane (presumably because the driver of the striping truck pulled over without turning off the striper) and I started to curve off the road thanks to subconscious interpretation of the cue. I caught myself before I drove into a corn field, but human vision systems are also susceptible to these sorts of problems.

Re: Adversarial image attacks are no joke

#33

Post by jimbob45 »

mgraczyk wrote: post #7

As somebody who works on computer vision, my general take on these things is that adversarial examples are like poison. It would be fairly easy to add poison to a water supply or the air intake of a large building and kill a large number of people. This rarely happens though. It's ok that water sources, buildings, and people aren't completely immune to poison. The safety requirement isn't that poison can't hurt. Inst…

>It would be fairly easy to add poison to a water supply or the air intake of a large building and kill a large number of people.

I used to think this until someone walked me through the logistics of both and made me realize that you would need an agency-alerting level of poison for the water supply and some way to avoid people just shutting off the A/C and sticking their heads out of windows (also a huge amount of gas). Also the news can't exist to alert anyone immediately.

Re: Adversarial image attacks are no joke

#34

Post by ggoo »

mgraczyk wrote: post #7

As somebody who works on computer vision, my general take on these things is that adversarial examples are like poison. It would be fairly easy to add poison to a water supply or the air intake of a large building and kill a large number of people. This rarely happens though. It's ok that water sources, buildings, and people aren't completely immune to poison. The safety requirement isn't that poison can't hurt. Inst…

I think a factor that should also be considered in your analogy is that poison is much more difficult to attain than stickers. I have to imagine that if poison was cheaply and widely available as stickers, we'd have a much larger problem than we currently see.

Re: Adversarial image attacks are no joke

#35

Post by jstanley »

mgraczyk wrote: post #14
pixelgeek wrote: post #12

Earlier quoted context omitted.

> For example, consider the case of pasting a sticker on a speed limit sign that causes Teslas to swerve off the road. If your vision system can be caused to swerve off a road by a sticker then maybe it shouldn't be used?

I bet I could cause a significant fraction of human vision systems to get in a crash with a well placed sticker. I'd replace " ".

I think in almost all cases that would not cause a crash. The drivers would see the oncoming traffic and stop rather than crash.

Re: Adversarial image attacks are no joke

#36

Post by wcarey »

ggoo wrote: post #34
mgraczyk wrote: post #7

As somebody who works on computer vision, my general take on these things is that adversarial examples are like poison. It would be fairly easy to add poison to a water supply or the air intake of a large building and kill a large number of people. This rarely happens though. It's ok that water sources, buildings, and people aren't completely immune to poison. The safety requirement isn't that poison can't hurt. Inst…

I think a factor that should also be considered in your analogy is that poison is much more difficult to attain than stickers. I have to imagine that if poison was cheaply and widely available as stickers, we'd have a much larger problem than we currently see.

Most households contain at least several poisons (and precursors to hazardous gasses as well) amongst their cleaning supplies.

Re: Adversarial image attacks are no joke

#37

Post by [deleted] »

wcarey wrote: post #36
ggoo wrote: post #34

Earlier quoted context omitted.

I think a factor that should also be considered in your analogy is that poison is much more difficult to attain than stickers. I have to imagine that if poison was cheaply and widely available as stickers, we'd have a much larger problem than we currently see.

Most households contain at least several poisons (and precursors to hazardous gasses as well) amongst their cleaning supplies.

[deleted]

Re: Adversarial image attacks are no joke

#38

Post by Ozzie_osman »

marcosdumay wrote: post #31
mgraczyk wrote: post #14

Earlier quoted context omitted.

I bet I could cause a significant fraction of human vision systems to get in a crash with a well placed sticker. I'd replace " ".

I'm pretty sure this would fail to kill people on almost every place you could try it. And if it works somewhere, it's because there are other problems with the road that should be fixed. Human driving is full of redundancies, and there is a clear hierarchy of information. People will not rush into a road full of cars going on the other way, it doesn't matter what the signs say. If your automated driving system doesn…

You put too much faith in humans. Things like stop sign removal have caused deaths in the past. https://www.nytimes.com/1997/06/21/us/3-are-sentenced-to-15-...

Re: Adversarial image attacks are no joke

#39

Post by YetAnotherNick »

marcosdumay wrote: post #31
mgraczyk wrote: post #14

Earlier quoted context omitted.

I bet I could cause a significant fraction of human vision systems to get in a crash with a well placed sticker. I'd replace " ".

I'm pretty sure this would fail to kill people on almost every place you could try it. And if it works somewhere, it's because there are other problems with the road that should be fixed. Human driving is full of redundancies, and there is a clear hierarchy of information. People will not rush into a road full of cars going on the other way, it doesn't matter what the signs say. If your automated driving system doesn…

You could spray handful of nails in the road and I think there is a big chance it would cause an accident. Or you could just dig up a hole using tools available in most homes. Agreed, it's not that easy, but not hard as well.

Re: Adversarial image attacks are no joke

#40

Post by OldHand2018 »

I see a completely different attack vector here.

Lawyers.

If you are selling a product or service that has been trained on a dataset that contains copyrighted photos you don't have permission to use and I can "prove it" enough to get you into court and into the discovery phase, you are screwed. I'll get an injunction that shuts you down while we talk about how much money you have to pay me. And lol, if any of those photos of faces was taken in Illinois, we're going to get the class-action lawyers involved, or bury you with a ton of individual suits from thousands of people.

That link at the bottom about a "safe harbor" you get from using old datasets from the Wild West is not going to fly when you start selling.

Post reply on HN