[mmirate]

The important difference here is that most adversarial examples for the human perception:

(a) do not occur frequently in nature,

(b) are not frequently - if at all - produced in man-made architecture or transit-constructions,

(c) often contain repetitive and regular geometric and chromatic patterns which further make them stand out from everything else, and

(d) practically cannot be produced by digital (ergo noisy/less-than-perfect) images of any common real-world scenario.

In short: optical illusions don't accidentally occur in places where they can be seen by meatbag drivers.

[dontreact]

I don’t see how you can make any claim about “most human adversarial examples”. There is a huge space of images and we have explored a negligible part of it.

Also a) and b) empirically seem to be true of the test sets people have collected thus far of the natural world for these models.

In short, we have no evidence that adversarial examples of the type being studied occur commonly in images collected by self driving cars.

[mannykannot]

The issue with regard to self-driving cars is that these cases demonstrate a disturbing level of fragility: we don't have a good handle on where the boundary between acceptable and chaotic responses lies.

You hypothesize that there are comparable examples for humans somewhere out there in the domain of all possible images, but the fact that, for all the countless cases of people looking at things that have occurred in humanity's existence, no-one has found a good example, suggests that, from the pragmatic point of view that you propose, image-recognition software has some catching-up to do.

Maybe a system that seeks consensus among several differently-trained models would be more robust.

[dontreact]

https://arxiv.org/pdf/1802.08195.pdf

Looks like we are starting to find examples.

I think your intuition is wrong because humans are adapted to what exists naturally so of course there are no naturally occurring adversarial examples. It seems like the same is true for models trained on large natural image sets though.

My point is not wow let’s stop developing neural networks they are perfect. It’s more let’s go collect real world test sets to find and then fix gaps. Adversarial examples actually help very little in making nets more robust in the ways that matter.

[de_watcher]

The difference is that you can calculate an adversarial example for our classifiers, but it's too slow to calculate on a human.

Even if you could, the result would be specific to that particular person, so it won't work as good on others. And these bastards learn while you're constructing the example (which isn't fair at all to a helpless classifier that's just sitting there and doesn't change).

[mannykannot]

Fairness doesn't come into it - machine vision has to be up to the task it is given, period. If humans depend on their more general intelligence to deal with problem cases, machine vision either has to do something similar, or compensate adequately in some other way.

[de_watcher]

That was a joke.

[thaumasiotes]

> The important difference here is that most adversarial examples for the human perception:

> (a) do not occur frequently in nature

You've never heard of walking sticks? Ever seen one of those leaf moths?

If you had seen one, would you realize you had?

Is a deer visible on that stretch of hillside, or is that just dead grass?

[LoSboccacc]

Well yes adversarial images cannot appear naturally because by definition are created out of the network itself, but they highlight the same issue that caused misclassification of the lady in the Uber incident.