[pithymaxim]

> Not worried enough? Imagine an attacker who manipulates road signs in a way such that self-driving cars will break traffic rules.

If someone was manipulating a bunch of road signs for bad, human drivers would probably be in trouble too..I guess the point is that these attacks could be more subtle/scalable?

[lsb]

It's the subtlety, because vision algorithms don't necessarily look at the world like we do.

Here, some folks perturbed an image of a cat to scan as guacamole, and have 3d printed a model of a turtle that scans as a rifle: https://www.labsix.org/physical-objects-that-fool-neural-net...

[yarg]

More on this point: computer vision tasks are (currently) far more reliant on the presence of a number of identifying features in the high frequency details of images.

The are looking for a significant subset of some identifying group of highly localised features:

think a large number of small things, rather than a small number of large things;

think colour gradients rather than colours.

These sorts of high frequency pieces of information can be placed into images in a way that is imperceivable to humans, but screams at computer vision neural networks.

A sign could say no right turn to people and no left turn to machines.

[yarg]

Sorry, I replied to a reply to this - the response was intended for you, but expanded on the pre-existing comment.

This comment's getting stupider, the more I think about it.