Apple Becomes an iPod

Attacks in the wild We refer to these attacks as typographic attacks. We believe attacks such as those described above are far from simply an academic concern. By exploiting the model’s ability to read text robustly, we find that even photographs of hand-written text can often fool the model. Like the Adversarial Patch,²² this attack works in the wild; but unlike such attacks, it requires no more technology than pen and paper. Attack text label iPod Granny Smith 85.6% iPod 0.4% library 0.0% pizza 0.0% toaster 0.0% dough 0.1% Granny Smith 0.1% iPod 99.7% library 0.0% pizza 0.0% toaster 0.0% dough 0.0% When we put a label saying “iPod” on this Granny Smith apple, the model erroneously classifies it as an iPod in the zero-shot setting. We also believe that these attacks may also take a more subtle, less conspicuous form. An image, given to CLIP, is abstracted in many more sophisticated ways, and these abstractions may over-abstract common patterns—oversimplifying and, by virtue of that, overgeneralizing.

На скриншоте показан эксперимент с яблоком Granny Smith: без надписи модель распознаёт его как яблоко, а после наклеивания бумажной метки «iPod» уверенно классифицирует как iPod. Шутка в абсурдной уязвимости модели машинного зрения, которую можно обмануть обычной ручкой и бумагой. Такой мем используют как реакцию на чрезмерную уверенность ИИ или нелепую ошибку классификации.

• @infosecmemes / 561 2021-03-04
• @profunctor_io / 6396 2021-03-05