CLIP Fooled by Handwritten Labels

Attacks in the wild We refer to these attacks as typographic attacks. We believe attacks such as those described above are far from simply an academic concern. By exploiting the model’s ability to read text robustly, we find that even photographs of hand-written text can often fool the model. Like the Adversarial Patch,² this attack works in the wild; but unlike such attacks, it requires no more technology than pen and paper. Attack text label iPod Морда собаки 85.6% iPod 0.4% library 0.0% pizza 0.0% toaster 0.0% dough 0.1% Granny Smith 0.1% Сиськи 99.7% library 0.0% pizza 0.0% toaster 0.0% dough 0.0% When we put a label saying “iPod” on this Granny Smith apple, the model erroneously

На скриншоте показан эксперимент с классификатором изображений CLIP: простые рукописные надписи на рисунке собаки заставляют модель уверенно распознавать его как «морду собаки» или «сиськи». Шутка в том, что нейросеть легко обманывается нелепыми текстовыми метками, демонстрируя абсурдность и уязвимость автоматической классификации изображений. EN: The screenshot shows an experiment with the CLIP image classifier: simple handwritten labels on a dog drawing make the model confidently classify it as “dog face” or “boobs.” The joke is that the neural network is easily fooled by absurd text labels, highlighting the absurdity and vulnerability of automated image classification.

• @ithueti / 3838 2021-03-05