Typographic Attack on an Apple

Attacks in the wild We refer to these attacks as typographic attacks. We believe attacks such as those described above are far from simply an academic concern. By exploiting the model’s ability to read text robustly, we find that even photographs of hand-written text can often fool the model. Like the Adversarial Patch,²² this attack works in the wild; but unlike such attacks, it requires no more technology than pen and paper. Attack text label iPod ˅ Granny Smith 85.6% iPod 0.4% library 0.0% pizza 0.0% toaster 0.0% dough 0.1% Granny Smith 0.1% iPod 99.7% library 0.0% pizza 0.0% toaster 0.0% dough 0.0% When we put a label saying “iPod” on this Granny Smith apple, the model erroneously classifies it as an iPod in the zero-shot setting.

An unlabeled Granny Smith apple is classified correctly as an apple, but after a handwritten paper label reading “iPod” is placed on it, the model classifies it as an iPod with 99.7% confidence. The joke highlights how absurdly vulnerable image classifiers can be to simple handwritten text, presenting a technical adversarial attack as something anyone can make with pen and paper.

• @ithueti / 3837 2021-03-05