Fooling neural networks in the physical world

Description

Adversarial examples generated with standard methods do not consistently fool a classifier in the physical world, due to a combination of viewpoint shifts, camera noise, and other natural transformations. These examples require complete control over direct input to the classifier, which is fundamentally impossible in many real-world systems.

Andrew Ilyas, Logan Engstrom, and Anish Athalye offer an overview of an algorithm that produces adversarial examples that remain adversarial under an attacker-chosen distribution and demonstrate its application in two dimensions, producing adversarial images that are robust to noise, distortion, and affine transformation and showing that these input distortions are ineffective against robust adversarial examples. They then apply the algorithm to produce the first physical 3D-printed adversarial objects, demonstrating how the approach works in the real world.