In the Deep Learning book of Ian Goodfellow, p. 261 it is shown how to build an "adversarial example" by adding to an image $x$ another image $x_{adversarial}$ build as epsilon times and image (same size) which is the sign of the gradient of the cost function $J$ with respect to $x$ (for the learned weights \theta of the network, is I understand correctly, i.e. fixed theta). I recall that the $x_{adversarial}$ looks like a panda to a human; human cannot see the small noise introduced in the image, but the DNN is fooled by it, and classifies it as a gibboon.

In mathematical form: $x_{adverserial} = x+\epsilon\nabla_x J(\theta,x,y)$, where $x$ is the panda image, $y$ is the ground truth label and $\theta$ are the DNN's wheights which I assume are the trained weights wich will not be touched anymore.

However, I didnt read (dont think ived missed ?) WHY this works, i.e., can someone give an "intuitive" explanation of why doing this procedure makes the DNN classify the panda as a gibbon? It is not intuitive to me why this gradient image results in this gibbon being found (gibbon or any other image).

The book is available here: https://www.deeplearningbook.org/contents/regularization.html p. 265 here (261 in my physical book)

side note: they take the gradient w.r.t. $x$ and not w.r.t $\theta$ as would be the case for the training. And also if they were taking it w.r.t $\theta$ the shame would not be the same. But I would like to know why it makes sense to take is w.r.t x and how that can fool the network into "thinking" that this is another image.

  • $\begingroup$ This is a very interesting question... maybe @Fat32 has an idea ..? $\endgroup$ – Machupicchu Jan 17 '20 at 15:37
  • $\begingroup$ not me but @TolgaBirdal should know it... $\endgroup$ – Fat32 Jan 17 '20 at 21:21
  • $\begingroup$ oh please if you can ask him? Since no way to contact ppl here (unfortunately) $\endgroup$ – Machupicchu Jan 18 '20 at 13:16
  • $\begingroup$ you can contact him as follows: search the users for his name, and leave a comment in one of his answers... $\endgroup$ – Fat32 Jan 18 '20 at 20:32
  • 1
    $\begingroup$ as I did for you yes ^^ $\endgroup$ – Machupicchu Jan 19 '20 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.