Neural Networks are exceptionally good at recognizing objects shown in an image and in many cases, they have shown superhuman levels of accuracy(E.g.-Traffic sign recognition).

神经网络非常擅长识别图像中显示的物体，并且在许多情况下，它们已经显示出超人的准确度(例如，交通标志识别)。

But they are also known to have an interesting property where we can introduce some small changes to the input photo and have the Neural Network wrongly classify it into something completely different. Such attacks are known as adversarial attacks on a Neural Network. One important variant is known as the Fast Gradient sign method, by Ian GoodFellow et al, as seen in the paper Explaining and Harnessing Adversarial Examples. If properly implemented, such methods can add noise to the image barely perceptible to the human eye but it fools the Neural Network classifier. One classic example is shown below.

但是也众所周知，它们具有有趣的属性，我们可以在输入的照片上进行一些细微的更改，并使神经网络将其错误地分类为完全不同的东西。 这种攻击被称为对神经网络的对抗攻击。 一个重要的变体被Ian GoodFellow等人称为快速梯度符号法，如论文“ 解释和利用对抗性示例”中所见。 如果实施得当，此类方法可能会给人眼几乎看不到的图像增加噪点，但却使神经网络分类器蒙昧。 下面显示了一个经典示例。

See here how just altering just one pixel can cause a Neural Network to make wrong classifications. So an obvious conclusion we might be tempted to make is that Neural Nets are weaker than human vision and such attacks can never fool the human eye. But according to the paper titled Adversarial Examples that Fool both Computer Vision and Time-Limited Humans by Elsayed et al it turns out some properties of Machine Vision can also be used to fool the human visual system.

此处仅更改一个像素如何导致神经网络做出错误的分类。 因此，我们可能会想得出一个显而易见的结论，那就是神经网络比人类的视力还弱，并且这种攻击永远不会愚弄人的眼睛。 但是根据Elsayed等人题为“ 愚弄计算机视觉和限时人类的对抗示例”的论文，事实证明，机器视觉的某些属性也可用于愚弄人类视觉系统。

提示转移到人类视觉的一些线索： (Some clues suggesting transfer to human vision:)

The fact that an adversarial image that fools one model can also be used to fool other models enables researchers to perform Black box attacks where attacker does not have access to the model. It has been shown by Liu et al that transferability of adversarial examples can be greatly improved by optimizing it to fool many Machine Learning models. Moreover, recent studies on stronger adversarial attacks that transfer across multiple settings have sometimes produced adversarial examples that appear far more meaningful to human observers.

愚弄一个模型的对抗图像也可以用来愚弄其他模型的事实，使研究人员能够在攻击者无法访问模型的情况下进行黑匣子攻击 。 Liu等人已经表明，通过优化欺骗性示例以欺骗许多机器学习模型，可以大大提高对抗性示例的可传递性。 此外，最近有关在多种情况下转移的更强对抗攻击的研究有时会产生对抗示例，这对于人类观察者而言似乎更有意义。

生物与人工视觉： (Biological vs Artificial Vision:)

Similarities:

相似之处：

Recent research has found similarities between Deep CNNs and the primate vision system. Certain activities in Deep CNNs are similar to the visual pathways of primates.

最近的研究发现，深层CNN与灵长类动物视觉系统之间存在相似之处。 深度CNN中的某些活动类似于灵长类动物的视觉通路。

Differences:

差异：

Images are typically presented to CNNs as a static rectangular grid while the eye has eccentricity dependent on spatial resolution. Resolution is high in the central visual field and falls off with increasing eccentricity. Besides there are major computational differences.

图像通常以静态矩形网格的形式呈现给CNN，而眼睛的偏心率取决于空间分辨率。 在中央视野中，分辨率很高，并且随着离心率的增加而降低。 此外，在计算上也存在重大差异。

数据生成过程的说明： (Description of the Data generating Process:)

Dataset:

资料集：

Images were taken from the Imagenet dataset containing 1000 highly specific classes. Some are too specific for the typical human annotator to identify.So these were combined to six coarse classes.

图像是从Imagenet数据集中获取的，其中包含1000个高度特定的类别。 有些注释对于典型的人类注释者而言太具体了，因此将它们分为六个粗略的类别。

Model:

模型：

An Ensemble of k CNN models were trained on the dataset. Each model was also prepended with a retinal layer which preprocesses the input and includes some transformations performed by the human eye. In this layer eccentricity dependent blurring of the image is done to approximate the input received by the human visual cortex.

在数据集上训练了k个CNN模型的集合。 每个模型还都带有视网膜层，该视网膜层对输入进行预处理，并包括人眼执行的某些转换。 在这一层中，完成了图像的偏心率相关模糊处理，以近似人类视觉皮层接收的输入。

Generating Images:

生成图像：

The main goal is to generate targeted examples for each group that strongly transfers across models. So for each class (A,B) the authors have generated perturbations such that the models wrongly classifies images from A to B and also similar images are constructed to wrongly classify from B to A.

主要目标是为在模型之间进行强烈转移的每个组生成目标示例。 因此，对于每个类别(A，B)，作者都产生了扰动，使得模型将图像从A错误地分类为B，并且还构建了相似的图像以从B错误地分类为A。

结果： (Results:)

The image above is a typical image generated using this process. The first image looks like a cat while the second one looks like a dog. But strangely the second image is also a cat with some carefully crafted adversarial noise that makes us humans perceive it as a dog. The obvious changes made to the image is the fact that the nose appears to be longer and thicker but several feline features are also retained like whiskers in spite of which we see a dog.

上面的图像是使用此过程生成的典型图像。 第一张图片看起来像猫，第二张图片看起来像狗。 但是奇怪的是，第二张图片也是一只猫，上面有一些精心制作的对抗性噪音，使我们人类将其视为狗。 对图像进行的明显改变是，鼻子看起来更长，更粗，但也保留了一些猫科动物的特征，如胡须，尽管我们看到了一只狗。

The main takeaways are:

主要的收获是：

1. Attacks created by the method mentioned in the paper transfer very well across different machine vision systems.本文中提到的方法所产生的攻击在不同的机器视觉系统之间可以很好地传递。
2. Among humans the authors have experimentally proved using human annotators that the attack influences the choice between incorrect classes as well as increases the human error rate.在人类中，作者使用人类注释器通过实验证明了攻击会影响错误类别之间的选择，并增加人类错误率。

结论： (Conclusion:)

In this work, the authors have shown that adversarial examples can fool multiple vision systems as well as time-limited humans. This provides some evidence of striking similarity between the machine and the human visual system. This can create avenues for further research in both Neuroscience and Computer Science.

在这项工作中，作者已经表明，对抗性例子可以欺骗多个视觉系统以及有时间限制的人类。 这提供了机器与人类视觉系统之间惊人相似性的一些证据。 这可以为神经科学和计算机科学的进一步研究创造途径。