When does a lifeboat look like a Scotch Terrier? It would appear that, if you’re an AI, the difference is a few pixel-shifts, and that’s got interesting implications.
I’m not particularly worried about AI-based facial recognition, because it’s like worrying about gravity after you’ve been pushed off a bridge: you may as well compose yourself and try to enjoy the ride down. Because certain things are going to happen.
I do think there’s some fun to be had trying to interfere with facial recognition algorithms, and I did some personal camouflage this fall, when I was farting around over at the studio – since I know that facial recognition systems render down our features into abstract elements, then do fuzzy matches against those elements and a database (generated with similar renderings) – there is a certain value to being able to invalidate the down-rendering algorithm. Especially if the database caches its own down-rendered versions; suppose someone had to update the renderer to recognize non-skin texture and change how it reduces the features: now they’d have to re-scrub the entire database of 50 million faces. Jamming these algorithms might be good, healthy, passive-aggressive fun.
Janelle Shane posted a link to a really interesting article on “adversarial noise” – the idea being, to produce carefully-designed noise that fuzzes the AI recognizer but not a human’s evolved-in recognizer. It turns out the human’s recognizers are evolved to defeat natural attempts at noise injection (also known as “camouflage”) as practiced by Bunny. You can see that what Bunny is doing is aligning with the landscape to blend in, and breaking the characteristic outlines of its body (nose, ears, eyes) by hiding them behind pieces of grass that break the outlines. Bunny is adding noise to what my eyes see and – it works! Bunny is nearly invisible.
Camouflage theory is pretty neat stuff. Back around the Franco-Prussian War, nations began to realize that being super-visible on battlefields or at sea was not such a great idea. Suddenly warships got exotic paint-jobs instead of polished brass, and soldiers (except for the French) began to blend in to their surroundings. One of the rules of camouflage was to “break lines” wherever possible – because the human eye/mind appears to do exactly what I described above: part of it tries to down-render a scene into edges, then we analyze based on the edges. Meanwhile, another analysis engine appears to analyze based on color. We don’t really understand how it all works, because we can’t pop the human algorithms into a debugger and look at all the various weightings and edge-detection routines and so forth – like we can in Photoshop.
Correctly tuned noise appears to devastate some image recognition algorithms.
I wonder how the algorithms’ designers will respond? My guess is, looking at that with my human eyes and brain, it’ll recognize certain areas as unusually noisy and ignore them. Poof. When I see that chunk of noise in the lower right, I immediately think “nothing there” and go back to looking at Lifeboat McLifeboatFace and wondering why it doesn’t have solar panels.
Here’s a link to the paper on adversarial noise. It’s got some neat illustrations. [arx]
The WWI-era camouflage was called “Dazzle” camouflage and I … I’m not impressed at its ability to hide ships. It looks cool as all get-out, though! When I was a kid there was an exhibit at Les Invalides with some of the original watercolor designs for the French Navy and they’re really quite beautiful. [wikipedia] The theme seems to be the same as Bunny’s camouflage: break edges, add noise. Perhaps the German U-boat commander will think that they are seeing a gigantic Scotch Terrier.
One of the other alleged values of dazzle camouflage was that it would interfere with an attacker’s ability to compute the range to the target ship. I’m highly skeptical of that, since naval ships, by WWI, used triangulating range-finders, which would actually work better against a target in dazzle camouflage, since lining up the image of the dazzle-painted ship accurately would be even easier. Those range-finders work by having two lenses a known distance apart, which you overlap the images from on a screen; then you can calculate the range using simple trigonometry (it’s how our eyes and brains do range estimation, too!)
Janelle Shane’s twitter feed is pretty cool. She does a lot of play with neural networks, mostly programming them to produce surrealistic results.
Searching for “Dazzle camouflage” brought me this amazing image:
With all this stuff, I think you can defeat it with a bit of introspection around “what does my brain do?” The edges, in my edge-detected self-portrait, are too sharp. The variety of tones in the adversarial noise is too dense for the size of the region; things in reality don’t have such large shifts in a small area. If you think about how your brain is defeating the adversarial noise, that’s what the algorithm designers of the AIs are going to try to do next.
This probably goes without saying, but I think mis-classification is what’s going on when our brains are on drugs. So, you take a dose of LSD or some shrooms and they mess with your norepinephrine levels in your brain. Some of that is going to result in spurious signals in your visual system, and your visual pattern-matching system takes over and goes, “right, now, what is that pulsating blobby thing!?” And, because it’s messed up, too, it goes, “yes, Cthulhu really is in your refrigerator!”