Fooling Neural Networks

Construct illusions for image classification networks

Load a pre-trained image classification network from the Wolfram Neural Net Repository.

In[1]:=

net=NetModel["Inception V1 Trained on ImageNet Competition Data"];

Choose two images that the network can classify with certainty:

In[2]:=

cockroach=

;tiger=

;

In[3]:=

net[cockroach,"TopProbabilities"]

Out[3]=



cockroach

0.964205

In[4]:=

net[tiger,"TopProbabilities"]

Out[4]=



tiger

0.729955,

tiger cat

0.267568

To "cockroach the tiger" a new neural net was built by prepending a

ConstantArrayLayer

that contains the image of the tiger:

In[5]:=

imageNet[img_Image]:=With[{imgWeights=ImageData[ImageResize[ColorConvert[img,"RGB"],NetExtract[net,{"Input","ImageSize"}],Resampling{"OMOMS",3}],InterleavingFalse]},NetChain["image"ConstantArrayLayer["Array"imgWeights],"network"net,"Output"NetExtract[net,"Output"]]]

One can retrain just the

ConstantArrayLayer

in this new network using the

LearningRateMultipliers

option and thus force the network to always classify the image as a cockroach:

In[6]:=

trainedNet=NetTrainimageNet[tiger],"Output"

cockroach

CONCEPT

,LearningRateMultipliers{"image"1,_None},MaxTrainingRounds256;

After 256 training rounds, the resulting image is extracted from the

ConstantArrayLayer

In[7]:=

tiger2=Image[NetExtract[trainedNet,{"image","Array"}],InterleavingFalse]

Out[7]=

For humans, the image appears to have stayed the same, but the network thinks differently. It now classifies the tiger as a cockroach with a high probability:

In[8]:=

net[tiger2,"TopProbabilities"]

Out[8]=



cockroach

0.864649

The network has been fooled by small changes with high spatial frequency:

In[9]:=

diff=ImageDifference[tiger2,tiger];

In[10]:=

ImageMeasurements[diff,"Max"]

Out[10]=

{0.0465536,0.0533883,0.0475996}

In[11]:=

diff//ImageAdjust

Out[11]=

Note that this optical illusion is network specific. The neural network in

ImageIdentify

is not fooled:

In[12]:=

ImageIdentify[tiger2]

Out[12]=

tiger

Furthermore, a blur quickly eliminates this optical illusion:

In[13]:=

net[Blur[tiger2]]

Out[13]=

tiger

Publisher Information

Contributed by: Wolfram Staff

Wolfram Language Example Repository

Fooling Neural Networks

See Also

Publisher Information

Fooling Neural Networks

See Also

Related Symbols

Publisher Information