OpenAI Robust Adversarial Inputs Research

OpenAI has developed images that reliably fool neural network classifiers regardless of the scale or perspective from which they are viewed. This research demonstrates that adversarial examples can be engineered to be robust against the common transformations used in real-world image capture, challenging the claim that systems like self-driving cars are inherently protected by capturing images from multiple angles and scales.

Scale-Invariant Adversarial Examples

Robust adversarial examples are created by optimizing over an ensemble of stochastic classifiers that randomly rescale the input image before classification. This approach uses projected gradient descent to find small perturbations to an image—such as an image of a cat—that fool the classifier across a wide range of desired scales simultaneously.

Transformation-Invariant Adversarial Examples

Adversarial examples can be made invariant to a wide distribution of transformations by incorporating random rotations, translations, scales, noise, and mean shifts into the training perturbations.

When these transformations are sampled randomly at test time, the resulting single input remains adversarial under any of these conditions. This confirms that active effort can produce adversarial examples that transfer to the physical world and remain effective despite the image transformations inherent in varied perspectives.