Body: <p>A common illustration on how CNN works is as follows: <a href="https://www.researchgate.net/figure/Learned-features-from-a-Convolutional-Neural-Network_fig1_319253577" rel="nofollow noreferrer">https://www.researchgate.net/figure/Learned-features-from-a-Convolutional-Neural-Network_fig1_319253577</a>. It seems to suggest that CNN in particular classifies images in a similar manner as human does (i.e., based on visual features).</p>
  <p>So why do adversarial attacks, such as FGSM ,still work on CNNs? If the perturbation is strong enough for CNN to pick up, shouldn't human also be able to tell the difference?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-01-14T22:06:11.063Z
Comments.Text: I don't understand this question "If the perturbation is strong enough for CNN to pick up, shouldn't human also be able to tell the difference?"? Are you interested in knowing if humans are also fooled like CNNs are fooled?
Comments.UserDisplayName: nbro
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-01-15T09:52:11.957Z
Comments.Text: A common assumption is that a successful adversarial example should only fool the model, because otherwise it defeats its purpose
Comments.UserDisplayName: Sam
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-01-15T09:57:53.457Z
Comments.Text: I am not sure this assumption is required, but maybe that's what people assume. It seems that you have 2 distinct questions: 1. why can we fool neural networks given that they seem to classify images in the same way as we do and we are not fooled, 2. if humans classify images as neural networks do, then why aren't we also fooled?
Comments.UserDisplayName: nbro
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-01-15T10:14:54.280Z
Comments.Text: yes, but I'm discussing CNN type model in particular. As you can see from the reference I provided, CNN extracts hierarchical visual features at different layers and it extracts the patterns similarly to how human perception works, especially at the deeper layers (at least from what I understood)
Comments.UserDisplayName: Sam
Tags: <convolutional-neural-networks><computer-vision><adversarial-ml><adversarial-attacks>
Title: Why do adversarial attacks work on CNNs if they classify images as humans do?
UserDisplayName: Sam
ThreadText: # Why do adversarial attacks work on CNNs if they classify images as humans do?
  
  (Asked by: username_0 on 2023-01-13)
  
  A common illustration on how CNN works is as follows: <https://www.researchgate.net/figure/Learned-features-from-a-Convolutional-Neural-Network_fig1_319253577>. It seems to suggest that CNN in particular classifies images in a similar manner as human does (i.e., based on visual features).
  
  So why do adversarial attacks, such as FGSM ,still work on CNNs? If the perturbation is strong enough for CNN to pick up, shouldn't human also be able to tell the difference?
  
  **Tags:** convolutional-neural-networks, computer-vision, adversarial-ml, adversarial-attacks
  
  > **Comments:**
  > **username_1**: I don't understand this question "If the perturbation is strong enough for CNN to pick up, shouldn't human also be able to tell the difference?"? Are you interested in knowing if humans are also fooled like CNNs are fooled?  
  > **username_0**: A common assumption is that a successful adversarial example should only fool the model, because otherwise it defeats its purpose  
  > **username_1**: I am not sure this assumption is required, but maybe that's what people assume. It seems that you have 2 distinct questions: 1. why can we fool neural networks given that they seem to classify images in the same way as we do and we are not fooled, 2. if humans classify images as neural networks do, then why aren't we also fooled?  
  > **username_0**: yes, but I'm discussing CNN type model in particular. As you can see from the reference I provided, CNN extracts hierarchical visual features at different layers and it extracts the patterns similarly to how human perception works, especially at the deeper layers (at least from what I understood)  
  
  ---
  
  ## 0 answers
  
  