 Dear Fellow Scholars, this is two-minute papers with Karojona Ifahir. This is a mind-boggling new piece of work from scientists at Google Brain on how to hack and reprogram neural networks to make them perform any task we want. A neural network is given by a prescribed number of layers, neurons within these layers, and weights. Or in other words, the list of conditions under which these neurons will fire. By choosing the weights appropriately, we can make the neural network perform a large variety of tasks, for instance, to tell us what an input image depicts, or predict new camera viewpoints when looking at a virtual scene. So this means that by changing the weights of the neural network, we can reprogram it to perform something completely different, for instance, solve a capture for us. That is a really cool feature. This work reveals a new kind of vulnerability by performing this kind of reprogramming of neural networks in an adversarial manner, forcing them to perform tasks that they were originally not intended to do. It can perform new tasks that it has never done before, and these tasks are chosen by the adversary. So how do adversarial attacks work in general? What does this mean? Let's have a look at a classifier. These neural networks are trained on a given already existing dataset. This means that they look at a lot of images of buses, and from these, they learn the most important features that are common across buses. Then, when we give them a new, previously unseen image of a bus, they will now be able to identify whether we are seeing a bus or an ostrich. A good example of an adversarial attack is when we present such a classifier with not an image of a bus, but a bus plus some carefully crafted noise that is barely perceptible that forces the neural network to misclassify it as an ostrich. And in this new work, we are not only interested in forcing the neural network to make a mistake, but we want to make it exactly the kind of mistake we want. That sounds awesome, but also quite nabulous. So let's have a look at an example. Here, we are trying to reprogram an image classifier to count the number of squares in our images. Step number one, we create a mapping between the classifier's original labels to our desired labels. Initially, this network was made to identify animals like sharks, hands, and ostriches. Now, we seek to get this network to count the number of squares in our images, so we make an appropriate mapping between their domain and our domain. And then, we present the neural network with our images. These images are basically noise and blocks, where the goal is to create these in a way that take worse the neurons within the neural network to perform our desired task. The neural network then says tiger shark and ostrich, which, when mapped to our domain, means four and 10 squares respectively, which is exactly the answer we were looking for. Now, as you see, the attack is not subtle at all, but it doesn't need to be. Quoting the paper, the attack does not need to be imperceptible to humans or even subtle in order to be considered a success. Potential consequences of adversarial reprogramming include theft of computational resources from public-facing services and repurposing of AI-driven assistance into spies or spam bots. As you see, it is of paramount importance that we talk about AI safety within the series, and my quest is to make sure that everyone is vigilant that now tools like this exist. Thank you so much for coming along on this journey, and if you're enjoying it, make sure to subscribe and hit the bell icon to never miss a future episode, some of which will be on follow-up papers on this super interesting topic. Thanks for watching, and for your generous support, and I'll see you next time.