But <i>argonaut</i> wasn&#x27;t talking about having access to the neural net activations, but about having access to individual <i>pixels</i> in the image (which corresponds to individual <i>photoreceptor cells</i> in the human retina). Crafting these NN-defeating images seems to depend on tweaking individual pixels.<p>I&#x27;m not sure how far it really does depend on that -- whether, e.g., you can use a more sophisticated version of the same approach to make an image that fools the NN reliably even if it&#x27;s slightly offset, out of focus, stretched, etc. I wouldn&#x27;t be astonished if you could. If not, that suggests an obvious defence mechanism: feed the NN not the raw image but several slightly perturbed ones, and take a majority vote or something.<p>It&#x27;s also worth observing that there <i>are</i> attacks on the human visual system, found by trying things out and observing their effects. We call them optical illusions, and some of them are very convincing.