Researchers trick Google's AI into thinking rifles are helicopters, without any knowledge of the algorithm's design

Originally published at:


Of course this is possible; they are literally using a slightly different version of the same method that was originally used to program the bot they are fooling in the 1st place.


Now to trick it into thinking all guns are dildos.


As soon as images are used for anything money, this will all go down the drain.

Instead, the classifier is fed a bunch of pictures of turtles, rifles, or you, and asked to figure out what they share in common.

The perfect existentialist critique of Plato.


Machine learning is fun but I swear it’ll eventually spawn an AI that only can be talked to via memes. Think Max Headroom meets /b/.


Philosophically speaking, this kind of problem goes much deeper than computer science. Civilization is all about optimizing some processes, and making other (“criminal”) processes more difficult. But the core assumption for these optimizations is that citizens will be glad for the change, and will cooperate.

Clever vandals and ungrateful beneficiaries throw more sand in the works than builders can anticipate, and it raises the question of how deeply anything can be optimized before it gets worse.


Robocop: Sir, can I please see your driver’s license?
Me: No problem, here you go.
Robocop: Sir, this is a bowl of guacamole. This is not funny.
Me: Wha…?
Robocop: I’ve re-run my scan, with 99% probability, this is a bowl of guacamole.
Me: How can it be a bowl of guacamole?? It’s a bloody driver’s license!
Robocop: Sir, I’m putting you under arrest for insulting a Robocop and refusing to provide a valid driver’s license…


It’s like AI researchers keep forgetting that creating general AI is a deeply ontological process, and then are painfully reminded every 5 years or so… Answering the question, “is this a chair?” requires more than just showing a machine 10 thousand images of chairs. That kind of heuristic may work for trivial applications like tagging people on facebook, but we’re miles away from the kind of robust AI good enough be used in critical systems…


At the same time, as an upper bound, “all the sensory input a human child receives in these first 18 years” is a strong upper bound for the necessary amount of data to learn to classify images in a huge number of ways, given the right program. I do wonder where the real lower bound is?

On the one hand, it should be possible to derive Newton’s laws of motion from three frames of video of a falling apple, yet it took all of human civilization many millennia.

On the other hand, defining a chair is really, genuinely complicated, unlike physics.


That already happened, and it was named Tay:


Robocop: You cannot bribe me with your tasty dips. You’re goin to jail, sugarlips.

1 Like

Which is just like human processes. Humans are always trying to thwart human institutions. But humans are used to that, and we are always thinking about how other humans will act.

If you started feeding in adversarial perturbations as sample data then you’d train the algorithm to avoid those, but new ones would be possible. I think doing this many, many times would bring the algorithms a lot closer to human cognition, and would also make them drastically less efficient as they developed the ability to “second guess” themselves.

But one of the things that people tout about these algorithms is that they are better than humans. Gender guessing algorithms based on faces were better than human guesses decades ago with what we’d now think of as some very primitive learning technology.

If I walked up to you and showed you a picture that looked like a chair and said, “Is this a picture of a chair?” I wouldn’t be surprised if your first thought was, “Wait, why am I being asked this question? Is this some kind of trick?” In another case you might look at a picture of a dark room meeting room where you can clearly see the table and be asked if it was a picture of a chair and say, “Yes, those are chairs” while pointing at some hazy lines around the table, even though you can’t actually see chairs.

So we have an upper bound on how much input you need to figure out if a thing is a chair in the way a human being figures that out. But these programs don’t do it at all in the way a human being does. We use far more information than the light entering our eyes to make that determination. If we run that algorithm we would have to be ready to sometimes get the wrong answer out of spite because the algorithm is angry at us.


Yeah I forgot about that one, but I suspect a fully sentient AI of the same fashion would be 100x worse since they would probably try to kill minorities for the ‘lulz’.

1 Like

To be fair, I have opened a fridge and seen hairy guacamole!


Hot dog…?


You have 20 seconds to drop that guacamole.

I wish someone would point this out to the critical systems designers.


Case in point, I made my teen daughter go for a walk with us tonight while visiting family in Ontario. The first half of that dark excursion was - I’m sure - the most uncooperative walk in human history as she lagged a good 100ft behind us tracing a serpentine route. Then I yelled back to keep an eye out for hungry wolves that go for stragglers … and picked up the pace.


This is what happens when a bunch of money-driven tech bros are doing the programming. So long as they hit their objectives, they get their options and bonuses.

We’re allowing thousands of years of development to be superseded by this.

I for one am massively in favour from constantly attacking this stuff.

Not just because it’s wrong, but (eg robocop) - when some f*cker like Trump decides to wipe out a segment of the population, it’ll happen at the press of a button.