Appearances can be deceptive. But on the whole humans don’t have a problem telling a milk jug from a train or a power drill from an orange. Not so for artificial intelligence, which can be fooled just by altering a few pixels in an image.
Yet a series of experiments by Zhenglong Zhou and Chaz Firestone at Johns Hopkins University hint that the difference between human and machine perception might not be as big as we thought. This could change the way we think about both human and computer vision and suggest new ways to prevent AIs from getting quite so flummoxed.
Computer vision systems are now being used to identify people in crowds, spot anomalies in medical scans and drive cars down busy streets. But they have a serious weakness. Images can be generated that cause AIs to see something that isn’t there or become blind to something that is. For example, tiny tweaks to a stop sign can make it invisible to a self-driving car or a pattern printed on a toy turtle can make it look like a gun.
Advertisement
These AI-fooling images, known as adversarial examples, seem to reveal deep flaws in the way machine learning systems teach themselves to recognise objects. Google has just launched  to help it understand the problem better.
Zhou and Firestone figured that one way to get at the problem was simply to show AI-fooling images to people and ask them what they see. “Some people think that humans and machines are as different as they can be,” says Firestone. “They thought that never in a million years would a human call a turtle a gun. But nobody had checked that.”
Seeing what AI sees
The pair set up experiments in which they showed people a range of different adversarial images and asked them to pick which object AIs wrongly claimed to spot from a list of up to 48 options. The images ranged from ones that made a computer misidentify a clearly depicted object, such as labelling an orange as a power drill, to ones that made a computer identify objects that were not there, such as labelling a square of random pixels as an armadillo.
Across six different kinds of image, most participants – between 81 and 98 per cent, depending on the image type – picked the right wrong option at above chance rates. “It suggests that humans are able to decipher these images in the same way as the poor victim machines do,” says Anh Nguyen at Auburn University in Alabama, who provided some of the examples for Firestone’s experiments.
This adds to recent work from a team including researchers at Google Brain that showed that if flashed on screen for only 71 milliseconds or less. At those time scales – before higher cognitive functions kick in – it seems the perceptual systems of humans and these AIs might be wired up in similar ways.
Nguyen thinks that humans could help machines handle adversarial images better. You could train AIs to mimic human visual perception and use this model as a defense mechanism, filtering out anything that doesn’t agree with what the human model sees, he says.
What’s more, it might be possible to train humans to decipher adversarial images even more accurately. Zhou and Firestone found that participants got better over the course of the experiments.
“It’s a huge research problem to defend against adversarial examples,” says Firestone. “It tickles me a bit to think humans could be part of the answer.”
