Digital camouflage could make tanks look like cows or turn aircraft into clouds 鈥� but only if the observer is a computer.
Artificially intelligent systems that recognise objects automatically have an Achilles heel. Slightly tweaked images, called adversarial examples, can fool them into misidentifying an object in ways absurd to humans. These adversarial examples include a plastic turtle which AIs mistake for a rifle and spectacle frames which baffle facial recognition software into misidentifying the wearer as someone else.
Now the US Navy鈥檚 Office of Naval Research, based in Virginia wants to modify military vehicles so AI systems will misclassify them, for example seeing tanks as cars, or fail to classify them at all, making them effectively invisible.
Advertisement
The US Navy has not revealed many details about the project, but has awarded contracts to three companies for the first phase. This will focus on theoretical background and maturing the technology.
The second phase will extend to modification 鈥渇oolkits鈥� to camouflage aircraft and vehicles, such as stickers or templates for paint marks. 鈥淎 unit may want to confuse enemy surveillance into thinking that a Honda Civic might be a tank or vice versa,鈥� the US Navy writes in its project description.
The work will feed into the US Navy鈥檚 own image recognition program to try to prevent their systems being similarly fooled.
The goal seems plausible, says Anish Athalye at the Massachusetts Institute of Technology. Athalye has previously shown how to fool Google鈥檚 image recognition system into identifying two skiers as a dog.
Most work has involved a white box approach, where the attacker has full knowledge of the system being attacked so they know how to tweak an image, but even when the system is an unknown black box, they are still vulnerable, says Athalye.
One way to create adversarial images for an unknown system is to create one for a known system and hope they still work. 鈥淭he folklore has it that they have a good chance of transferring,鈥� says Mark Ryan at the University of Birmingham, UK.
Ryan has targeted Amazon鈥檚 Rekognition software, a black box system, modifying an image of Donald Trump so it would be misidentified as someone else. While it was not possible to nudge it towards a specific target identity, the system could be fooled.
鈥淚t will be an arms race,鈥� says Ryan, anticipating a struggle in which classifiers are constantly upgraded to see through the opposition鈥檚 digital camouflage, while being able to make themselves invisible.
