Diagnostics for Deep Neural Networks with Automated Copy/Paste Attacks

2022/11/18 by Stephen Casper, Kaivalya Hariharan, Casper, Stephen +3
Computer Science · Medicine · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Artificial Intelligence in Healthcare and Education #Cryptography and Security (cs.CR) #Domain Adaptation and Few-Shot Learning #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2211.10024

openalex publication_date 2022/11/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

This paper considers the problem of helping humans exercise scalable oversight over deep neural networks (DNNs). Adversarial examples can be useful by helping to reveal weaknesses in DNNs, but they can be difficult to interpret or draw actionable conclusions from. Some previous works have proposed using human-interpretable adversarial attacks including copy/paste attacks in which one natural image pasted into another causes an unexpected misclassification. We build on these with two contributions. First, we introduce Search for Natural Adversarial Features Using Embeddings (SNAFUE) which offers a fully automated method for finding copy/paste attacks. Second, we use SNAFUE to red team an ImageNet classifier. We reproduce copy/paste attacks from previous works and find hundreds of other easily-describable vulnerabilities, all without a human in the loop. Code is available at https://github.com/thestephencasper/snafue

Related

• Detecting and Correcting Adversarial Images Using Image Processing Operations
• A Survey on Transferability of Adversarial Examples across Deep Neural Networks
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Adversarial Reprogramming of Neural Networks
• Robust Feature-Level Adversaries are Interpretability Tools