But we should use models that are more like animal vision - keypoints or seg. for example (like edge detectors), and are much more robust; this model was never trained on adversarial data, yet no problem on Marvin! You can test yourself even from your phone: contrib.deeplabcut.org/contribute - ThreadSky

trackingactions.bsky.social • 85 days ago

But we should use models that are more like animal vision - keypoints or seg. for example (like edge detectors), and are much more robust; this model was never trained on adversarial data, yet no problem on Marvin!

You can test yourself even from your phone:
https://contrib.deeplabcut.org/contribute

Comments

seanescola.bsky.social•85 days ago

Cool! Have you ever tried adversarial examples for key point extraction? It would be interesting to know if they are more perceptually salient to humans than adversarials for object recognition. If so, it might suggest that biological vision works more like your models: keypoints then objects

trackingactions.bsky.social•85 days ago

Do you mean training with them, vs as zero-shot as above? To be clear, the image on the right is a perturbed image classified as a microwave :)

seanescola.bsky.social•85 days ago

I mean finding the minimum perturbation to an image needed to defeat the model. But instead of defeating an object recognition model, you find the perturbation to defeat keypoint extraction. I’m guessing this would be a pretty straightforward rotation project with potentially interesting results

trackingactions.bsky.social•85 days ago

Yeah we did this some years ago actually with style transfer perturbations and common corruptions; mostly documented here! Corruptions are in the suppl https://paperswithcode.com/paper/pretraining-boosts-out-of-domain-robustness

trackingactions.bsky.social•85 days ago

TL;DR is it needs to be very perceptually relevant to a human to cause off key points! :)

seanescola.bsky.social•85 days ago

I just checked out the supp figs. Maybe I’m reading it wrong, but it looks like the images were corrupted without reference to the model, right? As opposed to doing gradient descent in pixel space to find the minimal corruption to fool the model which is what I believe Patrick did to his chihuahua.

trackingactions.bsky.social•85 days ago

Then classification on top is more robust too. Delighted to chat more next time we see each other, but I have a few new works I’ll shamelessly plug that might be of interest: AROS for OOD detection https://arxiv.org/abs/2410.10744 & a Perspective on building adaptive intelligence https://arxiv.org/abs/2411.15234

patrickmineault.bsky.social•85 days ago

It would be interesting to test keypoint or segmentation-based models for adv robustness more thoroughly. AFAIK no one has scaled up to ImageNet-level (e.g. https://arxiv.org/abs/2209.09117). A combination of this + focus on measuring shape bias and robustness to corruptions would be helpful

trackingactions.bsky.social•85 days ago

Yeah I agree! We did a bit on common corruptions but much more to do :)

Comments

Posting Rules

Reply