I don't think it would be "much more effective" than trying to trick self-driving cars. Humans are (still, much) better at reasoning their way through ambiguous sensory input based on their abstract understanding of the world than AIs are.

While an AI might specifically already know that a given intersection is supposed to be controlled, there are large numbers of driving situations in which memory (or maps) aren't very useful in dealing with.

When it comes to self-driving cars, probably the way around attacks on signs or other static road features is just to fail safe even in situations in which you're mis-directed by road features (that is, you drive cautiously enough that even if you don't understand the road situation, you can find a way to stop without hurting anyone). But that's not a general AI solution, and may not even be a general self-driving car solution.

Except no amount of specially crafted noise will trick a human. If it looks like an octagon and is red then a human will interpret it as a stop sign. That's because I'd hope as a human you have a better conceptual understanding of what a stop sign is and what its intent is. Whereas none of the current crop of AI can claim any kind of understanding or even yield any kind of explanatory model.

Deep neural nets should really be called "really complicated composition of differentiable functions" and all the training algorithms should really be called "really complicated function root finding" because that's all these things are at the end of the day, a rats nest of functions with a billion knobs.

> That's because I'd hope as a human you have a better conceptual understanding of what a stop sign is and what its intent is.

That's not the reason at all.

It's because if you add exactly the right type of specially crafted noise to an image of a stop sign such that, to a human, it looks like a panda--then who is going to be the arbiter that decides "No, it's still actually really an image of a stop sign and not a panda". The machine?

The real reason is the subjective nature of the perception of reality. With the advent of AI, all sorts of schools of philosophy that used to seem like useless navel-gazing are going to find some real important practical applications real soon. This is metaphysics and ontology. On a similar note (not in TFA), in the "friendly AI" debate, we're going to be looking real hard at the foundations of the philosophy of ethics (where does it really come from?), not just the teleological vs deontological (etc) debates we use to reason about law, politics, governance and appeasement of our "justice" instincts.

> Except no amount of specially crafted noise will trick a human

Or quite possibly we just don't know how to construct the noise yet :P

Well we do. Conspiracy theories are noise but not in the same category as pixel noise. When neural nets start falling for conspiracy theories then I'll start to worry about the coming singularity.

Might as well traffic signs were intentionally chosen as something human are good in classification of without any regard to machine learning algorithms (nonexistent at that time). Yet there are definitely tasks where specially crafted noise can fool humans. Think optical illusions or this car prototype camouflage: https://arstechnica.com/cars/2017/02/the-new-mclaren-720s-wi...

> covering, removing, or altering a stop sign such that it no longer looks like a stop sign

Isn't that illegal in most jurisdictions?

I would rather expect the same laws that keep you from defacing or removing a stop sign would apply to modifying one with noise to make it invisible to self-driving cars.

Although, you could argue that an attacker who is targeting self-driving cars could modify the sign in a way that is unnoticeable to humans, but greatly affects how the self-driving car interprets the sign.

Eg. look at the panda images at the start of the linked post. The third image looks like a panda to humans (and most humans probably wouldn't be able to see the difference between the first and third images), but it greatly affects the machine learning interpretation.

By modifying the sign in this way, if it is possible, it would be much harder to detect and enforce against than it would be if the attacker was targeting human drivers.

I get what you are getting at here. The human isn't the interesting bit. Humans have pretty good bullshit detectors built in already.

An image that triggers a false positive within the AI won't be noticeable to the average human, however good at detecting bullshit as they are. It probably looks like some annoying abstract pattern at the worst.

To the car, however, it could represent anything that made it react adversely upon observing it. Seems like figuring out how to find those images might pose a challenge.