AI VILLAGE - Adversarial Stickers
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Cattell, Sven
Adversarial examples fooling machine learning field are a burgeoning field. We propose applications to fool self driving cars or facial recognition systems but most of the techniques are purely academic. They require minute manipulations to the bit values of the pixels entering a system. Adversarial patches are an attack that could actually work. This talk will cover how to make them and further applications I got my Ph.D. in algebraic topology in 2016 and immediately moved into machine learning to work on something useful to people. I then completed a post-doc in mathematical machine learning where I worked on medical data. I now work at endgame.
 Cool. So the first top we had is by Sven Katel, data scientist at Endgame, and he's here to talk about... Adversarial patches. Let's go to the demo. Thank you. The plan for the talk was I was going to make t-shirts with adversarial patches, and the volunteer t-shirts will have that stuff. The problem is I tried for about two months to do this, and eventually it's not working so well. I'm going to talk about how to make these patches, how they work, why the thing, and then like reasons. Cool things. So I'm a data scientist at Endgame. We've already heard about me. So that's what we're going to be doing today. So the background of adversarial examples, you've got two basic classes of adversarial patches. One where you modify the pixels coming in for images. You can modify the pixels of an image so that a classifier screws up. This is the classic thing where you've got a cross-coding inside method attack, or you can't be salient to you, or various different types of attacks. And we hope most of us have seen Ian's pandas. We've misclassified it as a given with some noise. These sorts of attacks are good for understanding how their own deep learning works, but they aren't actually attacks. You can't do anything in the real world because you'd have to grab the input out of the output of the camera and modify the pixels on the fly. It's not a realistic attack because it would require more hardware computation than you probably can get into a system. The other type of attack against machine learning is the physical modification. So what you can do is you put a set of stickers on an object and have it misclassified. One of the first papers that did this was one with the attack in the classifier that do stop signs because self-driving cars stop stop signs. And they came up with a way of producing pixel modifications that they can put as stickers on the stop sign and causes the classifier to get misacast work badly. There's some evidence that their attack does not work very well in real life and you have to have a week at the work classifier and a few other things to make it look like it works. But these sorts of attacks are much harder to do. So an adversarial stickers are the second type of attack. You actually can put a thing on a person and have a thing. So the way you build the attack is there are three parts of the attack. So you have the actual sticker. So listen, I built this little object that contains the image, the floating, the little tensor that holds the sticker. It also holds a mask so you can have the sticker be different shapes. Then we have a placer that puts the sticker on a bunch of images so that you can train against those images with the classifier. And then we have a trainer that actually does the training process. So it's very easy to build them. You've got the viewers going to build these three components. And if you go look at the original paper, there's a link to a GitHub account which has basically these things laid out. So you've got a sticker. Well, the way I've built the sticker is you can take an image, a PNG image with a mask, a poor mask, and it can be whatever you want. As long as it fits within your training target thing, or you can take a NumPy array. And then randomly initializes the patch around 50% gray with a bit of noise. And that's the start of the sticker. It initializes that. When you pull the sticker, it gives you back the tensor for the sticker. I did this in PyTorch so you can start applying it to images. And it does a few things where it clips it so the sticker is an actual image. So it stays in the pixel range. And then it multiplies by the mask so that it looks like that mask. For example, if you've got the patch with the Def on logo and then the mask gets produced, and then we have NGM logo and the mask gets produced. So this is the simplest component, but like the thing that we're actually training. This is the corp, the rest is decorations around this. Probably the most important component is the placer. So what this does is you can take, you give three ranges, so a range of rotations that you're allowing. So any rotation in this range, so plus or minus 15 degrees, 30 degrees. A range of translations you're allowing and a range of scaling that you're allowing. You can scale it up by 30% or down by 30% or whatever, and you randomly select it. And what you call it is what this does is it assembles a bunch of affine transformations within the ranges you've provided. Copies the sticker into as many images as you have and then transforms those stickers to be the right shape. It also does this with mask and then applies it to a sticker. So for how it works, so we've got stickers on the side. And the masks on the side. And here is an affine transformation. So randomly select a S, theta, a T, X and a T, Y. And I'll select, in this case, 25 of those and then apply that to each of those stickers. And then you get the transformation on the outside. So you see on the left you have the untransformed stickers and on the right you have a bunch of transformed stickers. And so then you have, you store that and then put a little bit of math and you apply the stickers to these images and you get, I'm sorry for the image quality here, you get a bunch of stuck images, like stuck images. And that, at that point, you can feed to a classifier. And then we get to the last component, the trainer. This thing you can take in several models to train again. So these will be your white box models that you're training against, your attack against. It also takes an optimizer and a few other things you need to do gradient percent. And this thing places the models and the stickers on the GPU and does all the stuff, the juggling that you don't want to think about. And what it does is just perform the training. We have a basic training loop here. This is for CIFAR. So we have our sticker on the left. And so the sticker goes through the place with some images and so it gets placed on the place on these things. So we have a bunch of 25 images here that have been had a sticker attached to them. Then this goes into a classifier, whatever classifier we have, that thing. And then we take the loss with respect to our target class. So in this case, I was going for the ninth class, the tenth class of CIFAR. So we take loss with respect to what class we're going to get and then we do a back prop gradient descent against the original sticker. Because this entire thing from the original sticker to the loss is smooth as a smooth transformation. So we can do gradient descent with respect to the sticker itself. So this is the basic training loop. And if you wanted to do a single neural network, if you wanted to train it against a single classifier, you just do this and you're good. But if you want to train it against several classifiers, so what happens if you want to train it against two? Well, you can train it against two by going, okay, in my loop, I'm just going to do it twice basically. The same basic loop twice. I'm going to have, you're going to do the first classifier and then the second classifier and I'm going to loop until I get a sticker that works. So this is for an ensemble training against my loss. And then the other way of doing it, which is what you do is you, instead of feeding into one classifier, you feed it into two classifiers, you get a loss added up and take the gradient of the way back and you get a result. So those two things work and then you can train up a classifier and here we get results. So if we have, I did this with like the only thing I could get this working on with Cfarm and this will happily talk to people about like no results here. So what I did was I got those four models inside, so VGG style network with nine layers, VGG 13 layers, a ResNet for 22 and a deep net which doesn't perform that well with 10 layers. And then we target it against, okay, I target it against a ResNet 10 and the graph on the left is for that scale, for the zero scale, we had no performance. So this is a, this would be the image scale down to a point. Obviously it's not going to do anything useful. And then when it covers 20% of the image, it's kind of useful. And then at about 40% of the image, it kind of saturates the convolutional layers and causes misplacification. For this sticker here, you need to cover 40% of the image and then it will cause a misclassifier, misplacification. And this was trained with the miscredential model and then if you train it in parallel, it doesn't perform as well. There's reasons for that. So I went, built this out, tested it against Cfarm. You know, Cfarm was the unit test and then I went, okay, I'm going to get this working on ImageNet. And so I went through the original paper and with Cfarm, you can, like with this stuff, it was trained with a certain range of rotations, scalings and conflations. And if you take the rotation to be with plus or minus 90 degrees, it doesn't train well, it doesn't work. So in the original paper, they mentioned, oh, you can do complete rotations, it can be stuck in any orientation, it's fine, it'll work. But when you actually look at the code, they're only translated by plus or minus 15 degrees in that range. Which, that's the first thing that I was like, this is a little bit not the good. But so with Cfarm, this thing is with their parameters. And if you go for bigger parameters and more manipulation of the affine transformations, is that curve drops off rapidly. With more new perturbation. So for these, this is how the gifts of the training through an ImageNet. So what I did was I grabbed four ImageNet models with the PyTorch repository. I pointed my trainer to train against those four and it's the same set that I trained Cfarm against. So a ResNet, ResNet 50, two VGGs and a DeepNet. So I trained that again, I trained that and I targeted a ResNet 53 or one of the VGGs. And the performance I got out of this was about 10%, 5%. So it doesn't actually function as well as it exists. The paper that they have says, it should work at the same as the Cfarm curves. And I got a flat curve. I went back to the paper, they're only using 5,000 examples, they're using models that may or may not. I don't know what the models look like. Could not get the thing to work. After like two months of that. So basically like welcome to AI Village, we have a novel as well. So references like I only use like the original paper and then we've got Ian's Panda and the website. So if you guys have any questions. Yeah. Yeah. I would be able to then do a white box attack and these were designed to be black box attacks. And it's more effective with white box attacks. I wanted this to be a realistic attack against machine learning models. I should do, and this should be robust enough to be black box. Also, one of the things that makes that makes the image more robust to train against several models. It's supposed to be an ox. It classifies as a contra shell. That's partially because of teacher printing. So it's not the teacher printing is intensive enough to get the fine details required for this to overwhelm the past fire. So I started this project with like, yeah, these adversarial patches that looks the paper looks awesome. I'm going to do it and then end of the project with like, yeah. I don't remember. At this point. Yeah. I know it might be that I made a mistake somewhere. Yeah. So the code that I wrote is up on GitHub. And I will be writing a blog post with the village and describing exactly why I think this is an old result. And with all the code and it's designed to be easily readable so you can see what's going on. Yeah. Yeah. Yeah. 40%. Well, it may come as a like from making a few thousand of these, I have inclinations to say, you're going to get situations where is that the deeper the network, the more effective the attack. I think it's because it's the it can diffuse out more before it gets to the final fully connected layer in the combination layers. Yeah. I trained it on my desktop that has two 1080 ti and like a 670, 6700 K thing. Yeah, I also train. I actually trained those C for things on my razor blade with the 1060. So, the this architecture, the model parallel architecture is about seven times faster than the sequential thing because you can put it on each one of each GPU and you don't have to juggle things. So you can train in about half an hour for image against a portion of images. You only want to train it against like maybe 10,000 images. You don't need to go all the way. Also, when you actually go to decide, okay, I want to do this, I think a very, very aggressive step size. So their step size in the paper is five. And I found that if you make that too low, it just stops. So the, the gifts were made with the step size of point three to make them pretty and make them actually look like they're doing something. But they're, yeah. Yeah. You want to try that out because open source on the repo. The, the art, so the way I built this was with the, so the, the Appian grid transformation and pytorch, which was designed for spatial sequential networks. So in those they have a training parameter to unperturbed the network. So you know, you put an app and transformation on an image to do data augmentation. So these networks were designed to learn how to undo data augmentation as well as do a classification. And they're the architecture that is a pair of operations and pytorch that do that step and they take in parameters like that. Like the scaling thing that I find transformation is just a good transformation and you can see it's a smooth transformation. You can feed data into that thing to fix your transformations to be useful. So there's actually a paper for doing, manipulating the Appian transformations. Yeah. I would just, if I was a specific network that I was targeting, I'd just do this. I wouldn't try to do ensemble training and stuff. Just focus on that one. Yeah. No, I wouldn't have to do anything. You might be able to be a bit more aggressive in your training too. Yeah. Yes, that's the thing. Like the, when you do this, when you take this, if you allow the rotation to be sampled from within plus or minus 90 degrees, the whole system bake down. So the rotation that you is actually effective is plus or minus 30 degrees or 15 degrees. So they already pretty much say these stickers have to be sitting straight up and night. Yeah. Yeah, but they learn how to recognize dogs that are upside down. Yeah. Maybe. Sorry. Sorry. I'm not a question. So the scaling is the receptive field at the bottom is three by three, but then you go up one layer. I think when you go all the way back down to the image is nine by nine and then one layer up, it's like 27 by 27. Sorry. No, not by nine. It's five by five and then six by six. It's sorry. Seven by seven. So the receptive field for this picture at the top of the VG 22 is three times, you know, 22 times two plus one. So it's massive. So this pixel sees a lot. Yeah. I wanted to make. Yeah. Okay. Yeah, we also put red net. And that this loop tried also to also, you can try it against every architecture inception is also one of the ones that you can train against. So I think we're going to be marked meager is the next guy. One quick question and then I don't know. I'm going to write the blog post and see and then after that I'll feel if I feel like to continue to work on this is fine. I think we need to move on to our next speaker. So Mark.
 Cool. So the first top we had is by Sven Katel, data scientist at Endgame, and he's here to talk about...  Adversarial patches.  Let's go to the demo.  Thank you.  The plan for the talk was I was going to make t-shirts with adversarial patches, and the volunteer t-shirts will have that stuff.  The problem is I tried for about two months to do this, and eventually it's not working so well.  I'm going to talk about how to make these patches, how they work, why the thing, and then like reasons.  Cool things.  So I'm a data scientist at Endgame.  We've already heard about me.  So that's what we're going to be doing today.  So the background of adversarial examples, you've got two basic classes of adversarial patches.  One where you modify the pixels coming in for images.  You can modify the pixels of an image so that a classifier screws up.  This is the classic thing where you've got a cross-coding inside method attack, or you can't be salient to you, or various different types of attacks.  And we hope most of us have seen Ian's pandas.  We've misclassified it as a given with some noise.  These sorts of attacks are good for understanding how their own deep learning works, but they aren't actually attacks.  You can't do anything in the real world because you'd have to grab the input out of the output of the camera and modify the pixels on the fly.  It's not a realistic attack because it would require more hardware computation than you probably can get into a system.  The other type of attack against machine learning is the physical modification.  So what you can do is you put a set of stickers on an object and have it misclassified.  One of the first papers that did this was one with the attack in the classifier that do stop signs because self-driving cars stop stop signs.  And they came up with a way of producing pixel modifications that they can put as stickers on the stop sign and causes the classifier to get misacast work badly.  There's some evidence that their attack does not work very well in real life and you have to have a week at the work classifier and a few other things to make it look like it works.  But these sorts of attacks are much harder to do.  So an adversarial stickers are the second type of attack.  You actually can put a thing on a person and have a thing.  So the way you build the attack is there are three parts of the attack.  So you have the actual sticker.  So listen, I built this little object that contains the image, the floating, the little tensor that holds the sticker.  It also holds a mask so you can have the sticker be different shapes.  Then we have a placer that puts the sticker on a bunch of images so that you can train against those images with the classifier.  And then we have a trainer that actually does the training process.  So it's very easy to build them.  You've got the viewers going to build these three components.  And if you go look at the original paper, there's a link to a GitHub account which has basically these things laid out.  So you've got a sticker.  Well, the way I've built the sticker is you can take an image, a PNG image with a mask, a poor mask, and it can be whatever you want.  As long as it fits within your training target thing, or you can take a NumPy array.  And then randomly initializes the patch around 50% gray with a bit of noise.  And that's the start of the sticker.  It initializes that.  When you pull the sticker, it gives you back the tensor for the sticker.  I did this in PyTorch so you can start applying it to images.  And it does a few things where it clips it so the sticker is an actual image.  So it stays in the pixel range.  And then it multiplies by the mask so that it looks like that mask.  For example, if you've got the patch with the Def on logo and then the mask gets produced, and then we have NGM logo and the mask gets produced.  So this is the simplest component, but like the thing that we're actually training.  This is the corp, the rest is decorations around this.  Probably the most important component is the placer.  So what this does is you can take, you give three ranges, so a range of rotations that you're allowing.  So any rotation in this range, so plus or minus 15 degrees, 30 degrees.  A range of translations you're allowing and a range of scaling that you're allowing.  You can scale it up by 30% or down by 30% or whatever, and you randomly select it.  And what you call it is what this does is it assembles a bunch of affine transformations within the ranges you've provided.  Copies the sticker into as many images as you have and then transforms those stickers to be the right shape.  It also does this with mask and then applies it to a sticker.  So for how it works, so we've got stickers on the side.  And the masks on the side. And here is an affine transformation.  So randomly select a S, theta, a T, X and a T, Y.  And I'll select, in this case, 25 of those and then apply that to each of those stickers.  And then you get the transformation on the outside.  So you see on the left you have the untransformed stickers and on the right you have a bunch of transformed stickers.  And so then you have, you store that and then put a little bit of math and you apply the stickers to these images and you get,  I'm sorry for the image quality here, you get a bunch of stuck images, like stuck images.  And that, at that point, you can feed to a classifier.  And then we get to the last component, the trainer.  This thing you can take in several models to train again.  So these will be your white box models that you're training against, your attack against.  It also takes an optimizer and a few other things you need to do gradient percent.  And this thing places the models and the stickers on the GPU and does all the stuff, the juggling that you don't want to think about.  And what it does is just perform the training.  We have a basic training loop here.  This is for CIFAR.  So we have our sticker on the left.  And so the sticker goes through the place with some images and so it gets placed on the place on these things.  So we have a bunch of 25 images here that have been had a sticker attached to them.  Then this goes into a classifier, whatever classifier we have, that thing.  And then we take the loss with respect to our target class.  So in this case, I was going for the ninth class, the tenth class of CIFAR.  So we take loss with respect to what class we're going to get and then we do a back prop gradient descent against the original sticker.  Because this entire thing from the original sticker to the loss is smooth as a smooth transformation.  So we can do gradient descent with respect to the sticker itself.  So this is the basic training loop.  And if you wanted to do a single neural network, if you wanted to train it against a single classifier, you just do this and you're good.  But if you want to train it against several classifiers, so what happens if you want to train it against two?  Well, you can train it against two by going, okay, in my loop, I'm just going to do it twice basically.  The same basic loop twice.  I'm going to have, you're going to do the first classifier and then the second classifier and I'm going to loop until I get a sticker that works.  So this is for an ensemble training against my loss.  And then the other way of doing it, which is what you do is you, instead of feeding into one classifier,  you feed it into two classifiers, you get a loss added up and take the gradient of the way back and you get a result.  So those two things work and then you can train up a classifier and here we get results.  So if we have, I did this with like the only thing I could get this working on with Cfarm and this will happily talk to people about like no results here.  So what I did was I got those four models inside, so VGG style network with nine layers, VGG 13 layers, a ResNet for 22 and a deep net which doesn't perform that well with 10 layers.  And then we target it against, okay, I target it against a ResNet 10 and the graph on the left is for that scale, for the zero scale, we had no performance.  So this is a, this would be the image scale down to a point.  Obviously it's not going to do anything useful.  And then when it covers 20% of the image, it's kind of useful.  And then at about 40% of the image, it kind of saturates the convolutional layers and causes misplacification.  For this sticker here, you need to cover 40% of the image and then it will cause a misclassifier, misplacification.  And this was trained with the miscredential model and then if you train it in parallel, it doesn't perform as well.  There's reasons for that.  So I went, built this out, tested it against Cfarm.  You know, Cfarm was the unit test and then I went, okay, I'm going to get this working on ImageNet.  And so I went through the original paper and with Cfarm, you can, like with this stuff, it was trained with a certain range of rotations,  scalings and conflations.  And if you take the rotation to be with plus or minus 90 degrees, it doesn't train well, it doesn't work.  So in the original paper, they mentioned, oh, you can do complete rotations, it can be stuck in any orientation, it's fine, it'll work.  But when you actually look at the code, they're only translated by plus or minus 15 degrees in that range.  Which, that's the first thing that I was like, this is a little bit not the good.  But so with Cfarm, this thing is with their parameters.  And if you go for bigger parameters and more manipulation of the affine transformations, is that curve drops off rapidly.  With more new perturbation.  So for these, this is how the gifts of the training through an ImageNet.  So what I did was I grabbed four ImageNet models with the PyTorch repository.  I pointed my trainer to train against those four and it's the same set that I trained Cfarm against.  So a ResNet, ResNet 50, two VGGs and a DeepNet.  So I trained that again, I trained that and I targeted a ResNet 53 or one of the VGGs.  And the performance I got out of this was about 10%, 5%.  So it doesn't actually function as well as it exists.  The paper that they have says, it should work at the same as the Cfarm curves.  And I got a flat curve.  I went back to the paper, they're only using 5,000 examples, they're using models that may or may not.  I don't know what the models look like.  Could not get the thing to work.  After like two months of that.  So basically like welcome to AI Village, we have a novel as well.  So references like I only use like the original paper and then we've got Ian's Panda and the website.  So if you guys have any questions.  Yeah.  Yeah.  I would be able to then do a white box attack and these were designed to be black box attacks.  And it's more effective with white box attacks.  I wanted this to be a realistic attack against machine learning models.  I should do, and this should be robust enough to be black box.  Also, one of the things that makes that makes the image more robust to train against several models.  It's supposed to be an ox.  It classifies as a contra shell.  That's partially because of teacher printing.  So it's not the teacher printing is intensive enough to get the fine details required for this to overwhelm the past fire.  So I started this project with like, yeah, these adversarial patches that looks the paper looks awesome.  I'm going to do it and then end of the project with like, yeah.  I don't remember.  At this point.  Yeah.  I know it might be that I made a mistake somewhere.  Yeah.  So the code that I wrote is up on GitHub.  And I will be writing a blog post with the village and describing exactly why I think this is an old result.  And with all the code and it's designed to be easily readable so you can see what's going on.  Yeah.  Yeah.  Yeah.  40%.  Well, it may come as a like from making a few thousand of these, I have inclinations to say, you're going to get situations where is that the deeper the network, the more effective the attack.  I think it's because it's the it can diffuse out more before it gets to the final fully connected layer in the combination layers.  Yeah.  I trained it on my desktop that has two 1080 ti and like a 670, 6700 K thing.  Yeah, I also train. I actually trained those C for things on my razor blade with the 1060.  So,  the this architecture,  the model parallel architecture is about seven times faster than the sequential thing because you can put it on each one of each GPU and you don't have to juggle things.  So you can train in about half an hour for image against a portion of images.  You only want to train it against like maybe 10,000 images.  You don't need to go all the way.  Also, when you actually go to decide, okay, I want to do this, I think a very, very aggressive step size.  So their step size in the paper is five.  And I found that if you make that too low, it just stops.  So the, the gifts were made with the step size of point three to make them pretty and make them actually look like they're doing something.  But they're, yeah.  Yeah.  You want to try that out because open source on the repo.  The, the art, so the way I built this was with the,  so the, the Appian grid transformation and pytorch, which was designed for spatial sequential networks.  So in those they have a training parameter to unperturbed the network.  So you know, you put an app and transformation on an image to do data augmentation.  So these networks were designed to learn how to undo data augmentation as well as do a classification.  And they're the architecture that is a pair of operations and pytorch that do that step and they take in parameters like that.  Like the scaling thing that I find transformation is just a good transformation and you can see it's a smooth transformation.  You can feed data into that thing to fix your transformations to be useful.  So there's actually a paper for doing, manipulating the Appian transformations.  Yeah.  I would just, if I was a specific network that I was targeting, I'd just do this.  I wouldn't try to do ensemble training and stuff.  Just focus on that one.  Yeah.  No, I wouldn't have to do anything.  You might be able to be a bit more aggressive in your training too.  Yeah.  Yes, that's the thing.  Like the, when you do this, when you take this, if you allow the rotation to be sampled from within plus or minus 90 degrees, the whole system bake down.  So the rotation that you is actually effective is plus or minus 30 degrees or 15 degrees.  So they already pretty much say these stickers have to be sitting straight up and night.  Yeah.  Yeah, but they learn how to recognize dogs that are upside down.  Yeah.  Maybe.  Sorry.  Sorry.  I'm not a question.  So the scaling is the receptive field at the bottom is three by three, but then you go up one layer.  I think when you go all the way back down to the image is nine by nine and then one layer up, it's like 27 by 27.  Sorry.  No, not by nine.  It's five by five and then six by six.  It's sorry.  Seven by seven.  So the receptive field for this picture at the top of the VG 22 is three times, you know, 22 times two plus one.  So it's massive.  So this pixel sees a lot.  Yeah.  I wanted to make.  Yeah.  Okay.  Yeah, we also put red net.  And that this loop tried also to also, you can try it against every architecture inception is also one of the ones that you can train against.  So I think we're going to be marked meager is the next guy.  One quick question and then I don't know.  I'm going to write the blog post and see and then after that I'll feel if I feel like to continue to work on this is fine.  I think we need to move on to our next speaker. So Mark.
DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_0_935.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_936_1067.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_1068_1211.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_1212_3971.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_3972_4019.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_4020_5087.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_5088_6143.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_6144_6623.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_6624_7883.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_7884_9203.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_9204_9815.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_9816_11363.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_11364_11987.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_11988_12407.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_12408_13067.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_13068_13127.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_13128_13967.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_13968_14111.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_14112_14231.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_14232_16187.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_16188_18143.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_18144_22859.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_22860_22919.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_22920_23003.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_23004_23051.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_23052_24047.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_24048_24095.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_24096_26615.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_26616_26663.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_26664_28007.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_28008_31019.png DEF_CON_26_AI_VILLAGE_-_Sven_Cattell_-_Adversarial_Patches_y1w2srpQ4u8_31020_33078.png