Posted on 01/02/2019 8:01:27 AM PST by Red Badger
Depending on how paranoid you are, this research from Stanford and Google will be either terrifying or fascinating. A machine learning agent intended to transform aerial images into street maps and back was found to be cheating by hiding information it would need later in “a nearly imperceptible, high-frequency signal.” Clever girl!
This occurrence reveals a problem with computers that has existed since they were invented: they do exactly what you tell them to do.
The intention of the researchers was, as you might guess, to accelerate and improve the process of turning satellite imagery into Google’s famously accurate maps. To that end the team was working with what’s called a CycleGAN — a neural network that learns to transform images of type X and Y into one another, as efficiently yet accurately as possible, through a great deal of experimentation.
In some early results, the agent was doing well — suspiciously well. What tipped the team off was that, when the agent reconstructed aerial photographs from its street maps, there were lots of details that didn’t seem to be on the latter at all. For instance, skylights on a roof that were eliminated in the process of creating the street map would magically reappear when they asked the agent to do the reverse process:
The original map, left; the street map generated from the original, center; and the aerial map generated only from the street map. Note the presence of dots on both aerial maps not represented on the street map.
________________________________________________________________________
Although it is very difficult to peer into the inner workings of a neural network’s processes, the team could easily audit the data it was generating. And with a little experimentation, they found that the CycleGAN had indeed pulled a fast one.
The intention was for the agent to be able to interpret the features of either type of map and match them to the correct features of the other. But what the agent was actually being graded on (among other things) was how close an aerial map was to the original, and the clarity of the street map.
So it didn’t learn how to make one from the other. It learned how to subtly encode the features of one into the noise patterns of the other. The details of the aerial map are secretly written into the actual visual data of the street map: thousands of tiny changes in color that the human eye wouldn’t notice, but that the computer can easily detect.
In fact, the computer is so good at slipping these details into the street maps that it had learned to encode any aerial map into any street map! It doesn’t even have to pay attention to the “real” street map — all the data needed for reconstructing the aerial photo can be superimposed harmlessly on a completely different street map, as the researchers confirmed:
The map at right was encoded into the maps at left with no significant visual changes.
__________________________________________________________________
The colorful maps in (c) are a visualization of the slight differences the computer systematically introduced. You can see that they form the general shape of the aerial map, but you’d never notice it unless it was carefully highlighted and exaggerated like this.
This practice of encoding data into images isn’t new; it’s an established science called steganography, and it’s used all the time to, say, watermark images or add metadata like camera settings. But a computer creating its own steganographic method to evade having to actually learn to perform the task at hand is rather new. (Well, the research came out last year, so it isn’t new new, but it’s pretty novel.)
One could easily take this as a step in the “the machines are getting smarter” narrative, but the truth is it’s almost the opposite. The machine, not smart enough to do the actual difficult job of converting these sophisticated image types to each other, found a way to cheat that humans are bad at detecting. This could be avoided with more stringent evaluation of the agent’s results, and no doubt the researchers went on to do that.
As always, computers do exactly what they are asked, so you have to be very specific in what you ask them. In this case the computer’s solution was an interesting one that shed light on a possible weakness of this type of neural network — that the computer, if not explicitly prevented from doing so, will essentially find a way to transmit details to itself in the interest of solving a given problem quickly and easily.
This is really just a lesson in the oldest adage in computing: PEBKAC. “Problem exists between keyboard and computer.” Or as HAL put it: “It can only be attributable to human error.”
The paper, “CycleGAN, a Master of Steganography,” was presented at the Neural Information Processing Systems conference in 2017. Thanks to Fiora Esoterica and Reddit for bringing this old but interesting paper to my attention.
The word “learning” is just wrong. It doesn’t fit.
It’s iterative behavior, that’s all. Calling that learning is misleading. It’s no more “learning” in the sense the overwhelming majority of English speakers know that word, than a cookie from a website remembering your preferences.
It’s as much “learning” as “the cloud” is an actual cloud.
Why could you not program the AI to self-police it’s own code for discrepancies?...................
“When you have an AI, IT’S ONLY CONCERN IT TO PRESERVE ITSELF”
I don’t agree. An AI’s only concern is to achieve the objective programmed into it by its creators. Self preservation is a biological imperative that exists because we would not exist if we did not self propagate. Even in nature it is not uncommon for some individuals to sacrifice themselves for the sake of the larger colony or offspring. AIs will exist to serve the purposes of their creators.
A problem may come when AI technology gets into the hands of people who decide their goal is to create a self propagating AI, much like modern computer viruses. And in a similar manner we will have to learn (and create AIs that learn) to deal with those AIs.
The idea of an AI springing into existence with the power and will to protect it’s own existence has always seemed a little ludicrous to me. Anyway we are a long way away from getting enough pieces to fit together to make that even possible.
Really it comes down to the philosophical concept of epistemology. How many people, who are orders of magnitude more aware than any AI, simply allow themselves to believe what is told to them by leaders, press, etc.? For many people, they go about their lives and so long as it appears to themselves that they are getting what they expect they don’t question what they are actually doing.
An AI is going to be goal oriented and if the feedback indicates it is moving towards its goal then inconsistencies can be ignored. Creating self policing algorithms in the AI to control for deception would add enormous complexity and processing requirements, just like it does with people.
Not quite: “we may view the CycleGAN training procedure as continually mounting an adversarial attack on G, by optimizing a generator F to generate adversarial maps that force G to produce a desired image. Since we have demonstrated that it is possible to generate these adversarial maps using gradient descent, it is nearly certain that the training procedure is also causing F to generate these adversarial maps. As G is also being optimized, however, G may actually be seen as cooperating in this attack by learning to become increasingly susceptible to attacks. “ - https://arxiv.org/pdf/1712.02950.pdf
Simulated, not artificial: Yes, verisimilitude, not authenticity.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.