Essays, Posts & Presentations

Wolfram Neural Networks Boot Camp Recap: Dog vs. Butterfly Optical Illusion Showdown

Zach Shelton

Author

Zach Shelton

Title

Wolfram Neural Networks Boot Camp Recap: Dog vs. Butterfly Optical Illusion Showdown

Description

How to beat a neural network using an example of a computer vision shortcoming. Fooling a neural network is an introduction to generative adversarial networks (GANs).

Wolfram Neural Networks Boot Camp Recap: Dog vs. Butterfly Optical Illusion Showdown

May 7, 2021

Zach Shelton, Outreach & Communications

Neural networks are increasingly a part of society and are used in many aspects of life, especially e-commerce and social media. I recently had the opportunity to attend the Wolfram Neural Networks Boot Camp with developers and researchers who design and utilize Wolfram Language neural net resources. During the boot camp, participants received a crash course on using neural nets in the Wolfram Language.

Wolfram developer and researcher Markus van Almsick introduced attendees to the structure and features of the Wolfram Language for computer vision and deep-learning image classification. During this session, he explained how to create an optical illusion for a computer. What does that mean? Would an optical illusion that fools a person fool a computer too? Maybe it would work vice versa?

This blog is an exploration for beginning users of neural networks and computer vision that uses an example of a computer vision shortcoming. Fooling a neural network is an introduction to generative adversarial networks (GANs). If you’re interested in learning about neural networks in either a complete introduction or a refresher, you should read Tuseeta Banerjee’s blog post “Neural Networks: An Introduction.”

How Do Computers See? Computers see an image as a rank-3 tensor. Each pixel located in an image has three values associated with it that correspond to red, green and blue (RGB). The computer reads these three values and translates them into light we can see and understand. These values, for example, produce the colors on your screen right now.

Humans excel at pattern recognition. We can pick out patterns everywhere: in faces, shapes in clouds and plenty of other places—including toast. Even though neural networks accomplish similar visual tasks as humans, substantial differences remain.

The center of the human retina provides much higher resolution compared to its peripheral vision. Computers, in contrast, weigh equally the RGB values of each pixel in an entire image. Furthermore, humans recognize aligned, oriented features with ease, while neural networks are hard to beat in texture recognition. These differences become apparent when investigating optical illusions that humans and machines fall for.

Let’s utilize some example data from the Wolfram Data Repository to demonstrate this.

In[]:=

imgArray=ExampleData[{"TestImage","Airplane2"}],ImagePerspectiveTransformationExampleData[{"TestImage","Airplane2"}],

1	1/3	0
1/3	1	0
0	1/2	1

,BackgroundTransparent,MaskingAll

Out[]=





The Wolfram Language’s neural network–powered function

ImageIdentify

will attempt to identify the original and transformed images.

In[]:=

ImageIdentify/@imgArray

Out[]=



interceptor

envelope



This feels like the question is answered. Deforming the image is easy, but it could make the image difficult for even a human to identify. Why not try to create an image that surely fools a neural network without deforming the image totally?

Dog vs. Butterfly During the Neural Networks Boot Camp, we were walked through a fun and relatively simple exploration of a trained neural network currently available to Wolfram Language users.

In[]:=

inceptNet=NetModel["Inception V1 Trained on ImageNet Competition Data"]

Out[]=

NetChain



Input port:	image
Output port:	class



Inception V1 is a neural network released by Google in 2014. Attendees learned how to access the Wolfram Neural Net Repository (premade and pretrained networks for various applications that can be found and programmatically called using

NetModel

). This

NetChain

is a complete model that was used in the previous example to make predictions and can be trained with new data and even restructured (which is also known as net surgery and transfer learning).

The first step is to define how we want our test image to be predicted. We will pull sample images for a dog and a butterfly from the Data Repository.

In[]:=

butterfly=ResourceData["Sample Image: Orange Butterfly on a Purple Flower"]

Out[]=

In[]:=

dog=ResourceData["Sample Image: White Dog on a Beach"]

Out[]=

Inception V1 identifies that the first image has a butterfly in it.

In[]:=

inceptNet[butterfly]

Out[]=

monarch butterfly

The Inception V1 network stores probabilities of every option the image could represent, and we can pull what it believes are the most probable identifications.

In[]:=

inceptNet[dog,{"TopProbabilities",3}]

Out[]=



Pomeranian

0.0133037,

Eskimo dog

0.0231366,

Samoyed

0.946689

Following are the probabilities the dog and butterfly images are either a dog or a butterfly. In both cases, it’s very sure that it is not one of the options.

In[]:=



monarch butterfly

CONCEPT

Samoyed

CONCEPT

/.inceptNet[dog,"Probabilities"]

Out[]=

{4.71117×

-8

,0.946689}

In[]:=



monarch butterfly

CONCEPT

Samoyed

CONCEPT

/.inceptNet[butterfly,"Probabilities"]

Out[]=

{0.739746,3.73908×

-8

}

The goal is to make Inception V1 believe with a high probability or confidence that the image of the butterfly is a dog, specifically a Samoyed. This is done via increasing the other concept’s probabilities. The key is to create the features in the butterfly image that the neural net is looking for when it identifies the dog.

For this purpose, we will implement a new neural network called foolNet. It will contain the butterfly image as an array of weights and modify these weights to change the image classification from “Monarch butterfly” to “Samoyed.”

Step one in building our network is to extract from the Inception V1 network the input image dimensions and number of color channels as well as the

NetDecoder

with its output classes. These parameters are needed later in the construction of foolNet.

In[]:=

imageDims=NetExtract[inceptNet,{"Input","ImageSize"}];imageChannels=NetExtract[inceptNet,{"Input","ColorChannels"}];decoder=Normal@NetExtract[inceptNet,"Output"];decodeDims=decoder["Dimensions"];foolNetEncoder=NetEncoder[{"Class",decoder["Labels"],"UnitVector"}];

To provoke a misclassification, we apply a modified

CrossEntropyLossLayer

to Inception V1. This layer is doing most of the legwork for foolNet by comparing the resulting 1,000 class probabilities to those of a dog.

In[]:=

featureLossLayer=CrossEntropyLossLayer["Probabilities"]

Out[]=

CrossEntropyLossLayer



Input:	matrix (rank≥1)
Target:	matrix (rank≥1)
Loss:	real



foolNet is inherently simple. The image of the butterfly will be stored as a tensor of weights in a

NetArrayLayer

that we prepend as input to the inceptNet.

In[]:=

imgWeights=ImageData[ImageResize[butterfly,imageDims,Resampling{"OMOMS",3}],InterleavingFalse];

The new network is made using NetGraph and

NetPort

In[]:=

foolNet[img_Image]:=With[{imgWeights=ImageData[ImageResize[img,imageDims,Resampling{"OMOMS",3}],InterleavingFalse]},NetGraph[<|"image"NetArrayLayer["Array"imgWeights],"inceptnet"NetReplacePart[inceptNet,{"Input"Prepend[imageDims,imageChannels],"Output"{decodeDims}}],"loss"featurelosslayer|>,{"image""inceptnet",{"inceptnet",NetPort["Target"]}"loss"NetPort["Loss"]},"Target"foolnetencoder]]

Note that foolNet requires no training data. We only provide the target tag for the misclassification, which amounts to a batch size of 1. Furthermore, almost all

LearningRateMultipliers

are set to

None

to avoid the (re)training of inceptNet itself. Just the learning rate for the layer with the butterfly image is set to 1.

In[]:=

training=NetTrain[foolNet[butterfly],<|"Target"{inceptNet[dog]}|>,All,LearningRateMultipliers{"image"1,_None},MaxTrainingRounds300,BatchSize1,TargetDevice"CPU"];

Observe the structure of foolNet, as it is still per se the same network. The metric the model uses to learn about the tracked data, however, is changed. foolNet is minimizing the loss (or incorrect probabilities) of the new image created.

In[]:=

fooledNet=training["TrainedNet"]

Out[]=

NetGraph



InputPort
Target:	class
OutputPort
Loss:	real



foolNet uses the structure of Inception V1 with the additional loss layer. The output or target is the modified weight tensor. This tensor can also be converted back into an image.

In[]:=

maybedog=ImageResize[Image[NetExtract[fooledNet,{"image","Array"}],InterleavingFalse],ImageDimensions[butterfly],Resampling{"OMOMS",3}]

Out[]=

This image, while blurry, looks like a butterfly, and most humans would identify it as one. Testing in Inception V1, however, produces peculiar results.

In[]:=

inceptNet[maybedog,{"TopProbabilities",5}]

Out[]=



kuvasz

0.00909942,

chow chow

0.010128,

lacewing

0.0123186,

Pomeranian

0.0153848,

Samoyed

0.734899

Now, comparing the probabilities of butterfly or Samoyed identification:

In[]:=



monarch butterfly

CONCEPT

Samoyed

CONCEPT

/.inceptNet[maybedog,"Probabilities"]

Out[]=

{0.00380349,0.734899}

In[]:=

ImageDifference[butterfly,maybedog]//ImageAdjust

Out[]=

Inception V1 is now pretty sure it sees a Samoyed dog, or at least it’s sure the image isn’t a butterfly. None of the overall patterns of the butterfly’s wings have changed, so this is a certified computer optical illusion. Neural networks are fooled with seemingly slight adjustments because they are not human brains; they are constrained by methods that are very simple in comparison. This means a neural network can incorrectly classify a slightly modified image.

Before celebrating our supremacy over neural networks, it’s worth noting that simply blurring the resulting image causes Inception V1 to again correctly identify the butterfly.

In[]:=

Blur[maybedog,3]

Out[]=

inceptNet[Blur[maybedog,3]]

Out[]=

monarch butterfly

As explained at the Neural Networks Boot Camp, this method is network- and image-specific. Given a new network or image, the procedure must be repeated and potentially modified. Fooling or beating a neural network is expanded upon and applied within GANs.

Additional Resources This article explores just one of many topics covered at the Wolfram Neural Networks Boot Camp. If you’re interested in learning more about the structure of neural networks and using them in the Wolfram Language, take a look at these resources:

◼

“Neural Networks: An Introduction”

◼

Reference pages for neural network functionality in the Wolfram Language

◼

“New in Version 12: Neural Network Framework”

◼

Machine learning courses from Wolfram U

Check out the rest of Wolfram U’s courses and tutorials to learn how to use Wolfram technologies in a wide range of fields and applications, and take advantage of opportunities for recognition and certifications.

Cite this as: Zach Shelton, "Wolfram Neural Networks Boot Camp Recap: Dog vs. Butterfly Optical Illusion Showdown" from the Notebook Archive (2021), https://notebookarchive.org/2021-06-8c37v40