mlsanityData to 7 Oct 2026

Humans can decipher adversarial images

arXiv 1809.04120 ↗First posted 11 Sep 2018cs.CV cs.CY cs.LGcited by 31

Not on the map. Why?

Abstract (arXiv)

How similar is the human mind to the sophisticated machine-learning systems that mirror its performance? Models of object categorization based on convolutional neural networks (CNNs) have achieved human-level benchmarks in assigning known labels to novel images. These advances promise to support transformative technologies such as autonomous vehicles and machine diagnosis; beyond this, they also serve as candidate models for the visual system itself -- not only in their output but perhaps even in their underlying mechanisms and principles. However, unlike human vision, CNNs can be "fooled" by adversarial examples -- carefully crafted images that appear as nonsense patterns to humans but are recognized as familiar objects by machines, or that appear as one object to humans and a different object to machines. This seemingly extreme divergence between human and machine classification challenges the promise of these new advances, both as applied image-recognition systems and also as models of the human mind. Surprisingly, however, little work has empirically investigated human classification of such adversarial stimuli: Does human and machine performance fundamentally diverge? Or could humans decipher such images and predict the machine's preferred labels? Here, we show that human and machine classification of adversarial stimuli are robustly related: In eight experiments on five prominent and diverse adversarial imagesets, human subjects reliably identified the machine's chosen label over relevant foils. This pattern persisted for images with strong antecedent identities, and even for images described as "totally unrecognizable to human eyes". We suggest that human intuition may be a more reliable guide to machine (mis)classification than has typically been imagined, and we explore the consequences of this result for minds and machines alike.

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). First posted on arXiv 11 Sep 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 6; 2023: 11; 2024: 5; 2025: 1; 2026: 4.

31 papers.

Sort:

By area:

  1. 2023Neither hype nor gloom do DNNs justicecited by 40
  2. 2023Spatial-frequency channels, shape bias, and adversarial robustnesscited by 28
  3. 2023Language-Driven Anchors for Zero-Shot Adversarial Robustnesscited by 23
  4. 2022Recognizing Object by Components with Human Prior Knowledge Enhances Adversarial Robustness of Deep Neural Networkscited by 18
  5. 2022Designing Perceptual Puzzles by Differentiating Probabilistic Programscited by 12
  6. 2023Are Deep Neural Networks Adequate Behavioural Models of Human Visual Perception?cited by 10
  7. 2023Adversarial alignment: Breaking the trade-off between the strength of an attack and its relevance to human perceptioncited by 7
  8. 2024PartImageNet++ Dataset: Scaling up Part-based Models for Robust Recognitioncited by 7
  9. 2023Robustified ANNs Reveal Wormholes Between Human Category Perceptscited by 6
  10. 2022Adversarially trained neural representations may already be as robust as corresponding biological neural representationscited by 4
  11. 2022Extreme Image Transformations Affect Humans and Machines Differentlycited by 4
  12. 2024Improving deep learning with prior knowledge and cognitive models: A survey on enhancing explainability, adversarial robustness and zero-shot learningcited by 4
19 more
  1. 2021Human Imperceptible Attacks and Applications to Improve Fairnesscited by 3
  2. 2022Robustness of Humans and Machines on Object Recognition with Extreme Image Transformationscited by 3
  3. 2022Is current research on adversarial robustness addressing the right problem?cited by 2
  4. 2024Statistical Challenges with Dataset Construction: Why You Will Never Have Enough Imagescited by 2
  5. 2021The Effects of Image Distribution and Task on Adversarial Robustnesscited by 1
  6. 2021Why Out-of-distribution Detection in CNNs Does Not Like Mahalanobis -- and What to Use Insteadcited by 1
  7. 2021Image classifiers can not be made robust to small perturbationscited by 1
  8. 2023Beyond the limitations of any imaginable mechanism: large language models and psycholinguisticscited by 1
  9. 2023The Representational Status of Deep Learning Modelscited by 1
  10. 2023Intrinsic Biologically Plausible Adversarial Robustnesscited by 1
  11. 2024Limited but consistent gains in adversarial robustness by co-training object recognition models with human EEGcited by 1
  12. 2026A Framework for Generating Semantically Ambiguous Images to Probe Human and Machine Perceptioncited by 1
  13. 2023Noise robust neural network architecturecited by 0
  14. 2023Fixing the problems of deep neural networks will require better training data and learning algorithmscited by 0
  15. 2024Comparing supervised learning dynamics: Deep neural networks match human data efficiency but show a generalisation lagcited by 0
  16. 2025Targeted perturbations reveal brain-like local coding axes in robustified, but not standard, ANN-based brain modelscited by 0
  17. 2026Retina gap junctions support the robust perception by warping neural representational geometries along the visual hierarchycited by 0
  18. 2026RoME: Robust Mixture of Low-Rank Experts against Multiple Adversarial Perturbationscited by 0
  19. 2026A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detectioncited by 0