classification
The pixel you cannot see
It is 2013, and a disquieting discovery is circulating: a deep network that classifies images with superhuman confidence can be flipped to a wildly wrong label by a perturbation so small no human eye can detect it. The image looks identical; the model calls a school bus an ostrich. Characterize why high-accuracy classifiers are so brittle at these engineered points, and build defenses that hold when an adversary — not nature — chooses the input. The stakes leave the lab immediately: a stop sign with a few stickers, a face-recognition gate, a malware detector. Get it wrong and you deploy a system whose benchmark accuracy is a fiction the moment someone wants it to fail — and in security, someone always does.
Who this problem belongs to
The two figures whose methods fit it best, out of 71 in contention.
Goodfellow is a co-author of the 2014 paper 'Explaining and Harnessing Adversarial Examples,' which followed directly on Szegedy et al.'s original 2013 discovery and gave the field its first clear explanation, that adversarial vulnerability arises from the linear behavior of high-dimensional models rather than some exotic nonlinear quirk, plus the fast gradient sign method for both generating and defending against these attacks. His broader invention of generative adversarial networks demonstrates deep, hands-on fluency with exactly this problem's core mechanic: an adversary crafting inputs to fool a model. He essentially co-founded the technical vocabulary this entire problem is written in. Almost no one in this roster has a more direct historical claim on this exact 2013-era result.
Sutskever is a co-author of Szegedy et al.'s 2013 paper 'Intriguing Properties of Neural Networks,' the original discovery this problem describes: that imperceptible perturbations could flip a high-accuracy classifier's prediction with high confidence, illustrated with the school-bus example this problem echoes almost exactly. He was, quite literally, one of the researchers who first characterized this brittleness in the paper that launched adversarial machine learning as a field. His subsequent career emphasis on scale and capability did not center on adversarial robustness as a primary research thread, but his direct authorship of the founding paper gives him an essentially unmatched historical claim on this problem's origin, trailing only Goodfellow's more extensive subsequent defense work.
Fought here
In the mind map
The same ideas, as concepts rather than history — in John's ML knowledge map.
71 figures are scored on this problem. Draw it in a battle to see where you land.