perception
The sticker that erases the stop sign
It is 2017, and the uncomfortable laboratory result has walked outdoors: image classifiers that surpass humans on benchmarks can be inverted, their gradients yielding perturbations invisible to people that flip any prediction — and now a few printed stickers on a physical stop sign make a driving-grade detector read SPEED LIMIT 45 from every angle and distance a camera will pass through. Explain the vulnerability — high-dimensional linearity, not exotic overfitting — then attack and defend honestly: craft the physical, robust perturbation, and evaluate defenses against an adversary who knows them, because obscured gradients have already embarrassed a round of published fixes. Get it wrong and perception models certified on clean test sets ship into safety-critical roads while their failure modes are printable at home.
Who this problem belongs to
The two figures whose methods fit it best, out of 55 in contention.
This problem is Goodfellow's own desk. His 2014 paper "Explaining and Harnessing Adversarial Examples," written with Shlens and Szegedy, is the primary source for exactly the explanation this problem demands: adversarial vulnerability is not exotic overfitting but a consequence of high-dimensional linear behavior in models that appear nonlinear, and the fast gradient sign method he derived there generates the kind of imperceptible perturbation the problem describes. His subsequent research on adversarial training as a defense, and his honest engagement with the finding that many published defenses rely on obscured gradients that a determined adversary defeats, matches the problem's demand to evaluate against an adversary who knows the defenses. He did not personally craft the physical stop-sign attack -- that is Eykholt and Song's 2017 contribution -- but the theoretical explanation this problem requires is substantially his own.
This problem's physical attack is Song's own published result. Her 2017-2018 paper "Robust Physical-World Attacks on Deep Learning Visual Classification," with Eykholt and collaborators, demonstrated exactly this scenario: printed black-and-white stickers placed on a real stop sign, designed to survive the distances, angles, and lighting conditions a moving vehicle's camera would encounter, causing a production-grade classifier to misread it as a speed limit sign. Her broader research career in AI security and adversarial machine learning is built on evaluating systems honestly against adversaries who know the deployed defenses, precisely the "obscured gradients have already embarrassed a round of published fixes" caution this problem demands be respected. She both crafted the physical, robust perturbation this problem describes and evaluated it under real-world conditions, making her among the most direct possible carriers for this exact scenario.
Fought here
In the mind map
The same ideas, as concepts rather than history — in John's ML knowledge map.
55 figures are scored on this problem. Draw it in a battle to see where you land.