@techreport {pub3875pub4080pub4212,
	title = {Adversarial attacks hidden in plain sight},
	author = {Heiko Wersing AND Barbara Hammer},
	year = {2019},
	month = {December},
	abstract = {Convolutional neural networks have been used to achieve a string of successes dur-
ing recent years, but their lack of interpretability remains a serious issue. Adversarial
examples are designed to deliberately fool neural networks into making any desired
incorrect classification, potentially with very high certainty. In this contribution, we
underline the severity of the issue by presenting a technique that allows to hide such
adversarial attacks in regions of high complexity, such that they are imperceptible even
to an astute observer. The design of this method relies on fundamental principles of
human{\textquoteright}s visual perception. Visual attention is not distributed evenly to different parts
of an image, rather fixation is directed to points of high information in a series of sac-
cades. Interestingly, it is possible to hide adversarial manipulations of an image in such
regions of high interest by restricting gradient-based targeted attacks to regions which
reveal high information as quantified e.g. based on information theoretic measures. Al-
beit such manipulations take place in {\textquoteleft}plain sight{\textquoteright}, they are less visible to humans as
compared to attacks which uniformly address the full image. We hypothesize that this
effect can be explained by the fact that a uniform attack uniformly changes the infor-
mation content of all regions, hence rendering previously uninformative low-contrast
and homogeneous predictable regions potentially interesting, whereas changes in re-
gions of high interest do not affect the saccades. In this contribution, we explain how to
technically realize such adversarial attacks given a deep network and according inputs,
resulting in illustrative examples of this effect. An empirical investigation of the altered
human{\textquoteright}s perception of such images will be the subject of future research.},
	publisher = {arXiv},
	booktitle = { arXiv:1902.09286}
}