A single doctored photo can now fool AI from any angle

Remember last week’s reassuring claim—that self-driving cars couldn’t easily be tricked by altered street signs because their cameras capture images from multiple angles and distances? That argument just took a beating. A new demonstration shows it is entirely possible to create so-called adversarial examples that reliably fool neural network classifiers regardless of how you look at them.

Standard attacks are brittle. The researchers point out that a picture of a cat perturbed to be misclassified as a desktop computer by Google’s Inception v3 model snaps right back to ‘tabby cat’ with a zoom factor of just 1.002. That fragility gave the physical world a sense of security. But the team, suspecting that deliberate effort could overcome this, turned to a technique called projected gradient descent. Instead of optimizing an image to fool a classifier from one static viewpoint, they optimized it against a massive, randomized ensemble of classifiers that rescale the input on the fly.

The result is a scale-invariant attack. A single perturbed image remains adversarial at every scale simultaneously. Even restricting pixel changes only to the actual cat in the photo doesn’t stop the attack from working. The researchers then layered in randomization during the creation process—throwing in random rotations, translations, and noise—to produce a single input that stays adversarial under practically any transformation you can throw at it. The transformations are sampled randomly at test time, proving invariance to an entire distribution of visual changes rather than a few pre-set tricks. This isn’t just a lab curiosity; it’s a blueprint for an attack that transfers into messy, unpredictable physical environments, directly undermining a core safety assumption for autonomous systems.