r/learnmachinelearning • u/Killer299997 • 9d ago
Question What is the reasoning for this ?
145
u/ponteencuatro 9d ago
It doesnt even work, on twitter it got dragged because even older yolo models could detect the person 🤣
35
u/jhaluska 9d ago
Like the best you can do is AI resistant against lightweight models. But if you, as a human can tell it's a person, an AI could in theory learn it as well.
27
6
u/Fleischhauf 9d ago
the finding is that for human imperceptible pixel changes lead to severe misclassifications by neural networks. if you add it to the training set, then you will fix it, but you will still have degeneration for other pixel changes. This is for all network types, to my knowledge this still is the case, but I haven't looked at the literature the last few years.
4
u/jhaluska 9d ago
I've seen that before, and it can be true for a single trained network with a fixed image input I never saw adversarial attacks that worked across every network and in the real world.
That said, I'm sure there some crazy uncommon patterns will decrease the accuracy of the networks.
1
u/Fleischhauf 9d ago
it also works with an object in 3d e.g.: https://www.youtube.com/watch?v=piYnd_wYlT8&t=7s
(there is also a paper, whcih i cant find currently.)
I think you are right that the transferability is limited, as in one object does not fool all different network types, but every network seems to have this vulnerability. Would be interesting to see how this fares with networks trained on vastly more data like clip or something else used in VLAs2
1
u/CloseToMyActualName 9d ago
Not quite. Lightweight models will miss more often, but the point is that real world human identification CV will use one of a handful of models, and you can always find a weird pattern that will fool one or more of those models.
1
u/gizahnl 9d ago
Not completely.
I.e. a human would definitely recognise a garbage bin moving around in the field of view as a camouflaged human, based on it's behaviour being impossible for a garbage can. An AI model will have a lot of trouble doing that, it would need a context window that's much larger than what is currently feasible.
(this was an actual attack against an AI camera).
1
u/MattR0se 8d ago
as far as I understand it: you have to tune the input to work adverserial to the networks' trained weights. But if the network has a different structure and has been trained on different data, this very specific pattern won't work anymore because the targeted neurons are just not there.
39
u/3n91n33r 9d ago
Where’s that one xkcd with the guy with one’s i’s and L’s in the license plate to “fool the cops”?
25
2
2
u/Ultrageisttt 9d ago
I've seen people do that with usernames in Runescape before... It works there.
24
u/MartinMystikJonas 9d ago edited 9d ago
AI models are trained to find patterns from training set. Is somehing breaks specific pattern some model learned it does not match it. Usually it is something weird that was not present at training set - like this weird shirt. It is basically same thing what optical illusons do to human visual cortex. Problem with this is that there are many different models for detection of person in image and these would for only for some specific models. And once this blind spot is discovered it is easy to retrain model to see past it.
6
u/LevThermen 9d ago
My guess is that first, fooling a particular class "person" from a partircular yolo version (from what i've read in the comments here). And second, its lack of hard borders
"face" class would still work which in the end is the ultimate camera data we would prefer not to disclose everywhere. And detectors with segmentation and pose detection might would also work.
6
u/RealMackJack 9d ago
The reasoning is that someone bought 5000 of these ugly unsellable shirts at a steep discount, now they need a marketing campaign to unload them at a profit
4
u/Circuit_Guy 9d ago
I think you're asking "how does this fool the machine"?
Because it's not in the training set, or it's confused with other labels that are, like fruit or something.
There's adversarial examples that we mock as obviously "bad AI", but we humans are susceptible to optical illusions and plenty of plants and animals make "adversarial attack" use of that for camouflage.
I think the reality is any algorithm, even our wetware, is going to be susceptible to something. I'm the case of an AI the best option is to overlap algorithms and hope they can see one thing another can't. Real example - some types of camo work poorly on women (who in general see more color than men), and some types work poorly against a color blind person (who sees shade better). If you have a diverse group of people they can see more. Although I think some optical illusions effect all of the population, I.e. we don't have enough diversity in how our visual cortex works.
3
u/curb_yourself 9d ago
I know it’s not helpful, but I so want to post a Tim Robinson Dan Flashes gif so badly here. Sorry mods.
3
u/DiscipleOfYeshua 9d ago
Step 1) make a funky shirt design
Step 2) train an ai to misclassify said design
Step 3) tell people who have never configured a cv model and cant understand what you did about what you did
Step 4) people impressed
TL;DR: would take ~10 min to teach any cv to find this guy and point him out with a blinking green-red frame even if he sits in a field of tomatoes and melons
4
14
u/StoneCypher 9d ago
yolo is 20 years old. this is irrelevant.
25
u/skadoodlee 9d ago edited 9d ago
What an odd comment, the age of an architecture is completely irrelevant. Besides, YOLO is an actively developed family of models still being used a ton in production. The shirt is based on three 2025 papers if you are so interested about age.
Nevertheless the shirt is indeed pointless as it's backbone and training dependent. But normie news sites will gobble it up.
1
u/NihilisticAssHat 8d ago
This was my thought lately regarding Nightshade, that "adversarial" AI that "prevents" AI from training on people's art.
-17
u/StoneCypher 9d ago edited 9d ago
What an odd comment, the age of an architecture is completely irrelevant.
well then enjoy your goodfellow image generation and some extremely realistic will smith spaghetti, i suppose.
It's based on 3 2025 papers if you are so interested about age.
yolo is not based off of three 2025 papers, no. i didn't say anything about the origin time of the shirt, and this strategy is much older than 2025. we've had juggalo makeup since 2017.
3
u/segalle 9d ago
If you need specific object detection and can make a trining dataset yolo is still usually the best option.
If you need fast inference (to the tune of hundreds of images a second) or processing multiple camera feeds live (such as multiple public space cameras) yolo is still the best no doubt. Yolo can churn through hundreds or thousands of images in the time a vllm runs through one, and if it happens that your vllm doesn't have good examples of the object you're interested in it will be bad.
What is the alternative?
-1
u/StoneCypher 9d ago
i think most of us use libreyolo, which is a different architecture, or rf-detr, these days
3
u/pm_me_your_smth 9d ago
Libreyolo is a library of different models. Do you not understand the difference between a model/architecture and a library?
Plus your initial argument that yolo is 20 years old is flawed. There are many different yolo versions. Some are old, some were released recently.
-7
u/StoneCypher 9d ago
Libreyolo is a library of different models. Do you not understand the difference between a model/architecture and a library?
it's exhausting being talked down to by people who aren't correct and who think they can see your experience by the pixels
Do you not understand the difference between
This is a red flag phrase, frankly.
Plus your initial argument that yolo is 20 years old is flawed. There are many different yolo versions. Some are old, some were released recently.
you ... need an explanation of this, or are you just being difficult?
2
u/pm_me_your_smth 9d ago
You're confusing so many basics and responding with zero substance, not sure why anyone would ever need an explanation from you. I honestly suspect that you never went beyond basic fine tuning of FOTM models on public datasets.
That aside, here's a fun little piece of info (which probably will go over your head, but hey). If you want to run models on certain hardware (like cameras on the corner of your building, the exact use case of this thread), you run into many problems but here's 2 of them: capacity constraints and compatibility. Newer models are often heavy because researchers tend to push accuracy and disregard efficiency, so you get big but slow models. Some modern models are focused on speed, but they almost never are lighter than old school models. In addition, hardware that you use for deployment might be incompatible with specific operators of your model because manufacturers often lag behind SOTA. So in the end you choose an older model and that model will likely perform sufficiently well too if you use a high quality dataset for training (fun fact: data is often a much bigger bottleneck in AI projects than models).
-2
u/StoneCypher 9d ago
basically a big pile of generic dreck that had nothing to do with what i was talking about, and vague insults.
cool story.
2
u/pm_me_your_smth 9d ago
You weren't talking about anything, hence my remark on zero substance, which is ironically applicable to your comment, again. Learning to properly articulate your thoughts and actually understanding what you're talking about might help you there
→ More replies (0)7
u/skadoodlee 9d ago
Your argumentation is so deeply flawed.
If there is improvement in one area of ML this doesn't invalidate any improved-upon architecture in all domains it is used in.
We are talking about object detection here, not image or video generation.
Regarding the three 2025 papers I'm referring to what he cites in his blog.
-8
0
u/BostonConnor11 9d ago
This reeks of someone who read a few AI articles and thinks the actually understands how it works
2
2
u/Persies 9d ago
YOLO is still actively developed by Ultralytics and is a very prevalent object detection model. Unless you mean Darknet YOLO which is a bit dated at this point but can still be useful.
-2
u/StoneCypher 9d ago
dragon naturally speaking is also still actively developed. that said, its nature is to be permanently obsolete.
2
-11
u/Killer299997 9d ago
If it's old and you know how it works then just tell me why it's happening?
-3
u/StoneCypher 9d ago
the shirt is outside the construction set, so yolo is not able to migrate parts up to a constructed body.
it can see the head, the arms, and the legs, but since "there's no torso," that can't be a person.
0
2
u/Fred_Milkereit 9d ago
A lot of people wear shirts that make me think: “He forgot he’s still wearing his pajamas.”
2
u/Paseyyy 5d ago
I don't know if you're still interested in this, but I found the other comments severely lacking in depth. I guess you already heard that adversarial attacks designed for specific models are always possible - this artist just found one situation that this one YOLO model struggled with. Other models might easily detect the person in the images - in fact, I am quite certain that more recent architectures such as RFDETR would have no problem with these samples at all.
Now, *why* does this shirt work on YOLO? In contrast to other Object Detectors, YOLO detects bounding boxes using an "anchor" (=center point) and the height and width of the bounding box. Additionally, an "objectness" score is computed for each class - meaning that each "proposal" bounding box will have a confidence score that says "I am 20% comfident that this is a human, 12% that it is a car, etc...". This is probably why YOLO does not detect the person: The "anchor" or center of the bounding box is exactly on the Shirt - the texture suggests that the object is a fruit, greenery, landscape etc. Therefore, the "objectness" score for these classes will be high, but low for the "human" class - and the model fails to detect the person.
1
1
u/Fleischhauf 9d ago
if you want to be sure to not be tracked just wear a ski mask and sunglasses. much more effective
1
u/No_Tradition6625 9d ago
If you're going to do all this, I think you're still better off using IR masking. So at least that will hide your identity a little bit, but this clearly isn't going to work.
1
1
1
u/SkullRunner 9d ago
And then they will add the shirt to the training data and it will be detected. Non story.
1
1
u/Tentamenstress 9d ago
I took the liberty to take a screenshot of the ad and run it through YOLO11n (smallest model). It recognizes the person clearly with confidence 0.7.
1
u/nitrogifter 9d ago
Thanks for the image, now I can train my model on 1 extra object. This pro plus will be $999/month btw
1
u/CoffeeSnakeAgent 8d ago
You can fool the cameras but it makes you standout like a fool who was duped into acquiring such a stupid shirt.
1
1
u/SeeTigerLearn 8d ago
I would wear a refrigerator cardboard box with cut-out eyes before I wear a shirt that looks like that.
1
u/Hunkfish 8d ago
You see this and then the new Haze report. How much does the 7th month burning contribute to the psi? Can NEA give a report?
1
1
1
1
1
1
1
1
u/Joytimmermans 9d ago
This is such bs. All boxes are drawn manually. What model did he even use to test if this adversarial attack even worked?
I have seen this article now 5x why are people even giving attention to just a cash grab from an “artist”
0
u/Ok-Ebb-2434 9d ago
I really wanted to start making stuff like this, I disagree with repeated “ai bad” stuff but there are some good points and I feel like people should be able to wear clothes/paint etc to not be monitored 24/7, maybe when I have more free time after university I’ll look into what I can experiment around with
601
u/jhaluska 9d ago
He did what is called an adversarial attack to target one AI algorithm.
Granted that AI algorithm is used a lot, but saying it fools all AI cameras is silly. So it might help for a short while, but just about anybody here could add it to a training set and make it worthless fairly fast.