To get an idea of what adversarial examples look like, consider this demonstration from Explaining and Harnessing Adversarial Examples⁠(opens in a new window): starting with an image of a panda, the attacker adds a small perturbation that has been calculated to make the image be recognized as a gibbon with high confidence.

The approach is quite robust; recent research⁠(opens in a new window) has shown adversarial examples can be printed out on standard paper then photographed with a standard smartphone, and still fool systems.

Adversarial examples can be printed out on normal paper and photographed with a standard resolution smartphone and still cause a classifier to, in this case, label a “washer” as a “safe”.

Adversarial examples have the potential to be dangerous. For example, attackers could target autonomous vehicles by using stickers or paint to create an adversarial stop sign that the vehicle would interpret as a ‘yield’ or other sign, as discussed in Practical Black-Box Attacks against Deep Learning Systems using Adversarial Examples⁠(opens in a new window).