Computer Vision Foundations · free preview

Aliasing Attacks

A tiny strided-convolution network turns an invisible Nyquist perturbation into a completely wrong output, making aliasing a security problem.

1. A tiny network that sees less than we do

A tiny network that sees less than we do

2. Hiding a pattern at Nyquist

Hiding a pattern at Nyquist

3. Decimation folds it down

Decimation folds it down

4. Aliasing is a security issue

Aliasing is a security issue

5. Where the attack lives

The adversarial pattern $z[n,m] = (-1)^n(-1)^m\,\ell_{\text{hidden}}[n,m]$ is added to an image at strength $0.05$ . Why does it go unnoticed in the input image?

6. What decimation does to the pattern

After the decimation step $h[n,m] = u[2n,2m]$ , what has happened to the spectral content of the hidden pattern that lived at Nyquist in the input?

7. Frequency of the attack

A perturbation flips sign at every pixel in both the horizontal and the vertical direction, alternating $+,-,+,-$ as $n$ and $m$ increase. Expressed in cycles per pixel, what is its spatial frequency along one axis? Write it as a decimal.

Practice this interactively

Free account · instant grading · spaced review that schedules itself.

Start this course for free