## Image Comparison: Localized Adversarial Perturbations ### Overview The image presents a side-by-side comparison of two grayscale digital images. Both images feature the identical central subject: a pixelated, handwritten digit (resembling a '2') on a uniform gray background, framed by a thick black border. The primary focus of the image is the introduction of localized, square patches of visual noise (perturbations) located in the top-left corners of the gray canvas. ### Components and Layout * **Left Panel Header:** Text reading "(a) 4×4 perturbation" centered above the left image. * **Right Panel Header:** Text reading "(b) 3×3 perturbation" centered above the right image. * **Main Subject (Both Panels):** A white/light-gray curved stroke forming a handwritten numeral '2', positioned centrally. * **Background (Both Panels):** A flat, medium-gray tone. * **Frame (Both Panels):** A thick, solid black border enclosing the gray background and the digit. * **Variable Component:** A small, square grid of altered pixels in the top-left corner, immediately inside the black border. ### Content Details **Panel (a) - Left Image:** * **Label:** (a) 4×4 perturbation * **Perturbation Location:** Top-left corner of the gray background. * **Perturbation Characteristics:** A distinct 4 by 4 grid of pixels (16 pixels total). The pixels within this grid exhibit varying intensities, including dark gray, light gray, and near-white, creating a randomized, checkerboard-like noise pattern. * **Subject Interaction:** The perturbation is spatially isolated from the handwritten digit. There is a clear gap of unaltered gray background between the noise patch and the top of the numeral. **Panel (b) - Right Image:** * **Label:** (b) 3×3 perturbation * **Perturbation Location:** Top-left corner of the gray background, in the exact same anchor position as panel (a). * **Perturbation Characteristics:** A distinct 3 by 3 grid of pixels (9 pixels total). Similar to panel (a), it contains varying intensities of grayscale pixels. It occupies a smaller physical area than the perturbation in panel (a). * **Subject Interaction:** Identical to panel (a), the perturbation is spatially isolated from the handwritten digit. ### Key Observations * **Subject Constancy:** The central handwritten digit and the black border are pixel-perfect matches across both images. The *only* variable is the noise patch in the top-left corner. * **Spatial Isolation:** The noise patches do not obscure, overlap, or touch the primary subject (the digit). * **Dimensionality:** The text explicitly defines the dimensions of the noise patches (4x4 pixels vs. 3x3 pixels), which is visually confirmed by the grid sizes in the respective corners. ### Interpretation * **Context:** This image is a classic visualization from a technical paper in the field of **Adversarial Machine Learning**, specifically focusing on Computer Vision. The handwritten digit is highly characteristic of the MNIST dataset, a standard benchmark in machine learning. * **What the Data Demonstrates:** The image illustrates a "patch attack" or "localized adversarial perturbation." In machine learning, an attacker alters a small number of pixels to intentionally cause a neural network (like a Convolutional Neural Network) to misclassify the image. To a human, the image is obviously still a '2'. To a compromised AI, the specific pattern of noise in the corner forces a wrong prediction (e.g., classifying it as a '7' or '0'). * **Significance of the Comparison (4x4 vs 3x3):** The authors are comparing the size of the adversarial patch. * A **4x4 patch** (16 pixels) gives the attacker more "degrees of freedom" (more variables to optimize) to successfully fool the AI, but alters more of the original image. * A **3x3 patch** (9 pixels) is a more constrained, stealthier attack. It alters fewer pixels (a lower $L_0$ norm), making it harder to detect visually or programmatically, but it may be mathematically harder to find a 3x3 pattern that successfully breaks the model compared to a 4x4 pattern. * **Peircean Investigative Deduction (Reading between the lines):** Because the perturbation is placed in the corner—completely detached from the digit itself—this graphic highlights a specific vulnerability in how the AI processes images. It proves that the AI model is not just looking at the shape of the digit; it is highly sensitive to background/contextual pixels. The model has learned spurious correlations in the background space, allowing an attacker to hijack the classification without ever touching the actual subject of the image.