This paper considers the problem of helping humans exercise scalable oversight over deep neural networks (DNNs). Adversarial examples can be useful by helping to reveal weaknesses in DNNs, but they can be difficult to interpret or draw actionable conclusions from. Some previous works have proposed using human-interpretable adversarial attacks including copy/paste attacks in which one natural image pasted into another causes an unexpected misclassification. We build on these with two contributions. First, we introduce Search for Natural Adversarial Features Using Embeddings (SNAFUE) which offers a fully automated method for finding copy/paste attacks. Second, we use SNAFUE to red team an ImageNet classifier. We reproduce copy/paste attacks from previous works and find hundreds of other easily-describable vulnerabilities, all without a human in the loop. Code is available at https://github.com/thestephencasper/snafue

翻译：本文探讨如何帮助人类对深度神经网络(DNN)实施可扩展监督的问题。对抗样本虽有助于揭示DNN的脆弱性，但往往难以解释或无法从中得出可操作的结论。此前研究提出人类可解释的对抗攻击方法，包括将一幅自然图像粘贴到另一幅图像中引发意外错误分类的复制/粘贴攻击。我们在该基础上提出两项贡献：首先，引入基于嵌入的自然对抗特征搜索方法(SNAFUE)，该方法能全自动发现复制/粘贴攻击；其次，利用SNAFUE对ImageNet分类器进行红队测试。我们复现了此前研究中的复制/粘贴攻击，并在无需人工干预的情况下发现数百个易于描述的其他脆弱性。代码已开源至https://github.com/thestephencasper/snafue