When Goodfellow first arrived at Google, he began to explore a separate technique called “adversarial attacks,” showing that a neural network could be fooled into seeing or hearing things that weren’t really there. Just by changing a few pixels in a photo of an elephant—a change imperceptible to the human eye—he could fool a neural network into thinking this elephant was a car.
