Images designed to fool AI can subtly trick humans too

For years, AI researchers have known that tweaking a few invisible pixels can cause computer vision to lose its mind, confidently identifying a vase of flowers as a cat. We always assumed this was just a quirky machine bug, completely invisible to the human eye.

Now, a study from Google DeepMind published in Nature Communications shows that these adversarial perturbations can actually hijack human perception too.

The illusion of a random guess

In digital images, individual pixel values sit on a scale from 0 to 255. In DeepMind's experiment, the adversarial attack shifted pixel values by no more than two levels, making the changes utterly indistinguishable to human observers.

Researchers took an image of a vase and created two perturbed versions. An image classification model viewed both and labeled one as a cat and the other as a truck with high confidence.

Then, DeepMind showed both modified images to human participants and asked a bizarre question: which image looks more cat-like?

To the volunteers, both images looked like identical vases, and participants reported feeling like they were guessing at random. But when the numbers rolled in, people chose the cat-perturbed image significantly more than the 50 percent chance rate.

Even though the human brain knew it was looking at a vase, those subtle pixel shifts registered somewhere in the subconscious, nudging people toward the machine's mistaken classification.

Bridging silicon and biology

Earlier research had already shown that humans respond to obvious, heavy adversarial distortions that disrupt major shapes. But subtle, math-heavy perturbations were supposed to be the exclusive domain of neural network confusion.

DeepMind's findings prove that our visual pathways and deep neural networks might share more architectural quirks than previously thought.

Cognitive scientists have long observed that human brains quietly process weak perceptual signals below the threshold of conscious awareness. As it turns out, adversarial noise designed for convolutional filters taps into those very same subtle biological cues.

DeepMind suggests this dynamic could actually help benchmark AI models. Measuring how closely an artificial neural network mirrors human perceptual bias could guide the design of safer, more biologically aligned vision systems.

Why it matters

This paper upends the idea that adversarial vulnerabilities are isolated to artificial networks.

For everyday users, there is no immediate danger of being brainwashed by subtle image noise. Unlike brittle machine vision models that completely fail to identify the vase, human perception remains grounded, keeping the original object intact.

However, the implications for interface design and covert behavioral manipulation are real. If imperceptible pixel alterations can bias two-alternative forced choices, bad actors could theoretically nudge user behavior across web thumbnails, digital ads, or voting prompts without raising any conscious suspicion.

We think DeepMind's approach is brilliant because it treats AI alignment not just as an engineering challenge, but as an empirical neuroscience experiment. Instead of slapping more defenses onto black-box models, studying the overlap between human perception and machine vision might be the smartest way to make both sides safer.