I guess the question is how much does the pixel have to change in order to flip the image classification. In short, is it enough for a given pixel to go from #666600 to #666620 which is very unlikely to be detected by the human eye. A followup might be that since one image was successfully modified to be put in all nine classifications, what is the implication to use this as a means of passing secret information?
Biting the hand that feeds IT
