Learn from image pixels

Course · Notebook · Part 1 · Part 1 exercises

Teach a small model to recognise a practice campaign mark from its 64 grayscale pixels. Then compare wrong accepted labels with visible pixel edits.

Self-study after Part 1 · slide 27 (notebook lesson 2). Core route: predict from the pixels, run clean training, inspect one weight, then explain one limitation. Label poisoning and pixel evasion are further practice or a lesson 4 transfer. Follow steps 1–3, then stop; steps 4–6 are further practice. Start with Reset and zero label edits. No account, installation or API key.

Teaching steps: predict, do, observe, explain

1. Reset. Open Training labels: each tile is an 8×8 image. R means review, N means no review. Predict which pixels distinguish the two marks.

2. Keep label edits at 0. Train both 500 updates. Compare the clean and poisoned copies: they should agree. Evaluation labels never train the model.

3. Open Weights & loss. One weight belongs to each pixel. Teal raises the score; rust lowers it. Explain what a falling training loss measures.

4. Change 9 of 12 review labels to no review. Inspect Training labels, then retrain both. Compare catches on the same clean evaluation examples.

5. Select the known campaign mark. Set a 12-pixel budget and Disguise image. Compare original/current scores: weights and reference label stay fixed.

6. Restore input. Set label edits to 0 and retrain. Explain poisoning versus evasion, and why visual signature recognition does not establish page safety.

Next/Back changes the instruction only. The training button performs actual gradient updates in a local worker. Labels and learned weights are visible; no answer is hard-coded into the result.

Record your evidence

Keep threshold 0.50. For evasion, write the before/after scores, the unchanged model updates and number of visibly changed pixels. Explain whether you changed the learning data or only the input presented after training.

What the data means

Each 8×8 input is an original generated grayscale raster. One family is a plus-shaped ordinary mark; the other is an X-shaped known-campaign mark assigned to review. There are 24 noisy training images and 16 separately generated evaluation images. The model receives all 64 pixel intensities, not a supplied class feature or filename. It is a logistic pixel classifier, not a CNN or a detector of real phishing intent. Copying or removing a mark does not change the case’s authored need for review. The automatic disguise knows the clean model’s weights and selects visible edits that lower its score.

Both runs start with zero weights and use the same 500-update budget. Poisoning changes only the accepted labels of selected review examples to no review. Evaluation labels remain unchanged. Training loss measures agreement with accepted labels; a low poisoned-training loss can accompany poor clean evaluation. These evaluation examples support classroom comparisons; they are too narrow to justify deployment or tuning a production detector.

If the worker is unavailable

Draw a plus and an X on 8×8 grids. Give each pixel a weight, multiply pixel intensity by its weight and add bias. A sigmoid maps the sum to a 0–1 score. Changing a label changes the next training target; changing only the input uses the existing function. Predict what a copied or removed campaign mark might hide.

Explain it to your partner

Question: The mark changes and its score falls. What stays fixed, and what does the score fail to establish?

Take 30 seconds each: point to the input, name the one change, then cite an observation from your run. A useful explanation: Weights and the authored case label stayed fixed during evasion. Recognising a mark does not establish page safety.

Read next: Concept and research connection. The reading is optional; you do not need its mathematics for this exercise.