““Adversarial attacks” like these have shown remarkable weakness, time and again, repeatedly establishing that what deep learning systems do just isn’t the same as what people do:”
Our reading, the sentence that was checked:
Adversarial attacks have repeatedly shown that deep learning systems have remarkable weaknesses and don't work the way people do.
Assessment: Supported Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, David beats Go-liath, paragraph 9.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-david-beats-go-liath-37d4e3-a2
We recorded 4 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-29. The source may have been edited after 2023-02-18. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- Adversarial attacks
- remarkable weakness
- time and again
- what deep learning systems do just isn’t the same as what people do
Our interpretation
- The preceding seven-year discussion supplies the historical period.
- Repeatedly means multiple independent demonstrations of substantial vulnerability.
- The ordinary testable reading concerns differing behavior on attacked tasks. It does not establish that humans and networks share no computational principles.
Counts as supported if: Multiple primary studies demonstrate substantial adversarial failures, with evidence that human responses or robustness differ on comparable inputs.
Counts as contradicted if: The reported vulnerabilities fail to reproduce, or appropriate human comparisons remove the claimed behavioral differences.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
In 2017, adversarial distractor sentences reduced average reading-comprehension F1 from 75% to 36% across sixteen models; direct human testing found substantially smaller losses [e5]. In 2018, a separate speech-recognition study reported 100% success in making DeepSpeech produce attacker-selected transcriptions in its tested white-box setting [e6]. These studies support repeated substantial weaknesses and observed differences from human behavior during the claimed period [e5, e6]. The difference is not universal: a 2018 study found that adversarial images also influenced time-limited human observers [e7].
Limitations
- These behavioral results do not establish that human and deep-learning mechanisms are fundamentally unrelated [e5, e6, e7].
- The speech study's audio-similarity finding does not provide the same direct human comparison as the reading-comprehension study [e5, e6].
- The evidence does not establish human immunity to adversarial attacks [e7].
Evidence (3 items)
Supports the claim: Jia and Liang, EMNLP paper hosted on arXiv,
no published open-source model is robust to the addition of adversarial sentences.
Why it matters here: Distracting sentences sharply reduced model performance. Direct human testing showed substantially smaller losses, supporting a behavioral robustness difference rather than perfect human immunity.
- Publisher
- Jia and Liang, EMNLP paper hosted on arXiv
- Kind of source
- Peer-reviewed paper
- Describes events of
- Public from
Supports the claim: Carlini and Wagner, arXiv,
show it has a 100% success rate.
Why it matters here: A separate domain exhibits severe vulnerability: small audio changes induce attacker-selected transcriptions. This establishes repetition across tasks; the paper's perceptual-similarity discussion is weaker evidence than a controlled human comparison.
- Publisher
- Carlini and Wagner, arXiv
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Context only: Elsayed et al., NeurIPS paper hosted on arXiv,
influence the classifications made by time-limited human observers.
Why it matters here: Some attacks influence humans under restricted viewing conditions. This limits the generalization but does not erase documented differences in other experiments.
- Publisher
- Elsayed et al., NeurIPS paper hosted on arXiv
- Kind of source
- Peer-reviewed paper
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, David beats Go-liath
“Adversarial attacks” like these have shown remarkable weakness, time and again, repeatedly establishing that what deep learning systems do just isn’t the same as what people do:
- Where
- paragraph 9
- Published
- 2023-02-18
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-david-beats-go-liath-37d4e3-a2: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.