This paper explores the null space properties of neural networks. We extend
the null space definition from linear to nonlinear maps and discuss the
presence of a null space in neural networks. The null space of a given neural
network can tell us the part of the input data that makes no contribution to
the final prediction so that we can use it to trick the neural network. This
reveals an inherent weakness in neural networks that can be exploited. One
application described here leads to a method of image steganography. Through
experiments on image datasets such as MNIST, we show that we can use null space
components to force the neural network to choose a selected hidden image class,
even though the overall image can be made to look like a completely different
image. We conclude by showing comparisons between what a human viewer would
see, and the part of the image that the neural network is actually using to
make predictions and, hence, show that what the neural network ``sees'' is
completely different than what we would expect.

本文探讨神经网络的零空间特性，扩展了线性到非线性映射的零空间定义，并讨论了神经网络中的零空间存在。我们利用零空间的部分来欺骗神经网络，揭示了神经网络的内在弱点。我们描述了一种图像隐写术的应用，并通过在 MNIST 等图像数据集上的实验表明，我们可以利用零空间成分来强制神经网络选择一个选定的隐藏图像类别，即使整体图像看起来完全不同。最后，我们比较了人类观察者所看到的图像和神经网络实际用于进行预测的图像部分，证明神经网络 “看到” 的与我们预期完全不同。