1 / 4
(I) Classification boundaries can easily be manipulated. (II) The semantic understanding of images is still not at a high level. The artwork demonstrates these two ideas through an experiment conducted on a frozen DINOv2 classification setup, where images of Bergama rugs are distorted using a white-box attack to obtain a predefined sequence of classification results. As the distortion continues, the classifier outputs perfectly high confidence (P = 1) for each target class and the images follow an aesthetic journey, influenced by the method of distortion.
The software takes an image and gradually makes it “become” a sequence of other things — apple → crab → eel → penguin → beetle → salamander → fruits, then back again. The transformation is driven entirely by the opinion of a frozen image classifier. The software continuously pushes the image until the classifier becomes convinced of each target class in sequence, recording every step. The result is a continuous morph through semantic categories.
Classifier: DINOv2 + linear probe
The classifier is built on Facebook’s DINOv2, a vision transformer trained through self-supervised learning (without labels) to produce rich, general-purpose image features. On top of DINOv2 is a single linear layer (facebook/dinov2-base-imagenet1k-1-layer) trained to map these features to the ImageNet classes.
For classification, the software resizes the image, normalizes it, passes it through DINOv2 to obtain a feature vector, and uses the linear layer to produce class scores. Both components are frozen; nothing is trained during the process. So, the classifier acts only as a fixed judge.
White-box adversarial attack
Because the classifier’s weights are accessible and differentiable, the software can calculate exactly how the image should change to move the classifier’s prediction toward a target class.
The current image is passed through the frozen classifier to obtain class scores. A loss is defined as the distance from the target class (cross-entropy) plus a small penalty that keeps the edits controlled. The loss is backpropagated through the classifier to calculate gradients with respect to the image itself, showing how each pixel, or each value in a latent representation, should change to better match the target. An Adam optimization step nudges the image in that direction.
This process repeats for 100 gradient steps, then the software continues to distort the image to get a high confidence from the classifier for the next class in line.
By chaining these targeted attacks over a single persistent representation, individual adversarial attacks become a continuous semantic journey.
Distortion methods (aesthetic exercise)
The same attack produces different aesthetic results depending on where the optimization happens, e.g. on a latent space of a variational autoencoder or on direct pixels. These different distortion methods are used on different rug images.
Onur Yüksel
CISTUS AI AB
Onur Yuksel is a Stockholm based independent software engineer and founder of CISTUS AI. He builds computer vision first products in various fields. In recent years, his work focused on developing medical imaging models specifically in dermatology and microbiology. Always with a side project in mind, he participates in open calls for artistic endeavors. As working with computer vision exposes the builders with strange aesthetic artefacts, Onur is exploring ways that these unusual image forms could tell a story.
