The EconomistAugust 17th 2019 Science & technology 612 is still clearly a face. But a computer—or, at
least, the specific algorithm Mr Harvey was
aiming at—is baffled.
Dramatic make-up is likely to attract
more attention from other people than it
deflects from machines. HyperFace is a
newer project of Mr Harvey’s. Where cv
Dazzle aims to alter faces, HyperFace aims
to hide them among dozens of fakes. It uses
blocky, semi-abstract and comparatively
innocent-looking patterns that are de-
signed to appeal as strongly as possible to
face classifiers. The idea is to disguise the
real thing among a sea of false positives.
Clothes with the pattern, which features
lines and sets of dark spots vaguely remi-
niscent of mouths and pairs of eyes (see
photograph), are already available.
An even subtler idea was proposed by
researchers at the Chinese University of
Hong Kong, Indiana University Blooming-
ton, and Alibaba, a big Chinese informa-
tion-technology firm, in a paper published
in 2018. It is a baseball cap fitted with tiny
light-emitting diodes that project infra-red
dots onto the wearer’s face. Many of the
cameras used in face-recognition systems
are sensitive to parts of the infra-red spec-
trum. Since human eyes are not, infra-red
light is ideal for covert trickery.
In tests against FaceNet, a face-recogni-
tion system developed by Google, the re-
searchers found that the right amount of
infra-red illumination could reliably pre-
vent a computer from recognising that it
was looking at a face at all. More sophisti-
cated attacks were possible, too. By search-
ing for faces which were mathematically
similar to that of one of their colleagues,
and applying fine control to the diodes, the
researchers persuaded FaceNet, on 70% of
attempts, that the colleague in question
was actually someone else entirely.
Training one algorithm to fool another
is known as adversarial machine learning.
It is a productive approach, creating im-
ages that are misleading to a computer’s vi-
sion while looking meaningless to a hu-
man being’s. One paper, published in 2016
by researchers from Carnegie Mellon Uni-
versity, in Pittsburgh, and the University of
North Carolina, showed how innocuous-
looking abstract patterns, printed on paper
and stuck onto the frame of a pair of glass-
es, could often convince a computer-vision
system that a male airesearcher was in fact
Milla Jovovich, an American actress.
In a similar paper, presented at a com-
puter-vision conference in July, a group of
researchers at the Catholic University of
Leuven, in Belgium, fooled person-recog-
nition systems rather than face-recogni-
tion ones. They described an algorithmi-
cally generated pattern that was 40cm
square. In tests, merely holding up a piece
of cardboard with this pattern on it was
enough to make an individual—who would
be eminently visible to a human security
guard—vanishfromthesightofa comput-
erisedwatchman.
Astheresearchersthemselvesadmit,
allthesesystemshaveconstraints.Inpar-
ticular,most work onlyagainst specific
recognitionalgorithms,limitingtheirde-
ployability.Happily, saysMrHarvey, al-
thoughfacerecognitionisspreading,itis
notyetubiquitous—orperfect.Astudyby
researchersattheUniversityofEssex,pub-
lishedinJuly,foundthatalthoughonepo-
licetrialinLondonflaggedup 42 potential
matches,onlyeightprovedaccurate.Even
inChina,saysMrHarvey,onlya fractionof
cctv cameras collect pictures sharp
enoughforfacerecognitiontowork.Low-
techapproachescanhelp,too.“Evensmall
thingslikewearingturtlenecks,wearing
sunglasses, looking at yourphone [and
therefore not at the cameras]—together
thesehavesomeprotectiveeffect”. 7NothingtoseehereI
n 1957 workbegan on Project Pluto, a
treetop-skimming American missile
loaded with hydrogen bombs. Nothing odd
about that, except that the missile itself
was also to be propelled by nuclear energy.
A reactor on board would suck in air, heat
and thus expand it, and then hurl it out of
the back to provide thrust. Unfortunately,
this also spewed out radioactive particles—
which would hardly matter in war, but
meant the missile could not be tested safe-
ly, and so the project was cancelled.
America’s experience has not, however,
deterred Vladimir Putin, Russia’s presi-
dent. In March 2018 he announced the de-velopment of a Pluto-like missile called
Burevestnik (“petrel”, a bird regarded by
sailors of old as a harbinger of storms). This
has since been tested in Novaya Zemlya,
and has crashed several times.
On August 8th there was another acci-
dent ascribed by many observers to Burev-
estnik. Seven scientists perished in a rock-
et explosion on an offshore platform near
Arkhangelsk. The damage was widespread.
Some reports suggest that on August 13th
Nyonoksa, a village 40km away, was al-
most evacuated after radiation there ex-
ceeded background levels.
As Michael Elleman, a missile expert at
the International Institute for Strategic
Studies, a think-tank, observes, nuclear
propulsion can work in two ways. One is
fission reaction—the sort used in power
stations. But, as Project Pluto’s designers
found, that is tricky to fit in a missile.
The other option is radioisotope decay,
which uses a substance such as poloni-
um-218 to heat and evaporate a liquid. The
gas generated might be employed to propel
probes through the vacuum of space, but
because it produces less thrust than fission
the process has not been thought suitable
for missiles. Mr Elleman hypothesises,
however, that Russia may use it for another
purpose: to create a long-lasting thermal
battery which can provide unlimited elec-
trical power for tasks such as missile guid-
ance and warhead initiation.
Russia has admitted that an “isotope
power source” was being tested, and Ros-
atom, the country’s atomic-energy agency,
has said a “nuclear battery” was involved.
Some Russian sources suggest it was this—
rather than a reactor—which failed, ex-
ploding when it was pulled from the water.
Why go to such trouble in the first
place? Russia has ballistic missiles that can
reach any part of the world, but it is worried
that they may be vulnerable to current or
future American defences. Cruise missiles
can fly along low, erratic paths capable of
skirting those defences. But Russia’s lon-
gest-range cruise missile, Kalibr, can travel
only a few thousand kilometres, so hitting
America would require launching it from
planes, ships or submarines. Burevestnik,
by contrast, could be fired from deep inside
Russian territory, and would thus be a
more credible threat.
Pranay Vaddi, an arms-control expert at
the Carnegie Endowment, a think-tank,
suggests it might also serve as a bargaining
chip. “This may be an effort to gain leverage
in arms-control negotiations, to force the
United States to the table,” he says. New
Start, a treaty that limits American and
Russian nuclear forces, covers only ballis-
tic missiles. America does not seem keen
on renewing it when it expires in 2021. The
Russians may hope that Burevestnik will
change America’s attitude—if they can
make it work. 7A nuclear accident in Russia points to
the risks of atomic aviationNuclear propulsionChernobyl with
wings