In particular, the pixel patterns used were specifically not on the "manifold" of natural images — thus making it difficult for algorithms such as Latent Diffusion to generate good results. Ironically, optimization techniques were used to find these adversarial pixel patterns!

→ View original post on X — @alexjc,