I believe the old technique was gradient ascent starting with a random image and optimizing for the classifier’s dogginess score, but now we train image denoisers then give them pure noise and tell them it’s a noisy image of a dog. Basically, we lie to models to make them make stuff for us, and we’ve gotten better at what lying scheme we use.