One small kernel slides over the whole image, reusing the same weights at every position — so a machine can learn to see a local pattern anywhere it appears with only nine numbers. That weight-sharing is what gave vision to machines. Down the center, data flows: the image goes in, the kernel convolves, the feature map comes out. The blue team builds and defends it; the red team tries to break it.
source LeCun, Bottou, Bengio & Haffner, Gradient-Based Learning Applied to Document Recognition (LeNet-5), Proc. IEEE 86(11):2278–2324, 1998 — author's primary hosting yann.lecun.com/exdb/publis/pdf/lecun-98.pdf. Pre-arXiv (1998); no clean archive.org details id found in search — cited from the author's copy, marked AMBER. Rendered, not quoted.
A 3×3 kernel K is dragged across the image I. At each spot it multiplies the nine overlapping pixels by its nine weights and sums:
out[i,j] = Σa,b∈{-1,0,1} K[a,b]·I[i+a, j+b]
The same nine weights are used everywhere — that is weight sharing: a pattern learned in one corner is detected in every corner, and the parameter count stays tiny regardless of image size.
Two honest choices, both disclosed: (1) like every deep-learning framework this computes cross-correlation — the kernel is not flipped (true convolution flips it). (2) borders use edge-replicate padding so the output stays the same size as the input.
A convolution is a neuron with two constraints added: its inputs are a small local patch (a receptive field), and its weights are shared across every position. Take the first neuron — one weighted sum through a nonlinearity — tie its weights across space and you have a feature detector that scans.
LeNet stacked these into the ConvNet that read cheques at scale. And the "receptive field" that grows as you stack layers is exactly the intuition attention later generalized — from a fixed local window to a learned, content-addressed one. Each sphere is the next one's premise.
The blue team's live check: re-run the engine on fixed reference images and confirm the four laws still hold — identity is a no-op, the box blur preserves a flat field, Sobel spikes on an edge, and one hand-computed cell equals its known value. If red tampers, this badge is where it shows.
A 6×6 grayscale image — each cell is one pixel, 0 (dark) to 9 (bright). Click any cell to raise its value (wraps 9→0). It starts as a vertical edge: a dark half beside a bright half, the pattern an edge detector lives to find.
This is the signal the kernel below will scan.
out[3,3] is recomputed from the nine multiply-adds on the spot — never looked up. Change the kernel or edit a pixel and this recalculates.
Every position's response, tiled back into an image. Purple = positive response, red = negative (Sobel is signed). Where the kernel's pattern matches the image, the map lights up; a flat region falls to near-zero.
It is also only translation-equivariant, not invariant: rotate or rescale the pattern and the same kernel misses it. Real robustness needs pooling, augmentation, or more filters — the operation itself is narrow and literal. Convolution is not seeing; it is the first proof that seeing has a computable, reusable shape.
"CNNs compute convolution." Cut. They compute cross-correlation — the kernel is not flipped. It only coincides with true convolution because the network learns whichever (flipped or not) weights it needs. This engine does correlation, and says so.
"LeCun invented the convolutional net." Corrected. Fukushima's Neocognitron (1980) already had local, shared-weight receptive fields + pooling. LeNet's gift was training the whole stack end-to-end with backprop.
"Convolution is translation-invariant." Cut. It is translation-equivariant: shift the input, the feature map shifts with it. Invariance comes later, from pooling — not from the convolution.
The red team's move: mis-index the kernel — rotate each row's taps by one column so the wrong weight lands on each pixel (an off-by-one that drops a tap). It looks like a convolution and runs fine. The blue team's witness (window 7) is watching.
Shift the tap indices and identity stops being a no-op, the hand-computed cell disagrees with its known value, and the witness recomputes and turns red. Nothing is faked; the attack is real and it is caught.