Robustness bounds on the successful adversarial examples in probabilistic models: Implications from Gaussian processes

2024/03/04 by Hiroaki Maeshima, Maeshima, Hiroaki, Akira Otsuka +1
Computer Science · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Physical Unclonable Functions (PUFs) and Hardware Security

paper · pdf · doi:10.48550/arxiv.2403.01896

openalex publication_date 2024/03/04 · openalex created_date 2024/03/06 · openalex updated_date 2026/07/28

Abstract

Adversarial example (AE) is an attack method for machine learning, which is crafted by adding imperceptible perturbation to the data inducing misclassification. In the current paper, we investigated the upper bound of the probability of successful AEs based on the Gaussian Process (GP) classification, a probabilistic inference model. We proved a new upper bound of the probability of a successful AE attack that depends on AE's perturbation norm, the kernel function used in GP, and the distance of the closest pair with different labels in the training dataset. Surprisingly, the upper bound is determined regardless of the distribution of the sample dataset. We showed that our theoretical result was confirmed through the experiment using ImageNet. In addition, we showed that changing the parameters of the kernel function induces a change of the upper bound of the probability of successful AEs.

Related

• Adversarial Vulnerability Bounds for Gaussian Process Classification
• How Wrong Am I? - Studying Adversarial Examples and their Impact on Uncertainty in Gaussian Process Machine Learning Models
• Adversarial Robustness Guarantees for Gaussian Processes
• Adversarial Robustness Guarantees for Classification with Gaussian Processes
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models