Mathematical Analysis of Adversarial Attacks

2018/11/15 by Dou, Zehao, Osher, Stanley J., Wang, Bao
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML)

paper · doi:10.48550/arxiv.1811.06492

Abstract

In this paper, we analyze efficacy of the fast gradient sign method (FGSM) and the Carlini-Wagner's L2 (CW-L2) attack. We prove that, within a certain regime, the untargeted FGSM can fool any convolutional neural nets (CNNs) with ReLU activation; the targeted FGSM can mislead any CNNs with ReLU activation to classify any given image into any prescribed class. For a special two-layer neural network: a linear layer followed by the softmax output activation, we show that the CW-L2 attack increases the ratio of the classification probability between the target and ground truth classes. Moreover, we provide numerical results to verify all our theoretical results.

Related

• Evaluating Adversarial Robustness: A Comparison Of FGSM, Carlini-Wagner Attacks, And The Role of Distillation as Defense Mechanism
• A randomized gradient-free attack on ReLU networks
• Adversarial Attacks on Image Classification Models: Analysis and Defense
• A Learning and Masking Approach to Secure Learning
• Unscrambling the Rectification of Adversarial Attacks Transferability across Computer Networks