A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples

2016/12/01 by Beilun Wang, Wang, Beilun, Ji Gao +3 · 6 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #cs.CR #cs.CV #cs.LG

paper · pdf · doi:10.48550/arxiv.1612.00334

38 pages , ICLR 2017 Workshop Track

arxiv created 2017/09/27 · arxiv updated 2017/09/28

Abstract

Most machine learning classifiers, including deep neural networks, are vulnerable to adversarial examples. Such inputs are typically generated by adding small but purposeful modifications that lead to incorrect outputs while imperceptible to human eyes. The goal of this paper is not to introduce a single method, but to make theoretical steps towards fully understanding adversarial examples. By using concepts from topology, our theoretical analysis brings forth the key reasons why an adversarial example can fool a classifier (f₁) and adds its oracle (f₂, like human eyes) in such analysis. By investigating the topological relationship between two (pseudo)metric spaces corresponding to predictor f₁ and oracle f₂, we develop necessary and sufficient conditions that can determine if f₁ is always robust (strong-robust) against adversarial examples according to f₂. Interestingly our theorems indicate that just one unnecessary feature can make f₁ not strong-robust, and the right feature representation learning is the key to getting a classifier that is both accurate and strong-robust.

Citations

• Gradient-based learning applied to document recognition
• ImageNet classification with deep convolutional neural networks

Cited by

• Microsoft Malware Classification Challenge
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• ROBY: Evaluating the Robustness of a Deep Model by its Decision Boundaries
• Curls & Whey: Boosting Black-Box Adversarial Attacks
• Graph Neural Networks with Continual Learning for Fake News Detection from Social Media
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy

Related

• Intriguing Properties of Adversarial Examples
• Theoretical Foundations of Adversarially Robust Learning
• Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustness
• Analysis of classifiers' robustness to adversarial perturbations
• Understanding and Quantifying Adversarial Examples Existence in Linear Classification