A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
By Beilun Wang, Ji Gao, Yanjun Qi. 2016
31 citations recorded by the source corpus.
Most machine learning classifiers, including deep neural networks, are vulnerable to adversarial examples. Such inputs are typically generated by adding small but purposeful modifications that lead to incorrect outputs while imperceptible to human eyes. The goal of this paper is not to introduce a single method, but to make theoretical steps towards fully understanding adversarial examples. By using concepts from topology, our theoretical analysis brings forth the key reasons why an adversarial example can fool a classifier ($f_1$) and adds its oracle ($f_2$, like human eyes) in such analysis. By investigating the topological relationship between two (pseudo)metric spaces corresponding to predictor $f_1$ and oracle $f_2$, we develop necessary and sufficient conditions that can determine if $f_1$ is always robust (strong-robust) against adversarial examples according to $f_2$. Interestingly our theorems indicate that just one unnecessary feature can make $f_1$ not strong-robust, and the right feature representation learning is the key to getting a classifier that is both accurate and strong-robust.
Subfields: Artificial Intelligence, Signal Processing
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Philip H. S. Torr
- Namhoon Lee
- Saumya Jetley
- Yusuke Tsuzuku
- Nicholas A. Lord
- Masashi Sugiyama
- Issei Sato
- Bernt Schiele
In Signal Processing
Citations in the corpus
- Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks (2018, background): “As Wang et al. [38] pointed out, learning unnecessary features can be a cause of adversarial perturbations, which indicates the orthonormality condition has adverse effects that encourage the existence of adversarial perturbations.”
- Learn To Pay Attention (2018, background): “The works by Wang et al. (2016) and Gao et al. (2017) argue that this vulnerability comes from relying on spurious or non-oracle features for classification.”