54
30

A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples

Abstract

Most machine learning classifiers, including deep neural networks, are vulnerable to adversarial examples. Such inputs are typically generated by adding small but purposeful modifications that lead to incorrect outputs while imperceptible to human eyes. The goal of this paper is not to introduce a single method, but to make theoretical steps towards fully understanding adversarial examples. By using concepts from topology, our theoretical analysis brings forth the key reasons why an adversarial example can fool a classifier (f1f_1) and adds its oracle (f2f_2, like human eyes) in such analysis. By investigating the topological relationship between two (pseudo)metric spaces corresponding to predictor f1f_1 and oracle f2f_2, we develop necessary and sufficient conditions that can determine if f1f_1 is always robust (strong-robust) against adversarial examples according to f2f_2. Interestingly our theorems indicate that just one unnecessary feature can make f1f_1 not strong-robust, and the right feature representation learning is the key to getting a classifier that is both accurate and strong-robust.

View on arXiv
Comments on this paper

We use cookies and other tracking technologies to improve your browsing experience on our website, to show you personalized content and targeted ads, to analyze our website traffic, and to understand where our visitors are coming from. See our policy.