# The Adversarial Attack and Detection under the Fisher Information Metric

arXiv: https://arxiv.org/abs/1810.03806 · HTML: https://mlsanity.com/paper/1810.03806/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Oct 2018.

## Built on by (most cited first, 18 of 18)

- [Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attack](https://mlsanity.com/paper/2103.05347/) (2021)
- [Adversarial robustness of amortized Bayesian inference](https://mlsanity.com/paper/2305.14984/) (2023)
- [Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart](https://mlsanity.com/paper/2105.14785/) (2021)
- [Defenses in Adversarial Machine Learning: A Survey](https://mlsanity.com/paper/2312.08890/) (2023)
- [Stabilized Medical Image Attacks](https://mlsanity.com/paper/2103.05232/) (2021)
- [Model Inversion Attack via Dynamic Memory Learning](https://mlsanity.com/paper/2309.00013/) (2023)
- [Adversarial attacks on neural networks through canonical Riemannian foliations](https://mlsanity.com/paper/2203.00922/) (2022)
- [Erasing Without Remembering: Implicit Knowledge Forgetting in Large Language Models](https://mlsanity.com/paper/2502.19982/) (2025)
- [Adversarial robustness of VAEs through the lens of local geometry](https://mlsanity.com/paper/2208.03923/) (2022)
- [Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?](https://mlsanity.com/paper/2505.12871/) (2025)
- [Wavelet Regularization Benefits Adversarial Training](https://mlsanity.com/paper/2206.03727/) (2022)
- [Attack Transferability Characterization for Adversarially Robust Multi-label Classification](https://mlsanity.com/paper/2106.15360/) (2021)
- [Information-Geometric Inverse Distillation for Enhancing Adversarial Transferability](https://mlsanity.com/paper/2502.17003/) (2025)
- [Rendering-Aware Bayesian 3D Gaussian Splatting with Native Uncertainty and Adaptive Complexity Control](https://mlsanity.com/paper/2607.05522/) (2026)
- [Cartan moving frames and the data manifolds](https://mlsanity.com/paper/2409.12057/) (2024)
- [Measuring Model Robustness via Fisher Information: Spectral Bounds, Theoretical Guarantees, and Practical Algorithms](https://mlsanity.com/paper/2606.04767/) (2026)
- [Low-Frequency Shortcuts in Texture-Driven Visual Learning](https://mlsanity.com/paper/2606.03493/) (2026)
- [Dynamics to decision: A mathematical theory of Lyapunov spectra and decision boundaries in deep classifiers](https://mlsanity.com/paper/2609.39190/) (2026)

## Abstract (arXiv)

Many deep learning models are vulnerable to the adversarial attack, i.e., imperceptible but intentionally-designed perturbations to the input can cause incorrect output of the networks. In this paper, using information geometry, we provide a reasonable explanation for the vulnerability of deep learning models. By considering the data space as a non-linear space with the Fisher information metric induced from a neural network, we first propose an adversarial attack algorithm termed one-step spectral attack (OSSA). The method is described by a constrained quadratic form of the Fisher information matrix, where the optimal adversarial perturbation is given by the first eigenvector, and the model vulnerability is reflected by the eigenvalues. The larger an eigenvalue is, the more vulnerable the model is to be attacked by the corresponding eigenvector. Taking advantage of the property, we also propose an adversarial detection method with the eigenvalues serving as characteristics. Both our attack and detection algorithms are numerically optimized to work efficiently on large datasets. Our evaluations show superior performance compared with other methods, implying that the Fisher information is a promising approach to investigate the adversarial attacks and defenses.