# Empirically Measuring Concentration: Fundamental Limits on Intrinsic Robustness

arXiv: https://arxiv.org/abs/1905.12202 · HTML: https://mlsanity.com/paper/1905.12202/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 May 2019.

## Built on by (most cited first, 12 of 12)

- [Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?](https://mlsanity.com/paper/2104.09425/) (2021)
- [Investigating Vulnerabilities of Deep Neural Policies](https://mlsanity.com/paper/2108.13093/) (2021)
- [Adversarial Examples Are Not Bugs, They Are Superposition](https://mlsanity.com/paper/2508.17456/) (2025)
- [Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustness](https://mlsanity.com/paper/2309.16096/) (2023)
- [Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition](https://mlsanity.com/paper/2103.09947/) (2021)
- [It Is All About Data: A Survey on the Effects of Data on Adversarial Robustness](https://mlsanity.com/paper/2303.09767/) (2023)
- [Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisions](https://mlsanity.com/paper/2306.05873/) (2023)
- [Improved Estimation of Concentration Under ℓp-Norm Distance Metrics Using Half Spaces](https://mlsanity.com/paper/2103.12913/) (2021)
- [Understanding Intrinsic Robustness Using Label Uncertainty](https://mlsanity.com/paper/2107.03250/) (2021)
- [HASI: Hardware-Accelerated Stochastic Inference, A Defense Against Adversarial Machine Learning Attacks](https://mlsanity.com/paper/2106.05825/) (2021)
- [Computable Model-Independent Bounds for Adversarial Quantum Machine Learning](https://mlsanity.com/paper/2411.06863/) (2024)
- [The Role of Input Dimensionality in the Emergence and Targeted Control of Adversarial Examples](https://mlsanity.com/paper/2606.26207/) (2026)

## Abstract (arXiv)

Many recent works have shown that adversarial examples that fool classifiers can be found by minimally perturbing a normal input. Recent theoretical results, starting with Gilmer et al. (2018b), show that if the inputs are drawn from a concentrated metric probability space, then adversarial examples with small perturbation are inevitable. A concentrated space has the property that any subset with Omega(1) (e.g., 1/100) measure, according to the imposed distribution, has small distance to almost all (e.g., 99/100) of the points in the space. It is not clear, however, whether these theoretical results apply to actual distributions such as images. This paper presents a method for empirically measuring and bounding the concentration of a concrete dataset which is proven to converge to the actual concentration. We use it to empirically estimate the intrinsic robustness to ℓ_∞ and ℓ2 perturbations of several image classification benchmarks. Code for our experiments is available at https://github.com/xiaozhanguva/Measure-Concentration.