Image classifiers can not be made robust to small perturbations
Not on the map. Why?
Abstract (arXiv)
The sensitivity of image classifiers to small perturbations in the input is often viewed as a defect of their construction. We demonstrate that this sensitivity is a fundamental property of classifiers. For any arbitrary classifier over the set of n-by-n images, we show that for all but one class it is possible to change the classification of all but a tiny fraction of the images in that class with a perturbation of size O(n^1/max(p,1)) when measured in any p-norm for p ≥ 0. We then discuss how this phenomenon relates to human visual perception and the potential implications for the design considerations of computer vision systems.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 20 of its 33 references that are in the map. First posted on arXiv 7 Dec 2021.
Builds on
20 of 33 references.
References · 20
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Identity Mappings in Deep Residual Networkscited by 1,960
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2018Robustness May Be at Odds with Accuracycited by 873
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2017A Neural Representation of Sketch Drawingscited by 311
8 more
- 2018Adversarial vulnerability for any classifiercited by 78
- 2018Adversarial Examples that Fool both Computer Vision and Time-Limited Humanscited by 73
- 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
- 2020Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspectivecited by 58
- 2018The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measurecited by 44
- 2018Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distributioncited by 32
- 2018Humans can decipher adversarial imagescited by 31
- 2018Secure Deep Learning Engineering: A Software Quality Assurance Perspectivecited by 3
Built on by
Citing papers per year: 2023: 1.
1 paper.