Feature compression is the root cause of adversarial fragility in neural network classifiers
Not on the map. Why?
Abstract (arXiv)
In this paper, we uniquely study the adversarial robustness of deep neural networks (NN) for classification tasks against that of optimal classifiers. We look at the smallest magnitude of possible additive perturbations that can change a classifier's output. We provide a matrix-theoretic explanation of the adversarial fragility of deep neural networks for classification. In particular, our theoretical results show that a neural network's adversarial robustness can degrade as the input dimension d increases. Analytically, we show that neural networks' adversarial robustness can be only 1/√d of the best possible adversarial robustness of optimal classifiers. Our theories match remarkably well with numerical experiments of practically trained NN, including NN for ImageNet images. The matrix-theoretic explanation is consistent with an earlier information-theoretic feature-compression-based explanation for the adversarial fragility of neural networks.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 25 of its 32 references that are in the map. First posted on arXiv 23 Jun 2024.
Builds on
25 of 32 references.
References · 25
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Understanding deep learning requires rethinking generalizationcited by 1,657
- 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
- 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
- 2020Feature Purification: How Adversarial Training Performs Robust Deep Learningcited by 107
- 2016Robustness of classifiers: from adversarial to random noisecited by 87
- 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
- 2021Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descentcited by 34
- 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
13 more
- 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
- 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
- 2022A Survey on Physical Adversarial Attack in Computer Visioncited by 24
- 2023CGBA: Curvature-aware Geometric Black-box Attackcited by 20
- 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
- 2023Adversarial Examples Are Not Real Featurescited by 16
- 2018A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretabilitycited by 8
- 2023Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspacescited by 8
- 2022One-vs-the-Rest Loss to Focus on Important Samples in Adversarial Trainingcited by 7
- 2019An Information-Theoretic Explanation for the Adversarial Fragility of AI Classifierscited by 5
- 2023Improved Adversarial Training Through Adaptive Instance-wise Loss Smoothingcited by 5
- 2022Attacking Adversarial Defences by Smoothing the Loss Landscapecited by 2
- 2023Boosting Adversarial Attacks by Leveraging Decision Boundary Informationcited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.