A Theoretical Framework for Robustness of (Deep) Classifiers against Adversarial Examples
It addresses the vulnerability of classifiers to adversarial attacks, which is a critical issue for AI safety and reliability, but it is incremental as it builds on existing theoretical work without introducing new methods.
This paper tackles the problem of adversarial examples fooling machine learning classifiers by developing a theoretical framework using topology to analyze the robustness of classifiers against such attacks, finding that unnecessary features can compromise robustness and proper feature representation is crucial for achieving both accuracy and strong robustness.
Most machine learning classifiers, including deep neural networks, are vulnerable to adversarial examples. Such inputs are typically generated by adding small but purposeful modifications that lead to incorrect outputs while imperceptible to human eyes. The goal of this paper is not to introduce a single method, but to make theoretical steps towards fully understanding adversarial examples. By using concepts from topology, our theoretical analysis brings forth the key reasons why an adversarial example can fool a classifier ($f_1$) and adds its oracle ($f_2$, like human eyes) in such analysis. By investigating the topological relationship between two (pseudo)metric spaces corresponding to predictor $f_1$ and oracle $f_2$, we develop necessary and sufficient conditions that can determine if $f_1$ is always robust (strong-robust) against adversarial examples according to $f_2$. Interestingly our theorems indicate that just one unnecessary feature can make $f_1$ not strong-robust, and the right feature representation learning is the key to getting a classifier that is both accurate and strong-robust.