The Adversarial Attack and Detection under the Fisher Information Metric
This addresses the problem of adversarial attacks in deep learning for researchers and practitioners, offering a novel geometric perspective and efficient algorithms, though it is incremental in building on existing information geometry concepts.
The paper tackles the vulnerability of deep learning models to adversarial attacks by using information geometry to explain it and proposes a one-step spectral attack algorithm based on the Fisher information metric, along with a detection method using eigenvalues, with evaluations showing superior performance compared to other methods.
Many deep learning models are vulnerable to the adversarial attack, i.e., imperceptible but intentionally-designed perturbations to the input can cause incorrect output of the networks. In this paper, using information geometry, we provide a reasonable explanation for the vulnerability of deep learning models. By considering the data space as a non-linear space with the Fisher information metric induced from a neural network, we first propose an adversarial attack algorithm termed one-step spectral attack (OSSA). The method is described by a constrained quadratic form of the Fisher information matrix, where the optimal adversarial perturbation is given by the first eigenvector, and the model vulnerability is reflected by the eigenvalues. The larger an eigenvalue is, the more vulnerable the model is to be attacked by the corresponding eigenvector. Taking advantage of the property, we also propose an adversarial detection method with the eigenvalues serving as characteristics. Both our attack and detection algorithms are numerically optimized to work efficiently on large datasets. Our evaluations show superior performance compared with other methods, implying that the Fisher information is a promising approach to investigate the adversarial attacks and defenses.