Classification regions of deep neural networks

Abstract

The goal of this paper is to analyze the geometric properties of deep neural network classifiers in the input space. We specifically study the topology of classification regions created by deep networks, as well as their associated decision boundary. Through a systematic empirical investigation, we show that state-of-the-art deep nets learn connected classification regions, and that the decision boundary in the vicinity of datapoints is flat along most directions. We further draw an essential connection between two seemingly unrelated properties of deep networks: their sensitivity to additive perturbations in the inputs, and the curvature of their decision boundary. The directions where the decision boundary is curved in fact remarkably characterize the directions to which the classifier is the most vulnerable. We finally leverage a fundamental asymmetry in the curvature of the decision boundary of deep nets, and propose a method to discriminate between original images, and images perturbed with small adversarial examples. We show the effectiveness of this purely geometric approach for detecting small adversarial perturbations in images, and for recovering the labels of perturbed images.

References in corpus (7)

• Caffe: Convolutional Architecture for Fast Feature Embedding
• Understanding deep learning requires rethinking generalization
• Identifying and attacking the saddle point problem in high-dimensional non-convex optimization
• Train faster, generalize better: Stability of stochastic gradient descent
• Exponential expressivity in deep neural networks through transient chaos
• Entropy-SGD: Biasing Gradient Descent Into Wide Valleys
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly

Cited by in corpus (17)

• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Embedded deep learning in ophthalmology: Making ophthalmic imaging smarter
• Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study
• On the Resilience of Biometric Authentication Systems against Random Inputs
• Combating Adversarial Attacks Using Sparse Representations
• Neural Networks Should Be Wide Enough to Learn Disconnected Decision Regions
• Bayesian Anomaly Detection and Classification
• The Local Elasticity of Neural Networks
• Input Hessian Regularization of Neural Networks
• Robust Adversarial Learning via Sparsifying Front Ends
• Analytical Moment Regularizer for Gaussian Robust Networks
• Attacking Convolutional Neural Network using Differential Evolution
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• In Proximity of ReLU DNN, PWA Function, and Explicit MPC
• PoisHygiene: Detecting and Mitigating Poisoning Attacks in Neural Networks
• Learning mappings onto regularized latent spaces for biometric authentication