Sufficient Conditions for Idealised Models to Have No Adversarial Examples: a Theoretical and Empirical Study with Bayesian Neural Networks

Abstract

We prove, under two sufficient conditions, that idealised models can have no adversarial examples. We discuss which idealised models satisfy our conditions, and show that idealised Bayesian neural networks (BNNs) satisfy these. We continue by studying near-idealised BNNs using HMC inference, demonstrating the theoretical ideas in practice. We experiment with HMC on synthetic data derived from MNIST for which we know the ground-truth image density, showing that near-perfect epistemic uncertainty correlates to density under image manifold, and that adversarial images lie off the manifold in our setting. This suggests why MC dropout, which can be seen as performing approximate inference, has been observed to be an effective defence against adversarial examples in practice; We highlight failure-cases of non-idealised BNNs relying on dropout, suggesting a new attack for dropout models and a new defence as well. Lastly, we demonstrate the defence on a cats-vs-dogs image classification task with a VGG13 variant.

References in corpus (6)

• Detecting Adversarial Samples from Artifacts
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Understanding Measures of Uncertainty for Adversarial Example Detection
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• Dropout Inference in Bayesian Neural Networks with Alpha-divergences
• Adversarial Phenomenon in the Eyes of Bayesian Deep Learning

Cited by in corpus (15)

• Motivating the Rules of the Game for Adversarial Example Research
• Stakeholders in Explainable AI
• Large-Scale Visual Active Learning with Deep Probabilistic Ensembles
• Robustness of Bayesian Neural Networks to Gradient-Based Attacks
• Universal adversarial examples in speech command classification
• Introducing an Explicit Symplectic Integration Scheme for Riemannian Manifold Hamiltonian Monte Carlo
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• Bayesian deep neural networks for low-cost neurophysiological markers of Alzheimer's disease severity
• Graph Posterior Network: Bayesian Predictive Uncertainty for Node Classification
• Generating Interpretable Counterfactual Explanations By Implicit Minimisation of Epistemic and Aleatoric Uncertainties
• Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Setting
• Sequential Neural Methods for Likelihood-free Inference
• Gradient-Free Adversarial Attacks for Bayesian Neural Networks
• Assessing the Adversarial Robustness of Monte Carlo and Distillation Methods for Deep Bayesian Neural Network Classification
• Who's Afraid of Thomas Bayes?