Mathematical Analysis of Adversarial Attacks
arXiv:1811.06492
Abstract
In this paper, we analyze efficacy of the fast gradient sign method (FGSM) and the Carlini-Wagner's L2 (CW-L2) attack. We prove that, within a certain regime, the untargeted FGSM can fool any convolutional neural nets (CNNs) with ReLU activation; the targeted FGSM can mislead any CNNs with ReLU activation to classify any given image into any prescribed class. For a special two-layer neural network: a linear layer followed by the softmax output activation, we show that the CW-L2 attack increases the ratio of the classification probability between the target and ground truth classes. Moreover, we provide numerical results to verify all our theoretical results.
arXiv comment21 pages
References in corpus (12)
- Adam: A Method for Stochastic Optimization
- Ensemble Adversarial Training: Attacks and Defenses
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Black-box Adversarial Attacks with Limited Queries and Information
- Adversarial Perturbations Against Deep Neural Networks for Malware Classification
- Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
- Laplacian Smoothing Gradient Descent
- Deep Neural Nets with Interpolating Function as Output Activation
- Adversarial Defense via Data Dependent Activation Function and Total Variation Minimization
Cited by in corpus (5)
- ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
- Topological safeguard for evasion attack interpreting the neural networks' behavior
- Softmax-based Classification is k-means Clustering: Formal Proof, Consequences for Adversarial Attacks, and Improvement through Centroid Based Tailoring
- Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
- Graph Interpolating Activation Improves Both Natural and Robust Accuracies in Data-Efficient Deep Learning