A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance

Abstract

The existence of adversarial examples in which an imperceptible change in the input can fool well trained neural networks was experimentally discovered by Szegedy et al in 2013, who called them "Intriguing properties of neural networks". Since then, this topic had become one of the hottest research areas within machine learning, but the ease with which we can switch between any two decisions in targeted attacks is still far from being understood, and in particular it is not clear which parameters determine the number of input coordinates we have to change in order to mislead the network. In this paper we develop a simple mathematical framework which enables us to think about this baffling phenomenon from a fresh perspective, turning it into a natural consequence of the geometry of ${\mathbb{R}}^n$ with the $L_0$ (Hamming) metric, which can be quantitatively analyzed. In particular, we explain why we should expect to find targeted adversarial examples with Hamming distance of roughly $m$ in arbitrarily deep neural networks which are designed to distinguish between $m$ input classes.

References in corpus (11)

• Explaining and Harnessing Adversarial Examples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Adversarial examples from computational constraints

Cited by in corpus (28)

• Adversarial Examples Are Not Bugs, They Are Features
• A General Framework for Adversarial Examples with Objectives
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• SNIFF: Reverse Engineering of Neural Networks with Fault Attacks
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Liberty or Depth: Deep Bayesian Neural Nets Do Not Need Complex Weight Posterior Approximations
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• There are No Bit Parts for Sign Bits in Black-Box Attacks
• Transferable Universal Adversarial Perturbations Using Generative Models
• Thief, Beware of What Get You There: Towards Understanding Model Extraction Attack
• Neural Networks and Polynomial Regression. Demystifying the Overparametrization Phenomena
• Investigating Decision Boundaries of Trained Neural Networks
• Shift Invariance Can Reduce Adversarial Robustness
• A Bayes-Optimal View on Adversarial Examples
• Most ReLU Networks Suffer from ${\ell }^2$ Adversarial Perturbations
• Towards Identifying and closing Gaps in Assurance of autonomous Road vehicleS -- a collection of Technical Notes Part 1
• ROBY: Evaluating the Robustness of a Deep Model by its Decision Boundaries
• Dompteur: Taming Audio Adversarial Examples
• Adversarial Examples in Multi-Layer Random ReLU Networks
• Towards a Theoretical Understanding of the Robustness of Variational Autoencoders
• Adversarial Robustness Guarantees for Random Deep Neural Networks
• Who's Afraid of Adversarial Transferability?
• A single gradient step finds adversarial examples on random two-layers neural networks
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• Towards Explaining Adversarial Examples Phenomenon in Artificial Neural Networks
• Verifying the Causes of Adversarial Examples
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• CodNN -- Robust Neural Networks From Coded Classification