Unique properties of adversarially trained linear classifiers on Gaussian data

Abstract

Machine learning models are vulnerable to adversarial perturbations, that when added to an input, can cause high confidence misclassifications. The adversarial learning research community has made remarkable progress in the understanding of the root causes of adversarial perturbations. However, most problems that one may consider important to solve for the deployment of machine learning in safety critical tasks involve high dimensional complex manifolds that are difficult to characterize and study. It is common to develop adversarially robust learning theory on simple problems, in the hope that insights will transfer to `real world datasets'. In this work, we discuss a setting where this approach fails. In particular, we show with a linear classifier, it is always possible to solve a binary classification problem on Gaussian data under arbitrary levels of adversarial corruption during training, and that this property is not observed with non-linear classifiers on the CIFAR-10 dataset.

References in corpus (17)

• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Theoretically Principled Trade-off between Robustness and Accuracy
• Adversarially Robust Generalization Requires More Data
• Robustness May Be at Odds with Accuracy
• Adversarial Training Can Hurt Generalization
• Adversarial examples from computational constraints
• Rademacher Complexity for Adversarially Robust Generalization
• Adversarial Robustness May Be at Odds With Simplicity
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Lower Bounds on Adversarial Robustness from Optimal Transport
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Adversarial Risk Bounds via Function Transformation
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• On the Hardness of Robust Classification
• Lower Bounds for Adversarially Robust PAC Learning
• Optimal Transport Classifier: Defending Against Adversarial Attacks by Regularized Deep Embedding