Derivation of Information-Theoretically Optimal Adversarial Attacks with Applications to Robust Machine Learning

Abstract

We consider the theoretical problem of designing an optimal adversarial attack on a decision system that maximally degrades the achievable performance of the system as measured by the mutual information between the degraded signal and the label of interest. This problem is motivated by the existence of adversarial examples for machine learning classifiers. By adopting an information theoretic perspective, we seek to identify conditions under which adversarial vulnerability is unavoidable i.e. even optimally designed classifiers will be vulnerable to small adversarial perturbations. We present derivations of the optimal adversarial attacks for discrete and continuous signals of interest, i.e., finding the optimal perturbation distributions to minimize the mutual information between the degraded signal and a signal following a continuous or discrete distribution. In addition, we show that it is much harder to achieve adversarial attacks for minimizing mutual information when multiple redundant copies of the input signal are available. This provides additional support to the recently proposed ``feature compression" hypothesis as an explanation for the adversarial vulnerability of deep learning classifiers. We also report on results from computational experiments to illustrate our theoretical results.

16 pages, 5 theorems, 6 figures

References in corpus (11)

• Explaining and Harnessing Adversarial Examples
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Adversarially Robust Generalization Requires More Data
• Are Labels Required for Improving Adversarial Robustness?
• Adversarial examples from computational constraints
• Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
• HopSkipJumpAttack: A Query-Efficient Decision-Based Attack
• Adversarial Examples in Modern Machine Learning: A Review
• Adversarial Examples from Cryptographic Pseudo-Random Generators
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Towards Query Efficient Black-box Attacks: An Input-free Perspective