Most ReLU Networks Suffer from ${\ell }^2$ Adversarial Perturbations

Abstract

We consider ReLU networks with random weights, in which the dimension decreases at each layer. We show that for most such networks, most examples $x$ admit an adversarial perturbation at an Euclidean distance of $O\left(\frac{\Vert x\Vert }{\sqrt{d}}\right)$, where $d$ is the input dimension. Moreover, this perturbation can be found via gradient flow, as well as gradient descent with sufficiently small steps. This result can be seen as an explanation to the abundance of adversarial examples, and to the fact that they are found via gradient descent.

References in corpus (6)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Adversarially Robust Generalization Requires More Data
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance

Cited by in corpus (1)

• A single gradient step finds adversarial examples on random two-layers neural networks