A Manifold View of Adversarial Risk
A Manifold View of Adversarial Risk
复制标题
DOI：
10.48550/arxiv.2203.13277
复制
发表时间：
2022-03
期刊：
影响因子：
--
通讯作者：
Wen-jun Zhang;Yikai Zhang;Xiaoling Hu;Mayank Goswami;Chao Chen;Dimitris N. Metaxas
中科院分区：
文献类型：
--
作者：
Wen-jun Zhang;Yikai Zhang;Xiaoling Hu;Mayank Goswami;Chao Chen;Dimitris N. Metaxas
机器学习模型的对抗风险已经得到了广泛的研究。以前的大部分工作都假设数据位于整个环境空间中。我们建议采取一个新的角度，考虑到多方面的假设。假设数据存在于流形中，我们研究了两种新的对抗风险，即由于在法向摄动引起的正常对抗风险和由于流形内摄动引起的流形内对抗风险。我们用正态和流形对抗风险证明了经典对抗风险可以从两边有界。我们还用一个令人惊讶的悲观案例表明，即使正常风险和流形风险都为零，标准对抗风险也可能是非零的。最后，我们用实证研究来支持我们的理论结果。我们的结果表明，通过只关注正常的对抗性风险来提高分类器的鲁棒性的可能性。
The adversarial risk of a machine learning model has been widely studied. Most previous works assume that the data lies in the whole ambient space. We propose to take a new angle and take the manifold assumption into consideration. Assuming data lies in a manifold, we investigate two new types of adversarial risk, the normal adversarial risk due to perturbation along normal direction, and the in-manifold adversarial risk due to perturbation within the manifold. We prove that the classic adversarial risk can be bounded from both sides using the normal and in-manifold adversarial risks. We also show with a surprisingly pessimistic case that the standard adversarial risk can be nonzero even when both normal and in-manifold risks are zero. We finalize the paper with empirical studies supporting our theoretical results. Our results suggest the possibility of improving the robustness of a classifier by only focusing on the normal adversarial risk.