论文标题
对抗风险的多种观点
A Manifold View of Adversarial Risk
论文作者
论文摘要
已经广泛研究了机器学习模型的对抗风险。大多数以前的作品都假定数据在整个环境空间中。我们建议采取一个新的角度，并考虑多种假设。假设数据在于一个多方面，我们研究了两种新型的对抗风险，正常的对抗风险，沿正常方向扰动引起的正常对抗性风险以及由于歧管内部扰动而引起的on-manifold对手风险。我们证明，经典的对抗风险可以使用正常和术中对抗性风险从双方界定。我们还表明，令人惊讶的悲观案例表明，即使正常和势内风险均为零，标准对抗风险也可能是非零的。我们通过支持我们的理论结果的经验研究最终确定了论文。我们的结果表明，仅关注正常的对抗风险，可以提高分类器的鲁棒性。
The adversarial risk of a machine learning model has been widely studied. Most previous works assume that the data lies in the whole ambient space. We propose to take a new angle and take the manifold assumption into consideration. Assuming data lies in a manifold, we investigate two new types of adversarial risk, the normal adversarial risk due to perturbation along normal direction, and the in-manifold adversarial risk due to perturbation within the manifold. We prove that the classic adversarial risk can be bounded from both sides using the normal and in-manifold adversarial risks. We also show with a surprisingly pessimistic case that the standard adversarial risk can be nonzero even when both normal and in-manifold risks are zero. We finalize the paper with empirical studies supporting our theoretical results. Our results suggest the possibility of improving the robustness of a classifier by only focusing on the normal adversarial risk.
