An Information Geometric Perspective to Adversarial Attacks and Defenses

Kyle Naddeo, Nidhal Bouaynaya, Roman Shterenberg

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Deep learning models have achieved state-of-the-art accuracy in complex tasks, sometimes outperforming human-level accuracy. Yet, they suffer from vulnerabilities known as adversarial attacks, which are imperceptible input perturbations that fool the models on inputs that were originally classified correctly. The adversarial problem remains poorly understood and commonly thought to be an inherent weakness of deep learning models. We argue that understanding and alleviating the adversarial phenomenon may require us to go beyond the Euclidean view and consider the relationship between the input and output spaces as a statistical manifold with the Fisher Information as its Riemannian metric. Under this information geometric view, the optimal attack is constructed as the direction corresponding to the highest eigenvalue of the Fisher Information Matrix - called the Fisher spectral attack. We show that an orthogonal transformation of the data cleverly alters its manifold by keeping the highest eigenvalue but changing the optimal direction of attack; thus deceiving the attacker into adopting the wrong direction. We demonstrate the defensive capabilities of the proposed orthogonal scheme - against the Fisher spectral attack and the popular fast gradient sign method - on standard networks, e.g., LeNet and MobileNetV2 for benchmark data sets, MNIST and CIFAR-10.

    Original languageEnglish (US)
    Title of host publication2022 International Joint Conference on Neural Networks, IJCNN 2022 - Proceedings
    PublisherInstitute of Electrical and Electronics Engineers Inc.
    ISBN (Electronic)9781728186719
    DOIs
    StatePublished - 2022
    Event2022 International Joint Conference on Neural Networks, IJCNN 2022 - Padua, Italy
    Duration: Jul 18 2022Jul 23 2022

    Publication series

    NameProceedings of the International Joint Conference on Neural Networks
    Volume2022-July

    Conference

    Conference2022 International Joint Conference on Neural Networks, IJCNN 2022
    Country/TerritoryItaly
    CityPadua
    Period7/18/227/23/22

    All Science Journal Classification (ASJC) codes

    • Software
    • Artificial Intelligence

    Fingerprint

    Dive into the research topics of 'An Information Geometric Perspective to Adversarial Attacks and Defenses'. Together they form a unique fingerprint.

    Cite this