The robustness of a classifier to arbitrary small perturbations of the datapoints is a highly desirable property when the classifier is deployed in real and possibly hostile environments. In this paper, we propose a theoretical framework for analyzing the robustness of classifiers to adversarial perturbations, and study two common families of classifiers. In both cases, we show the existence of a fundamental limit on the robustness to adversarial perturbations, which is expressed in terms of a distinguishability measure between the classes. Our result implies that in tasks involving small distinguishability, no classifier will be robust to adversarial perturbations, even if a good accuracy is achieved. Furthermore, we show that robustness to random noise does not imply, in general, robustness to adversarial perturbations. In fact, in high dimensional problems, linear classifiers are shown to be much more robust to random noise than to adversarial perturbations. Our analysis is complemented by experimental results on controlled and real-world data. Up to our knowledge, this is the first theoretical work that addresses the surprising phenomenon of adversarial instability recently observed for deep networks (Szegedy et al., 2014). Our work shows that this phenomenon is not limited to deep networks, and gives a theoretical explanation of the causes underlying the adversarial instability of classifiers.

本论文分析了深层网络的一个有趣现象，即它们对于对抗性扰动的不稳定性，并提出了一个分析分类器鲁棒性的理论框架，并且为对抗性扰动的鲁棒性建立了一个上限。具体而言，我们建立了分类器对于对抗性扰动的鲁棒性的一个通用上限并用一些线性和二次分类器的例子说明了所获得的上限。我们的结果表明，在涉及小区分能力的任务中，所有选定的分类器将不会对于对抗性扰动产生鲁棒性，即使达到了较高的准确率。

分类器对于对抗扰动的鲁棒性分析