In the context of deep neural networks, we expose the existence of a harmless
perturbation space, where perturbations leave the network output entirely
unaltered. Perturbations within this harmless perturbation space, regardless of
their magnitude when applied to images, exhibit no impact on the network's
outputs of the original images. Specifically, given any linear layer within the
network, where the input dimension $n$ exceeds the output dimension $m$, we
demonstrate the existence of a continuous harmless perturbation subspace with a
dimension of $(n-m)$. Inspired by this, we solve for a family of general
perturbations that consistently influence the network output, irrespective of
their magnitudes. With these theoretical findings, we explore the application
of harmless perturbations for privacy-preserving data usage. Our work reveals
the difference between DNNs and human perception that the significant
perturbations captured by humans may not affect the recognition of DNNs. As a
result, we utilize this gap to design a type of harmless perturbation that is
meaningless for humans while maintaining its recognizable features for DNNs.

在深度神经网络的背景下，我们揭示了一种无害扰动空间的存在，即使应用于图像的扰动的幅度不同，也不会对原始图像的网络输出产生任何影响。具体而言，在网络中的任何线性层中，其中输入维度 $n$ 大于输出维度 $m$ 时，我们证明了连续的无害扰动子空间的存在，其维度为 $(n-m)$。受此启发，我们求解了一系列一致影响网络输出的通用扰动，无论其幅度如何。借助这些理论发现，我们探索了在保护隐私的数据使用方面无害扰动的应用。我们的工作揭示了 DNNs 和人类感知之间的差异，人类所捕捉到的重要扰动可能不会影响 DNNs 的识别。因此，我们利用这一差距设计了一种对人类无意义，但对 DNNs 具有可识别特征的无害扰动类型。