Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The mathematics of adversarial attacks in AI -- Why deep learning is unstable despite the existence of stable neural networks

Alexander Bastounis, Anders C Hansen, Verner Vlačić

TL;DR

This work analyzes why deep learning classifiers exhibit universal instability under adversarial perturbations despite the provable existence of stable and accurate networks. It shows a fundamental methodological barrier: fixed-architecture training with ReLU networks cannot guarantee stability, and true stability requires input-dependent, variable-dimension architectures. It then proves a computability barrier: provable existence of such networks does not imply computability by algorithms, using the Solvability Complexity Index (SCI) framework and Δ1-information to formalize inexact computations. The results connect to generalized hardness of approximation and robust optimisation, offering a rigorous mathematical explanation for DL instability and guiding future directions toward computability-aware, adaptable architectures. Overall, the paper links instability, existence, and computability in a unified framework, highlighting the need for new paradigms beyond fixed-architecture DL for trustworthy AI.

Abstract

The unprecedented success of deep learning (DL) makes it unchallenged when it comes to classification problems. However, it is well established that the current DL methodology produces universally unstable neural networks (NNs). The instability problem has caused an enormous research effort -- with a vast literature on so-called adversarial attacks -- yet there has been no solution to the problem. Our paper addresses why there has been no solution to the problem, as we prove the following mathematical paradox: any training procedure based on training neural networks for classification problems with a fixed architecture will yield neural networks that are either inaccurate or unstable (if accurate) -- despite the provable existence of both accurate and stable neural networks for the same classification problems. The key is that the stable and accurate neural networks must have variable dimensions depending on the input, in particular, variable dimensions is a necessary condition for stability. Our result points towards the paradox that accurate and stable neural networks exist, however, modern algorithms do not compute them. This yields the question: if the existence of neural networks with desirable properties can be proven, can one also find algorithms that compute them? There are cases in mathematics where provable existence implies computability, but will this be the case for neural networks? The contrary is true, as we demonstrate how neural networks can provably exist as approximate minimisers to standard optimisation problems with standard cost functions, however, no randomised algorithm can compute them with probability better than 1/2.

The mathematics of adversarial attacks in AI -- Why deep learning is unstable despite the existence of stable neural networks

TL;DR

This work analyzes why deep learning classifiers exhibit universal instability under adversarial perturbations despite the provable existence of stable and accurate networks. It shows a fundamental methodological barrier: fixed-architecture training with ReLU networks cannot guarantee stability, and true stability requires input-dependent, variable-dimension architectures. It then proves a computability barrier: provable existence of such networks does not imply computability by algorithms, using the Solvability Complexity Index (SCI) framework and Δ1-information to formalize inexact computations. The results connect to generalized hardness of approximation and robust optimisation, offering a rigorous mathematical explanation for DL instability and guiding future directions toward computability-aware, adaptable architectures. Overall, the paper links instability, existence, and computability in a unified framework, highlighting the need for new paradigms beyond fixed-architecture DL for trustworthy AI.

Abstract

The unprecedented success of deep learning (DL) makes it unchallenged when it comes to classification problems. However, it is well established that the current DL methodology produces universally unstable neural networks (NNs). The instability problem has caused an enormous research effort -- with a vast literature on so-called adversarial attacks -- yet there has been no solution to the problem. Our paper addresses why there has been no solution to the problem, as we prove the following mathematical paradox: any training procedure based on training neural networks for classification problems with a fixed architecture will yield neural networks that are either inaccurate or unstable (if accurate) -- despite the provable existence of both accurate and stable neural networks for the same classification problems. The key is that the stable and accurate neural networks must have variable dimensions depending on the input, in particular, variable dimensions is a necessary condition for stability. Our result points towards the paradox that accurate and stable neural networks exist, however, modern algorithms do not compute them. This yields the question: if the existence of neural networks with desirable properties can be proven, can one also find algorithms that compute them? There are cases in mathematics where provable existence implies computability, but will this be the case for neural networks? The contrary is true, as we demonstrate how neural networks can provably exist as approximate minimisers to standard optimisation problems with standard cost functions, however, no randomised algorithm can compute them with probability better than 1/2.

Paper Structure

This paper contains 25 sections, 12 theorems, 81 equations, 1 figure.

Table of Contents

  1. Introduction
  2. Main theorems -- Methodological barriers, Smale's 18th problem and the limits of AI
  3. Phase transitions and generalised hardness of approximation (GHA)
  4. Main Results I -- Trained NNs become unstable despite the existence of stable and accurate NNs
  5. Interpreting Theorem \ref{['theorem:NNCV']}
  6. Main Results II -- NNs may provably exist, but no algorithm can compute them
  7. The weakness of the universal approximation theorem -- When will existence imply computability?
  8. Inexactness and floating point arithmetic
  9. Being able to prove existence may imply being able to compute -- but not in Deep Learning
  10. A missing theory in AI -- Which NNs can be computed?
  11. Connection to previous work
  12. Proofs of the main results
  13. Some well known definitions and ideas from deep learning
  14. Lemmas and definitions common to the proofs of both Theorem \ref{['theorem:NNCV']} and \ref{['theorem:NNNonComp']}
  15. Proof of Lemma \ref{['lem:NN-separation-lemma']}
  16. ...and 10 more sections

Key Result

Theorem 2.2

There is an uncountable collection $\mathcal{C}_1$ of classification functions $f$ as in eq:the_fs -- with fixed $d \geq 2$ -- and a constant $C>0$ such that the following holds. For every $f \in \mathcal{C}_1$, any norm $\|\cdot\|$ and every $\epsilon>0$, there is an uncountable family $\mathcal{C} any training data $\mathcal{T} = \{x^1, \hdots, x^r\}$ and validation data $\mathcal{V} = \{y^1, \h

Figures (1)

  • Figure 1: ( Training with fixed architecture yields instability -- Variable dimensions on NNs is necessary for stability for ReLu NNs). A visual interpretation of Theorem \ref{['theorem:NNCV']}. A fixed dimension training procedure can lead to excellent performance and yet be highly susceptible to adversarial attacks, even if there exists a NN which has both great performance and excellent stability properties. However, such a stable and accurate ReLu network must have variable dimensions depending on the input.

Theorems & Definitions (47)

  • Remark 2.1: Choice of cost functions
  • Theorem 2.2: Instability of trained NNs despite existence of a stable NN
  • Remark 2.3: The role of $g$ in (ii) in Theorem \ref{['theorem:NNCV']}
  • Theorem 3.1: Universal Approximation Theorem pinkus1999approximation
  • Example 3.2: When provable existence implies computability
  • Remark 3.3
  • Definition 3.4: The approximate argmin
  • Theorem 3.5: NNs may provably exist, but no algorithm can compute them
  • Remark 3.6: Theorem \ref{['theorem:NNNonComp']} is independent of the exact computational model
  • Remark 3.7: Irrelevance of local minima
  • ...and 37 more