Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Adversarial attacks on neural networks through canonical Riemannian foliations

Eliot Tron, Nicolas Couellan, Stéphane Puechmorel

TL;DR

The results show that the proposed attack is more efficient at all levels of available budget for the attack (norm of the attack), confirming that the curvature of the transverse neural network FIM foliation plays an important role in the robustness of neural networks.

Abstract

Deep learning models are known to be vulnerable to adversarial attacks. Adversarial learning is therefore becoming a crucial task. We propose a new vision on neural network robustness using Riemannian geometry and foliation theory. The idea is illustrated by creating a new adversarial attack that takes into account the curvature of the data space. This new adversarial attack, called the two-step spectral attack is a piece-wise linear approximation of a geodesic in the data space. The data space is treated as a (degenerate) Riemannian manifold equipped with the pullback of the Fisher Information Metric (FIM) of the neural network. In most cases, this metric is only semi-definite and its kernel becomes a central object to study. A canonical foliation is derived from this kernel. The curvature of transverse leaves gives the appropriate correction to get a two-step approximation of the geodesic and hence a new efficient adversarial attack. The method is first illustrated on a 2D toy example in order to visualize the neural network foliation and the corresponding attacks. Next, we report numerical results on the MNIST and CIFAR10 datasets with the proposed technique and state of the art attacks presented in Zhao et al. (2019) (OSSA) and Croce et al. (2020) (AutoAttack). The result show that the proposed attack is more efficient at all levels of available budget for the attack (norm of the attack), confirming that the curvature of the transverse neural network FIM foliation plays an important role in the robustness of neural networks. The main objective and interest of this study is to provide a mathematical understanding of the geometrical issues at play in the data space when constructing efficient attacks on neural networks.

Adversarial attacks on neural networks through canonical Riemannian foliations

TL;DR

The results show that the proposed attack is more efficient at all levels of available budget for the attack (norm of the attack), confirming that the curvature of the transverse neural network FIM foliation plays an important role in the robustness of neural networks.

Abstract

Deep learning models are known to be vulnerable to adversarial attacks. Adversarial learning is therefore becoming a crucial task. We propose a new vision on neural network robustness using Riemannian geometry and foliation theory. The idea is illustrated by creating a new adversarial attack that takes into account the curvature of the data space. This new adversarial attack, called the two-step spectral attack is a piece-wise linear approximation of a geodesic in the data space. The data space is treated as a (degenerate) Riemannian manifold equipped with the pullback of the Fisher Information Metric (FIM) of the neural network. In most cases, this metric is only semi-definite and its kernel becomes a central object to study. A canonical foliation is derived from this kernel. The curvature of transverse leaves gives the appropriate correction to get a two-step approximation of the geodesic and hence a new efficient adversarial attack. The method is first illustrated on a 2D toy example in order to visualize the neural network foliation and the corresponding attacks. Next, we report numerical results on the MNIST and CIFAR10 datasets with the proposed technique and state of the art attacks presented in Zhao et al. (2019) (OSSA) and Croce et al. (2020) (AutoAttack). The result show that the proposed attack is more efficient at all levels of available budget for the attack (norm of the attack), confirming that the curvature of the transverse neural network FIM foliation plays an important role in the robustness of neural networks. The main objective and interest of this study is to provide a mathematical understanding of the geometrical issues at play in the data space when constructing efficient attacks on neural networks.
Paper Structure (22 sections, 24 theorems, 52 equations, 18 figures, 4 tables, 1 algorithm)

This paper contains 22 sections, 24 theorems, 52 equations, 18 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Problem statement
  3. Setup
  4. Adversarial attacks
  5. A local method
  6. A two-step attack
  7. The case λ>0
  8. The case λ=O
  9. An enlightening play-test example
  10. Setup
  11. Computing the output FIM
  12. Computing the pullback metric
  13. The metric kernel foliation
  14. Visualizing the curvature
  15. Numerical results
  16. ...and 7 more sections

Key Result

Proposition 2.1

The geodesic distance can be expressed with the Riemannian norm and the logarithm mapsee Definition def:log_map in app:intro_geo: Otherwise said, if $v=\log_{x_o} x_a$ is the initial velocity of the geodesic between the two points,

Figures (18)

  • Figure 1: The one-step spectral attack in action. The circle represents the Euclidean budget. The blue curve represents the leaf of the kernel foliation and the red curve represents the transverse foliation.
  • Figure 2: The two-step attack in action. The two circles represent the Euclidean budget. The blue curves represent the leaves of the kernel foliation and the red curves represent the transverse foliation.
  • Figure 3: The two-step attack in action with the triangular inequality simplification. The three circles represent the Euclidean budget. The blue curves represent the leaves of the kernel foliation.
  • Figure 4: XorNet $N_\theta$ with 3 hidden neurons.
  • Figure 5: Kernel foliation: the leaves are represented by the blue lines, the red dots are the $0$ result and the green dots are the $1$ results.
  • ...and 13 more figures

Theorems & Definitions (63)

  • Definition 1: Fisher Information Metric
  • Remark 1
  • Proposition 2.1
  • Definition 2: $\varepsilon$-Adversarial Attack Problem
  • Remark 2
  • Proposition 3.1
  • Remark 3
  • Remark 4
  • Proposition 4.1
  • proof
  • ...and 53 more