On the Minimal Adversarial Perturbation for Deep Neural Networks With Provable Estimation Error

Area of Science:

• Artificial Intelligence
• Machine Learning
• Computer Vision

Background:

• Deep Neural Networks (DNNs) excel in perception and control but face trustworthiness issues.
• Adversarial perturbations pose a significant threat, necessitating robust quantification techniques.
• Euclidean distance to the classification boundary is a key metric for input robustness, but hard to compute for DNNs.

Purpose of the Study:

• To propose lightweight strategies for estimating the minimal adversarial perturbation in DNNs.
• To develop a theory for error estimation of approximate distances compared to theoretical ones.
• To provide provable robustness guarantees against adversarial attacks.

Main Methods:

• Developed two novel, lightweight algorithms to approximate the minimal adversarial perturbation.
• Formulated an error estimation theory to bound the approximation error.
• Conducted extensive experiments to validate the algorithms and theoretical findings.

Main Results:

• The proposed strategies effectively approximate the theoretical distance for inputs near the classification boundary.
• The methods provide provable robustness guarantees against adversarial perturbations.
• Experimental results support the theoretical findings on error estimation and approximation.

Conclusions:

• The novel strategies offer a practical solution for assessing DNN robustness.
• This work advances the field of provable defenses against adversarial attacks.
• The findings contribute to building more trustworthy and secure AI systems.