Adversarial Robustness with Partial Isometry.

Area of Science:

• Artificial Intelligence
• Machine Learning
• Deep Learning

Background:

• Deep learning models exhibit high performance but lack robustness guarantees, especially against adversarial examples.
• This vulnerability compromises trustworthiness and limits deployment in critical applications requiring certified robustness.

Purpose of the Study:

• To establish precise robustness criteria for l2 white-box attacks in multi-class classification using an information geometric framework.
• To ensure model robustness by deriving criteria on the input-output Jacobian.

Main Methods:

• Endowed the output space with the Fisher information metric.
• Derived criteria on the input-output Jacobian for robustness.
• Constrained models to be partially isometric around training points.

Main Results:

• Demonstrated that partial isometry ensures model robustness.
• Evaluated the approach on MNIST and CIFAR-10 datasets against adversarial attacks.
• Achieved substantial improvements over defensive distillation and Jacobian regularization for medium perturbations.

Conclusions:

• The proposed information geometric framework provides certified robustness for deep learning models.
• The method offers superior robustness to adversarial training for large perturbations while preserving accuracy.
• This approach enhances the trustworthiness and deployability of deep learning in critical domains.