中国物理B ›› 2021, Vol. 30 ›› Issue (4): 48702-.doi: 10.1088/1674-1056/abd68e

所属专题: SPECIAL TOPIC — Machine learning in statistical physics

• • 上一篇    下一篇

  

  • 收稿日期:2020-07-09 修回日期:2020-12-09 接受日期:2020-12-24 出版日期:2021-03-16 发布日期:2021-03-24

Relationship between manifold smoothness and adversarial vulnerability in deep learning with local errors

Zijian Jiang(蒋子健), Jianwen Zhou(周健文), and Haiping Huang(黄海平)   

  1. 1 PMI Laboratory, School of Physics, Sun Yat-sen University, Guangzhou 510275, China
  • Received:2020-07-09 Revised:2020-12-09 Accepted:2020-12-24 Online:2021-03-16 Published:2021-03-24
  • Contact: Corresponding author. E-mail: huanghp7@mail.sysu.edu.cn
  • Supported by:
    Project supported by the National Key R&D Program of China (Grant No. 2019YFA0706302), the start-up budget 74130-18831109 of the 100-talent-program of Sun Yat-sen University, and the National Natural Science Foundation of China (Grant No. 11805284).

Abstract: Artificial neural networks can achieve impressive performances, and even outperform humans in some specific tasks. Nevertheless, unlike biological brains, the artificial neural networks suffer from tiny perturbations in sensory input, under various kinds of adversarial attacks. It is therefore necessary to study the origin of the adversarial vulnerability. Here, we establish a fundamental relationship between geometry of hidden representations (manifold perspective) and the generalization capability of the deep networks. For this purpose, we choose a deep neural network trained by local errors, and then analyze emergent properties of the trained networks through the manifold dimensionality, manifold smoothness, and the generalization capability. To explore effects of adversarial examples, we consider independent Gaussian noise attacks and fast-gradient-sign-method (FGSM) attacks. Our study reveals that a high generalization accuracy requires a relatively fast power-law decay of the eigen-spectrum of hidden representations. Under Gaussian attacks, the relationship between generalization accuracy and power-law exponent is monotonic, while a non-monotonic behavior is observed for FGSM attacks. Our empirical study provides a route towards a final mechanistic interpretation of adversarial vulnerability under adversarial attacks.

Key words: neural networks, learning

中图分类号:  (Neural networks and synaptic communication)

  • 87.18.Sn
87.19.lv (Learning and memory)