Adversarial Examples Are a Natural Consequence of Test Error in Noise

Justin Gilmer, Nicolas Ford, Nicholas Carlini, Ekin Cubuk
Proceedings of the 36th International Conference on Machine Learning, PMLR 97:2280-2289, 2019.

Abstract

Over the last few years, the phenomenon of adversarial examples — maliciously constructed inputs that fool trained machine learning models — has captured the attention of the research community, especially when restricted to small modifications of a correctly handled input. Less surprisingly, image classifiers also lack human-level performance on randomly corrupted images, such as images with additive Gaussian noise. In this paper we provide both empirical and theoretical evidence that these are two manifestations of the same underlying phenomenon, and therefore the adversarial robustness and corruption robustness research programs are closely related. This suggests that improving adversarial robustness should go hand in hand with improving performance in the presence of more general and realistic image corruptions. This yields a computationally tractable evaluation metric for defenses to consider: test error in noisy image distributions.

Cite this Paper

BibTeX
@InProceedings{pmlr-v97-gilmer19a, title = {Adversarial Examples Are a Natural Consequence of Test Error in Noise}, author = {Gilmer, Justin and Ford, Nicolas and Carlini, Nicholas and Cubuk, Ekin}, booktitle = {Proceedings of the 36th International Conference on Machine Learning}, pages = {2280--2289}, year = {2019}, editor = {Chaudhuri, Kamalika and Salakhutdinov, Ruslan}, volume = {97}, series = {Proceedings of Machine Learning Research}, month = {09--15 Jun}, publisher = {PMLR}, pdf = {http://proceedings.mlr.press/v97/gilmer19a/gilmer19a.pdf}, url = {https://proceedings.mlr.press/v97/gilmer19a.html}, abstract = {Over the last few years, the phenomenon of adversarial examples — maliciously constructed inputs that fool trained machine learning models — has captured the attention of the research community, especially when restricted to small modifications of a correctly handled input. Less surprisingly, image classifiers also lack human-level performance on randomly corrupted images, such as images with additive Gaussian noise. In this paper we provide both empirical and theoretical evidence that these are two manifestations of the same underlying phenomenon, and therefore the adversarial robustness and corruption robustness research programs are closely related. This suggests that improving adversarial robustness should go hand in hand with improving performance in the presence of more general and realistic image corruptions. This yields a computationally tractable evaluation metric for defenses to consider: test error in noisy image distributions.} }
Endnote
%0 Conference Paper %T Adversarial Examples Are a Natural Consequence of Test Error in Noise %A Justin Gilmer %A Nicolas Ford %A Nicholas Carlini %A Ekin Cubuk %B Proceedings of the 36th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2019 %E Kamalika Chaudhuri %E Ruslan Salakhutdinov %F pmlr-v97-gilmer19a %I PMLR %P 2280--2289 %U https://proceedings.mlr.press/v97/gilmer19a.html %V 97 %X Over the last few years, the phenomenon of adversarial examples — maliciously constructed inputs that fool trained machine learning models — has captured the attention of the research community, especially when restricted to small modifications of a correctly handled input. Less surprisingly, image classifiers also lack human-level performance on randomly corrupted images, such as images with additive Gaussian noise. In this paper we provide both empirical and theoretical evidence that these are two manifestations of the same underlying phenomenon, and therefore the adversarial robustness and corruption robustness research programs are closely related. This suggests that improving adversarial robustness should go hand in hand with improving performance in the presence of more general and realistic image corruptions. This yields a computationally tractable evaluation metric for defenses to consider: test error in noisy image distributions.
APA
Gilmer, J., Ford, N., Carlini, N. & Cubuk, E.. (2019). Adversarial Examples Are a Natural Consequence of Test Error in Noise. Proceedings of the 36th International Conference on Machine Learning, in Proceedings of Machine Learning Research 97:2280-2289 Available from https://proceedings.mlr.press/v97/gilmer19a.html.

Related Material