Mathematical Analysis of Adversarial Attacks

Mathematical Analysis of Adversarial Attacks

In this paper, we analyze efficacy of the fast gradient sign method (FGSM)and the Carlini-Wagner's L2 (CW-L2) attack. We prove that, within a certainregime, the untargeted FGSM can fool any convolutional neural nets (CNNs) withReLU activation; the targeted FGSM can mislead any CNNs with ReLU activation toclassify any given image into any prescribed class.For a special two-layerneural network: a linear layer followed by the softmax output activation, weshow that the CW-L2 attack increases the ratio of the classificationprobability between the target and ground truth classes. Moreover, we providenumerical results to verify all our theoretical results.

对抗攻击的数学分析

在本文中，我们分析了快速梯度符号法（FGSM）和Carlini-Wagner的L2（CW-L2）攻击的功效。我们证明，在一定范围内，无目标的FGSM可以通过ReLU激活来欺骗任何卷积神经网络（CNN）。目标FGSM可能误导任何具有ReLU激活的CNN，从而将任何给定图像分类为任何规定的类别。.. 对于特殊的两层神经网络：线性层，后跟softmax输出激活，我们表明CW-L2攻击会增加目标和地面真理类之间的分类概率之比。此外，我们提供数值结果来验证我们所有的理论结果。 （阅读更多）