Research map / Adversarial robustness and security / Certified and empirical robustness
Doppelgangers and Adversarial Vulnerability
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Theoretical framework defining adversarial Doppelgangers (perceptually indiscriminable inputs with different classifier labels) via context-relative perceptual topology, with results on regular classifiers, accuracy trade-offs, and fooling-rate bounds.
Problem
Adversarial examples are usually analyzed with metric (l_p) distances, but humans cannot discriminate many classifier-fooling pairs; the paper asks how to formally define and analyze such perceptually indiscriminable adversarial examples and how classifier accuracy and robustness relate.
Approach
Model perceptual indiscriminability as a context-relative, generally non-metric topology on the input space; define adversarial Doppelgangers as classifier-discordant indiscriminable inputs, and derive existence, trade-off, and hypersensitivity results from this topology rather than from norm-ball geometry.
Key results
- Shows adversarial Doppelgangers are close under a perceptual metric dw defined as d/(1+d) on the extended perceptual distance, which is not a manifold metric.
- Observation 3 and 4: classifiers with recall below 1/k-bar are totally unsafe, and classifiers with sufficiently high accuracy are hypersensitive, so every misclassification is an adversarial Doppelganger.
- Observation 5: if a classifier is conceptually ambiguous at every input, there exists an adversarial Doppelganger attack with fooling rate one.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| lower classifier recall below 1/¯k(Ω) | fully populated classifier · classification problems with non-negligible Doppelgänger sets | adversarial Doppelgänger vulnerability | Hurt |
| raise classifier recall above 1 − 1/¯k(Ω) | classifier · classification problems with non-negligible Doppelgänger sets | hypersensitive behavior | Helped |
| use a fully populated classifier when the number of labels exceeds the number of perceptual equivalence classes | classifier · classification problems with too few perceptual equivalence classes | adversarial Doppelgänger robustness | Hurt |
| improve accuracy of a hypersensitive classifier | hypersensitive classifier · classification problems with non-negligible Doppelgänger sets | adversarial Doppelgänger robustness | Helped |
| assign an NA label to unseen data when training data covers only part of an elementary set | classifier · unseen data within an elementary set | adversarial Doppelgänger robustness | Hurt |
Surprising findings
- Some classification problems admit no AD-robust classifier because the underlying classes are perceptually ambiguous, so robust training cannot remove adversarial Doppelgangers.
- Marking unseen data with an NA label can introduce conceptual ambiguity and compromise AD robustness.
Limitations
- Empirical validation is limited; the paper is primarily theoretical and the MobileNetV2 example is illustrative.
- The perceptual topology is assumed rather than measured from human data; biological plausibility of discriminative feature representations is an open question.
Experimental setup
Baselines: MobileNetV2
Builds on: Williamson context-relative discrimination Tversky feature contrast model tolerance spaces and rough sets Fast Signed Gradient attack
Closest papers by meaning
- Adversarial Examples Are Not Bugs, They Are Features (NeurIPS 2019 · similarity 0.88)
- Adversarial vulnerability for any classifier (NeurIPS 2018 · similarity 0.88)
- Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations (ICML 2020 · similarity 0.88)
- With Friends Like These, Who Needs Adversaries? (NeurIPS 2018 · similarity 0.88)
- Adversarial Examples that Fool both Computer Vision and Time-Limited Humans (NeurIPS 2018 · similarity 0.88)
- Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustness (NeurIPS 2023 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.