[Paper Review] Adversarial examples from computational constraints

Sébastien Bubeck, Eric Price+1 more|arXiv (Cornell University)|May 25, 2018

Adversarial Robustness in Machine LearningComputer Science15 references98 citations

TL;DR

The paper argues that adversarial vulnerability may stem from computational limitations rather than purely information-theoretic barriers, providing an SQ-hardness separation between robust and non-robust learning while showing sample-efficient, information-theoretically robust learning in some cases.

ABSTRACT

Why are classifiers in high dimension vulnerable to "adversarial" perturbations? We show that it is likely not due to information theoretic limitations, but rather it could be due to computational constraints. First we prove that, for a broad set of classification tasks, the mere existence of a robust classifier implies that it can be found by a possibly exponential-time algorithm with relatively few training examples. Then we give a particular classification task where learning a robust classifier is computationally intractable. More precisely we construct a binary classification task in high dimensional space which is (i) information theoretically easy to learn robustly for large perturbations, (ii) efficiently learnable (non-robustly) by a simple linear separator, (iii) yet is not efficiently robustly learnable, even for small perturbations, by any algorithm in the statistical query (SQ) model. This example gives an exponential separation between classical learning and robust learning in the statistical query model. It suggests that adversarial examples may be an unavoidable byproduct of computational limitations of learning algorithms.

Motivation & Objective

• Motivate and formalize the robust learning problem under adversarial perturbations.
• Demonstrate that robust learning can be information-theoretically easy but computationally hard under SQ access.
• Provide a concrete task illustrating an exponential separation between robust and classical learning in the SQ model.
• Offer conditions under which robust learning is feasible with a polynomial amount of data and computation.

Proposed method

• Introduce the ε-robust zero-one loss and formalize robust learnability under a normed perturbation constraint.
• Construct a hard distributional task in high dimensions that is information-theoretically robustly learnable but SQ-hard for robust learning.
• Use the statistical query (SQ) model with an exponentially precise oracle to prove exponential SQ lower bounds for robust learning on the constructed task.
• Show that robust feasibility implies sample-efficient robust learning in settings with finite classifier families (robust empirical risk minimization).
• Relate covering numbers and generative model approximations to bound sample complexity for robust learning under continuous distribution families.

Experimental results

Research questions

• RQ1 Can robust classifiers exist for high-dimensional tasks, and if so, is robust learning necessarily computationally tractable?
• RQ2 Does there exist a task that is easy to learn robustly in theory but hard to learn robustly with SQ queries?
• RQ3 Under what conditions can robust learning be achieved with reasonable sample complexity, and how do generative models influence this?>
• RQ4 How does the hardness of robust learning relate to classical learning for distributions that are approximable by generative models?

Key findings

• There exist robustly feasible classification tasks that are information-theoretically learnable with polynomial resources but not efficiently robustly learnable in the SQ model.
• There is an exponential separation between classical learning and robust learning within the SQ framework for a constructed high-dimensional task.
• Robust learning can be achieved with polynomial samples when robust feasibility holds, via robust empirical risk minimization.
• A simple construction shows that the same task can be easy to learn non-robustly, yet require exponential SQ queries to learn a robust classifier for small perturbations.
• Distributions approximable by neural-network-based generative models can have bounded covering numbers, enabling polynomial-sample robust learning under certain conditions.