[Paper Review] The Adversarial Attack and Detection under the Fisher Information Metric

Chenxiao Zhao, P. Thomas Fletcher+4 more|arXiv (Cornell University)|Oct 9, 2018

Adversarial Robustness in Machine Learning27 references5 citations

TL;DR

This paper proposes a unified framework for adversarial attack and detection using the Fisher information metric (FIM) in information geometry. It introduces the one-step spectral attack (OSSA), where adversarial perturbations are derived from the top eigenvector of the FIM, and uses the corresponding eigenvalues as features for a robust detection model. The method achieves state-of-the-art detection performance, with AUC scores up to 7.16% higher than baseline methods on adversarial examples generated by its own attack.

ABSTRACT

Many deep learning models are vulnerable to the adversarial attack, i.e., imperceptible but intentionally-designed perturbations to the input can cause incorrect output of the networks. In this paper, using information geometry, we provide a reasonable explanation for the vulnerability of deep learning models. By considering the data space as a non-linear space with the Fisher information metric induced from a neural network, we first propose an adversarial attack algorithm termed one-step spectral attack (OSSA). The method is described by a constrained quadratic form of the Fisher information matrix, where the optimal adversarial perturbation is given by the first eigenvector, and the model vulnerability is reflected by the eigenvalues. The larger an eigenvalue is, the more vulnerable the model is to be attacked by the corresponding eigenvector. Taking advantage of the property, we also propose an adversarial detection method with the eigenvalues serving as characteristics. Both our attack and detection algorithms are numerically optimized to work efficiently on large datasets. Our evaluations show superior performance compared with other methods, implying that the Fisher information is a promising approach to investigate the adversarial attacks and defenses.

Motivation & Objective

• To understand the intrinsic geometric vulnerability of deep neural networks to adversarial attacks using information geometry.
• To develop a new adversarial attack method that leverages the Fisher information matrix (FIM) to identify optimal perturbations.
• To exploit the eigenvalues of the FIM as intrinsic features for detecting adversarial examples.
• To design an efficient, numerically optimized algorithm that scales to large datasets.
• To demonstrate generalization capability of the detection method across diverse attack types.

Proposed method

• Formulates the adversarial attack as a constrained quadratic optimization problem over the Fisher information matrix (FIM), where the optimal perturbation corresponds to the first eigenvector of the FIM.
• Uses the eigenvalues of the FIM as a measure of local model vulnerability, with larger eigenvalues indicating higher susceptibility to adversarial perturbations.
• Applies numerical optimization techniques to efficiently compute the FIM and its eigenvectors on large-scale datasets like CIFAR-10 and MNIST.
• Employs binary search to identify the minimal perturbation size that fools the network, validating the eigenvalue-based vulnerability characterization.
• Trains a random forest or naive Bayes classifier on the top 20 eigenvalues to detect adversarial inputs.
• Ensures invariance to reparameterization by using the FIM, which is Fisher information metric-invariant under sufficient statistics.

Experimental results

Research questions

• RQ1 How can the Fisher information metric be used to characterize the intrinsic vulnerability of deep neural networks to adversarial attacks?
• RQ2 Can the eigenvectors and eigenvalues of the FIM be used to generate more effective and geometry-aware adversarial examples?
• RQ3 Do the eigenvalues of the FIM serve as reliable and generalizable features for detecting adversarial inputs across diverse attack types?
• RQ4 How does the proposed detection method compare in performance and robustness to existing methods like kernel density estimation and Bayesian uncertainty?
• RQ5 To what extent does the geometric optimality of the proposed attack (OSSA) affect the generalization capability of the detection model?

Key findings

• The one-step spectral attack (OSSA) generates adversarial examples by selecting the first eigenvector of the FIM, which corresponds to the direction of maximum curvature in the input-output mapping under the Fisher metric.
• The eigenvalues of the FIM are strongly correlated with adversarial vulnerability: larger eigenvalues indicate higher susceptibility to perturbations in the corresponding eigenvector direction.
• The proposed detection method using top 20 eigenvalues as features achieves AUC scores of 98.55% and 98.96% when trained on OTCM and FGM attacks, respectively, outperforming KD and BU baselines.
• The detector achieves 7.16% and 4.47% higher AUC scores than the combination of KD and BU on OSSA-generated adversarial examples, demonstrating superior detection capability.
• The detector generalizes well across diverse attack types, with AUC scores exceeding 90% even when trained on only one attack type, except for OSSA-trained detectors, which show slightly lower generalization due to the method’s geometric optimality.
• The random forest classifier with up to 20 trees and depth ≤5 yields stable performance, indicating low variance and robustness of the eigenvalue-based features.