Searching for the Essence of Adversarial Perturbations
Neural networks have achieved the state-of-the-art performance on various
machine learning fields, yet the incorporation of malicious perturbations with
input data (adversarial example) is able to fool neural networks' predictions.
This would lead to potential risks in real-world applications, for example,
auto piloting and facial recognition. However, the reason for the existence of
adversarial examples remains controversial. Here we demonstrate that
adversarial perturbations contain human-recognizable information, which is the
key conspirator responsible for a neural network's erroneous prediction. This
concept of human-recognizable information allows us to explain key features
related to adversarial perturbations, which include the existence of
adversarial examples, the transferability among different neural networks, and
the increased neural network interpretability for adversarial training. Two
unique properties in adversarial perturbations that fool neural networks are
uncovered: masking and generation. A special class, the complementary class, is
identified when neural networks classify input images. The human-recognizable
information contained in adversarial perturbations allows researchers to gain
insight on the working principles of neural networks and may lead to develop
techniques that detect/defense adversarial attacks.