Signal Processing - November 2017 - 52

f (x2) = 2

x2

B

change the label at x, other works have instead adopted slightly
different definitions, where a "sufficiently small'' perturbation
is sought (instead of the minimal one) [7]-[9]. To measure the
global robustness of a classifier f, one can compute the expectation of r ) (x) R over the data distribution [1], [10]. That is, the
global robustness t ( f ) is defined as follows:
t ( f ) = E ^ r ) (x)

	

Tr ∗ (x1)
x1

f (x1) = 1

T

FIGURE 2. Here, B denotes the decision boundary of the classifier
between classes 1 and 2, and T denotes the set of perturbed versions
of x 1 (i.e., T = {Tr (x 1): r ! R} ), where we recall that R denotes the set
of admissible perturbations. The pointwise robustness at x 1 is defined as
the smallest perturbation in R that causes x 1 to change class.

x~n

Rh .

(3)

It is important to note that in our robustness setting, the perturbed
point Tr (x) need not belong to the support of the data distribution.
Hence, while the focus of the risk in (1) is the accuracy on typical
images (sampled from n), the focus of the robustness computed
from (2) is instead on the distance to the "closest" image (potentially outside the support of n) that changes the label of the classifier. The risk and robustness hence capture two fundamentally
different properties of the classifier, as illustrated in "Robustness
and Risk: A Toy Example."

Robustness and Risk: A Toy Example
To illustrate the general concepts of robustness and risk of
classifiers, we consider the simple binary classification task
illustrated in Figure S1, where the goal is to discriminate
between images representing vertical and horizontal stripes.
In addition to the orientation of the stripe that separates the
two classes, a very small positive bias is added to pixels of
first-class images and subtracted from the pixels of the images in the second class. This bias is chosen to be very small, in
such a way that it is imperceptible to humans.; see Figure S2
for example images of class 1 and 2 with the pixel values,
where a denotes the bias.

It is easy to see that a linear classifier can perfectly separate the two classes, thus achieving zero risk (i.e., R (f ) = 0).
Note, however, that such a classifier only achieves zero risk
because it captures the bias but fails to distinguish between
the images based on the orientation of the stripe. Hence,
despite being zero risk, this classifier is highly unstable to
additive perturbation, as it suffices to perturb the bias of the
image (i.e., by adding a very small value to all pixels) to
cause misclassification. On the other hand, a more complex
classifier that captures the orientation of the stripe will be
robust to small perturbations (while equally achieving zero
risk), as changing the label would require changing the
direction of the stripe, which is the most visual (and natural)
concept that separates the two classes.

1-a
(a)
a

1+a

-a
(a)

(b)

(b)

FIGURE S2. (a) An example image of class 1. White pixels have value
FIGURE S1. (a) The images belonging to class 1 (vertical stripe and
positive bias) and (b) the images belonging to class 2 (horizontal
stripe and negative bias).

52

1 + a, and black pixels have value a. (b) An example image of class -1.
White pixels have value 1 - a, and black pixels have value - a . The
bias a is set to be very small, in such a way that it is imperceptible.

IEEE SIGNAL PROCESSING MAGAZINE

|

November 2017

|
Table of Contents for the Digital Edition of Signal Processing - November 2017
