Signal Processing - November 2017 - 57

estimated label (i.e., f (x) is constant for each such region). The
decision boundary B of the classifier is defined as the union
of the boundaries of such classification regions (see Figure 2).

Geometric Properties
of Adversarial Perturbations
Observation
)
Let x ! X and r adv
(x) be the adversarial perturbation,
defined as the minimizer of (4), with p = 2 and R = X.
Then, we have the following:
)
1)	 r adv
(x) 2 measures the Euclidean distance from x to
the closest point on the decision boundary B.
)
(x) is orthogonal to the decision
2)	The vector r adv
)
boundary of the classifier, at x + r adv
(x ).

Adversarial perturbations
We first focus on additive adversarial perturbations and
highlight their relation with the geometry of the decision
boundary. This link relies on the simple observation shown
in "Geometric Properties of Adversarial Perturbations." The
two geometric properties are illustrated in Figure 6. Note
that these geometric properties are specific to the , 2 norm.
The high instability of classifiers to adversarial perturbations, which we highlighted in the previous section, shows
that natural images lie very closely to the classifier's decision
boundary. While this result is key to understanding the geometry of the data points with regard to the classifier's decision
boundary, it does not provide any insights on the shape of
the decision boundary. A local geometric description of the
decision boundary (in the vicinity of x) is rather captured by
* (x), due to the orthogonality property of
the direction of r adv
adversarial perturbations (highlighted in "Geometric Properties of Adversarial Perturbations"). In [18] and [25], these geometric properties of adversarial perturbations are leveraged
to visualize typical cross sections of the decision boundary at
the vicinity of the data points. Specifically, a two-dimensional
normal section of the decision boundary is illustrated, where
the sectioning plane is spanned by the -adversarial perturbation (normal to the decision boundary) and a random vector
in the tangent space. Examples of normal sections of decision
boundaries are illustrated in Figure 7.
Observe that the decision boundaries of state-of-the-art
deep neural networks have a very low curvature on these
two-dimensional cross sections (note the difference between
the x and y axis). In other words, these plots suggest that the
decision boundary at the vicinity of x can be locally well

10

0.25

7.5

0

5

0.25

2.5

-0.5
0.75

(b)

7.5

5

2.5

0

x
-2.5

-1

-5

200

150

100

50

0

-50

x
-100

-2.5

x

)
FIGURE 6. r adv
denotes the adversarial perturbation of x (with p = 2).
)
)
Note that r adv
is orthogonal to the decision boundary B and r adv
2 =
dist (x, B).

0.5

-150

150

125

75

100

50

0

(a)

∗
radv

12.5

0
25

-25

-50

x

-75

-100

2.5
2
1.5
1
0.5
0
-0.5
-1
-1.5
-2
-2.5

B

(c)

FIGURE 7. The two-dimensional normal cross sections of the decision boundaries for three different classifiers near randomly chosen samples. The section is
spanned by the adversarial perturbation of the data point x (vertical axis) and a random vector in the tangent space to the decision boundary (horizontal axis). The
green region is the classification region of x. The decision boundaries with different classes are illustrated in different colors. Note the difference in range between
the x and y axes. (a) VGG-F (ImageNet), (b) LeNet (CIFAR), (c) LeNet (MNIST). (Figure used with permission from [18].)
IEEE SIGNAL PROCESSING MAGAZINE

|

November 2017

|

57
Table of Contents for the Digital Edition of Signal Processing - November 2017
