The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure

Many modern machine learning classifiers are shown to be vulnerable to adversarial perturbations of the instances. Despite a massive amount of work focusing on making classifiers robust, the task seems quite challenging. In this work, through a theoretical study, we investigate the adversarial risk and robustness of classifiers and draw a connection to the well-known phenomenon of concentration of measure in metric measure spaces. We show that if the metric probability space of the test instance is concentrated, any classifier with some initial constant error is inherently vulnerable to adversarial perturbations. One class of concentrated metric probability spaces are the so-called Levy families that include many natural distributions. In this special case, our attacks only need to perturb the test instance by at most $O(\sqrt n)$ to make it misclassified, where $n$ is the data dimension. Using our general result about Levy instance spaces, we first recover as special case some of the previously proved results about the existence of adversarial examples. However, many more Levy families are known (e.g., product distribution under the Hamming distance) for which we immediately obtain new attacks that find adversarial examples of distance $O(\sqrt n)$. Finally, we show that concentration of measure for product spaces implies the existence of forms of "poisoning" attacks in which the adversary tampers with the training data with the goal of degrading the classifier. In particular, we show that for any learning algorithm that uses $m$ training examples, there is an adversary who can increase the probability of any "bad property" (e.g., failing on a particular test instance) that initially happens with non-negligible probability to $\approx 1$ by substituting only $\tilde{O}(\sqrt m)$ of the examples with other (still correctly labeled) examples

Improved Delay Estimates for a Queueing Model for Random Linear Coding for Unicast

Consider a lossy communication channel for unicast with zero-delay feedback. For this communication scenario, a simple retransmission scheme is optimum with respect to delay. An alternative approach is to use random linear coding in automatic repeat-request (ARQ) mode. We extend the work of Shrader and Ephremides, by deriving an expression for the delay of random linear coding over field of infinite size. Simulation results for various field sizes are also provided.Comment: 5 pages, 3 figures, accepted at the 2009 IEEE International Symposium on Information Theor

Pressure forces on sediment particles in turbulent open-channel flow : a laboratory study

Acknowledgements This research was sponsored by EPSRC grant EP/G056404/1 and their financial support is greatly appreciated. We also acknowledge Dr S. Cameron, who developed the PIV system and its algorithms. The design and construction of pressure sensors was carried out at the workshop and the experiments were conducted in the fluids laboratory at the University of Aberdeen. We therefore express our gratitude to the workshop and laboratory technicians and also to Mr M. Witz and Mr S. Gretland for their assistance in carrying out these experiments. The authors would also like to thank Professor J. Frohlich, Professor M. Uhlmann, Dr C.-B. Clemens and Mr B. Vowinckel for their useful suggestions and discussions throughout the course of this project. The Associate Editor Professor I. Marusic and four anonymous reviewers provided many useful and insightful comments and suggestions that have been gratefully incorporated into the final version.Peer reviewedPublisher PD

A Multiscale Pyramid Transform for Graph Signals

Multiscale transforms designed to process analog and discrete-time signals and images cannot be directly applied to analyze high-dimensional data residing on the vertices of a weighted graph, as they do not capture the intrinsic geometric structure of the underlying graph data domain. In this paper, we adapt the Laplacian pyramid transform for signals on Euclidean domains so that it can be used to analyze high-dimensional data residing on the vertices of a weighted graph. Our approach is to study existing methods and develop new methods for the four fundamental operations of graph downsampling, graph reduction, and filtering and interpolation of signals on graphs. Equipped with appropriate notions of these operations, we leverage the basic multiscale constructs and intuitions from classical signal processing to generate a transform that yields both a multiresolution of graphs and an associated multiresolution of a graph signal on the underlying sequence of graphs.Comment: 16 pages, 13 figure