Analysis of classifiers' robustness to adversarial perturbations

The goal of this paper is to analyze an intriguing phenomenon recently discovered in deep networks, namely their instability to adversarial perturbations (Szegedy et. al., 2014). We provide a theoretical framework for analyzing the robustness of classifiers to adversarial perturbations, and show fundamental upper bounds on the robustness of classifiers. Specifically, we establish a general upper bound on the robustness of classifiers to adversarial perturbations, and then illustrate the obtained upper bound on the families of linear and quadratic classifiers. In both cases, our upper bound depends on a distinguishability measure that captures the notion of difficulty of the classification task. Our results for both classes imply that in tasks involving small distinguishability, no classifier in the considered set will be robust to adversarial perturbations, even if a good accuracy is achieved. Our theoretical framework moreover suggests that the phenomenon of adversarial instability is due to the low flexibility of classifiers, compared to the difficulty of the classification task (captured by the distinguishability). Moreover, we show the existence of a clear distinction between the robustness of a classifier to random noise and its robustness to adversarial perturbations. Specifically, the former is shown to be larger than the latter by a factor that is proportional to \sqrt{d} (with d being the signal dimension) for linear classifiers. This result gives a theoretical explanation for the discrepancy between the two robustness properties in high dimensional problems, which was empirically observed in the context of neural networks. To the best of our knowledge, our results provide the first theoretical work that addresses the phenomenon of adversarial instability recently observed for deep networks. Our analysis is complemented by experimental results on controlled and real-world data

On polyhedral approximations of the positive semidefinite cone

Let $D$ be the set of $n\times n$ positive semidefinite matrices of trace equal to one, also known as the set of density matrices. We prove two results on the hardness of approximating $D$ with polytopes. First, we show that if $0 < \epsilon < 1$ and $A$ is an arbitrary matrix of trace equal to one, any polytope $P$ such that $(1-\epsilon)(D-A) \subset P \subset D-A$ must have linear programming extension complexity at least $\exp(c\sqrt{n})$ where $c > 0$ is a constant that depends on $\epsilon$. Second, we show that any polytope $P$ such that $D \subset P$ and such that the Gaussian width of $P$ is at most twice the Gaussian width of $D$ must have extension complexity at least $\exp(cn^{1/3})$. The main ingredient of our proofs is hypercontractivity of the noise operator on the hypercube.Comment: 12 page

Algorithmic Aspects of Optimal Channel Coding

A central question in information theory is to determine the maximum success probability that can be achieved in sending a fixed number of messages over a noisy channel. This was first studied in the pioneering work of Shannon who established a simple expression characterizing this quantity in the limit of multiple independent uses of the channel. Here we consider the general setting with only one use of the channel. We observe that the maximum success probability can be expressed as the maximum value of a submodular function. Using this connection, we establish the following results: 1. There is a simple greedy polynomial-time algorithm that computes a code achieving a (1-1/e)-approximation of the maximum success probability. Moreover, for this problem it is NP-hard to obtain an approximation ratio strictly better than (1-1/e). 2. Shared quantum entanglement between the sender and the receiver can increase the success probability by a factor of at most 1/(1-1/e). In addition, this factor is tight if one allows an arbitrary non-signaling box between the sender and the receiver. 3. We give tight bounds on the one-shot performance of the meta-converse of Polyanskiy-Poor-Verdu.Comment: v2: 16 pages. Added alternate proof of main result with random codin

How Highly Pathogenic Avian Influenza (H5N1) Has Affected World Poultry-Meat Trade

In 2003, outbreaks of the highly pathogenic avian influenza (HPAI) H5N1 virus had a major negative impact on the global poultry industry. Initially, import demand for both uncooked and cooked poultry declined substantially, due to consumers’ fear of contracting avian influenza by eating poultry meat. Consumer fears adversely affected poultry consumption in many countries, leading to lower domestic prices, decreased production, and lower poultry meat exports. These reductions proved to be short-lived, as prices, consumption, production, and exports returned to preoutbreak levels in a relatively short time. As consumers gained confidence that poultry was safe if properly handled and cooked, world demand for cooked poultry increased. The cooked poultry share of total cooked and uncooked global exports nearly doubled from 2004 to 2006. In 2006, the world poultry industry was again under pressure due to HPAI H5N1 outbreaks, this time in Europe. By the end of the year, however, world poultry meat output had reached a new high, although, for some European countries, it was slightly below the 2005 level.highly pathogenic avian influenza, HPAI H5N1, cooked poultry meat, uncooked poultry meat, poultry exports, domestic poultry prices, export poultry prices, poultry consumption, poultry production, International Relations/Trade, Livestock Production/Industries,

An ontology-based approach to relax traffic regulation for autonomous vehicle assistance

Traffic regulation must be respected by all vehicles, either human- or computer- driven. However, extreme traffic situations might exhibit practical cases in which a vehicle should safely and reasonably relax traffic regulation, e.g., in order not to be indefinitely blocked and to keep circulating. In this paper, we propose a high-level representation of an automated vehicle, other vehicles and their environment, which can assist drivers in taking such "illegal" but practical relaxation decisions. This high-level representation (an ontology) includes topological knowledge and inference rules, in order to compute the next high-level motion an automated vehicle should take, as assistance to a driver. Results on practical cases are presented

GSi Compliant RAS for Public Private Sector Partnership

With the current trend of moving intelligent services and administration towards the public private partnership, and the security controls that are currently in place, the shareable data modeling initiative has become a controversial issue. Existing applications often rely on isolation or trusted networks for their access control or security, whereas untrusted wide area networks pay little attention to the authenticity, integrity or confidentiality of the data they transport. In this paper, we examine the issues that must be considered when providing network access to an existing probation service environment. We describe how we intend to implement the proposed solution in one probation service application. We describe the architecture that allows remote access to the legacy application, providing it with encrypted communications and strongly authenticated access control but without requiring any modifications to the underlying application