Canonical foliations of neural networks: application to robustness

Eliot Tron (1) , Nicolas Couellan (2, 3) , Stéphane Puechmorel (2)

1 ENS de Lyon - École normale supérieure de Lyon
2 ENAC - Ecole Nationale de l'Aviation Civile
3 IMT - Institut de Mathématiques de Toulouse UMR5219

Adversarial attack is an emerging threat to the trustability of machine learning. Understanding these attacks is becoming a crucial task. We propose a new vision on neural network robustness using Riemannian geometry and foliation theory, and create a new adversarial attack by taking into account the curvature of the data space. This new adversarial attack called the "dog-leg attack" is a two-step approximation of a geodesic in the data space. The data space is treated as a (pseudo) Riemannian manifold equipped with the pullback of the Fisher Information Metric (FIM) of the neural network. In most cases, this metric is only semi-definite and its kernel becomes a central object to study. A canonical foliation is derived from this kernel. The curvature of the foliation's leaves gives the appropriate correction to get a two-step approximation of the geodesic and hence a new efficient adversarial attack. Our attack is tested on a toy example, a neural network trained to mimic the Xor function, and demonstrates better results that the state of the art attack presented by Zhao et al. (2019).

Mots clés: Neural Networks; Robustness; Fisher Information Metric; Information geometry; Adversarial attacks

Domaines: Apprentissage [cs.LG]; Statistiques [math.ST]; Géométrie différentielle [math.DG]

Eliot Tron, Nicolas Couellan, Stéphane Puechmorel. Canonical foliations of neural networks: application to robustness. 2022. ⟨hal-03593479v1⟩