Explaining and Harnessing Adversarial Examples

This paper examines why machine learning models, including neural networks, consistently misclassify adversarial examples — inputs formed by applying small but intentionally worst-case perturbations that cause the model to output an incorrect answer with high confidence. Where early attempts at explanation focused on nonlinearity and overfitting, the authors argue that the primary cause of this vulnerability is the linear nature of neural networks, supporting the claim with new quantitative results.

The linearity view provides the first explanation for the most intriguing property of adversarial examples — their generalization across architectures and training sets — and yields a simple and fast method for generating them. Using this approach to supply examples for adversarial training, the authors reduce the test set error of a maxout network on the MNIST dataset.