{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/on-the-limitation-of-local-intrinsic","title":"On the Limitation of Local Intrinsic Dimensionality for Characterizing the Subspaces of Adversarial Examples","arxiv_id":"1803.09638","date":"2018-03-26","proceeding":null,"authors":["Pei-Hsuan Lu","Pin-Yu Chen","Chia-Mu Yu"],"abstract":"Understanding and characterizing the subspaces of adversarial examples aid in\nstudying the robustness of deep neural networks (DNNs) to adversarial\nperturbations. Very recently, Ma et al. (ICLR 2018) proposed to use local\nintrinsic dimensionality (LID) in layer-wise hidden representations of DNNs to\nstudy adversarial subspaces. It was demonstrated that LID can be used to\ncharacterize the adversarial subspaces associated with different attack\nmethods, e.g., the Carlini and Wagner's (C&W) attack and the fast gradient sign\nattack.\n  In this paper, we use MNIST and CIFAR-10 to conduct two new sets of\nexperiments that are absent in existing LID analysis and report the limitation\nof LID in characterizing the corresponding adversarial subspaces, which are (i)\noblivious attacks and LID analysis using adversarial examples with different\nconfidence levels; and (ii) black-box transfer attacks. For (i), we find that\nthe performance of LID is very sensitive to the confidence parameter deployed\nby an attack, and the LID learned from ensembles of adversarial examples with\nvarying confidence levels surprisingly gives poor performance. For (ii), we\nfind that when adversarial examples are crafted from another DNN model, LID is\nineffective in characterizing their adversarial subspaces. These two findings\ntogether suggest the limited capability of LID in characterizing the subspaces\nof adversarial examples.","url_abs":"http://arxiv.org/abs/1803.09638v1","url_pdf":"http://arxiv.org/pdf/1803.09638v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"on-the-limitation-of-local-intrinsic","repo_url":"https://github.com/ysharma1126/EAD_Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1803.09638","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}