Adversarial vulnerability for any classifier

Despite achieving impressive performance, state-of-the-art classifiers remain\nhighly vulnerable to small, imperceptible, adversarial perturbations. This\nvulnerability has proven empirically to be very intricate to address. In this\npaper, we study the phenomenon of adversarial perturbations under the\nassumption that the data is generated with a smooth generative model. We derive\nfundamental upper bounds on the robustness to perturbations of any\nclassification function, and prove the existence of adversarial perturbations\nthat transfer well across different classifiers with small risk. Our analysis\nof the robustness also provides insights onto key properties of generative\nmodels, such as their smoothness and dimensionality of latent space. We\nconclude with numerical experimental results showing that our bounds provide\ninformative baselines to the maximal achievable robustness on several datasets.\n