Neural networks, being susceptible to adversarial attacks, should face a strict level of scrutiny before being deployed in critical or adversarial applications. This paper uses ideas from Chaos Theory to explain, analyze, and quantify the degree to which neural networks are susceptible to or robust against adversarial attacks. To this end, we present a new metric, the "susceptibility ratio," given by $\hat \Psi(h, \theta)$, which captures how greatly a model's output will be changed by perturbations to a given input. Our results show that susceptibility to attack grows significantly with the depth of the model, which has safety implications for the design of neural networks for production environments. We provide experimental evidence of the relationship between $\hat \Psi$ and the post-attack accuracy of classification models, as well as a discussion of its application to tasks lacking hard decision boundaries. We also demonstrate how to quickly and easily approximate the certified robustness radii for extremely large models, which until now has been computationally infeasible to calculate directly.

翻译：神经网络极易受到对抗攻击的影响，在部署到关键或对抗性应用中之前，必须对其施以严格审查。本文利用混沌理论中的思想来解释、分析并量化神经网络对抗攻击的易感性或鲁棒性程度。为此，我们提出了一种新度量指标——“易感性比率”，记为 $\hat \Psi(h, \theta)$，该指标捕捉了输入扰动对模型输出影响的剧烈程度。研究结果表明，模型深度增加会显著提高对攻击的易感性，这对生产环境中的神经网络设计具有安全启示。我们提供了 $\hat \Psi$ 与分类模型受攻击后准确率之间关系的实验证据，并讨论了其在缺乏硬决策边界的任务中的应用。此外，我们还展示了如何快速便捷地近似计算超大型模型的认证鲁棒半径，而此前直接计算这一指标在计算上不可行。