The prominent success of neural networks, mainly in computer vision tasks, is increasingly shadowed by their sensitivity to small, barely perceivable adversarial perturbations in image input. In this work, we aim at explaining this vulnerability through the framework of sparsity. We show the connection between adversarial attacks and sparse representations, with a focus on explaining the universality and transferability of adversarial examples in neural networks. To this end, we show that sparse coding algorithms, and the neural network-based learned iterative shrinkage thresholding algorithm (LISTA) among them, suffer from this sensitivity, and that common attacks on neural networks can be expressed as attacks on the sparse representation of the input image. The phenomenon that we observe holds true also when the network is agnostic to the sparse representation and dictionary, and thus can provide a possible explanation for the universality and transferability of adversarial attacks. The code is available at https://github.com/danawr/adversarial_attacks_and_sparse_representations.

翻译：神经网络在计算机视觉任务中取得的显著成功，正日益因其对图像输入中微小、几乎不可察觉的对抗性扰动的敏感性而蒙上阴影。本文旨在通过稀疏性框架解释这一脆弱性。我们揭示了对抗攻击与稀疏表示之间的关联，重点阐述了神经网络中对抗样本的普遍性与可迁移性。为此，我们证明了稀疏编码算法（包括基于神经网络的迭代收缩阈值算法LISTA）同样存在这种敏感性，并且针对神经网络的常见攻击可转化为对输入图像稀疏表示的攻击。当网络对稀疏表示和字典无关时，这一现象仍然成立，从而为对抗攻击的普遍性与可迁移性提供了可能的解释。相关代码可访问 https://github.com/danawr/adversarial_attacks_and_sparse_representations 获取。