Vulnerability to adversarial attacks is one of the principal hurdles to the adoption of deep learning in safety-critical applications. Despite significant efforts, both practical and theoretical, training deep learning models robust to adversarial attacks is still an open problem. In this paper, we analyse the geometry of adversarial attacks in the large-data, overparameterized limit for Bayesian Neural Networks (BNNs). We show that, in the limit, vulnerability to gradient-based attacks arises as a result of degeneracy in the data distribution, i.e., when the data lies on a lower-dimensional submanifold of the ambient space. As a direct consequence, we demonstrate that in this limit BNN posteriors are robust to gradient-based adversarial attacks. Crucially, we prove that the expected gradient of the loss with respect to the BNN posterior distribution is vanishing, even when each neural network sampled from the posterior is vulnerable to gradient-based attacks. Experimental results on the MNIST, Fashion MNIST, and half moons datasets, representing the finite data regime, with BNNs trained with Hamiltonian Monte Carlo and Variational Inference, support this line of arguments, showing that BNNs can display both high accuracy on clean data and robustness to both gradient-based and gradient-free based adversarial attacks.

翻译：对抗攻击的脆弱性是深度学习在安全关键应用中的主要障碍之一。尽管在理论与实践层面都付出了巨大努力，训练出能抵御对抗攻击的鲁棒深度学习模型仍是一个开放性问题。本文分析了大数据过参数化极限下贝叶斯神经网络的对抗攻击几何特性。研究表明，在该极限下，对基于梯度的攻击的脆弱性源于数据分布的退化性，即数据位于环境空间的低维子流形上。作为直接推论，我们证明了在该极限下贝叶斯神经网络后验分布对基于梯度的对抗攻击具有鲁棒性。关键在于，我们证明了即便从后验分布中采样的每个神经网络个体都易受梯度攻击，但损失函数关于贝叶斯神经网络后验分布的期望梯度会趋于零。在MNIST、Fashion MNIST及半半月数据集上，通过哈密顿蒙特卡洛和变分推断训练的贝叶斯神经网络实验（代表有限数据场景）支持了这一论证，表明贝叶斯神经网络能在保持干净数据高准确率的同时，对基于梯度与无梯度对抗攻击均展现出鲁棒性。