发现卷积网络的对抗扰动可逼近理论极限，仅需一步梯度下降即可触发。
Most Convolutional Networks Suffer from Small Adversarial Perturbations
- 用傅里叶分解分析随机卷积层，推导出奇异值上界
- 证明对抗扰动可在 $\lVert x \rVert /\sqrt{d}$ 距离内被找到
- 适用于理解随机卷积网络的脆弱性，适合安全研究者阅读
对抗样本的存在在随机全连接神经网络中已有较清晰理解，但在卷积神经网络（CNN）中仍不充分。近期工作 [Daniely, 2025] 证明了在非最优距离下可找到 CNN 的对抗样本。本文进一步拓展，证明在输入维度为 $d$ 的随机 CNN 中，对抗样本可在 $\ell_2$ 距离 $\lVert x \rVert /\sqrt{d}$ 内被发现，这几乎达到理论最小距离。我们还表明，仅需一步梯度下降即可找到此类小扰动。核心方法是利用傅里叶分解高效控制随机线性卷积算子的奇异值，该边界可能具有独立研究价值。
原文摘要 · Abstract (English)
The existence of adversarial examples is relatively understood for random fully connected neural networks, but much less so for convolutional neural networks (CNNs). The recent work [Daniely, 2025] establishes that adversarial examples can be found in CNNs, in some non-optimal distance from the input. We extend over this work and prove that adversarial examples in random CNNs with input dimension $d$ can be found already in $\ell_2$-distance of order $\lVert x \rVert /\sqrt{d}$ from the input $x$, which is essentially the nearest possible. We also show that such adversarial small perturbations can be found using a single step of gradient descent. To derive our results we use Fourier decomposition to efficiently bound the singular values of a random linear convolutional operator, which is the main ingredient of a CNN layer. This bound might be of independent interest.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。