论文标题
深度神经网络的跨度恢复，并应用于输入混淆
Span Recovery for Deep Neural Networks with Applications to Input Obfuscation
论文作者
论文摘要
深度神经网络的巨大成功促使需要更好地了解这些网络的基本属性，但是提出的许多理论结果仅是针对浅网络的。在本文中，我们研究了了解深网的有意义的输入空间：跨度恢复的重要原始性。对于$ k <n $，让$ \ m马理{a} \ in \ mathbb {r}^{k \ times n} $是任意fef feff toffer forther网络$ m：\ mathbb {r}^n \ to \ mathbb {r} $ m（r} $的最内在的重量矩阵，以下σ（\ mathbf {a} x）$，对于某些网络$σ：\ mathbb {r}^k \ to \ mathbb {r} $。然后，目标是恢复$ \ mathbf {a} $的行跨度，仅给出了Oracle访问$ m（x）$的值。我们表明，如果$ m $是一个具有Relu激活功能的多层网络，则可以进行部分恢复：即，我们可以在$ \ Mathbf {a} $的行中使用Poly Poly $（n）$非适应性查询到$ m（x）$（x）$恢复$ \ mathbf {a} $的行中的$ k/2 $线性独立的向量。此外，如果$ m $具有可区分的激活功能，我们证明即使首先通过符号或$ 0/1 $阈值函数，即使输出首先通过输出，也可以进行完整的跨度恢复；在这种情况下，我们的算法是自适应的。从经验上讲，我们确认并非总是可能的跨度恢复，而是仅适用于不切实际的薄层。对于合理宽的网络，我们可以在随机网络和接受MNIST数据训练的网络上获得完整的跨度恢复。此外，我们通过诱导神经网络将跨度恢复作为攻击的实用性误解了通过受控随机噪声作为感官输入而混淆的数据。
The tremendous success of deep neural networks has motivated the need to better understand the fundamental properties of these networks, but many of the theoretical results proposed have only been for shallow networks. In this paper, we study an important primitive for understanding the meaningful input space of a deep network: span recovery. For $k<n$, let $\mathbf{A} \in \mathbb{R}^{k \times n}$ be the innermost weight matrix of an arbitrary feed forward neural network $M:\mathbb{R}^n \to \mathbb{R}$, so $M(x)$ can be written as $M(x) = σ(\mathbf{A} x)$, for some network $σ:\mathbb{R}^k \to \mathbb{R}$. The goal is then to recover the row span of $\mathbf{A}$ given only oracle access to the value of $M(x)$. We show that if $M$ is a multi-layered network with ReLU activation functions, then partial recovery is possible: namely, we can provably recover $k/2$ linearly independent vectors in the row span of $\mathbf{A}$ using poly$(n)$ non-adaptive queries to $M(x)$. Furthermore, if $M$ has differentiable activation functions, we demonstrate that full span recovery is possible even when the output is first passed through a sign or $0/1$ thresholding function; in this case our algorithm is adaptive. Empirically, we confirm that full span recovery is not always possible, but only for unrealistically thin layers. For reasonably wide networks, we obtain full span recovery on both random networks and networks trained on MNIST data. Furthermore, we demonstrate the utility of span recovery as an attack by inducing neural networks to misclassify data obfuscated by controlled random noise as sensical inputs.
