Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbb{so}(d)$

Amit Daniely

REVIEW 3 major objections 5 minor 28 references

Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbb{so}(d)$

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves that before any training, a random convolutional network has, with high probability, a nearby input that flips the output's sign, and shows this follows directly from isoperimetric concentration on the rotation group…

desk verdict A clean, genuinely new proof that random convolutional networks have adversarial examples; the ReLU half rests on an unproved kernel-approximation extension, so treat Theorem 3.2 as conditional and Theorem 3.1 as solid. read the letter →

arxiv 2506.12613 v1 pith:RUMWDVB2 submitted 2025-06-14 cs.LG math.PRstat.ML

Amit Daniely This is my paper · ORCID

classification cs.LGmath.PRstat.ML MSC 68T0760E1552A4060B20

keywords adversarialexamplesrandomneuralnetworksconvolutionalisoperimetricinequalityspecialorthogonalgroupconcentrationofmeasureReLUkernelapproximation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes that adversarial examples are unavoidable in a broad class of random convolutional networks, before any training. If the first layer is a regular random convolutional layer, all activations are odd, and the input dimension $d$ is even, then for any fixed input $\vec{x}_0$, with probability at least $1-2e^{-\tau^2/32}$ over the random weights, either the output is zero or a perturbation of size roughly $\|\vec{x}_0\|/\sqrt{d}$ changes its sign, regardless of the width or depth of the remaining layers. For constant-depth convolutional ReLU networks with Xavier initialization, a similar guarantee holds when widths and the input dimension grow faster than $\log(nd)$. The mechanism is geometric: the random function is invariant under rotations of the input, and the uniform measure on the special orthogonal group $SO(d)$ concentrates so strongly that every balanced sign pattern has a sign change very close to every point. This gives a short proof that extends earlier results for fully connected random networks.

What carries the argument

The load-bearing object is the pair consisting of the special orthogonal group $SO(d)$ with its Haar measure, extended to the orbit $C(\vec{x}_0)$ of the fixed input under the rotation action. This orbit is a transitive $SO(d)$-metric space whose action is $L$-Lipschitz with $L=\|\vec{x}_0\|_{\mathrm{sp}}$. Theorem 4.4 transfers measure concentration from $SO(d)$ to the orbit, giving the neighborhood bound used in Lemma 5.3. The proof then needs just two facts about the network: $SO(d)$-invariance of the random function (Lemma 5.1), supplied by a regular random convolutional first layer; and balance, meaning the sets where the output is positive and negative each have measure at least $p$ on the orbit. Odd activations give $p=1/2$ immediately; for ReLU networks the paper proves $p\approx 1/\log d$ through an auxiliary chain in which a quoted kernel-approximation result identifies the penultimate feature map's inner products with a recursively defined patch-average kernel $k$, forcing constant separation of random orbit points, and Sudakov's inequality then guarantees the final linear layer takes both signs.

What would settle it

Run a finite-width convolutional ReLU network with Xavier initialization, fix an input $\vec{x}_0$ with $\|\vec{x}_0\|\approx\sqrt d$, sample $m=\lfloor\sqrt{\log d}\rfloor$ points from its $SO(d)$-orbit, and measure the penultimate feature distances $\|\Psi(\vec{x}_i)-\Psi(\vec{x}_j)\|$; if for large $d$ and widths $\omega(\log nd)$ the minimal distance does not stay above a positive constant $\beta$, or if the feature inner products deviate from the kernel $k(\vec{x}_i,\vec{x}_j)$ by a constant, then Lemma 6.4 fails and the ReLU guarantee of Theorem 3.2 does not follow.

Watch

Extended reading notes

Core claim

The central claim, stated on the paper's own terms, is that the existence of adversarial examples in random convolutional networks is a rotation-symmetry phenomenon. Because the first layer's weight matrix is regular, meaning its distribution is unchanged by right multiplication with any orthogonal matrix, the whole random network is $SO(d)$-invariant: rotating the input is statistically equivalent to re-randomizing that layer. Fix an input $\vec{x}_0$ and look at its orbit $C(\vec{x}_0)=\{U\vec{x}_0:U\in SO(d)\}$, equipped with the pushforward of Haar measure. The isoperimetric inequality for $SO(d)$-metric spaces (Theorem 4.4) says that any subset of the orbit of measure at least $p$ has an $\epsilon$-neighborhood of measure at least $1-\exp(-(d-2)\epsilon^2 p^2/(8L^2))$, where $L=\|\vec{x}_0\|_{\mathrm{sp}}$ is the spectral norm of the input matrix. Applying this to the positive and negative regions of the network's output on the orbit shows that a random rotation puts $\vec{x}_0$ within distance $\epsilon$ of both regions. The only network property left to prove is balance: odd activations give exact balance with $p=1/2$, and for ReLU networks approximate balance follows from a kernel-approximation lemma plus a Sudakov lower bound on the last layer.

Load-bearing premise

The load-bearing premise is Lemma 6.6, quoted from a previous paper on fully connected networks, which says the feature map of a random convolutional ReLU network approximates a patch-average kernel; the proof of the ReLU balance argument would collapse if that approximation fails, and the text does not show how the fully connected proof extends to convolutional layers.

Editorial extensions

If this is right

For odd-activation networks whose first layer is a regular random convolutional layer, every fixed input has a sign-flipping perturbation of radius at most $(\tau/\sqrt{d-2})(\|\vec{x}_0\|_{\mathrm{sp}}/\|\vec{x}_0\|)\|\vec{x}_0\|$ with probability at least $1-2e^{-\tau^2/32}$; for any input this is $O(\|\vec{x}_0\|/\sqrt{d})$.
For typical random inputs the spectral-norm ratio is about $1/\sqrt{\min(d,n)}$, improving the radius to $O(\|\vec{x}_0\|/\sqrt{\min(d^2,dn)})$.
Constant-depth convolutional ReLU networks with Xavier initialization have adversarial examples with probability $1-o_d(1)$ as soon as the number of channels and the input dimension are $\omega(\log(nd))$.
The conclusions hold for random, untrained networks, so the phenomenon is tied to the architecture's initialization and its rotation invariance, not to a particular training procedure.
The probability bound degrades gracefully with the parameter $\tau$, so one can trade confidence against perturbation size.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The geometric core of Theorem 5.2 applies to any $SO(d)$-invariant random function that is balanced, so other architectures whose initialization is rotation-invariant should inherit the same adversarial-example guarantee without further changes.
Because the proof is non-constructive, the paper leaves open whether a simple algorithm such as gradient descent finds the guaranteed perturbation in convolutional networks; the fully connected case has such algorithms, so testing a single gradient step on random convolutional nets is a natural next experiment.
The bound's dependence on the spectral-norm ratio suggests the hardest inputs are highly anisotropic ones, where $\|\vec{x}_0\|_{\mathrm{sp}}/\|\vec{x}_0\|$ is close to 1, giving a quantitative prediction about which inputs are least robust.
The parity condition for odd activations enters only because $-I$ must lie in $SO(d)$; the same concentration argument should work on the full orthogonal group $O(d)$, which would remove the even-dimension restriction.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper extends the recent line on adversarial examples in random networks to convolutional architectures, and it does so with a substantially cleaner proof technique. The central idea—using isoperimetric concentration on SO(d) to show that any SO(d)-invariant, balanced random function has a nearby sign flip—is simple and genuinely useful. Theorem 3.1 (odd activations, first convolutional layer) is essentially self-contained, and I believe it.

The ReLU result (Theorem 3.2) is the weak half. The balance argument reduces to three lemmas, and Lemma 6.4 rests on Lemma 6.6, a kernel approximation statement cited from Daniely et al. [8]. That citation is not enough here. [8] proves kernel approximation for fully connected networks; this paper needs the same result for a recursive patch-averaging kernel on convolutional layers with shared weights and overlapping patches. The text provides no proof that the [8] argument extends to that setting, and the stress-test note is right that the cross-position dependencies are exactly what's missing. The paper also needs a uniform version of Lemma 6.6 (over all m² pairs) but states it pointwise; the union bound is not supplied. The definition of k_{l,1} for the final linear layer is also left a bit vague. These are fixable, but they are not cosmetic—Lemma 6.4's positive separation is the input to the Sudakov step, so without a proper kernel approximation the balance lemma and Theorem 3.2 collapse.

What the paper does well: it's clearly written, the SO(d)-isoperimetric framework is a real simplification, and the odd-activation theorem is new and correct. It also honestly notes that it does not give an algorithm for finding the perturbation, a step backward from prior work but acceptable for an existence result.

I agree with the reader's conditional verdict. The paper deserves peer review and should be engageable, but a referee should demand a full proof of the convolutional kernel approximation or a citation that explicitly covers it. If that gap is patched, this is a nice contribution to the theory literature.

Referee Report

3 major / 5 minor

Summary. This paper proves two existence results for adversarial perturbations of random convolutional networks. Theorem 3.1 covers networks whose first layer is a regular random convolutional layer and all activations are odd; it shows that for even d, with probability at least 1 - 2e^{-τ^2/32}, either f(x0) = 0 or a sign-flipping perturbation exists of radius (τ/√(d-2))·(||x0||_sp/||x0||)·||x0||. Theorem 3.2 extends this to constant-depth convolutional Xavier ReLU networks under width and channel counts that are ω(log(nd)). The method reduces the problem to concentration of measure: SO(d)-invariant and balanced random functions on an SO(d)-metric space necessarily have adversarial examples, by an isoperimetric inequality. The odd-activation case follows from the balance of odd functions and the metric-space isoperimetric theorem. The ReLU case requires a separate balance lemma, proved by taking m ≈ √log d random rotations, showing the final layer separates them via Sudakov's inequality, and using a kernel approximation result to control the penultimate feature inner products.

Significance. The isoperimetric reduction is conceptually appealing, and Theorem 3.1 is essentially self-contained: its proof uses only the SO(d)-concentration inequality, the Lipschitz bound of Lemma 4.3, and the elementary balance of odd activations. The perturbation radius matches known fully connected results and the argument contains no fitted parameters, which is a genuine strength. However, Theorem 3.2 is not established in the submitted form: the key kernel approximation, Lemma 6.6, is cited from prior work on fully connected networks, and the extension to convolutional patch-averaging is neither proved nor exactly referenced. Additionally, the paper does not supply the uniform and quantitative versions of that approximation needed for the balance argument. The central idea is promising and deserves publication after this gap is addressed.

major comments (3)

[§6.1.1, Lemma 6.6] Lemma 6.6 is load-bearing for Theorem 3.2, but it is stated only as a citation to [8]. The cited paper proves kernel approximation for fully connected networks; the submitted text gives no proof that the result extends to convolutional layers with shared weights, overlapping patches, and stride, nor to the recursively defined patch-averaged kernel k_{v,t}. This is not a cosmetic issue: Lemma 6.4 derives the required β-separation of the m rotated inputs entirely from Lemma 6.6, and Lemma 6.5 needs that separation for the Sudakov argument. The author should either provide a proof of the convolutional kernel approximation in this paper or give an exact reference that states the convolutional version with the same recursion.
[§6.1, Lemma 6.6 and Lemma 6.4, quantitative uniformity] Even if the convolutional version of Lemma 6.6 is accepted, the quoted statement is pointwise: it bounds |k(x,y) - ⟨Ψ(x),Ψ(y)⟩| for fixed x,y with failure probability δ. Lemma 6.4 needs a simultaneous statement over all m^2 pairs with failure probability o_d(1), under the width assumption d_i = ω(log(nd)) from Theorem 3.2. The text does not provide a union bound or a uniform version, and the scaling is not reconciled: Lemma 6.6 requires d_i ≳ l^2 log(ln/δ)/ε^2, which with ε = o_d(1) can be much larger than ω(log(nd)). The author should state the exact width requirement needed for Lemma 6.4 and prove or reference the corresponding uniform statement.
[§6.1.1, definition of k_{l,1}] The definition of the final kernel k(⃗x,⃗y) = k_{l,1}(⃗x,⃗y) is ambiguous. The final layer is linear, yet the recursive definition applies the nonlinearity σ̂ at every level, including v = l; it is also unclear whether n_l = d_l = 1 in the kernel recursion and how the summation over spatial positions is represented. This ambiguity matters in Lemma 6.4, where the values k_{v,t}(x_i,x_j) for i ≠ j and k_{v,t}(x_i,x_i) = 1 are used to lower-bound ∥Ψ(x_i) - Ψ(x_j)∥. The author should define the recursion precisely for the final linear layer and state explicitly which normalization makes k(x,x) = 1.

minor comments (5)

[Abstract and Section 1] The text writes “isoperimetric inequalities on so(d)”; the group being used is SO(d), the special orthogonal group, and the notation should be consistent throughout.
[§5, proof of Lemma 5.3] The sentence “Since U^{-1}x0 ∈ A^-_ϵ there is y ∈ A^- such that d(y, U^{-1}x0)” is incomplete; it should state d(y, U^{-1}x0) ≤ ϵ, which is the property used in the subsequent chain of inequalities.
[§6.1, Lemma 6.3] The displayed probability bound has an unclear constant: the event is over all pairs 1 ≤ i < j ≤ m and all positions 1 ≤ t ≤ n, so the union bound should give O(m^2 n e^{-d/8}); the factor “2” in the displayed expression appears unnecessary and should be checked.
[§6.1.1, proof of Lemma 6.4] The phrase “w.p. 1 - o_d(1)” is used several times without specifying the underlying probability space; the randomness is over the network weights, while the conditioning on the event over the points x_i should be stated explicitly.
[Theorem 3.2 and §6.1] The notation x0 ∈ (R · S^{d-1})^n and the later replacement R = √d should be clarified: define R as the radius of the sphere and state that homogeneity of ReLU is used to reduce to R = √d before the proof of Lemma 6.1.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the adversarial-example bounds follow from external SO(d) isoperimetric concentration and independent kernel-approximation input; the asserted convolutional extension of [8] is an unproved gap, not a circular step.

full rationale

No parameter is fitted and no target quantity is defined in terms of the conclusion. Theorem 3.1 is derived from the external SO(d) isoperimetric inequality (Theorem 4.4), SO(d)-invariance of regular random convolutional layers (Lemma 5.1), and oddness-induced balance; the conclusion of sign change is obtained by a genuine concentration argument (Theorem 5.2), not by assuming the conclusion. For Theorem 3.2, the ReLU balance lemma is reduced to a separation property of the penultimate feature map (Lemmas 6.3-6.5). The only external input is Lemma 6.6, a kernel approximation cited to [8]; although [8] is a self-citation and the paper does not prove its extension from fully connected to convolutional networks, the cited result is an independent, parameter-free theorem that does not include the target statement. The unproved convolutional extension is a correctness risk or missing proof, not a circular reduction: no equation in the paper equals its conclusion by construction. The load-bearing citation burden is noted but, under the rule that self-citation is not itself circularity, does not raise the circularity score.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The proof introduces no new entities and fits no parameters. It relies on standard concentration of measure results (Meckes, Vershynin), a derived isoperimetric inequality for SO(d)-metric spaces, and one prior theorem on kernel approximation for random ReLU networks whose convolutional variant is assumed without proof.

assumptions (5)

standard math Measure concentration on SO(d): for an L-Lipschitz f, mu(f >= E mu f + eps) <= exp(-(d-2) eps^2 / (8 L^2)).
Theorem 4.1, cited to Meckes [16]; used to prove Corollary 4.2 and Theorem 4.4.
standard math Isoperimetric inequality for SO(d)-metric spaces (Theorem 4.4) follows from concentration and L-Lipschitz action.
Derived in Section 4 using the Lipschitz property of the group action.
domain assumption Kernel approximation for random convolutional ReLU networks (Lemma 6.6): <Psi(x),Psi(y)> approx k(x,y) with the convolutional kernel defined by patch averaging.
Cited from [8] but not proved for the convolutional recursion; the local averaging over patches is an extension beyond the fully connected setting of [8]. This is the main uncertainty.
standard math Sudakov's inequality and Gaussian concentration for Lipschitz functions.
Used in Lemma 6.5 to lower-bound the expected maximum of a Gaussian process and to control its fluctuations.
standard math Concentration of uniform random points on sqrt(d) S^{d-1}: Pr(<x,y> >= t) <= e^{-t^2/(2d)}.
Used in Lemma 6.3, cited to Vershynin [27].

how reviews work

0 comments

Cite this review

Pith. "Pith review of Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbb{so}(d)$." pith.science (2026). https://pith.science/paper/RUMWDVB2

@misc{pith2026250612613,
  author       = {Pith},
  title        = {Pith review of: Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on $\mathbbso(d)$},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RUMWDVB2}},
  note         = {Machine review of arXiv:2506.12613}
}

abstract

We show that adversarial examples exist for various random convolutional networks, and furthermore, that this is a relatively simple consequence of the isoperimetric inequality on the special orthogonal group $\mathbb{so}(d)$. This extends and simplifies a recent line of work which shows similar results for random fully connected networks.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 21 canonical work pages

[8]

Toward deeper understanding of neural networks: The power of initialization and a dual view on expressivity

Amit Daniely, Roy Frostig, and Yoram Singer. Toward deeper understanding of neural networks: The power of initialization and a dual view on expressivity. Advances in neural information processing systems, 29, 2016. 7

work page 2016
[1]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 , 2018. 1

arXiv 2018
[2]

Adversarial examples in multi-layer random relu networks

Peter Bartlett, S´ ebastien Bubeck, and Yeshwanth Cherapanamjeri. Adversarial examples in multi-layer random relu networks. Advances in Neural Information Processing Systems , 34:9241–9252, 2021. 1, 3

work page 2021
[3]

Adversarial examples from compu- tational constraints

Sebastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. Adversarial examples from compu- tational constraints. In International Conference on Machine Learning , pages 831–840, 2019. 1

work page 2019
[4]

A single gradient step finds adversarial examples on random two-layers neural networks

S´ ebastien Bubeck, Yeshwanth Cherapanamjeri, Gauthier Gidel, and Remi Tachet des Combes. A single gradient step finds adversarial examples on random two-layers neural networks. Advances in Neural Information Processing Systems, 34:10081–10091, 2021. 1, 3

work page 2021
[5]

Adversarial examples are not easily detected: Bypassing ten detection methods

Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pages 3–14, 2017. 1

work page 2017
[6]

Audio adversarial examples: Targeted attacks on speech-to-text

Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW) , pages 1–7. IEEE, 2018. 1

work page 2018
[7]

Most relu networks suffer from ℓ2 adversarial perturbations

Amit Daniely and Hadas Shacham. Most relu networks suffer from ℓ2 adversarial perturbations. Ad- vances in Neural Information Processing Systems , 33:6629–6636, 2020. 1, 3

work page 2020

Show all 28 references

[9]

Adversarial vulnerability for any classifier

Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. Adversarial vulnerability for any classifier. InAdvances in Neural Information Processing Systems , pages 1178–1187, 2018. 1

2018
[10]

Detecting adversarial samples from artifacts

Reuben Feinman, Ryan R Curtin, Saurabh Shintre, and Andrew B Gardner. Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 , 2017. 1

2017 arXiv
[11]

Understanding the difficulty of training deep feedforward neural networks

Xavier Glorot and Yoshua Bengio. Understanding the difficulty of training deep feedforward neural networks. In Proceedings of the thirteenth international conference on artificial intelligence and statistics, pages 249–256. JMLR Workshop and Conference Proceedings, 2010. 2 8

2010
[12]

Explaining and harnessing adversarial examples

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014. 1

2014 arXiv
[13]

On the (statistical) detection of adversarial examples

Kathrin Grosse, Praveen Manoharan, Nicolas Papernot, Michael Backes, and Patrick McDaniel. On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 , 2017. 1

2017 arXiv
[14]

Towards deep learning models resistant to adversarial attacks

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017. 1

2017 arXiv
[15]

The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure

Saeed Mahloujifar, Dimitrios I Diochnos, and Mohammad Mahmoody. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 4536–4543, 2019. 1

2019
[16]

The random matrix theory of the classical compact groups , volume 218

Elizabeth S Meckes. The random matrix theory of the classical compact groups , volume 218. Cambridge University Press, 2019. 3

2019
[17]

Adversarial examples exist in two-layer relu networks for low dimensional linear subspaces.Advances in Neural Information Processing Systems, 36:5028–5049,

Odelia Melamed, Gilad Yehudai, and Gal Vardi. Adversarial examples exist in two-layer relu networks for low dimensional linear subspaces.Advances in Neural Information Processing Systems, 36:5028–5049,
[18]

Adversarial examples in random neural networks with general activations

Andrea Montanari and Yuchen Wu. Adversarial examples in random neural networks with general activations. Mathematical Statistics and Learning , 6(1):143–200, 2023. 1, 3

2023
[19]

Distillation as a defense to adversarial perturbations against deep neural networks

Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium on Security and Privacy (SP) , pages 582–597. IEEE, 2016. 1

2016
[20]

Practical black-box attacks against machine learning

Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security , pages 506–519, 2017. 1

2017
[21]

Adversar- ially robust generalization requires more data

Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversar- ially robust generalization requires more data. In Advances in Neural Information Processing Systems , pages 5014–5026, 2018. 1

2018
[22]

Are adversarial examples inevitable? arXiv preprint arXiv:1809.02104 , 2018

Ali Shafahi, W Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. Are adversarial examples inevitable? arXiv preprint arXiv:1809.02104 , 2018. 1, 2

2018 arXiv
[23]

A simple explanation for the existence of adversarial examples with small hamming distance

Adi Shamir, Itay Safran, Eyal Ronen, and Orr Dunkelman. A simple explanation for the existence of adversarial examples with small hamming distance. arXiv preprint arXiv:1901.10861 , 2019. 1, 2

1901 arXiv
[24]

Intriguing properties of neural networks

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna Estrach, Dumitru Erhan, Ian Good- fellow, and Robert Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014 , 2014. 1

2014
[25]

Probability in high dimension

Ramon Van Handel. Probability in high dimension. Lecture Notes (Princeton University) , 2(3):2–3,
[26]

Gradient methods provably converge to non-robust networks

Gal Vardi, Gilad Yehudai, and Ohad Shamir. Gradient methods provably converge to non-robust networks. Advances in Neural Information Processing Systems , 35:20921–20932, 2022. 2

2022
[27]

High-dimensional probability: An introduction with applications in data science , volume 47

Roman Vershynin. High-dimensional probability: An introduction with applications in data science , volume 47. Cambridge university press, 2018. 7, 8

2018
[28]

Provable defenses against adversarial examples via the convex outer adver- sarial polytope

Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adver- sarial polytope. In International Conference on Machine Learning , pages 5286–5295, 2018. 1 9

2018

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [8]

Toward deeper understanding of neural networks: The power of initialization and a dual view on expressivity

Amit Daniely, Roy Frostig, and Yoram Singer. Toward deeper understanding of neural networks: The power of initialization and a dual view on expressivity. Advances in neural information processing systems, 29, 2016. 7

work page 2016

[2] [1]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420 , 2018. 1

arXiv 2018

[3] [2]

Adversarial examples in multi-layer random relu networks

Peter Bartlett, S´ ebastien Bubeck, and Yeshwanth Cherapanamjeri. Adversarial examples in multi-layer random relu networks. Advances in Neural Information Processing Systems , 34:9241–9252, 2021. 1, 3

work page 2021

[4] [3]

Adversarial examples from compu- tational constraints

Sebastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. Adversarial examples from compu- tational constraints. In International Conference on Machine Learning , pages 831–840, 2019. 1

work page 2019

[5] [4]

A single gradient step finds adversarial examples on random two-layers neural networks

S´ ebastien Bubeck, Yeshwanth Cherapanamjeri, Gauthier Gidel, and Remi Tachet des Combes. A single gradient step finds adversarial examples on random two-layers neural networks. Advances in Neural Information Processing Systems, 34:10081–10091, 2021. 1, 3

work page 2021

[6] [5]

Adversarial examples are not easily detected: Bypassing ten detection methods

Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , pages 3–14, 2017. 1

work page 2017

[7] [6]

Audio adversarial examples: Targeted attacks on speech-to-text

Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In 2018 IEEE Security and Privacy Workshops (SPW) , pages 1–7. IEEE, 2018. 1

work page 2018

[8] [7]

Most relu networks suffer from ℓ2 adversarial perturbations

Amit Daniely and Hadas Shacham. Most relu networks suffer from ℓ2 adversarial perturbations. Ad- vances in Neural Information Processing Systems , 33:6629–6636, 2020. 1, 3

work page 2020