Image classifiers can not be made robust to small perturbations

TL;DR

This paper proves that the sensitivity of image classifiers to small perturbations is a fundamental limitation, not just a flaw, affecting all classifiers and challenging the development of robust computer vision systems.

Contribution

It demonstrates that for any classifier, small perturbations can drastically change classifications, establishing a fundamental property of classifiers rather than a design flaw.

Findings

Sensitivity to small perturbations is unavoidable for classifiers.

Perturbations of size proportional to image dimensions can alter classifications.

This phenomenon applies broadly across different norms and classifier types.

Abstract

The sensitivity of image classifiers to small perturbations in the input is often viewed as a defect of their construction. We demonstrate that this sensitivity is a fundamental property of classifiers. For any arbitrary classifier over the set of $n$-by-$n$ images, we show that for all but one class it is possible to change the classification of all but a tiny fraction of the images in that class with a perturbation of size $O(n^{1/\max{(p,1)}})$ when measured in any $p$-norm for $p \geq 0$. We then discuss how this phenomenon relates to human visual perception and the potential implications for the design considerations of computer vision systems.