Non-Robust Features are Not Always Useful in One-Class Classification

TL;DR

This paper investigates the vulnerability of lightweight one-class classifiers to adversarial attacks, revealing that non-robust features learned are often not useful for the task, which differs from multi-class classification scenarios.

Contribution

It demonstrates that non-robust features in lightweight one-class classifiers are not always beneficial, highlighting a key difference from multi-class classification and suggesting training may inadvertently learn useless features.

Findings

Lightweight one-class classifiers learn non-robust features like texture.

These non-robust features are vulnerable under stronger attacks.

Non-robust features are not always useful for one-class classification.

Abstract

The robustness of machine learning models has been questioned by the existence of adversarial examples. We examine the threat of adversarial examples in practical applications that require lightweight models for one-class classification. Building on Ilyas et al. (2019), we investigate the vulnerability of lightweight one-class classifiers to adversarial attacks and possible reasons for it. Our results show that lightweight one-class classifiers learn features that are not robust (e.g. texture) under stronger attacks. However, unlike in multi-class classification (Ilyas et al., 2019), these non-robust features are not always useful for the one-class task, suggesting that learning these unpredictive and non-robust features is an unwanted consequence of training.