i was trying to build a bit of intuition about this paper by considering a trivial case where there are two classes, and the classifier is linear, in very low dimension. consider the following trivial example:
in this example, the decision boundary from different classifiers is shown as H_1, H_2, H_3. The "universal" perturbation for each of the three classifiers would be a small vector normal to the each classifier's decision boundary. This paper defines "universal" perturbation with respect to the choice of input from the population of inputs, but each "universal" perturbation is optimised specifically to target a single model (aka classifier).
both H_1 and H_2 do a reasonable job of separating the two classes, but the H_1 decision boundary with the smaller margin is more vulnerable to misclassification if inputs are perturbed by a small vector normal to its decision boundary.
You can imagine translating the input space a bit to the right -- this would result in H_1 misclassifying say 2 out of the 18 data points shown, whereas H_2 (the SVM generated decision boundary with maximal margin) classifier would not experience any errors.
i was trying to build a bit of intuition about this paper by considering a trivial case where there are two classes, and the classifier is linear, in very low dimension. consider the following trivial example:
https://en.wikipedia.org/wiki/Linear_classifier#/media/File:...
in this example, the decision boundary from different classifiers is shown as H_1, H_2, H_3. The "universal" perturbation for each of the three classifiers would be a small vector normal to the each classifier's decision boundary. This paper defines "universal" perturbation with respect to the choice of input from the population of inputs, but each "universal" perturbation is optimised specifically to target a single model (aka classifier).
both H_1 and H_2 do a reasonable job of separating the two classes, but the H_1 decision boundary with the smaller margin is more vulnerable to misclassification if inputs are perturbed by a small vector normal to its decision boundary.
You can imagine translating the input space a bit to the right -- this would result in H_1 misclassifying say 2 out of the 18 data points shown, whereas H_2 (the SVM generated decision boundary with maximal margin) classifier would not experience any errors.