Behind the general terms like adversarial attacks and generative adversarial networks (GANs), such criteria as AI resilience and AI robustness gained a crucial importance, in trying to make the emergent AI tools reliable, energy-efficient and safe. From mathematical perspective, these problems boil down to finding a mathematically-sound quantification of the smallest-sufficient amounts of the perturbations of function arguments that lead to the largest possible perturbations of the approximated function values. Here, the entropy-optimising perspective on adversarial algorithms from Artificial Intelligence (AI) is proposed to attack this problem. It is shown that adopting this perspective helps proving computational conditions for the global optimality and uniqueness of adversarial attacks based on cheaply-verifiable mathematical criteria. Further, it is shown how this perspective can be used for developing self-attacking learning algorithms, that generate optimal new data points for training, replacing one of the trained agents with this mathematical criterium. On a broad selection of various synthetic and real-life problems from hydrodynamics and biomedicine, it is shown that such self-attacking learning algorithms allow training orders-of-magnitude simpler and cheaper models with superior performance - and can be used to directly train the optimal controls in complex systems, requiring only a small fraction of the training data and outperforming the as-comprehensive-as-the-author-was-able-to-find set of contemporary AI tools (like boosted Random Forests, deep neural networks, foundational models based on transformer architectures, etc.) in complexity (measured as the model descriptor length) and predictive performance.}
Figures & tables
Figure 1: Graphical illustration of the eSPA+ Voronoi cell geometry in the Euclidean spaces dimensions d weighted with Wd , described by the formulas ( 6 , 7 ) and Theorem 1.
Figure 2: Swiss double-roll spiral and its extensions: MAP/MAD results for a common parameterization with D=2 and two full spiral turns (panels A-C), for an extension with four to spiral turns (and all other benchmark parameters left the same as in Haber and Ruthotto (2017) , panels D-F). Panels G-I show comparisons for the changing number of example spirals, and panels J-L for the changing number of non-informative (uniformly-distributed) feature dimensions.
Figure 3: Computation of MAP and MAD for the biomedical data analysis. Panels A and B represent the standard statistical boxplots, where the red line denotes the median and the blue bars the sizes of quantiles.
Figure 4: Self-Attacking Entropic Learning (SA) in comparison to existent AI/ML tools for a worms longevity data example, for D=50. Panels B-D feature the means and the 95% confidence intervals computed from the standard cross-validation procedure.
Figure 5: Application of SA-eSPA+ for a direct learning of optimal control in chaotic blackbox-systems, illustrated on a Lorenz’63-example. Panels B,E, H feature the means and the 95% confidence intervals computed from the standard cross-validation procedure. MAP-control in the legends of panels B, E and H refers to the computation of MAP according to Theorem 1 above, the word ”control” here just underlines the meaning of the MAP that is found - since it aims at providing the optimal control of the underlying system in this application.
Figure 6: Application of SA-eSPA+ to a direct learning of optimal patient-specific chemotherapy plan for children with Acute lymphoblastic leukemia (ALL) from a minimal number of pharmacokinetic/pharmacodynamic model simulations. Panel A features the means and the 95% confidence intervals computed from the standard cross-validation procedure. MAP-control in the legend of panel A refers to the computation of MAP according to Theorem 1 above, the word ”control” here just underlines the meaning of the MAP that is found - since it aims at providing the optimal control of the underlying system in this application.
Physical AI is being successfully applied to data which does not follow the traditional paradigm of independent and identically distributed (i.i.d.) samples. In fact, physical AI is often trained on data which is not random at all, and is instead derived from chaotic dynamical systems like turbulence. We aim to explain the empirical success of these methods using the example of generative adversarial networks (GANs), whose statistical learning theory under the i.i.d. assumption is generally well understood. We prove that it is possible, using an infinite-dimensional model of generative adversarial learning (GAL), to learn the invariant distribution of a sufficiently chaotic dynamical system from a single deterministically evolving time series of its states or measurements thereof, and give explicit rates for the convergence to the solution in terms of the Jensen-Shannon divergence.
Joris C. Kühl, Hanno Gottschalk
Institute of Mathematics, Technical University of Berlin, Germany
Trustworthy AI requires reliable data-processing pipelines, not only robust downstream predictive models. As an upstream component, data summarization determines which information is retained and passed to subsequent learning or decision modules. Therefore, adversarial perturbations to the summarization process can compromise trustworthy AI in an upstream manner: they may alter the selected summary, reduce its representativeness, and further degrade the utility of subsequent learning tasks. In this paper, we study adversarial attacks on continuous data summarization under similarity-level perturbations through DR-submodular optimization. We show that a class of multi-resolution image summarization objectives can be formulated as multilinear extensions of non-negative submodular set functions and satisfy DR-submodularity with m-weak monotonicity. We then formulate multi-target attack generation as a min-max problem, where one admissible perturbation of the similarity structure is optimized to degrade multiple target summarization models. To mitigate such perturbations, we formulate robust defense against mixed attack types as a regularized max-min problem. For both problems, we develop approximation algorithms with theoretical guarantees. Experiments on real-data and controlled clustered benchmarks show that the proposed attack is effective in representative low-to-moderate budget regimes and can induce downstream task-performance loss. The proposed defense improves the robustness--mitigation trade-off in structured settings, while also revealing the parameter sensitivity of robust protection on real data.
Yuefang Lian, Longkun Guo, Zhongrui Zhao +5
Nankai University · James Cook University · Western Sydney University +5
Minimax optimization is fundamental to adversarial learning yet suffers from severe stability challenges, often manifesting as persistent limit cycles or divergence. This paper investigates these instabilities through the lens of continuous-time dynamical systems. By modeling training dynamics as a second-order Ordinary Differential Equation (ODE), we rigorously identify the root cause of non-convergence: the problematic eigenstructure of the loss function's Hessian near equilibrium points. To address this, we introduce Controlled-Minimax, a novel stabilization framework that reformulates the optimization trajectory as a controllable physical system. Unlike heuristic regularization techniques, our approach derives a specific feedback controller that provides theoretical guarantees of local exponential stability, regardless of the underlying Hessian spectrum. Consequently, our method stabilizes general minimax problems where traditional gradient descent-ascent methods fail. Extensive experiments on pathological benchmarks including the Dirac-GAN, 2D Gaussian mixtures, and Swiss Roll datasets, as well as high-resolution image synthesis with StyleGAN2-ada, demonstrate that Controlled-Minimax effectively suppresses oscillatory behavior while ensuring fast and robust convergence.
Tianjiao Luo, Jianfei Chen, Jun Zhu
Department of Computer Science and Technology, Tsinghua University, Beijing, China.