The Role of Input Dimensionality in the Emergence and Targeted Control of Adversarial Examples

2026-06-24

AI Summary

This study investigates how input dimensionality affects the generation of adversarial examples and the difficulty of targeted attacks, evaluating the applicability of high-dimensional geometric theory to real-world data. Through concentration-of-measure analysis, experiments across multiple neural network architectures, and evaluation on hierarchical image datasets, the work reveals that real image classes exhibit strong empirical locality that exceeds predictions from classical high-dimensional assumptions. The findings demonstrate that higher input dimensions substantially reduce the difficulty of constructing adversarial examples, and the perturbation gap between targeted and non-targeted attacks diminishes as dimensionality increases—indicating that the additional cost for precise target control becomes limited in high-dimensional settings.

Abstract

Several theoretical works have tried to explain the adversarial vulnerability of deep neural networks through properties of high-dimensional geometry. However, the assumptions underlying these works are rarely examined empirically, and systematic evidence remains limited. In this work, we present a systematic study of the role of input dimensionality in both the emergence and the targeted control of adversarial examples. We first analyse the scope and limitations of existing theoretical frameworks based on concentration of measure, showing that real image classes exhibit strong empirical localization, beyond what such theories typically assume. We then conduct an extensive empirical evaluation across hierarchical image datasets spanning a wide range of input dimensionalities and diverse neural architectures. Our results consistently show that adversarial examples become easier to construct as dimensionality increases. We also investigate how input dimensionality affects the additional difficulty of crafting targeted adversarial examples. In particular, we provide theoretical arguments showing that high-dimensional geometry implies that enforcing a specific target label entails only a limited additional distortion compared to untargeted attacks. We corroborate this insight through extensive experiments, demonstrating that the gap between targeted and untargeted perturbations remains small and further narrows as input dimensionality increases. While, taken together, our findings establish high input dimensionality as a fundamental factor underlying the emergence and targeted control of adversarial examples, whether this phenomenon primarily arises from the interplay between high-dimensional geometry and data distributions or from the architectural properties of deep neural networks remains an open question.

Problem

• input dimensionality
• adversarial examples
• targeted control
• high-dimensional geometry
• adversarial vulnerability

Innovation

• input dimensionality
• adversarial examples
• targeted attacks
• high-dimensional geometry
• empirical localization