🤖 AI Summary
This work investigates the geometric origins of the trade-off between clean accuracy and adversarial robustness in deep learning. By introducing Symmetry-Breaking Dimension Expansion (SBDE)—a method that appends constant-valued pixels to inputs to boost accuracy—and combining it with test-time mask projection to analyze robustness effects, the study provides a clear geometric interpretation of this trade-off. For the first time, SBDE is employed as a controllable geometric probe, revealing that accuracy gains arise from the formation of sharp decision boundaries and steep loss gradients along auxiliary dimensions. Experiments on CIFAR-10 demonstrate that ResNet-18’s clean accuracy improves from 90.47% to 95.63%, while mask projection nearly fully restores adversarial robustness, confirming that the induced vulnerability indeed stems from the inserted dimensions.
📝 Abstract
The trade-off between clean accuracy and adversarial robustness is a pervasive phenomenon in deep learning, yet its geometric origin remains elusive. In this work, we utilize Symmetry-Breaking Dimensional Expansion (SBDE) as a controlled probe to investigate the mechanism underlying this trade-off. SBDE expands input images by inserting constant-valued pixels, which breaks translational symmetry and consistently improves clean accuracy (e.g., from $90.47\%$ to $95.63\%$ on CIFAR-10 with ResNet-18) by reducing parameter degeneracy. However, this accuracy gain comes at the cost of reduced robustness against iterative white-box attacks. By employing a test-time \emph{mask projection} that resets the inserted auxiliary pixels to their training values, we demonstrate that the vulnerability stems almost entirely from the inserted dimensions. The projection effectively neutralizes the attacks and restores robustness, revealing that the model achieves high accuracy by creating \emph{sharp boundaries} (steep loss gradients) specifically along the auxiliary axes. Our findings provide a concrete geometric explanation for the accuracy-robustness paradox: the optimization landscape deepens the basin of attraction to improve accuracy but inevitably erects steep walls along the auxiliary degrees of freedom, creating a fragile sensitivity to off-manifold perturbations.