Adversarial Attacks Leverage Interference Between Features in Superposition

2025-10-13

AI Summary

This paper investigates the fundamental origin of neural network adversarial vulnerability. Method: We propose that it arises intrinsically from efficient information encoding—specifically, feature superposition—where insufficient hidden-space dimensionality forces multiple semantic features to share overlapping representations; consequently, small input perturbations induce predictable misclassifications. We validate this mechanism in a controlled synthetic setting and empirically demonstrate on ViT/CIFAR-10 that feature superposition alone suffices to induce adversarial vulnerability, with attack patterns precisely predictable from feature permutations. Contribution/Results: Our work is the first to attribute adversarial vulnerability to the inherent trade-off of representational compression—rather than learning bias or non-robust features—establishing it as an unavoidable byproduct of efficient coding. This perspective unifies explanations for cross-model adversarial transferability and class-specific vulnerability patterns, providing a novel theoretical foundation for robustness research.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

Fundamental questions remain about when and why adversarial examples arise in neural networks, with competing views characterising them either as artifacts of the irregularities in the decision landscape or as products of sensitivity to non-robust input features. In this paper, we instead argue that adversarial vulnerability can stem from efficient information encoding in neural networks. Specifically, we show how superposition - where networks represent more features than they have dimensions - creates arrangements of latent representations that adversaries can exploit. We demonstrate that adversarial perturbations leverage interference between superposed features, making attack patterns predictable from feature arrangements. Our framework provides a mechanistic explanation for two known phenomena: adversarial attack transferability between models with similar training regimes and class-specific vulnerability patterns. In synthetic settings with precisely controlled superposition, we establish that superposition suffices to create adversarial vulnerability. We then demonstrate that these findings persist in a ViT trained on CIFAR-10. These findings reveal adversarial vulnerability can be a byproduct of networks' representational compression, rather than flaws in the learning process or non-robust inputs.

Problem

• Adversarial vulnerability stems from neural networks' efficient information encoding
• Superposition enables feature interference exploited by adversarial perturbations
• Attack patterns emerge from representational compression in neural networks

Innovation

• Adversarial attacks exploit interference between superposed features
• Superposition creates predictable adversarial vulnerability patterns
• Vulnerability stems from networks' representational compression mechanism