Adversarial vulnerability for any classifier

In fact, very small and often imperceptible perturbations of the data samples are sufficient to fool state-of-the-art classifiers and result in incorrect classification. This discovery of the surprising vulnerability of classifiers to perturbations has led to a large body of work that attempts to design robust classifiers. However, advances in designing robust classifiers have been accompanied with stronger perturbation schemes that easily defeat such defenses [CW17, RB17]. In fact, there is, to this date, no successful and scalable strategy to defend against adversarial perturbations. This leads to the following natural question: Is it possible to design robust classifiers against adversarial perturbations? Our main result is to prove that if the data distribution is defined by a smooth generative model with a sufficiently large latent space, then no classifier can be robust to adversarial noise.