Seeing is not always believing: The Space of Harmless Perturbations
Lu Chen Shaofeng Li Benhao Huang Fan Yang Zheng Li Jie Li Yuan Luo
In the context of deep neural networks, we expose the existence of a harmless
perturbation space, where perturbations leave the network output entirely
unaltered. Perturbations within this harmless perturbation space, regardless of
their magnitude when applied to images, exhibit no impact on the network's
outputs of the original images. Specifically, given any linear layer within the
network, where the input dimension $n$ exceeds the output dimension $m$, we
demonstrate the existence of a continuous harmless perturbation subspace with a
dimension of $(n-m)$. Inspired by this, we solve for a family of general
perturbations that consistently influence the network output, irrespective of
their magnitudes. With these theoretical findings, we explore the application
of harmless perturbations for privacy-preserving data usage. Our work reveals
the difference between DNNs and human perception that the significant
perturbations captured by humans may not affect the recognition of DNNs. As a
result, we utilize this gap to design a type of harmless perturbation that is
meaningless for humans while maintaining its recognizable features for DNNs.