Hostname: page-component-76d6cb85b7-lrvh5 Total loading time: 0 Render date: 2026-07-11T07:35:50.383Z Has data issue: false hasContentIssue false

The mathematics of adversarial attacks in AI – why deep learning is unstable despite the existence of stable neural networks

Published online by Cambridge University Press:  18 November 2025

Alexander Bastounis
Affiliation:
Department of Mathematics, King’s College London, London, UK
Anders Hansen*
Affiliation:
DAMTP, University of Cambridge, Cambridge, UK
Verner Vlačić
Affiliation:
D-ITET, ETH Zürich, Zürich, Switzerland
*
Corresponding author: Anders Hansen; Email: ach70@cam.ac.uk
Rights & Permissions [Opens in a new window]

Abstract

The unprecedented success of deep learning (DL) makes it unchallenged when it comes to classification problems. However, it is well established that the current DL methodology produces universally unstable neural networks (NNs). The instability problem has caused a substantial research effort – with a vast literature on so-called adversarial attacks – yet there has been no solution to the problem. Our paper addresses why there has been no solution to the problem, as we prove the following: any training procedure based on training rectified linear unit (ReLU) neural networks for classification problems with a fixed architecture will yield neural networks that are either inaccurate or unstable (if accurate) – despite the provable existence of both accurate and stable neural networks for the same classification problems. The key is that the stable and accurate neural networks must have variable dimensions depending on the input, in particular, variable dimensions is a necessary condition for stability. Our result points towards the paradox that accurate and stable neural networks exist; however, modern algorithms do not compute them. This yields the question: if the existence of neural networks with desirable properties can be proven, can one also find algorithms that compute them? There are cases in mathematics where provable existence implies computability, but will this be the case for neural networks? The contrary is true, as we demonstrate how neural networks can provably exist as approximate minimisers to standard optimisation problems with standard cost functions; however, no randomised algorithm can compute them with probability better than $1/2$.

Information

Type
Papers
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution and reproduction, provided the original article is properly cited.
Copyright
© The Author(s), 2025. Published by Cambridge University Press
Figure 0

Figure 1 (Training with fixed architecture yields instability – variable dimensions on NNs is necessary for stability for ReLu NNs). A visual interpretation of Theorem 2.2. A fixed dimension training procedure can lead to excellent performance and yet be highly susceptible to adversarial attacks, even if there exists a NN which has both great performance and excellent stability properties. However, such a stable and accurate ReLu network must have variable dimensions depending on the input.