Adversarial examples are modified samples that preserve original image structures but deviate classifiers. Researchers have put efforts into developing methods for generating adversarial examples and finding out origins. Past research put much attention on decision boundary changes caused by these methods. This paper, in contrast, discusses the origin of adversarial examples from a more underlying knowledge representation point of view. Human beings can learn and classify prototypes as well as transformations of objects. While neural networks store learned knowledge in a more hybrid way of combining all prototypes and transformations as a whole distribution. Hybrid storage may lead to lower distances between different classes so that small modifications can mislead the classifier. A one-step distribution imitation method is designed to imitate distribution of the nearest different class neighbor. Experiments show that simply by imitating distributions from a training set without any knowledge of the classifier can still lead to obvious impacts on classification results from deep networks. It also implies that adversarial examples can be in more forms than small perturbations. Potential ways of alleviating adversarial examples are discussed from the representation point of view. The first path is to change the encoding of data sent to the training step. Training data that are more prototypical can help seize more robust and accurate structural knowledge. The second path requires constructing learning frameworks with improved representations. With the more widespread use of deep neural networks, the robustness and security of these networks have aroused the attention of both academic and industrial eyes. Among these adversarial examples is one of the most interesting as well as intriguing.Since the discovery of adversarial examples in CNNs from 2013Szegedy et al. (2013 , security and robustness has become a hot topic. Researchers have put efforts into finding out sources for adversarial examples and also developing methods for automatically generating these adversarial examplesGoodfellow et al. (2014) .Most these research focus on how certain perturbations lead to changes in decision boundaries. This paper discusses the origin of adversarial examples from a more underlying knowledge representation point of view. It provides a possible reason why adversarial examples exist for current networks and uses some experiments to prove this idea. Experiments also in some way show that adversarial examples can be derived from only the training data and totally network-independent. In addition , adversarial examples may be in more forms than the usual small perturbations. At last, possible ways to alleviate this issue are discussed. In summary, this paper discusses the origin of adversarial examples from an underlying knowledge representation point of view. Neural networks store learned knowledge in a more hybrid way that combining all prototypes and transformation distributions as a whole. This hybrid storage may lead to lower distances between different classes so that small modifications may mislead the classifier.
Hybird storage and representation of learned knowledge may be a reason for adversarial examples.