Simplicial-Map Neural Networks Robust to Adversarial Examples

: Broadly speaking, an adversarial example against a classiﬁcation model occurs when a small perturbation on an input data point produces a change on the output label assigned by the model. Such adversarial examples represent a weakness for the safety of neural network applications, and many different solutions have been proposed for minimizing their effects. In this paper, we propose a new approach by means of a family of neural networks called simplicial-map neural networks constructed from an Algebraic Topology perspective. Our proposal is based on three main ideas. Firstly, given a classiﬁcation problem, both the input dataset and its set of one-hot labels will be endowed with simplicial complex structures, and a simplicial map between such complexes will be deﬁned. Secondly, a neural network characterizing the classiﬁcation problem will be built from such a simplicial map. Finally, by considering barycentric subdivisions of the simplicial complexes, a decision boundary will be computed to make the neural network robust to adversarial attacks of a given size.


Introduction
Adversarial examples are currently one of the main problems for the robustness of neural networks applications [1]. Broadly speaking, an adversarial example against a classification model occurs when a small perturbation on an input data point produces a change on its classification. Adversarial examples are usually associated with computer vision tasks [2]. In this context, small generally refers to changes that are not appreciable by human perception. Recently, several studies have shown that adversarial examples also appear in other contexts such as natural language processing [3], multivariate time series [4] or recommendation systems [5]. Therefore, the study of adversarial examples is of an undoubted importance for building reliable models, and also leads us to wonder about the mechanisms of our brain and the differences between artificial and natural classification processes.
Since the discovery of adversarial examples as a weakness for the safety of neural network models in real-world problems, many attacks and defenses have been proposed [6], each of which builds on the other. One of the most popular approaches to study models' robustness and adversarial examples is based on the concept of margin. From a geometrical point of view, data are points in an d-dimensional metric space and a classifier splits such a metric space into regions. In a classification problem, each region is associated with a label and all the points in such a region are classified with the corresponding label. Roughly speaking, the margin of the model is the minimum distance between the training data and the decision boundary (i.e., the set of regions' boundaries). In the literature, there are many approaches that try to maximize such a margin (see, for instance, [7]). The concept of margin in Neural Network is strongly influenced by its use in Support Vector Machines (SVMs) [8]. In such way, in [9], the final softmax layer of the neural network is replaced with a linear SVM. In [10], a way of reducing empirical margin errors was proposed, and in [11], the discriminability of Deep Neural Networks (DNNs) features is enhanced via an ensemble strategy.
In this paper, we explore this idea of margin between regions associated with labels from a novel point of view. To the best of our knowledge, this is the first time where adversarial examples are studied with techniques from Algebraic Topology. Our approach can be summarized as follows. The starting point is a classification problem where the data are d-dimensional vectors which are mapped onto a set of k labels with a one-hot representation. From a topological point of view, such set of instances can be seen as the vertices of a simplicial complex embedded in a bounded polytope in R d (details are given below), and the set of k one-hot labels can be endowed with the structure of a kdimensional simplex (in fact, k + 1 labels are considered since we add an unknown label to the set of one-hot labels). In this way, a simplicial map between both topological structures arises in a natural manner, since each vertex in the simplicial complex corresponds to an instance of the dataset, and it is mapped onto the vertex of the simplex that represents the corresponding label. The second step is to apply the extended Simplicial Approximation Theorem [12] that allows us to provide a constructive proof of the Universal Approximation Theorem obtaining a a neural network that classifies correctly all the instances of the dataset. As shown in [12], all the weights of such a neural network can be computed directly from the simplicial complexes without any kind of training processes. Finally, by considering these ideas together with a subdivision process of the simplices, a decision boundary for the classification problem will be computed to make the neural network robust to adversarial attacks of a given size, since the mesh of a simplicial complex can be bounded by the number of subdivisions and the neural network obtained is based on the simplices used in the simplicial map.
Regarding other approaches to these ideas found in the literature, in [13], the authors proved the existence of a two-hidden-layer neural network which can approximate any continuous multivariable function with arbitrary precision, and, in [14], they provided a constructive method through a numerical analysis approach. Therefore, such papers can be seen as alternative constructive proofs to the Universal Approximation Theorem where no adversarial examples on classification problems were considered. A related approach that uses simplicial complexes to feed a neural network, is the concept of Simplicial Neural Network (SNN), provided in [15], that consists of a generalization of Graph Neural Networks (GNNs) with the property that compared to GNNs, SNNs exploit higher order relationships between the input data due to representing the data using simplicial complexes. Let us observe that, although having a similar name, our approach has a totally different goal.
The paper is organized as follows. In Section 2, all the basic concepts needed to understand the rest of the paper are presented. In Section 3, we introduce the concept of simplicial-map neural networks. Their use to build neural networks for classification tasks robust to adversarial attacks of a given size is presented in Section 4. The paper ends with conclusions and future works listed in Section 5.

Background
In this section, some of the preliminary concepts from Algebraic Topology and Neural Networks are recalled. Several useful references for this section are [16][17][18][19]. Let us notice that, in order to provide a bridge between Algebraic Topology and Neural Network, some concepts need to be reinterpreted.
Firstly, let us state some basic notation. Given two integers j ≤ m, let j, m := {i ∈ Z : j ≤ i ≤ m}. Hereafter, let k > 0 be an integer and let e k 0 := (0, . . . , 0) be the origin of the Euclidean space R k . Let a one-hot vector of length k be denoted as e k i = (0, , 0, 0) = e k+1 i for i ∈ 1, k and e k 0 × 1 := (0, k · · ·, 0, 1) = e k+1 k+1 . Now, we recall different fundamental structures such as polytopes and simplicial complexes. Convex polytopes can be seen as a generalization in any dimension of the notion of polygons. Definition 1. The convex hull of a set S ⊂ R d , denoted by conv(S), is the smallest convex set containing S. A convex polytope P in R d is the convex hull of a finite set of points. Besides, the set of vertices of a convex polytope P is the minimum set V P of points in P such that P = conv(V P ).
Accordingly, a convex polytope P = conv(S) is a closed bounded subset of R d , and the set of vertices V P of a convex polytope P always exists and it is unique. A particular case of convex polytopes are simplices. Geometrically, a simplex is a generalization of a triangle to any dimension. For example, a 0-simplex is a point, a 1-simplex is a line segment, a 2simplex is a triangle, a 3-simplex is a tetrahedron, and so on. In this paper, all the considered simplicial complexes have their vertices in the Euclidean space R d . Nevertheless, simplicial complexes can be defined abstractly.

Definition 2.
Let us consider a finite set V whose elements will be called vertices. A simplicial complex K consists of a finite collection of nonempty subsets (called simplices) of V such that:

1.
Any subset of V with exactly one point of V is a simplex of K called 0-simplex or vertex.

2.
Any nonempty subset of a simplex σ is a simplex, called a face of σ.
A simplex σ with exactly k + 1 points is called a k-simplex. We also say that the dimension of σ is k and write dim σ = k. A maximal simplex of K is a simplex that is not face of any other simplex in K. The dimension of K is denoted by dim K and it is the maximum dimension of its maximal simplices. The set of vertices of a simplicial complex K will be denoted by K (0) . For a vertex v of V, the star of v is the set of simplices having v as a face and it is denoted by st v. A simplicial complex K is pure if all its maximal simplices have the same dimension.
Let us consider a simplicial complex K whose vertices are in R d . If a k-simplex σ of K satisfies that it is a set of affinely independent points, then its realization |σ| is the convex polytope |σ| = conv(σ), which is the convex hull of its k + 1 vertices. If all the simplices of K have a realization in R d satisfying that the intersection of two realizations is the realization of a simplex of K, then the union of their realizations is a subspace of R d denoted by |K| and called the embedding of K in R d .
Next, the definition of triangulation of a convex polytope is recalled.

Definition 3.
A triangulation of a convex polytope P is a simplicial complex K such that |K| = P.
Let us recall that given a set S = {p 1 , . . . , p n } of points in R d , its barycenter, denoted by bar S, is bar S := 1 n ∑ i∈ 1,n p i ∈ R d . In particular, bar{p} = p for p ∈ R d . The barycentric subdivision of a simplicial complex will be the main tool to refine the neural network in the next sections and consists of getting a new simplicial complex by splitting the simplices in a standard way (see Figure 1). The t-th iteration of the barycentric subdivision of a simplicial complex K will be denoted by Sd t K being Sd 0 K := K. Next definition provides a formalization of this idea. Definition 4. Let K be a simplicial complex with vertices in R d . The barycentric subdivision Sd K is the simplicial complex defined as follows. The set (Sd K) (0) of vertices of Sd K is the set of barycenters of all the simplices of K. The simplices of Sd K are the finite nonempty collections of (Sd K) (0) which are totally ordered by the face relation in K. That is, any k-simplex σ of Sd K can be written as an ordered set {w 0 , . . . , w k } such that w i = bar µ i being µ i a face of µ j ∈ K for i, j ∈ 0, k and i < j. In particular, if σ is maximal then there exists a k-simplex {u 0 , . . . , u k } ∈ K satisfying that w i = bar{u 0 , . . . , u i } for i ∈ 0, k .
Let us recall the definition of the Voronoi diagram of a set of points.
Then, the Voronoi diagram of S, denoted as V (S), is the set of Voronoi cells: From the Voronoi diagram V (S), a particular simplicial complex, called the Delaunay complex of S and denoted as D (S), can be constructed. Both structured can be computed in time Θ(n log n + n d 2 ) (see [17], Chapter 4). Definition 6. Given a finite set of points S = {p 1 , . . . , p n } in R d and its Voronoi diagram V (S) = {V (p 1 , S), . . . , V (ps n , S)}, the Delaunay complex of S can be defined as: The Delaunay complex is a well-defined concept in the sense that D (S) is always a simplicial complex [17]. Usually, a finite set of points S ⊂ R d is said to be in general position when any subset of S with size at most d + 1 is a set of affinely independent points. When the set of points S ⊂ R d is in general position, then the embedding of the Delaunay complex D (S) in R d is a triangulation of P = conv(S). In Figure 2, an example of the computation of a triangulation of a convex polytope P, being the Delaunay complex of the set of vertices of P together with a labelled dataset lying in the interior of P, is provided.
Given a labelled dataset D, a convex polytope P containing D can be computed. Then, the simplicial complex K can be obtained using the Delaunay triangulation of all the points of D and the vertices of P.
Let us see now how to define maps between simplicial complexes.

Definition 7.
Given two simplicial complexes K and L, a vertex map ϕ (0) : K (0) → L (0) is a function from the vertices of K to the vertices of L such that for any simplex σ ∈ K, the set Let us observe that ϕ(u) = ϕ (0) (u) if u ∈ K (0) and the composition of vertex maps is a vertex map. Let us see now that a vertex map ϕ (0) : K (0) → L (0) can always be extended to a continuous function ϕ c : |K| → |L| satisfying that if x = bar σ then ϕ c (x) = bar ϕ(σ).

Definition 8.
The simplicial map ϕ c : |K| → |L| induced by the vertex map ϕ (0) : is a continuous function defined as follows. Let x ∈ |K|. Then, Next, we recall one of the key ideas in this paper. Simplicial maps can be used to approximate continuous functions as closed as desired. Definition 9. Let K and L be simplicial complexes and g : |K| → |L| a continuous function. A simplicial map ϕ c : |K| → |L| induced by a vertex map ϕ (0) : Let us notice that | st x| is thought here as an open set of points. That is, | st x| := ∪ σ∈st x int σ. Theorem 1. Simplicial Approximation Theorem ( [20], p. 56) If g : |K| → |L| is a continuous function between the underlying spaces of two simplicial complexes K and L, then there is a sufficiently large integer t > 0 such that ϕ c : |Sd t K| → |L| is a simplicial approximation of g.
In Figure 3, an example of a simplicial approximation is provided. Theorem 1 was extended in [12] by introducing a bound to the distance between the continuous function and its simplicial approximation.  [12]). Given > 0 and a continuous function g : |K| → |L| between the underlying spaces of two simplicial complexes K and L, there exists s, t > 0 such that ϕ c : | Sd s K| → | Sd t L| is a simplicial approximation of g and ||g − ϕ c || ≤ .

Proposition 1 (Simplicial Approximation Theorem Extension
Once concepts from Algebraic Topology have been stated, let us provide the definition of neural network, and a connection between these two fields using results from [12]. Definition 10 (adapted from [19]). Given d, k > 0, a multi-layer feed-forward network defined between spaces X ⊆ R d and Y ⊆ R k is a function N : X → Y composed by m + 1 functions: where the integer m > 0 is the number of hidden layers and, for i ∈ 1, m + 1 , the function f i : and d i > 0 being an integer for i ∈ 1, m (called the width of the i-th hidden layer); W (i) ∈ M d i−1 ×d i being a real-valued d i−1 × d i matrix (called the matrix of weights of N ); b i being a point in R d i (called the bias term); and φ i being a function (called the activation function).
In the literature, many other definitions of neural networks are available. The field is continuously adding new ideas and there is not a general definition which covers all the possible approaches, but many of the problems where neural networks are applied are based on the idea of finding a set of weights and bias where the remaining features of the neural network (number of hidden layers, their dimension, and activation functions) are settled at the beginning of the problem. As usual, such set of features of the neural network beyond the weights and the bias, will be called the architecture of the neural network. A constructive method for approximating multidimensional functions with neural networks was provided in [12]. Such networks have two hidden layers and the weights are not obtained by a training method, but they are determined by a given simplicial map.
Theorem 2 (Theorem 4 of [12]). Let us consider a simplicial map ϕ c : |K| → |L| between the embedding of two finite pure simplicial complexes K and L of dimension d and k, respectively. Then a two-hidden-layer feed-forward network N ϕ : |K| → |L| such that N ϕ (x) = ϕ c (x) for all x ∈ |K| can be explicitly defined.
The construction of the neural network given in [12] to prove Theorem 2 gives rise to the concept of simplicial-map neural network introduced in the next section.

Simplicial-Map Neural Networks
The explicit construction of the neural network given in [12] is the main tool used in this paper for computing neural networks robust to adversarial attacks. Such a concrete construction is called simplicial-map neural network.
 and the function φ 1 is then defined as: being h = j(r + 1) and = s(t + 1) for s ∈ 1, n ; j ∈ 1, m ; t ∈ 0, d ; and r ∈ 0, k . The bias term b 2 ∈ R m(k+1) is null and the function φ 2 is defined as: the bias term b 3 is null, and φ 3 is defined as: being z j := W In [12], it is proven that N ϕ (x) and ϕ c (x) coincide for all x ∈ |K|.

Classification with Simplicial-Map Neural Networks
In this section, simplicial-map neural networks are considered as tools for classification tasks and for the study of adversarial examples. As usual, the classification problem will consist of finding a set of weights adapted to a labelled dataset given a fixed architecture. Definition 12. Let n, d, k > 0 be integers. A labelled dataset D is a finite set of pairs where, for j, h ∈ 1, n , p j = p h if j = h, and j represents a one-hot vector. We say that j is the label of p j or, equivalently, that p j belongs to the class j . Besides, we will denote by D P the ordered set of points p j j .
The concept of supervised classification problem for neural networks can be defined as follows.
Definition 13. Given a labelled dataset D ⊂ R d × E k , an integer m > 0, and activation functions φ i for i ∈ 1, m , a supervised classification problem consists of looking for the weights W (i) and bias terms b i for i ∈ 1, m , such that the associated neural network N : X → Y, with X ⊆ R d , Y ⊆ R k and D ⊆ X × Y, satisfies: N maps x ∈ X to a vector of scores N (x) = (y 1 , . . . , y k ) ∈ Y such that y i ∈ [0, 1] for i ∈ 1, n and ∑ i∈ 1,n y i = 1.
If such a neural network N exists, we will say that N characterizes D, or, equivalently, that N correctly classifies D.
Let us remark that the success of a classification model as a neural network is not usually measured on the correct classification on the input dataset, but on the correct classification of unseen examples, (that is, pairs not in D), collected in a test set. In this paper, we chose such a restrictive definition since we are more interested in dealing with the problem of the robustness of neural networks against adversarial attacks than in the problem of overfitting. Besides, let us observe that, as usual, the scores can be interpreted as a probability distribution over the labels.

Remark 1.
It is known that some functions like the logistic sigmoid, the softmax or the softplus satisfy the properties of a probability distribution and they are broadly applied in deep learning models. Our function also behaves like a probability distribution which is adequate for multiclassification tasks.
Next, we provide the definition of some of the main concepts in this paper, the confidence set T N , the classified set C N , and the decision boundary Γ N of N . The intuition behind these concepts is that x belongs to the confidence set of N if the output N (x) is one of the possible one-hot vectors. If the output is a vector where the maximum is reached in exactly one coordinate, we say that x belongs to the classified set of N . Otherwise, the output is a vector where the maximum is reached in two or more coordinates, i.e., the instance has equal probability to belong to two or more output classes, then we say that x belongs to the decision boundary of N . Let us observe that T N ⊆ C N and C N Γ N = X. Definition 14. Let d, k > 0 be integers. Let D ⊂ R d × E k be a labelled dataset and N : X → Y a neural network that characterizes D. Let x ∈ X, with N (x) = (y 1 , . . . , y k ) ∈ Y. If there exists j ∈ 1, k such that y j > max{y i : i ∈ 1, k , i = j}, then we say that x belongs to the set C j N and it has label e j ∈ E k (with probability y j ). Moreover, we define C N to be the union of the sets C j N for j ∈ 0, k . Besides, when y j = 1, we say that x belong to the confidence set T N . Finally, we say that x belongs to the decision boundary Γ N if there exists j ∈ 1, n such that y j = max{y i : i ∈ 1, k , i = j}.
The following is a key result to define a simplicial-map neural network that characterizes a given labelled dataset.

Proposition 3.
Let d, k > 0 be integers. Let L be the simplicial complex with only one maximal k-simplex σ = {v 0 , . . . , v k } with v i = e k i × 0 for i ∈ 1, k and v 0 = e k 0 × 1. Let D ⊂ R d × E k be a labelled dataset and let V P be the vertices of a convex polytope P such that D P ⊂ P. Let us assume that D P is in general position. Let K = D (D P ∪ V P ). Then, the map ϕ (0) : K (0) → L (0) defined as follows is a vertex map: Proof. L is composedof a maximal simplex. Any subset of vertices of a simplex is a simplex by definition. Then, any map between vertices of K (0) to L (0) is a vertex map. Specifically, ϕ (0) is a vertex map.
By abuse of notation, we will say that a point y ∈ R k with barycentric coordinates (y 0 , . . . , y k ) has label j ∈ 0, k if y j > max{y i : i ∈ 0, k , i = j}. Let us notice that an unknown label has been assigned to the vertex v 0 of L. Proof. By Proposition 2, the neural network N ϕ satisfies that N ϕ (x) = ϕ c (x) for all x ∈ |D (D P ∪ V P )|. Besides, let us observe that the Cartesian coordinates of N ϕ (x) coincide with its barycentric coordinates. Moreover, for all x ∈ D P , N ϕ (x) = ϕ (0) (x) and, by definition, Then, we can conclude that N ϕ characterizes D.
Again, by abuse of notation, when N ϕ is a simplicial-map neural network, we will denote by T ϕ , C ϕ , and Γ ϕ , its confidence set, classified set and decision boundary, respectively.

Remark 2.
Firstly, let us observe that, with the assumptions of Proposition 3, if x ∈ R d belongs to the decision boundary Γ ϕ then x ∈ |σ| for some σ ∈ K satisfying that there are at least two vertices in σ having different labels. Moreover, x ∈ |µ| for some µ ∈ Sd K with all its vertices in Γ ϕ . Secondly, if σ is a d-simplex in Sd K, then either all its vertices belong to the confidence set T ϕ or σ = σ 1 ∪ σ 2 with σ 1 , σ 2 ∈ Sd K satisfying that |σ 1 | ⊆ Γ ϕ and |σ 2 | ⊆ T ϕ . Finally, if σ is a d-simplex in Sd t K for t > 0 then either all its vertices belong to the classified subset C j ϕ for some j ∈ 0, k , or σ = σ 1 ∪ σ 2 with σ 1 , σ 2 ∈ Sd t K satisfying that |σ 1 | ⊆ Γ ϕ and ∅ = |σ| \ |σ 1 | ⊆ C j ϕ .
As the following result states, when K = D (D P ∪ V P ), we can obtain a vertex map ϕ (0) t from (Sd t K) (0) to (Sd t L) (0) applying the barycentric subdivision, inducing a neural network N ϕ t that coincides with N ϕ for any integer t > 0. Figure 4 illustrates these concepts.
is a vertex map inducing a neural network N ϕ t that coincides with N ϕ for any integer t ≥ 0.
Proof. Let t > 0 be an integer. Let us observe that ϕ (0) 0 is a vertex map. By induction, let us assume that ϕ By definition of barycentric subdivision, we can assume that σ = {w 0 , . . . , w k } with w i = bar µ i , being µ i a face of µ j ∈ Sd t−1 K for i, j ∈ 0, k and i < j.

Now, let us observe that
for all i ∈ 0, d . Then, for all x ∈ |K|, with λ i ∈ [0, 1] for all i ∈ 0, d and ∑ i∈ 0,d λ i = 1, concluding the proof.

Computing Simplicial-Map Neural Networks Robust to Adversarial Attacks
In this subsection, the main result of the paper is provided. It states that we can always compute a neural network characterizing a given labelled dataset, and being robust to adversarial attacks of a given size. Firstly, let us define the concepts of adversarial example and robustness of neural networks against adversarial attacks. Some interesting references on these concepts are [21,22]. Definition 15. Let d, k > 0 be integers. Let D ⊂ R d × E k be a labelled dataset and N a neural network that characterizes D. Let B(r) = {α ∈ R d : ||α|| ≤ r} being || · || a norm on R d . Let us suppose that x ∈ R d has label . Then, an adversarial example of size r is defined as x = x + α with α ∈ B(r) such that x has label with = . A neural network is called robust to adversarial attacks of size r if no labelled point x ∈ R d has an adversarial example of size r.

Proposition 5.
With the assumptions of Proposition 4, we have that N ϕ is not robust to adversarial attacks of size r for 0 < r < d(T ϕ , Γ ϕ ).
Proof. By Remark 2, consider σ ∈ K such that there exist v and w being two vertices of σ with different labels. Let z = bar{v, w}. Then z is in the decision boundary of |K| and {v, z}, {z, w} are edges of Sd K. Let x = (1 − a)z + av where a = r 2d (z,v) . Then x has the same label as v and d(x, z) = r 2 . Let x = (1 − a )z + a w where a = r 2d(z,w) . Then x has the same label as w and d(z, x ) = r 2 . Then, d(x, x ) = d(x, z) + d(z, x ) = r concluding that x is an adversarial example of size r and 0 < r < d(T ϕ , Γ ϕ ).  Figure 5. Let x = (6 − a, 6 + a) ∈ |K|, with a ∈ (0, 2], be in the geometric realization of the segment with endpoints {(4, 8), (8,4)}. Then, ϕ c (x) = (c, d, 0) with 0 ≤ c < 1 2 and 1 2 < d ≤ 1. Therefore, x is classified as (0, 1, 0) with probability d. Take z = (6, 6). Then, z belongs to the decision boundary since ϕ c (z) = ( 1 2 , 1 2 , 0). Take x = (6 + a, 6 − a). Then, ϕ c (x) = (c , d , 0) with 1 2 < c ≤ 1 and 0 ≤ d < 1 2 . Therefore, x is classified as (1, 0, 0) with probability d . Since d(x, z) = a √ 2 = d(x , z) and a ∈ (0, 2], then N ϕ is not robust to adversarial attacks of any size r with 0 < r ≤ 4 √ 2. See Figure 5. Let us now introduce the main result of this paper stating that there exists a twohidden-layer neural network characterizing a given labelled dataset and being robust to adversarial attacks of size r > 0 for r being small enough. In order to define such a neural network robust to adversarial examples, we will construct a continuous function from |K| to |K| with the idea of later applying the Simplicial Approximation Theorem and the composition of simplicial maps to obtain a simplicial map from |K| to |L| that will give rise to a neural network robust to adversarial attacks of a given size r > 0. Let us observe that, to be able to compute such a robust neural network, the size r should be smaller than the distance between the decision boundary and the confidence set. Theorem 3. Let n, d, k > 0 be integers. Let D = {(p j , j ): j ∈ 1, n , p j ∈ R d , j ∈ E k } be a labelled dataset. Then, there exists a two-hidden-layer neural network N characterizing D and robust to adversarial attacks of size r > 0, for r being small enough.
Proof. Let us consider a convex polytope P such that the points of D P are inside P. Then, we can compute the Delaunay complex D (D P ∪ V P ) that will be denoted simply by K (see Figure 4), and a simplicial complex L composed of just one maximal k-simplex. As claimed in Proposition 4, a simplicial map ϕ c can be defined between |K| and |L| giving rise to a neural network N ϕ that characterizes D (see Proposition 2). However, N ϕ is not robust to adversarial attacks (see Proposition 5). Our goal is to define a new simplicial map such that its associated simplicial-map neural network is robust to adversarial attacks. To reach that aim, we need r to be small enough, that is, 0 < r < d(T ϕ , Γ ϕ ), where d(T ϕ , Γ ϕ ) = min{d(p, q) : p ∈ T ϕ , q ∈ Γ ϕ }, so adversarial attacks will be placed between the confidence set T ϕ and the decision boundary Γ ϕ . Then, a continuous function g : | Sd K| → | Sd K| will be defined depending on such r, to later apply the Simplicial Approximation Theorem Extension (Proposition 1), obtaining a simplicial approximation ω c : Sd s K → Sd t K of g as close to g as desired. Then, ϕ c t • ω c : |K| → |L| will be a simplicial map giving rise to a simplicial-map neural network N ϕ t •ω robust to adversarial attacks of size r.
Let us define now the continuous function g : | Sd K| → | Sd K|. Let σ = {u 0 , . . . , u d } be a d-simplex of Sd K. Let us observe that, by Remark 2, the vertices of σ satisfy the following property: • All the vertices of σ are in T ϕ . Then, |σ| ⊆ T ϕ .
Let us compute the set of points of |σ| at distance less than r to |σ 1 | and let us send, by g, such points to points in |σ 1 |.
Let x be a point of |σ| with barycentric coordinates (x 0 , . . . , x d ) with respect to σ. Let λ = ∑ i∈ 0,h x i . Let z 1 ∈ R d be the projection of x in |σ 1 | whose barycentric coordinates with respect to σ are: (z 0 , . . . , z h , 0, . . . , 0), where z i = x i λ for i ∈ 0, h . Let z 2 be the point in |σ 2 | with barycentric coordinates (0, . . . , 0, z h+1 , . . . , z d ) with respect to σ, aligned with x and z 1 . Then, Let us observe that a ∈ [0, 1] and for a = ε, we have that a = 0 so (1 − a )z 1 + a z 2 = z 1 . Besides, for a = 1, we have that a = 1 so (1 − a )z 1 + a z 2 = z 2 . Let us prove that g is continuous at any point x ∈ |K|. Let us observe that, by construction, g is continuous in the interior of |σ| of every d-simplex σ ∈ Sd K.
By Remark 2, we have to consider two cases: (1) All the vertices of γ belong to T ϕ . Then γ ⊆ σ 2 ∩ µ 2 and g(x) = x.
Let us prove now that N ϕ t •ω is robust to adversarial attacks of size r. First of all, the following properties holds: (2) Let v ∈ (Sd t K) (0) and z ∈ | st v|. If v ∈ C j ϕ t then z ∈ C j ϕ t , being j ∈ 0, k . Since z ∈ | st v| then z ∈ |σ| for a d-simplex σ ∈ Sd t K with v ∈ σ. Then, by Remark 2, By contradiction, let us assume that g(x) ∈ Γ ϕ t and x ∈ C j ϕ t •ω for some j ∈ 0, k . Then, g(x) ∈ C j ϕ t by (2), leading to a contradiction. (5) Let x ∈ | Sd s K|. If g(x) ∈ C j ϕ t with probability y j and x ∈ C j ϕ t •ω then j = j and |y j − y j | < r 1 . This last statement is a consequence of (2) and that ||g − ω c || < r 1 . Now, let x ∈ C j ϕ t •ω being j ∈ 0, k . Let α ∈ R d with ||α|| < r and let x := x + α. Let us prove that x ∈ Γ ϕ t •ω or x ∈ C j ϕ t •ω . On one hand, if g(x ) ∈ Γ ϕ t then x ∈ Γ ϕ t •ω by (4). On the other hand, if g(x ) ∈ C j ϕ t then x ∈ C j ϕ t •ω or x ∈ Γ ϕ t •ω by (3), concluding the proof.

Example 2.
Let us consider a labelled dataset D = {(p, 1)} with p ∈ R composed of just one point. Let P be a segment with endpoints p 1 and p 2 in R such that p 1 < p < p 2 . Let r ∈ R such that 0 < r < min{|p 1 − p|, |p 2 − p|}. Let K be the Delaunay complex of {p, p 1 , p 2 } that consists of just the two maximal simplices {p, p 1 } and {p, p 2 }. Let L be a simplicial complex composed by a maximal 1-simplex with endpoints v 0 = (0, 1) and v 1 = (1, 0). Then, a simplicial map ϕ c can be defined as in Proposition 3 together with a neural network N ϕ as in Proposition 4. However, N ϕ is not robust to attacks of size r as it has been proved in Proposition 5. Then, following the proof of Theorem 3, in Figure 6, we have computed barycentric subdivisions on K until we approximate g by the simplicial map ω c : | Sd 3 K| → | Sd 2 K|. Finally, the neural network induced by the composition ϕ c 2 • ω c is robust to adversarial attacks of size r. Figure 6. Three simplicial complexes with simplicial maps ω c and ϕ c 2 between them are shown illustrating a neural network N ϕ 2 •ω robust to adversarial attacks of size r.

Conclusions and Future Work
Neural networks are one of the most promising tools in artificial intelligence and, currently, with the big success on real-world problem of Deep Learning architectures, it has become one of the most widely used. From a mathematical point of view, neural network can be seen as the composition of a big amount of simple functions, mainly from linear algebra, and the so-called activation functions. Since the efficiency of such neural networks depends of the choice of an appropriate set of parameters, most of the efforts in the study of such networks has been focused on optimization techniques. After a first wave of research based on these optimization techniques, many researchers are considering the study of neural networks by using different mathematical techniques as analysis, geometry or, as in this paper, algebraic topology.
Specifically, in this paper, we have presented a family of neural networks, called simplicial-map neural networks, that are robust to adversarial examples. The main contribution of the paper is a constructive proof that shows how to define a neural network robust to adversarial attacks of a given size. This result is proven thanks to the connection of neural networks with concepts from Algebraic Topology. By endowing the set of instances of a classification problem with the structure of simplicial complex and considering the set of one-hot labels as a simplex, provides a new point of view that allows to find the exact values of the weights of the associated network without any kind of training or optimization process.
Finally, we plan to provide an implementation of our methods that takes into account the efficiency issues that arise in creating neural networks following our approach. We believe that this point of view opens a new bridge between Neural Network and Algebraic Topology which can lead to a fruitful flow of concepts, problems and solutions in both directions.