  Adversarial examples arise from excessive sensitivity of a model. Commonly
studied adversarial examples are malicious inputs, crafted by an adversary from
correctly classified examples, to induce misclassification. This paper studies
an intriguing, yet far overlooked consequence of the excessive sensitivity,
that is, a misclassified example can be easily perturbed to help the model to
produce correct output. Such perturbed examples look harmless, but actually can
be maliciously utilized by a false friend to make the model self-satisfied.
Thus we name them hypocritical examples. With false friends like these, a
poorly performed model could behave like a state-of-the-art one. Once a
deployer trusts the hypocritical performance and uses the "well-performed"
model in real-world applications, potential security concerns appear even in
benign environments. In this paper, we formalize the hypocritical risk for the
first time and propose a defense method specialized for hypocritical examples
by minimizing the tradeoff between natural risk and an upper bound of
hypocritical risk. Moreover, our theoretical analysis reveals connections
between adversarial risk and hypocritical risk. Extensive experiments verify
the theoretical results and the effectiveness of our proposed methods.
