Convergence of Adversarial Training in Overparametrized Neural Networks

By Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, Jason D. Lee. 2019

119 citations recorded by the source corpus.

Neural networks are vulnerable to adversarial examples, i.e. inputs that are imperceptibly perturbed from natural data and yet incorrectly classified by the network. Adversarial training, a heuristic form of robust optimization that alternates between minimization and maximization steps, has proven to be among the most successful methods to train networks to be robust against a pre-defined family of perturbations. This paper provides a partial answer to the success of adversarial training, by showing that it converges to a network where the surrogate loss with respect to the the attack algorithm is within $\epsilon$ of the optimal robust loss. Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier. The analysis technique leverages recent work on the analysis of neural networks via Neural Tangent Kernel (NTK), combined with motivation from online-learning when the maximization is solved by a heuristic, and the expressiveness of the NTK kernel in the $\ell_\infty$-norm. In addition, we also prove that robust interpolation requires more model capacity, supporting the evidence that adversarial training requires wider networks.

Subfields: Artificial Intelligence, Optimization & Training, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Optimization & Training

In Safety, Robustness & Interpretability

Citations in the corpus

Feature Purification: How Adversarial Training Performs Robust Deep Learning (2020, methodology): “ur best knowledge) the rst explanation of how, the provably non-robust features after clean training can be provably \robustied" via adversarial training. We emphasize in prior theoretical works [32, 48, 80, 106], they study 2 Histogram of à SÜáSÜ ñ Histogram of à SÜáSÝ Layer 1 Layer 2 Layer 3 ”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, methodology): “Following [21], we assume the first layer and the last layer’s weights are fixed, and W is updated via projected gradient descent with projection set B(R) = {W : ‖W −W 0 ‖F ≤ R/ √ m,h = 1, 2, .”
TRAK: Attributing Model Behavior at Scale (2023, unknown): “, 2019), and robustness (Gao et al., 2019) of (overparameterized) neural networks.”
Intriguing properties of adversarial training (2019, result): “epth, Madry et al. (2018) show increase network width also substantially improve network robustness. These empirical observations also corroborate with the recent theoretical studies (Nakkiran, 2019; Gao et al., 2019) which argues that robust adversarial learning needs much more complex classiﬁers. ”
Precise Tradeoffs in Adversarial Training for Linear Regression (2020, background): “Another line of work considers the tradeoff between standard and robust accuracy when the capacity of the learning model varies Nakkiran (2019); Gao et al. (2019).”
A Theoretical Analysis of Deep Q-Learning (2019, methodology): “he network parameters. We run the SGD updates for a total of niterations and denote the output by Qek. Besides, in each FQI-step, we initialize the parameters via the symmetric initialization scheme (Gao et al., 2019; Bai and Lee, 2019) as follows. For any j ∈[m], we set bj i.i.d.∼ Unif({−1,1}) and ”
Smooth Adversarial Training (2020, result): “. Recall that this gap for ELU is 7.9%. This case study provides another strong support on showing the importance of performing SAT. 5 Exploring the Limits of Smooth Adversarial Training Recent works [47, 11] show that, compared to standard training, adversarial training exhibits a much stronger req”
Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality (2020, methodology): “We remark the choice of loss is for simplicity of technical presentation, following the convention in previous works [14, 2].”
The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization (2020, background): “To circumvent these issues, practitioners introduce adversarial training in order to produce adversarially robust models [15, 34, 23, 43, 12, 35] that can still make consistently correct predictions, even when faced with perturbed data.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[361] provide a theoretical analysis of adversarial training to explain its success using Neural Tangent Kernel and tools from online learning.”
Towards Deep Learning Models Resistant to Large Perturbations (2020, unknown): “This result is not unexpected as it has previously been shown that adversarial training would converge irrespective of the epsilon value in a simple model setting (Gao et al., 2019).”