# Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality

NIPS 2020, 2020.

EI

Weibo:

Abstract:

Adversarial training is a popular method to give neural nets robustness against adversarial perturbations. In practice adversarial training leads to low robust training loss. However, a rigorous explanation for why this happens under natural conditions is still missing. Recently a convergence theory for standard (non-adversarial) superv...More

Code:

Data:

Introduction

- Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013].
- For two-layer nets with quadratic ReLU activation1 they were able to show that if input is in Rd training can achieve robust loss at most provided the net’s width is (1/ )Ω(d)2.
- That there exists a two-layer ReLU neural network with width poly (d, n/ ) near Gaussian random initialization that achieves robust training loss.

Highlights

- Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013]
- Much effort has been spent to make deep nets resistant to such perturbations but adversarial training with a natural min-max objective Madry et al [2018] stands out as one of the most effective approaches according to Carlini and Wagner [2017], Athalye et al [2018]
- We’re interested in theoretical understanding of this phenomenon: Why does adversarial training efficiently find a feasibly sized neural net to fit training data robustly? In the last couple of years, a convergence theory has been developed for non-adversarial training: it explains the ability of gradient descent to achieve small training loss, provided the neural nets are fairly over-parametrized
- We have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results
- This may serve as an explanation for small loss achieved by adversarial training in practice

Results

- That starting from Gaussian random initialization, standard adversarial training (Algorithm 1) converges to such a network in poly (d, n/ ) iterations.
- New result in approximation theory, the existence of a good approximation to the step function by a polynomially wide two-layer ReLU network with weights close to the standard gaussian initialization.
- They prove that adversarial training with an artificial projection step always finds a multi-layer ReLU net that is -optimal within the neighborhood near initialization, but the optimal robust loss could be large.
- For two-layer quadratic ReLU net, they managed to prove that small adversarial loss will be achieved, but crucially the required width and running time are (1/ )Ω(d).
- The authors use A∗ to denote the worst-case ρ-bounded adversary for loss function , which is defined as
- Against a ρ-bounded adversary A, the authors define the robust training loss w.r.t. A as
- The authors' results imply that the required width is polynomial for Ω(1)-separable training sets.
- What is left to do to prove Theorem 4.1 is to show the existence of a network fW ∗ that is close to initialization and the worst-case robust loss LA∗(fW ∗) is small.
- For a ρ-bounded adversary and γ-separable training set, the authors have the following theorem.
- The authors show that since f ∗ has "low complexity", there exists a pseudo-network gW ∗ that is close to initialization, has polynomial width (for γ = Ω(1)), and gW ∗ ≈ f ∗.

Conclusion

- The authors use concentration bounds to argue that there exists a pseudo-network gW ∗ with width poly d, n 1/γ , such that for any fixed input x ∈ X , with probability at least 1−exp(−Ω( m/n)), gW ∗(x) ≈ f ∗(x).
- The authors have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results.
- Central in the proof is an explicit construction of a robust net near initialization, utilizing ideas from polynomial approximation.

Summary

- Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013].
- For two-layer nets with quadratic ReLU activation1 they were able to show that if input is in Rd training can achieve robust loss at most provided the net’s width is (1/ )Ω(d)2.
- That there exists a two-layer ReLU neural network with width poly (d, n/ ) near Gaussian random initialization that achieves robust training loss.
- That starting from Gaussian random initialization, standard adversarial training (Algorithm 1) converges to such a network in poly (d, n/ ) iterations.
- New result in approximation theory, the existence of a good approximation to the step function by a polynomially wide two-layer ReLU network with weights close to the standard gaussian initialization.
- They prove that adversarial training with an artificial projection step always finds a multi-layer ReLU net that is -optimal within the neighborhood near initialization, but the optimal robust loss could be large.
- For two-layer quadratic ReLU net, they managed to prove that small adversarial loss will be achieved, but crucially the required width and running time are (1/ )Ω(d).
- The authors use A∗ to denote the worst-case ρ-bounded adversary for loss function , which is defined as
- Against a ρ-bounded adversary A, the authors define the robust training loss w.r.t. A as
- The authors' results imply that the required width is polynomial for Ω(1)-separable training sets.
- What is left to do to prove Theorem 4.1 is to show the existence of a network fW ∗ that is close to initialization and the worst-case robust loss LA∗(fW ∗) is small.
- For a ρ-bounded adversary and γ-separable training set, the authors have the following theorem.
- The authors show that since f ∗ has "low complexity", there exists a pseudo-network gW ∗ that is close to initialization, has polynomial width (for γ = Ω(1)), and gW ∗ ≈ f ∗.
- The authors use concentration bounds to argue that there exists a pseudo-network gW ∗ with width poly d, n 1/γ , such that for any fixed input x ∈ X , with probability at least 1−exp(−Ω( m/n)), gW ∗(x) ≈ f ∗(x).
- The authors have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results.
- Central in the proof is an explicit construction of a robust net near initialization, utilizing ideas from polynomial approximation.

Related work

- Adversarial examples and defense. The seminal paper Szegedy et al [2013] discovered the existence of adversarial examples. Since its discovery, numerous defense methods have been proposed to make neural nets robust to perturbations constrained in a ball with respect to a certain norm (e.g. 2, ∞). These methods span an extremely wide spectrum including certification [Raghunathan et al, 2018, Wong and Kolter, 2017], input transformation [Buckman et al, 2018, Guo et al, 2017], randomization [Xie et al, 2017], adversarial training Madry et al [2018], etc. Recent studies on evaluating the effectiveness of the aforementioned defenses by Carlini and Wagner [2017], Athalye et al [2018] reveals that adversarial training dominates the others. One empirical observation made in Madry et al [2018] is that adversarial training can always make wide nets achieve small robust training loss.

Reference

- Zeyuan Allen-Zhu and Yuanzhi Li. Faster principal component regression and stable matrix chebyshev approximation. In Proceedings of the 34th International Conference on Machine LearningVolume 70, pages 107–115. JMLR. org, 2017.
- Zeyuan Allen-Zhu, Yuanzhi Li, and Yingyu Liang. Learning and generalization in overparameterized neural networks, going beyond two layers. In NeurIPS. arXiv preprint arXiv:1811.04918, 2019a.
- Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. On the convergence rate of training recurrent neural networks. In NeurIPS. https://arxiv.org/pdf/1810.12065, 2019b.
- Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. A convergence theory for deep learning via overparameterization. In ICML. https://arxiv.org/pdf/1811.03962, 2019c.
- Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, Ruslan Salakhutdinov, and Ruosong Wang. On exact computation with an infinitely wide neural net. In NeurIPS, 2019a.
- Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. In ICML. arXiv preprint arXiv:1901.08584, 2019b.
- Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420, 2018.
- Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. 2018.
- Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017.
- Simon S Du, Jason D Lee, Haochuan Li, Liwei Wang, and Xiyu Zhai. Gradient descent finds global minima of deep neural networks. In ICML. https://arxiv.org/pdf/1811.03804, 2019a.
- Simon S Du, Xiyu Zhai, Barnabas Poczos, and Aarti Singh. Gradient descent provably optimizes over-parameterized neural networks. In ICLR. https://arxiv.org/pdf/1810.02054, 2019b.
- Alexandre Eremenko and Peter Yuditskii. Uniform approximation of sgn (x) by polynomials and entire functions. arXiv preprint math/0604324, 2006.
- Roy Frostig, Cameron Musco, Christopher Musco, and Aaron Sidford. Principal component projection without principal component analysis. In International Conference on Machine Learning, pages 2349–2357, 2016.
- Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D Lee. Convergence of adversarial training in overparametrized neural networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 13009–13020, 2019.
- Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117, 2017.
- Elad Hazan. Introduction to online convex optimization. Foundations and Trends in Optimization, 2(3-4):157–325, 2016.
- Elad Hazan et al. Introduction to online convex optimization. Foundations and Trends R in Optimization, 2(3-4):157–325, 2016.
- Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. In Advances in neural information processing systems, pages 8571–8580, 2018.
- Yuanzhi Li and Yingyu Liang. Learning overparameterized neural networks via stochastic gradient descent on structured data. In NeurIPS, 2018.
- Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR. arXiv preprint arXiv:1706.06083, 2018.
- Samet Oymak and Mahdi Soltanolkotabi. Towards moderate overparameterization: global convergence guarantees for training shallow neural networks. arXiv preprint arXiv:1902.04674, 2019.
- Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial examples. arXiv preprint arXiv:1801.09344, 2018.
- Sushant Sachdeva, Nisheeth K Vishnoi, et al. Faster algorithms via approximation theory. Foundations and Trends R in Theoretical Computer Science, 9(2):125–210, 2014.
- Zhao Song and Xin Yang. Quadratic suffices for over-parametrization via matrix chernoff bound. arXiv preprint arXiv:1906.03593, 2019.
- Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
- Eric Wong and J Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1711.00851, 2017.
- Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017.
- Difan Zou, Yuan Cao, Dongruo Zhou, and Quanquan Gu. Stochastic gradient descent optimizes over-parameterized deep relu networks. arXiv preprint arXiv:1811.08888, 2018.

Tags

Comments