Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality

NIPS 2020, 2020.

Cited by: 0|Views112
EI
Weibo:
We have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results

Abstract:

Adversarial training is a popular method to give neural nets robustness against adversarial perturbations. In practice adversarial training leads to low robust training loss. However, a rigorous explanation for why this happens under natural conditions is still missing. Recently a convergence theory for standard (non-adversarial) superv...More

Code:

Data:

0
Full Text
Bibtex
Weibo
Introduction
  • Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013].
  • For two-layer nets with quadratic ReLU activation1 they were able to show that if input is in Rd training can achieve robust loss at most provided the net’s width is (1/ )Ω(d)2.
  • That there exists a two-layer ReLU neural network with width poly (d, n/ ) near Gaussian random initialization that achieves robust training loss.
Highlights
  • Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013]
  • Much effort has been spent to make deep nets resistant to such perturbations but adversarial training with a natural min-max objective Madry et al [2018] stands out as one of the most effective approaches according to Carlini and Wagner [2017], Athalye et al [2018]
  • We’re interested in theoretical understanding of this phenomenon: Why does adversarial training efficiently find a feasibly sized neural net to fit training data robustly? In the last couple of years, a convergence theory has been developed for non-adversarial training: it explains the ability of gradient descent to achieve small training loss, provided the neural nets are fairly over-parametrized
  • We have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results
  • This may serve as an explanation for small loss achieved by adversarial training in practice
Results
  • That starting from Gaussian random initialization, standard adversarial training (Algorithm 1) converges to such a network in poly (d, n/ ) iterations.
  • New result in approximation theory, the existence of a good approximation to the step function by a polynomially wide two-layer ReLU network with weights close to the standard gaussian initialization.
  • They prove that adversarial training with an artificial projection step always finds a multi-layer ReLU net that is -optimal within the neighborhood near initialization, but the optimal robust loss could be large.
  • For two-layer quadratic ReLU net, they managed to prove that small adversarial loss will be achieved, but crucially the required width and running time are (1/ )Ω(d).
  • The authors use A∗ to denote the worst-case ρ-bounded adversary for loss function , which is defined as
  • Against a ρ-bounded adversary A, the authors define the robust training loss w.r.t. A as
  • The authors' results imply that the required width is polynomial for Ω(1)-separable training sets.
  • What is left to do to prove Theorem 4.1 is to show the existence of a network fW ∗ that is close to initialization and the worst-case robust loss LA∗(fW ∗) is small.
  • For a ρ-bounded adversary and γ-separable training set, the authors have the following theorem.
  • The authors show that since f ∗ has "low complexity", there exists a pseudo-network gW ∗ that is close to initialization, has polynomial width (for γ = Ω(1)), and gW ∗ ≈ f ∗.
Conclusion
  • The authors use concentration bounds to argue that there exists a pseudo-network gW ∗ with width poly d, n 1/γ , such that for any fixed input x ∈ X , with probability at least 1−exp(−Ω( m/n)), gW ∗(x) ≈ f ∗(x).
  • The authors have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results.
  • Central in the proof is an explicit construction of a robust net near initialization, utilizing ideas from polynomial approximation.
Summary
  • Deep neural networks trained by gradient based methods tend to change their answer after small adversarial perturbations in inputs Szegedy et al [2013].
  • For two-layer nets with quadratic ReLU activation1 they were able to show that if input is in Rd training can achieve robust loss at most provided the net’s width is (1/ )Ω(d)2.
  • That there exists a two-layer ReLU neural network with width poly (d, n/ ) near Gaussian random initialization that achieves robust training loss.
  • That starting from Gaussian random initialization, standard adversarial training (Algorithm 1) converges to such a network in poly (d, n/ ) iterations.
  • New result in approximation theory, the existence of a good approximation to the step function by a polynomially wide two-layer ReLU network with weights close to the standard gaussian initialization.
  • They prove that adversarial training with an artificial projection step always finds a multi-layer ReLU net that is -optimal within the neighborhood near initialization, but the optimal robust loss could be large.
  • For two-layer quadratic ReLU net, they managed to prove that small adversarial loss will be achieved, but crucially the required width and running time are (1/ )Ω(d).
  • The authors use A∗ to denote the worst-case ρ-bounded adversary for loss function , which is defined as
  • Against a ρ-bounded adversary A, the authors define the robust training loss w.r.t. A as
  • The authors' results imply that the required width is polynomial for Ω(1)-separable training sets.
  • What is left to do to prove Theorem 4.1 is to show the existence of a network fW ∗ that is close to initialization and the worst-case robust loss LA∗(fW ∗) is small.
  • For a ρ-bounded adversary and γ-separable training set, the authors have the following theorem.
  • The authors show that since f ∗ has "low complexity", there exists a pseudo-network gW ∗ that is close to initialization, has polynomial width (for γ = Ω(1)), and gW ∗ ≈ f ∗.
  • The authors use concentration bounds to argue that there exists a pseudo-network gW ∗ with width poly d, n 1/γ , such that for any fixed input x ∈ X , with probability at least 1−exp(−Ω( m/n)), gW ∗(x) ≈ f ∗(x).
  • The authors have shown that under a natural separability assumption on the training data, adversarial training on polynomially wide two-layer ReLU networks always converges in polynomial time to small robust training loss, significantly improving previous results.
  • Central in the proof is an explicit construction of a robust net near initialization, utilizing ideas from polynomial approximation.
Related work
Reference
  • Zeyuan Allen-Zhu and Yuanzhi Li. Faster principal component regression and stable matrix chebyshev approximation. In Proceedings of the 34th International Conference on Machine LearningVolume 70, pages 107–115. JMLR. org, 2017.
    Google ScholarLocate open access versionFindings
  • Zeyuan Allen-Zhu, Yuanzhi Li, and Yingyu Liang. Learning and generalization in overparameterized neural networks, going beyond two layers. In NeurIPS. arXiv preprint arXiv:1811.04918, 2019a.
    Findings
  • Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. On the convergence rate of training recurrent neural networks. In NeurIPS. https://arxiv.org/pdf/1810.12065, 2019b.
    Findings
  • Zeyuan Allen-Zhu, Yuanzhi Li, and Zhao Song. A convergence theory for deep learning via overparameterization. In ICML. https://arxiv.org/pdf/1811.03962, 2019c.
    Findings
  • Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, Ruslan Salakhutdinov, and Ruosong Wang. On exact computation with an infinitely wide neural net. In NeurIPS, 2019a.
    Google ScholarLocate open access versionFindings
  • Sanjeev Arora, Simon S Du, Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. In ICML. arXiv preprint arXiv:1901.08584, 2019b.
    Findings
  • Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420, 2018.
    Findings
  • Jacob Buckman, Aurko Roy, Colin Raffel, and Ian Goodfellow. Thermometer encoding: One hot way to resist adversarial examples. 2018.
    Google ScholarFindings
  • Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pages 39–57. IEEE, 2017.
    Google ScholarLocate open access versionFindings
  • Simon S Du, Jason D Lee, Haochuan Li, Liwei Wang, and Xiyu Zhai. Gradient descent finds global minima of deep neural networks. In ICML. https://arxiv.org/pdf/1811.03804, 2019a.
    Findings
  • Simon S Du, Xiyu Zhai, Barnabas Poczos, and Aarti Singh. Gradient descent provably optimizes over-parameterized neural networks. In ICLR. https://arxiv.org/pdf/1810.02054, 2019b.
    Findings
  • Alexandre Eremenko and Peter Yuditskii. Uniform approximation of sgn (x) by polynomials and entire functions. arXiv preprint math/0604324, 2006.
    Google ScholarFindings
  • Roy Frostig, Cameron Musco, Christopher Musco, and Aaron Sidford. Principal component projection without principal component analysis. In International Conference on Machine Learning, pages 2349–2357, 2016.
    Google ScholarLocate open access versionFindings
  • Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D Lee. Convergence of adversarial training in overparametrized neural networks. In Advances in Neural Information Processing Systems (NeurIPS), pages 13009–13020, 2019.
    Google ScholarLocate open access versionFindings
  • Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations. arXiv preprint arXiv:1711.00117, 2017.
    Findings
  • Elad Hazan. Introduction to online convex optimization. Foundations and Trends in Optimization, 2(3-4):157–325, 2016.
    Google ScholarLocate open access versionFindings
  • Elad Hazan et al. Introduction to online convex optimization. Foundations and Trends R in Optimization, 2(3-4):157–325, 2016.
    Google ScholarLocate open access versionFindings
  • Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. In Advances in neural information processing systems, pages 8571–8580, 2018.
    Google ScholarLocate open access versionFindings
  • Yuanzhi Li and Yingyu Liang. Learning overparameterized neural networks via stochastic gradient descent on structured data. In NeurIPS, 2018.
    Google ScholarLocate open access versionFindings
  • Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR. arXiv preprint arXiv:1706.06083, 2018.
    Findings
  • Samet Oymak and Mahdi Soltanolkotabi. Towards moderate overparameterization: global convergence guarantees for training shallow neural networks. arXiv preprint arXiv:1902.04674, 2019.
    Findings
  • Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial examples. arXiv preprint arXiv:1801.09344, 2018.
    Findings
  • Sushant Sachdeva, Nisheeth K Vishnoi, et al. Faster algorithms via approximation theory. Foundations and Trends R in Theoretical Computer Science, 9(2):125–210, 2014.
    Google ScholarLocate open access versionFindings
  • Zhao Song and Xin Yang. Quadratic suffices for over-parametrization via matrix chernoff bound. arXiv preprint arXiv:1906.03593, 2019.
    Findings
  • Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
    Findings
  • Eric Wong and J Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1711.00851, 2017.
    Findings
  • Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991, 2017.
    Findings
  • Difan Zou, Yuan Cao, Dongruo Zhou, and Quanquan Gu. Stochastic gradient descent optimizes over-parameterized deep relu networks. arXiv preprint arXiv:1811.08888, 2018.
    Findings
Your rating :
0

 

Tags
Comments