[Paper Review] Adversarial Robustness May Be at Odds With Simplicity

Preetum Nakkiran|arXiv (Cornell University)|Jan 2, 2019

Adversarial Robustness in Machine Learning8 references75 citations

TL;DR

The paper provides theoretical constructions showing that robust classification can require more complex (even exponentially more complex) classifiers than standard classification, and that among simple classifiers there can be a trade-off between adversarial robustness and standard accuracy.

ABSTRACT

Current techniques in machine learning are so far are unable to learn classifiers that are robust to adversarial perturbations. However, they are able to learn non-robust classifiers with very high accuracy, even in the presence of random perturbations. Towards explaining this gap, we highlight the hypothesis that $ extit{robust classification may require more complex classifiers (i.e. more capacity) than standard classification.}$ In this note, we show that this hypothesis is indeed possible, by giving several theoretical examples of classification tasks and sets of "simple" classifiers for which: (1) There exists a simple classifier with high standard accuracy, and also high accuracy under random $\ell_\infty$ noise. (2) Any simple classifier is not robust: it must have high adversarial loss with $\ell_\infty$ perturbations. (3) Robust classification is possible, but only with more complex classifiers (exponentially more complex, in some examples). Moreover, $ extit{there is a quantitative trade-off between robustness and standard accuracy among simple classifiers.}$ This suggests an alternate explanation of this phenomenon, which appears in practice: the tradeoff may occur not because the classification task inherently requires such a tradeoff (as in [Tsipras-Santurkar-Engstrom-Turner-Madry `18]), but because the structure of our current classifiers imposes such a tradeoff.

Motivation & Objective

• Motivate why robust classification may demand higher capacity than standard classification.
• Provide concrete constructions where simple classifiers are non-robust yet robust classification exists only with more complex models.
• Demonstrate a quantitative trade-off between adversarial loss and standard loss within simple classifiers.

Proposed method

• Define standard loss, adversarial loss, and noise-robust loss for classifiers.
• Present Construction 1 with a distribution where simple linear classifiers can have low standard/noisy loss but high adversarial loss, while a non-simple classifier achieves low adversarial loss.
• Present Theorem 2 showing an explicit trade-off between adversarial loss and standard loss among a simple classifier subset.
• Present Construction 2 using an average-case hard function to separate time/complexity requirements for robustness.
• Show that robust classification may require exponentially more complex classifiers than those that are standardly accurate.

Experimental results

Research questions

• RQ1 Why do current techniques struggle to learn adversarially robust classifiers while achieving high standard accuracy?
• RQ2 Does robustness necessarily require higher classifier capacity, and can this be proven in concrete settings?
• RQ3 Can simple classifiers exhibit a trade-off between adversarial robustness and standard accuracy?
• RQ4 Under what conditions can a robust classifier exist yet require much more computational or representational complexity to obtain?
• RQ5 How does robustness relate to the ability to exploit simple, fragile features in standard classifiers?

Key findings

• There exist simple classifiers with high standard accuracy and high noise-robust accuracy but non-robust (high adversarial loss) to l_infinity perturbations.
• Any simple linear classifier may be non-robust under adversarial perturbations, while a more complex (non-linear) classifier can achieve low adversarial loss.
• Robust classification can require exponentially more complex classifiers than those needed for standard classification in some constructions.
• There is a quantitative trade-off between adversarial loss and standard loss among simple classifiers.
• There are distributions where a robust classifier exists but only with high computational complexity to find.
• In one construction, a simple pre-processing step (rounding) can fail to achieve robustness without increasing complexity.