[Paper Review] Convergence of Adversarial Training in Overparametrized Neural Networks

Ruiqi Gao, Tianle Cai+4 more|arXiv (Cornell University)|Jun 19, 2019

Adversarial Robustness in Machine LearningComputer Science59 references55 citations

TL;DR

The paper proves that adversarial training converges to a network with near-optimal robust loss on overparameterized networks and that robust interpolation requires larger capacity.

ABSTRACT

Neural networks are vulnerable to adversarial examples, i.e. inputs that are imperceptibly perturbed from natural data and yet incorrectly classified by the network. Adversarial training, a heuristic form of robust optimization that alternates between minimization and maximization steps, has proven to be among the most successful methods to train networks to be robust against a pre-defined family of perturbations. This paper provides a partial answer to the success of adversarial training, by showing that it converges to a network where the surrogate loss with respect to the the attack algorithm is within $ε$ of the optimal robust loss. Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier. The analysis technique leverages recent work on the analysis of neural networks via Neural Tangent Kernel (NTK), combined with motivation from online-learning when the maximization is solved by a heuristic, and the expressiveness of the NTK kernel in the $\ell_\infty$-norm. In addition, we also prove that robust interpolation requires more model capacity, supporting the evidence that adversarial training requires wider networks.

Motivation & Objective

• Motivate why adversarial training leads to robust classifiers in practice.
• Show convergence guarantees for the surrogate robust loss under wide network regimes.
• Link network expressivity to robust loss via RKHS/NTK perspectives.
• Demonstrate a capacity (VC-Dimension) requirement for robust interpolation.

Proposed method

• Analyze surrogate loss L_A(W) where A is a perturbation function representing the attack.
• Prove convergence of projected gradient descent to near-minimum robust loss within a convex ball B(R) around initialization.
• Use Neural Tangent Kernel (NTK) and RKHS arguments to relate existence of robust classifiers to wide networks.
• Provide two-layer network analysis with smooth activations showing convergence without projection.
• Establish capacity lower bounds for robust interpolation via VC-Dimension arguments.

Experimental results

Research questions

• RQ1 Can adversarial training converge to a network with robust loss close to the optimal robust loss within a neighborhood of initialization?
• RQ2 Does wide network width ensure convergence for the surrogate adversarial loss under general attack perturbations?
• RQ3 Is robust interpolation inherently more capacity-demanding than standard interpolation?
• RQ4 How does the NTK/RKHS framework explain the existence and approximation of robust classifiers near initialization?

Key findings

• Projected gradient descent on the surrogate loss converges to within epsilon of the best robust loss in a ball around initialization, given sufficient width.
• Two-layer networks with smooth activations converge without projection under adversarial training to near-optimal robust loss.
• With sufficiently large width, there exists a network within the initialization ball achieving near-minimal robust loss (epsilon).
• Adversarial training can find networks with small robust training loss under the stated assumptions and attack model.
• The VC-Dimension for robust interpolation is lower bounded by Omega(n d), indicating higher capacity is needed for robustness compared to standard interpolation.