[Paper Review] Hessian-based Analysis of Large Batch Training and Robustness to Adversaries

Zhewei Yao, Amir Gholami+3 more|arXiv (Cornell University)|Feb 22, 2018

Adversarial Robustness in Machine Learning22 references65 citations

TL;DR

The paper conducts a Hessian-based analysis of large-batch neural network training, showing large batches converge to high-curvature regions and are more vulnerable to adversarial perturbations; robust optimization counters this by biasing toward flat minima.

ABSTRACT

Large batch size training of Neural Networks has been shown to incur accuracy loss when trained with the current methods. The exact underlying reasons for this are still not completely understood. Here, we study large batch size training through the lens of the Hessian operator and robust optimization. In particular, we perform a Hessian based study to analyze exactly how the landscape of the loss function changes when training with large batch size. We compute the true Hessian spectrum, without approximation, by back-propagating the second derivative. Extensive experiments on multiple networks show that saddle-points are not the cause for generalization gap of large batch size training, and the results consistently show that large batch converges to points with noticeably higher Hessian spectrum. Furthermore, we show that robust training allows one to favor flat areas, as points with large Hessian spectrum show poor robustness to adversarial perturbation. We further study this relationship, and provide empirical and theoretical proof that the inner loop for robust training is a saddle-free optimization problem extit{almost everywhere}. We present detailed experiments with five different network architectures, including a residual network, tested on MNIST, CIFAR-10, and CIFAR-100 datasets. We have open sourced our method which can be accessed at [1].

Motivation & Objective

• Investigate how large batch size changes the loss landscape compared to small batch size using the true Hessian spectrum.
• Examine the relationship between large-batch training and robustness to adversarial perturbations.
• Explore how robust optimization affects Hessian spectrum and decision boundaries.

Proposed method

• Directly compute the true Hessian spectrum via back-propagating second derivatives during training.
• Compare Hessian spectra and perturbation landscapes for small vs large batch sizes.
• Analyze adversarial perturbations using FGSM and second-order attacks across architectures/datasets.
• Demonstrate that inner robust optimization is saddle-free almost everywhere under certain conditions.
• Use empirical and theoretical analysis to relate robust training to Hessian spectrum changes.

Experimental results

Research questions

• RQ1 How does large-batch training alter the local geometry of the loss landscape relative to small-batch training?
• RQ2 What is the connection between batch size and model robustness to adversarial perturbations?
• RQ3 Does robust optimization bias solutions toward flatter (lower-curvature) regions, and how does this relate to adversarial robustness?
• RQ4 Is the inner loop of adversarial training a saddle-free optimization problem almost everywhere?

Key findings

• Large batch training leads to convergence in regions with noticeably higher Hessian spectrum for both training and test losses.
• Points converged with large batches are more vulnerable to adversarial attacks than those trained with small batches.
• Robust training shifts the model to areas with smaller Hessian spectrum, indicating a bias toward flat minima.
• The inner adversarial perturbation problem is saddle-free almost everywhere under the presented assumptions.
• Robust optimization improves adversarial robustness but may reduce accuracy on clean data.
• Adversarial training changes the Hessian spectrum and can produce models with lower curvature even when total loss curvature remains positive.