[Paper Review] Implicit Bias of Gradient Descent based Adversarial Training on Separable Data

Yan Li, Ethan X. Fang+2 more|arXiv (Cornell University)|Apr 30, 2020

Adversarial Robustness in Machine Learning35 references22 citations

TL;DR

This paper analyzes the implicit bias of gradient descent in adversarial training on linearly separable data, showing it converges to the maximum L2 margin classifier at rate O(1/√T), significantly faster than clean data training. It further establishes that bounded Lq-norm perturbations lead to a maximum mixed-norm margin classifier, providing theoretical justification for adversarial robustness.

ABSTRACT

Adversarial training is a principled approach for training robust neural networks. Despite of tremendous successes in practice, its theoretical properties still remain largely unexplored. In this paper, we provide new theoretical insights of gradient descent based adversarial training by studying its computational properties, specifically on its implicit bias. We take the binary classification task on linearly separable data as an illustrative example, where the loss asymptotically attains its infimum as the parameter diverges to infinity along certain directions. Specifically, we show that for any fixed iteration $T$, when the adversarial perturbation during training has proper bounded L2 norm, the classifier learned by gradient descent based adversarial training converges in direction to the maximum L2 norm margin classifier at the rate of $O(1/\sqrt{T})$, significantly faster than the rate $O(1/\log T}$ of training with clean data. In addition, when the adversarial perturbation during training has bounded Lq norm, the resulting classifier converges in direction to a maximum mixed-norm margin classifier, which has a natural interpretation of robustness, as being the maximum L2 norm margin classifier under worst-case bounded Lq norm perturbation to the data. Our findings provide theoretical backups for adversarial training that it indeed promotes robustness against adversarial perturbation.

Motivation & Objective

• To understand the implicit bias of gradient descent in adversarial training on linearly separable data.
• To analyze how adversarial perturbations influence the direction of convergence in parameter space.
• To compare the convergence rate of adversarial training with standard training on clean data.
• To characterize the resulting classifier when adversarial perturbations are bounded in Lq norm.
• To provide theoretical justification for the robustness observed in adversarial training.

Proposed method

• Analyzes binary classification with linearly separable data under gradient descent-based adversarial training.
• Considers the limit where parameters diverge to infinity along certain directions, focusing on convergence in direction.
• Uses bounded L2 norm perturbations to show convergence to the maximum L2 norm margin classifier.
• Extends analysis to bounded Lq norm perturbations, deriving convergence to a maximum mixed-norm margin classifier.
• Employs asymptotic analysis of the loss function to characterize the implicit bias of the optimization process.
• Establishes convergence rates in direction using O(1/√T) for L2-bounded perturbations.

Experimental results

Research questions

• RQ1 How does gradient descent in adversarial training converge in direction on linearly separable data?
• RQ2 What is the convergence rate of adversarial training compared to standard training with clean data?
• RQ3 How does the choice of perturbation norm (L2 vs. Lq) affect the implicit bias of adversarial training?
• RQ4 What is the geometric interpretation of the classifier learned under bounded Lq-norm perturbations?
• RQ5 Does adversarial training implicitly promote robustness through its implicit bias?

Key findings

• For bounded L2 norm perturbations, adversarial training converges in direction to the maximum L2 norm margin classifier at rate O(1/√T), faster than the O(1/log T) rate of standard training.
• The maximum L2 norm margin classifier is achieved asymptotically as parameters diverge along specific directions in parameter space.
• When perturbations are bounded in Lq norm, the classifier converges to a maximum mixed-norm margin classifier, which corresponds to the L2 margin under worst-case Lq-bounded perturbations.
• This mixed-norm margin classifier provides a natural theoretical interpretation of robustness to adversarial attacks.
• The results establish that adversarial training's implicit bias aligns with robustness, offering theoretical support for its empirical success.
• The convergence rate of O(1/√T) for adversarial training is significantly faster than the O(1/log T) rate observed in standard training.