[Paper Review] Precise Statistical Analysis of Classification Accuracies for Adversarial Training

Adel Javanmard, Mahdi Soltanolkotabi|arXiv (Cornell University)|Oct 21, 2020

Advanced Statistical Methods and Models4 citations

TL;DR

This paper provides a precise theoretical characterization of standard and robust classification accuracy in binary linear classifiers trained via minimax adversarial training under a Gaussian mixture model with anisotropic covariance. It derives exact expressions for accuracy under general ℓp-norm bounded perturbations, revealing non-monotonic, counterintuitive dependencies on adversary strength, data size, and model overparameterization.

ABSTRACT

Despite the wide empirical success of modern machine learning algorithms and models in a multitude of applications, they are known to be highly susceptible to seemingly small indiscernible perturbations to the input data known as \emph{adversarial attacks}. A variety of recent adversarial training procedures have been proposed to remedy this issue. Despite the success of such procedures at increasing accuracy on adversarially perturbed inputs or \emph{robust accuracy}, these techniques often reduce accuracy on natural unperturbed inputs or \emph{standard accuracy}. Complicating matters further, the effect and trend of adversarial training procedures on standard and robust accuracy is rather counter intuitive and radically dependent on a variety of factors including the perceived form of the perturbation during training, size/quality of data, model overparameterization, etc. In this paper we focus on binary classification problems where the data is generated according to the mixture of two Gaussians with general anisotropic covariance matrices and derive a precise characterization of the standard and robust accuracy for a class of minimax adversarially trained models. We consider a general norm-based adversarial model, where the adversary can add perturbations of bounded $\ell_p$ norm to each input data, for an arbitrary $p\ge 1$. Our comprehensive analysis allows us to theoretically explain several intriguing empirical phenomena and provide a precise understanding of the role of different problem parameters on standard and robust accuracies.

Motivation & Objective

• To theoretically understand the counterintuitive trade-offs between standard and robust accuracy in adversarially trained models.
• To characterize the precise behavior of standard and robust accuracy in binary linear classification under general ℓp-norm adversarial perturbations.
• To explain empirical phenomena such as non-monotonic accuracy curves and data-size-dependent reversal of standard accuracy performance.
• To analyze the impact of model overparameterization, training data size, and perturbation norm (ℓp) on classification performance.

Proposed method

• Models the data as a mixture of two Gaussians with general anisotropic covariance matrices.
• Analyzes minimax adversarial training with ℓp-norm bounded perturbations for arbitrary p ≥ 1.
• Derives exact closed-form expressions for standard and robust accuracy using duality and weighted Moreau envelope techniques.
• Applies singular value decomposition and optimization duality to solve the minimax problem over adversarial perturbations.
• Uses a generalized loss function with ℓq-norm regularization to model adversarial robustness.
• Establishes convergence of gradient descent to the max-margin solution under mild smoothness and convexity assumptions.

Experimental results

Research questions

• RQ1 How does the standard accuracy of an adversarially trained linear classifier vary with the adversary’s perceived perturbation strength (ℓp norm)?
• RQ2 What is the precise relationship between training data size (relative to model parameters) and the resulting standard and robust accuracy?
• RQ3 Why does adversarial training sometimes improve standard accuracy in low-data regimes, contrary to the general trend?
• RQ4 How do different ℓp-norm perturbations (e.g., ℓ₁, ℓ₂, ℓ∞) affect the trade-off between standard and robust accuracy?
• RQ5 Can the non-monotonic behavior of accuracy curves be theoretically explained and predicted?

Key findings

• Standard accuracy exhibits a non-monotonic dependence on the adversary’s perturbation strength, first decreasing, then increasing, and decreasing again, with the exact shape depending on the data-to-parameter ratio δ.
• Robust accuracy initially decreases with increasing adversary strength but eventually increases or stabilizes beyond a threshold that depends on δ.
• For very low data regimes (small δ), adversarially trained models can outperform non-adversarial models in standard accuracy, reversing the typical robustness-accuracy trade-off.
• The theoretical predictions of standard and robust accuracy match empirical results closely, as validated by numerical experiments with ℓ∞-norm perturbations.
• The derived expressions for accuracy are exact and depend explicitly on the ℓp-norm of the data mean and the structure of the covariance matrix.
• The analysis reveals that the interplay between ℓp-perturbation type, model overparameterization, and data size leads to fundamentally different performance trends.