[Paper Review] Rademacher Complexity for Adversarially Robust Generalization

Dong Yin, Kannan Ramchandran+1 more|arXiv (Cornell University)|Oct 29, 2018

Adversarial Robustness in Machine LearningComputer Science56 references64 citations

TL;DR

This paper analyzes adversarially robust generalization under L-infinity attacks using Rademacher complexity, providing tight bounds for binary and multi-class linear classifiers and showing explicit dimension dependence, plus results for neural networks and a surrogate loss.

ABSTRACT

Many machine learning models are vulnerable to adversarial attacks; for example, adding adversarial perturbations that are imperceptible to humans can often make machine learning models produce wrong predictions with high confidence. Moreover, although we may obtain robust models on the training dataset via adversarial training, in some problems the learned models cannot generalize well to the test data. In this paper, we focus on $\ell_\infty$ attacks, and study the adversarially robust generalization problem through the lens of Rademacher complexity. For binary linear classifiers, we prove tight bounds for the adversarial Rademacher complexity, and show that the adversarial Rademacher complexity is never smaller than its natural counterpart, and it has an unavoidable dimension dependence, unless the weight vector has bounded $\ell_1$ norm. The results also extend to multi-class linear classifiers. For (nonlinear) neural networks, we show that the dimension dependence in the adversarial Rademacher complexity also exists. We further consider a surrogate adversarial loss for one-hidden layer ReLU network and prove margin bounds for this setting. Our results indicate that having $\ell_1$ norm constraints on the weight matrices might be a potential way to improve generalization in the adversarial setting. We demonstrate experimental results that validate our theoretical findings.

Motivation & Objective

• Motivate and formalize the study of adversarially robust generalization under L-infinity perturbations.
• Characterize the adversarial Rademacher complexity for linear and multi-class linear classifiers.
• Extend analysis to neural networks and explore surrogate losses and margin bounds.
• Suggest norm-based regularization (notably L1) as a potential way to improve adversarial generalization.
• Provide experimental validation of theoretical findings.

Proposed method

• Define adversarial risk and its empirical counterpart under L-infinity perturbations.
• Relate population and empirical risks to Rademacher complexity for the adversarial loss class.
• Derive bounds comparing natural and adversarial Rademacher complexities for binary linear classifiers.
• Extend to multi-class linear classifiers with margin-based bounds.
• Analyze neural networks to show dimension dependence in adversarial Rademacher complexity under norm constraints.
• Study a surrogate adversarial loss for one-hidden-layer ReLU networks and prove margin bounds under L1 constraints.

Experimental results

Research questions

• RQ1 What are the tight bounds for adversarial Rademacher complexity in binary linear classification under L-infinity attacks?
• RQ2 How does adversarial Rademacher complexity compare to the natural setting for linear and multi-class linear classifiers?
• RQ3 What dimension dependence emerges in the adversarial setting for neural networks, and can it be mitigated by norm constraints like L1?
• RQ4 Do margin bounds exist for multi-class and neural network models under adversarial perturbations, and under what conditions?
• RQ5 Can surrogate adversarial losses (e.g., SDP-relaxed) yield favorable margin bounds with limited dimension dependence?

Key findings

• Adversarial Rademacher complexity is never smaller than the natural counterpart, indicating inherent difficulty in adversarial generalization.
• For binary linear classifiers with Lp constraints (p≥1), the adversarial complexity has unavoidable polynomial dimension dependence unless p=1.
• For multi-class linear classifiers, margin bounds under adversarial perturbations exhibit similar dimension dependence when weights have bounded lp norms (p>1).
• Neural network analyses show a lower bound on adversarial Rademacher complexity with explicit dimension dependence, unlike some natural-setting bounds.
• A surrogate adversarial loss with an SDP relaxation yields margin bounds that avoid dimension dependence if the first-layer weights have bounded L1 norm.
• Experimental results support that L1 regularization can reduce adversarial generalization error and that the adversarial gap grows with input dimension.