[Paper Review] Stability Analysis and Generalization Bounds of Adversarial Training

Jiancong Xiao, Yanbo Fan+3 more|arXiv (Cornell University)|Oct 3, 2022

Adversarial Robustness in Machine Learning9 citations

TL;DR

This paper introduces $η$-approximate smoothness to analyze adversarial training stability, deriving generalization bounds for SGD on non-smooth adversarial losses. It shows robust test accuracy degrades with $ε$ at a rate between $Ω(\epsilon\sqrt{T})$ and $\mathcal{O}(\epsilon T)$, explaining robust overfitting and validating that techniques like early stopping and SWA are stability-promoting in theory.

ABSTRACT

In adversarial machine learning, deep neural networks can fit the adversarial examples on the training dataset but have poor generalization ability on the test set. This phenomenon is called robust overfitting, and it can be observed when adversarially training neural nets on common datasets, including SVHN, CIFAR-10, CIFAR-100, and ImageNet. In this paper, we study the robust overfitting issue of adversarial training by using tools from uniform stability. One major challenge is that the outer function (as a maximization of the inner function) is nonsmooth, so the standard technique (e.g., hardt et al., 2016) cannot be applied. Our approach is to consider $η$-approximate smoothness: we show that the outer function satisfies this modified smoothness assumption with $η$ being a constant related to the adversarial perturbation $ε$. Based on this, we derive stability-based generalization bounds for stochastic gradient descent (SGD) on the general class of $η$-approximate smooth functions, which covers the adversarial loss. Our results suggest that robust test accuracy decreases in $ε$ when $T$ is large, with a speed between $Ω(ε\sqrt{T})$ and $\mathcal{O}(εT)$. This phenomenon is also observed in practice. Additionally, we show that a few popular techniques for adversarial training (e.g., early stopping, cyclic learning rate, and stochastic weight averaging) are stability-promoting in theory.

Motivation & Objective

• To address the theoretical gap in explaining robust overfitting in adversarial training, where test accuracy degrades despite increasing training accuracy.
• To develop a stability analysis framework for non-smooth adversarial loss functions, which standard uniform stability tools cannot handle.
• To derive generalization bounds for SGD on $η$-approximately smooth functions, covering adversarial training.
• To theoretically validate that popular regularization techniques (e.g., early stopping, SWA, cyclic learning rate) promote stability.
• To show that robust generalization gap increases with perturbation size $ε$, explaining poor test performance in practice.

Proposed method

• Introduce $η$-approximate smoothness as a relaxation of standard smoothness to handle the non-smooth outer function in adversarial training.
• Prove that the adversarial loss satisfies $η$-approximate smoothness with $η$ linearly dependent on $ε$ and gradient Lipschitz constants of the inner function.
• Derive stability-based generalization bounds for SGD on $η$-approximately smooth functions, extending prior results from Hardt et al. (2016) and Bassily et al. (2020).
• Apply the derived bounds to adversarial training, showing the generalization gap scales with $ε$ and $T$.
• Analyze the impact of regularization techniques (early stopping, SWA, cyclic learning rate) by showing they reduce stability-related terms in the bound.
• Use convex and strongly convex settings to demonstrate the robust overfitting phenomenon and its dependence on $ε$ and $T$.

Experimental results

Research questions

• RQ1 Why does robust overfitting occur in adversarial training despite good training performance?
• RQ2 Can standard uniform stability tools explain the generalization gap in adversarial training, given the non-smoothness of the adversarial loss?
• RQ3 How does the perturbation size $ε$ affect the generalization performance of adversarial training?
• RQ4 Do common regularization techniques like early stopping and SWA improve stability and thus generalization in adversarial training?
• RQ5 Can a modified smoothness assumption (e.g., $η$-approximate smoothness) enable generalization bounds for non-smooth adversarial objectives?

Key findings

• The adversarial loss is $η$-approximately smooth with $η = \mathcal{O}(\epsilon \cdot L_z)$, where $L_z$ is the gradient Lipschitz constant of the inner function.
• Generalization bounds for SGD on $η$-approximately smooth functions are derived, showing a dependence on $ε$ and $T$.
• Robust test accuracy decreases with increasing $ε$ at a rate between $Ω(\epsilon\sqrt{T})$ and $\mathcal{O}(\epsilon T)$, explaining robust overfitting.
• Techniques like early stopping, cyclic learning rate, and stochastic weight averaging are shown to be stability-promoting in theory, reducing the generalization gap.
• In the strongly convex case, the generalization gap is bounded by $\mathcal{O}(\eta + 1/n + 1/T)$, indicating that robust overfitting vanishes under strong convexity, though performance remains worse than standard training by $\mathcal{O}(\eta)$.
• The theoretical analysis matches empirical observations: robust overfitting is more severe for larger $ε$ and longer training ($T$).