[Paper Review] The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression

Hamed Hassani, Adel Javanmard|arXiv (Cornell University)|Jan 13, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper provides a precise theoretical analysis of robust generalization in adversarially trained random features models under high-dimensional asymptotics. It reveals that overparametrization—while beneficial for standard generalization—can degrade robust generalization error due to increased sensitivity to adversarial perturbations, establishing a fundamental trade-off in model design.

ABSTRACT

Successful deep learning models often involve training neural network architectures that contain more parameters than the number of training samples. Such overparametrized models have been extensively studied in recent years, and the virtues of overparametrization have been established from both the statistical perspective, via the double-descent phenomenon, and the computational perspective via the structural properties of the optimization landscape. Despite the remarkable success of deep learning architectures in the overparametrized regime, it is also well known that these models are highly vulnerable to small adversarial perturbations in their inputs. Even when adversarially trained, their performance on perturbed inputs (robust generalization) is considerably worse than their best attainable performance on benign inputs (standard generalization). It is thus imperative to understand how overparametrization fundamentally affects robustness. In this paper, we will provide a precise characterization of the role of overparametrization on robustness by focusing on random features regression models (two-layer neural networks with random first layer weights). We consider a regime where the sample size, the input dimension and the number of parameters grow in proportion to each other, and derive an asymptotically exact formula for the robust generalization error when the model is adversarially trained. Our developed theory reveals the nontrivial effect of overparametrization on robustness and indicates that for adversarially trained random features models, high overparametrization can hurt robust generalization.

Motivation & Objective

• To understand the fundamental impact of overparametrization on robust generalization in adversarially trained models.
• To analyze the robust generalization error in random features regression models under proportional growth of sample size, input dimension, and model parameters.
• To derive an asymptotically exact formula for the robust generalization error in the high-dimensional regime.
• To reveal the non-monotonic and potentially harmful role of overparametrization in adversarial robustness.

Proposed method

• The analysis employs a high-dimensional asymptotic framework where sample size, input dimension, and number of parameters grow proportionally.
• The model uses a two-layer neural network with random first-layer weights (random features regression).
• The robust generalization error is derived via a variational formulation involving the Moreau envelope and Gaussian equivalence properties.
• The method leverages tools from random matrix theory, including the Stieltjes transform of the Marchenko-Pastur distribution and spectral approximations of kernel matrices.
• The analysis establishes strict convexity of the limiting objective, ensuring uniqueness of the optimal solution.
• The derivation uses a change of variables and concentration of measure to analyze the asymptotic behavior of the optimization landscape.

(a) $\varepsilon=10^{-7}$

Experimental results

Research questions

• RQ1 How does overparametrization affect robust generalization error in adversarially trained random features models?
• RQ2 Is there a fundamental trade-off between standard and robust generalization in overparametrized models?
• RQ3 Can we derive an asymptotically exact formula for the robust generalization error in the high-dimensional regime?
• RQ4 Does high overparametrization lead to worse robustness, despite improved standard generalization?

Key findings

• Overparametrization can degrade robust generalization error, contradicting the common belief that more parameters always improve performance.
• The robust generalization error is derived as an asymptotically exact formula under proportional growth of model dimensions.
• The analysis reveals a nontrivial, non-monotonic effect of overparametrization on robustness, indicating that excessive complexity harms robustness.
• The limiting optimization objective is strictly convex, ensuring unique minimizers for both the robust and standard generalization parameters.
• The derived formula shows that the robust error is higher than the standard error, and this gap increases with overparametrization.
• The results are consistent with empirical observations that adversarially trained models remain fragile despite high capacity.

(b) $\varepsilon=0.1$