Abstract:Successful deep learning models often involve training neural network architectures that contain more parameters than the number of training samples. Such overparametrized models have been extensively studied in recent years, and the virtues of overparametrization have been established from both the statistical perspective, via the double-descent phenomenon, and the computational perspective via the structural properties of the optimization landscape.
Despite the remarkable success of deep learning architectures in the overparametrized regime, it is also well known that these models are highly vulnerable to small adversarial perturbations in their inputs. Even when adversarially trained, their performance on perturbed inputs (robust generalization) is considerably worse than their best attainable performance on benign inputs (standard generalization). It is thus imperative to understand how overparametrization fundamentally affects robustness.
In this paper, we will provide a precise characterization of the role of overparametrization on robustness by focusing on random features regression models (two-layer neural networks with random first layer weights). We consider a regime where the sample size, the input dimension and the number of parameters grow in proportion to each other, and derive an asymptotically exact formula for the robust generalization error when the model is adversarially trained. Our developed theory reveals the nontrivial effect of overparametrization on robustness and indicates that for adversarially trained random features models, high overparametrization can hurt robust generalization.
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: How does over - parameterization affect the robust generalization ability of adversarially trained models? Specifically, the paper explores the specific impact of over - parameterization on the model robustness in high - dimensional random feature regression models and provides an accurate theoretical analysis framework.
### Background of the Paper and Problem Statement
Modern deep - learning models usually contain more parameters than the number of training samples. Such over - parameterized models show good performance in both statistics and optimization. From a statistical perspective, over - parameterized models exhibit the "double - descent" phenomenon, that is, as the model complexity increases, the generalization error first presents a traditional U - shaped curve and then reaches a global minimum in the over - parameterized region. However, these models are very fragile in the face of small perturbations of the input data. Even after adversarial training, their performance on perturbed inputs (robust generalization) is far worse than their performance on normal inputs (standard generalization).
### Research Objectives
The main objective of the paper is to accurately characterize the impact of over - parameterization on robust generalization in a high - dimensional environment (where the sample size, input dimension, and number of parameters grow proportionally) by studying random feature regression models (two - layer neural networks with the first - layer weights randomly fixed). Specifically, the author derives an asymptotically exact formula for describing the robust generalization error of the model under adversarial training.
### Main Contributions
1. **Accurately Characterize the Impact of Over - Parameterization on Robustness**: Through theoretical analysis, the paper reveals the non - trivial impact of over - parameterization on robustness and points out that high over - parameterization may damage the robust generalization ability of the model.
2. **High - Dimensional Asymptotic Analysis**: In a high - dimensional environment where the sample size \(n\), input dimension \(d\), and number of parameters \(N\) grow proportionally, an asymptotically exact formula for the robust generalization error is derived.
3. **Theoretical Prediction of Adversarial Risk**: Through theoretical prediction and experimental verification, the impact of over - parameterization on the robust generalization error under different noise levels and adversarial strengths is shown.
### Experimental Results
The paper shows the impact of over - parameterization on robust generalization through theoretical prediction and experimental results. For example, when the adversarial strength is small (such as \(\epsilon = 0.1\)), the impact of over - parameterization on robustness is small; while when the adversarial strength is large (such as \(\epsilon = 1\)), over - parameterization significantly increases the robust generalization error. In addition, when the noise level is high, the negative impact of over - parameterization on robustness is more obvious.
### Conclusions
Through strict theoretical analysis and experimental verification, the paper reveals the "curse" of over - parameterization in adversarial training, that is, high over - parameterization may damage the robust generalization ability of the model. This finding is of great significance for understanding the behavior of deep - learning models in an adversarial environment and also provides a theoretical basis for designing more robust models.