Do Wider Neural Networks Really Help Adversarial Robustness?
Year: 2021

Abstract:
Adversarial training is a powerful type of defense against adversarial examples. Previous empirical results suggest that adversarial training requires wider networks for better performances. However, it remains elusive how does neural network width affect model robustness. In this paper, we carefully examine the relationship between network width and model robustness. Specifically, we show that the model robustness is closely related to the tradeoff between natural accuracy and perturbation stability, which is controlled by the robust regularization parameter λ. With the same λ, wider networks can achieve better natural accuracy but worse perturbation stability, leading to a potentially worse overall model robustness. To understand the origin of this phenomenon, we further relate the perturbation stability with the network’s local Lipschitzness. By leveraging recent results on neural tangent kernels, we theoretically show that wider networks tend to have worse perturbation stability. Our analyses suggest that: 1) the common strategy of first fine-tuning λ on small networks and then directly use it for wide model training could lead to deteriorated model robustness; 2) one needs to properly enlarge λ to unleash the robustness potential of wider models fully. Finally, we propose a new Width Adjusted Regularization (WAR) method that adaptively enlarges λ on wide models and significantly saves the tuning time.

text: Adversarial training is a powerful type of defense against adversarial examples. Previous empirical results suggest that adversarial training requires wider networks for better performances. However, it remains elusive how does neural network width affect model robustness. In this paper, we carefully examine the relationship between network width and model robustness. Specifically, we show that the model robustness is closely related to the tradeoff between natural accuracy and perturbation stability, which is controlled by the robust regularization parameter λ. With the same λ, wider networks can achieve better natural accuracy but worse perturbation stability, leading to a potentially worse overall model robustness. To understand the origin of this phenomenon, we further relate the perturbation stability with the network’s local Lipschitzness. By leveraging recent results on neural tangent kernels, we theoretically show that wider networks tend to have worse perturbation stability. Our analyses suggest that: 1) the common strategy of first fine-tuning λ on small networks and then directly use it for wide model training could lead to deteriorated model robustness; 2) one needs to properly enlarge λ to unleash the robustness potential of wider models fully. Finally, we propose a new Width Adjusted Regularization (WAR) method that adaptively enlarges λ on wide models and significantly saves the tuning time.

heading: 1 Introduction
text: Researchers have found that Deep Neural Networks (DNNs) suffer badly from adversarial examples [59]. By perturbing the original inputs with an intentionally computed, undetectable noise, one can deceive DNNs and even arbitrarily modify their predictions on purpose. To defend against adversarial examples and further improve model robustness, various defense approaches have been proposed [48, 42, 18, 40, 67, 26, 58, 55]. Among them, adversarial training [23, 41] has been shown to be the most effective type of defenses [5]. Adversarial training can be seen as a form of data augmentation by first finding the adversarial examples and then training DNN models on those examples. Specifically, given a DNN classifier f parameterized by θ, a general form of adversarial training with loss function
∗Equal contribution.
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
L can be defined as:
argmin θ
1
N N∑ i=1 [ L(θ;xi, yi)︸ ︷︷ ︸
natural risk
+λ · max x̂i∈B(xi, )
[ L(θ; x̂i, yi)− L(θ;xi, yi) ] ︸ ︷︷ ︸
robust regularization
] , (1.1)
where {(xi, yi)ni=1} are training data, B(x, ) = {x̂ | ‖x̂ − x‖p ≤ } denotes the `p norm ball with radius centered at x, and p ≥ 1, and λ > 0 is the regularization parameter. Compared with standard empirical risk minimization, the extra robust regularization term encourages the data points within B(x, ) to be classified as the same class, i.e., encourages the predictions to be stable. The regularization parameter λ adjusts the strength of robust regularization. When λ = 1, it recovers the formulation in [41], and when λ = 0.5, it recovers the formulation in [23]. Furthermore, replacing the loss difference in robust regularization term with the KL-divergence based regularization recovers the formulation in [70].
One common belief in the practice of adversarial training is that, compared with the standard empirical risk minimization, adversarial training requires much wider neural networks to achieve better robustness. [41] provided an intuitive explanation: robust classification requires a much more complicated decision boundary, as it needs to handle the presence of possible adversarial examples. However, it remains elusive how the network width affects model robustness. To answer this question, we first examine whether the larger network width contributes to both the natural risk term and the robust regularization term in (1.1). Interestingly, when tracing the value changes in (1.1) during adversarial training, we observe that the value of the robust regulariza-
tion part actually gets worse on wider models, suggesting that larger network width does not lead to better stability in predictions. In Figure 1, we show the loss value comparison of two different wide models trained by TRADES [70] with λ = 6 as suggested in the original paper. We can see that the wider model (i.e., WideResNet-34-10) achieves better natural risk but incurs a larger value on robust regularization. This motivates us to find out the cause of this phenomenon.
In this paper, we study the relationship between neural network width and model robustness for adversarially trained neural networks. Our contributions can be summarized as follows:
1. We show that the model robustness is closely related to both natural accuracy and perturbation stability, a new metric we proposed to characterize the strength of robust regularization. The balance between the two is controlled by the robust regularization parameter λ. With the same value of λ, the natural accuracy is improved on wider models while the perturbation stability often worsens, leading to a possible decrease in the overall model robustness. This suggests that proper tuning of λ on wide models is necessary despite being extremely time-consuming, while directly using the fine-tuned λ on small networks to train wider ones, as many people did in practice [41, 70], may lead to deteriorated model robustness.
2. Unlike previous understandings that there exists a trade-off between natural accuracy and robust accuracy, we show that the real trade-off should between natural accuracy and perturbation stability. And the robust accuracy is actually the consequence of this trade-off.
3. To understand the origin of the lower perturbation stability of wider networks, we further relate perturbation stability with the network’s local Lipschitznesss. By leveraging recent results on neural tangent kernels [36, 3, 73, 8, 21], we show that with the same value of λ, larger network width naturally leads to worse perturbation stability, which explains our empirical findings.
4. Our analyses suggest that to unleash the potential of wider model architectures fully, one should mitigate the perturbation stability deterioration and enlarge robust regularization parameter λ for training wider models. Empirical results verified the effectiveness of this strategy on benchmark datasets. In order to alleviate the heavy burden for tuning λ on wide models, we develop the
Width Adjusted Regularization (WAR) method to transfer the knowledge we gain from fine-tuning smaller networks into the training of wider networks and significantly save the tuning time.
Notation. For a d-dimensional vector x = [x1, ..., xd]>, we use ‖x‖p = ( ∑d i=1 |xi|p)1/p with p ≥ 1 to denote its `p norm. 1(·) represents the indicator function and ∀ represents the universal quantifier.

heading: 2 Related Work
text: Adversarial attacks: Adversarial examples were first found in [59]. Since then, tremendous work have been done exploring the origins of this intriguing property of deep learning [25, 38, 20, 60, 22, 72] as well as designing more powerful attacks [23, 47, 43, 41, 9, 11] under various attack settings. [5] identified the gradient masking problem and showed that many defense methods could be broken with a few changes on the attacker. [13] proposed gradient-free black-box attacks and [32, 33, 12] further improved its efficiency. Recently, [34, 35] pointed out that adversarial examples are generated from the non-robust or invariant features hidden in the training data.
Defensive adversarial learning: Many defense approaches have been proposed to directly learn a robust model that can defend against adversarial attacks. [41] proposed a general framework of robust training by solving a min-max optimization problem. [62] proposed a new criterion to evaluate the convergence quality quantitatively. [70] theoretically studied the trade-off between natural accuracy and robust accuracy for adversarially trained models. [63] followed this framework and further improved its robustness by differentiating correctly classified and misclassified examples. [14] solve the problem by restricting the variation of outputs with respect to the inputs. [15, 54, 39] developed provably robust adversarial learning methods that have the theoretical guarantees on robustness. Recent works in [65, 50] focus on creating adversarial robust networks with faster training protocol. Another line of works focuses on increasing the effective size of the training data, either by pre-trained models [30] or by semi-supervised learning [10, 1, 44]. Very recently, [66] proposed to conduct adversarial weight perturbation aside from input perturbation to obtain more robust models. [24] achieves further robust models by practical techniques like weight averaging.
Robustness and generalization: Earlier works like [23] found that adversarial learning can reduce overfitting and help generalization. However, as the arms race between attackers and defenses keeps going, it is observed that strong adversarial attacks can cause severe damage to the model’s natural accuracy [41, 70]. Many works [70, 61, 52, 19] attempt to explain this trade-off between robustness and natural generalization, while some other works proposed different perspectives. [56] confirmed that more training data has the potential to close this gap. [6] suggested that a robust model is computationally difficult to learn and optimize. [72] showed that there is still a large gap between the currently achieved model robustness and the theoretically achievable robustness limit on natural image distributions. [2] showed that the adversarial examples stem from the accumulation of small dense mixtures in the hidden weights during training and adversarial training works by removing such mixtures. Very recently, [51] showed that this trade-off stems from overparameterization and insufficient data in the linear regression setting. [68] proved that both accuracy and robustness are achievable through locally Lipschitz functions with separated data, and the gap between theory and practice is due to either failure to impose local Lipschitzness or insufficient generalization. [7] also studied the relationship between robustness and network size. In particular, [7] shows that overparametrization is necessary for robustness on two-layer neural networks, while we show that when networks get wider, they will have worse perturbation stability, and therefore larger regularization is needed to achieve better robustness.

heading: 3 Empirical Study on Network Width and Adversarial Robustness
text: In this section, we empirically study the relation between network width and robustness by first taking a closer look at the robust accuracy and the associated robust examples.

heading: 3.1 Characterization of Robust Examples
text: Robust accuracy is the standard evaluation metric of robustness, which measures the ratio of robust examples, i.e., examples that can still be correctly classified after adversarial attacks.
Previous empirical results suggest that wide models enjoy both better generalization ability and model robustness. Specifically, [41] proposed to extend ResNet [28] architecture to WideResNet [69] with a widen factor 10 for adversarial training on the CIFAR10 dataset and found that the increased model capacity significantly improves both robust accuracy and natural accuracy. Later works [70, 63] follow this finding and report their best result using the wide networks.
However, as shown by our findings in Figure 1, wider models actually lead to worse robust regularization effects, suggesting that wider models are not better in all aspects, and the relation between model robustness and network width may be more intricate than what people understood previously. To understand the intrinsic relationship between model robustness and network width, let us first take a closer look at the robust examples. Mathematically, robust examples can be defined as Srob := { x : ∀x̂ ∈ B(x, ), f(θ; x̂) = y } . Note that by definition of robust examples, we have the following equation holds:{ x : ∀x̂ ∈ B(x, ), f(θ; x̂) = y
}︸ ︷︷ ︸ robust examples:Srob = { x : f(θ;x) = y }︸ ︷︷ ︸ correctly classified examples:Scorrect ∧ { x : ∀x̂ ∈ B(x, ), f(θ;x) = f(θ; x̂) } ,︸ ︷︷ ︸
stable examples:Sstable (3.1)
Figure 2: An illustration of robust, correctly classified, and stable examples in (3.1).
where ∧ is the logical conjunction operator. (3.1) suggests that the robust examples are the intersection of two other sets: the correctly classified examples (examples whose predictions are the correct labels) and the stable examples (examples whose predictions are the same within the `p norm ball). A more direct illustration of this relationship can be found in Figure 2. While the natural accuracy measures the ratio of correctly classified examples |Scorrect| against the whole sample set, to our knowledge, there does not exist a metric measuring the ratio of stable examples |Sstable| against whole the sample set. Here we formally define this ratio as the perturbation stability, which measures the fraction of examples whose predictions cannot be perturbed as reflected in the robust regularization term in (1.1).

heading: 3.2 Evaluation of Perturbation Stability
text: We apply the TRADES [70] method, which is one of the strongest baselines in robust training, on CIFAR10 dataset and plot the robust accuracy, natural accuracy, and perturbation stability against the training epochs in Figure 3. Experiments are conducted on WideResNet-34 [69] with various widen factors. For each network, when robust accuracy reaches the highest point, we record all three metrics and show their changing trend against network width in Figure 3(d). From Figure 3(d), we can observe that the perturbation stability decreases monotonically as the network width increases. This suggests that wider models are actually more vulnerable to adversarial perturbation. In this sense, the increased network width could hurt the overall model robustness to a certain extent. This can be seen from Figure 3(d), where the robust accuracy of widen-factor 5 is actually slightly better than that of widen-factor 10.
Aside from the relation with model width, we can also gain other insights from perturbation stability:
1. Unlike robust accuracy and natural accuracy, perturbation stability gradually gets worse during the training process. This makes sense since an untrained model that always outputs the same label will have perfect stability, and the training process tends to break this perfect stability. From another perspective, the role of robust regularization in (1.1) is to encourage perturbation stability, such that the model predictions remain the same under small perturbations, which in turn improves model robustness.
2. Previous works [70, 61, 52] have argued that there exists a trade-off between natural accuracy and robust accuracy. However, from (3.1), we can see that robust accuracy and natural accuracy are coupled with each other, as a robust example must first be correctly classified. When the
natural accuracy goes to zero, the robust accuracy will become zero. On the other hand, higher natural accuracy also implies that more examples will likely become robust examples. Works including [51] and [45] also challenged this robust-natural trade-off [61] does not hold for some cases. Therefore, we argue that the real trade-off here should be between natural accuracy and perturbation stability and the robust accuracy is actually the consequence of this trade-off.
3. [53] has recently shown that adversarial training suffers from over-fitting as the robust accuracy might get worse as training proceeds, which can be seen in Figure 3(a). We found that the origin of this over-fitting is mainly attributed to the degenerate perturbation stability (Figure 3(c)) rather than the natural risk (Figure 3(b)). Future works of adversarial training may consider evaluating our perturbation stability to understand how their method takes effects. Do they only help natural risk, or robust regularization, or maybe both of them.

heading: 4 Why Larger Network Width Leads to Worse Perturbation Stability?
text: Our empirical findings in Section 3 explains why the larger network width may not help model robustness as it leads to worse perturbation stability. However, it still remains unclear what is the underlying reasons for the negative correlation between the perturbation stability and the model width. In this section, we show that larger network width naturally leads to worse perturbation stability from a theoretical perspective. Specifically, we first relate perturbation stability with the network’s local Lipschitzness and then study the relationship between local Lipschitzness and the model width by leveraging recent studies on neural tangent kernels [36, 3, 8, 73, 21].

heading: 4.1 Perturbation Stability and Local Lipschitzness
text: Previous works [29, 64] usually relate local Lipschitzness with network robustness, suggesting that smaller local Lipschitzness leads to robust models. Here we show that local Lipshctzness is more directly linked to perturbation stability, through which it further influences model robustness.
As a start, let us first recall the definition of Lipschitz continuity and its relation with gradient norms.
Lemma 4.1 (Lipschitz continuity and gradient norm [49]). Let D ∈ Rd denotes a convex compact set, f is a Lipschitz function if for all x,x′ ∈ D, it satisfies
|f(x′)− f(x)| ≤ L‖x′ − x‖p,
where L = supx∈D{‖∇f(x)‖q} and 1/p+ 1/q = 1.
Intuitively speaking, Lipschitz continuity guarantees that small perturbation in the input will not lead to large changes in the function output. In the adversarial training setting where the perturbation x′ can only be chosen within the neighborhood of x, we focus on the local Lipschitz constant where we restrict x′ ∈ B(x, ) and L = supx′∈B(x, ){‖∇f(x′)‖q}.
Now suppose our neural network loss function is local Lipschitz, let x′ be our computed adversarial example x̂ and x be the original example, the robust regularization term satisfies
max x̂∈B(x, )
[ L(θ; x̂, y)− L(θ;x, y) ] ≤ L max
x̂∈B(x, )
[ ‖x̂− x‖p ] ≤ L, (4.1)
where the first inequality is due to local Lipschitz continuity and L = supx′∈B(x, ){‖∇L(θ;x′, y)‖q}. (4.1) shows that the local Lipschitz constant is directly related to the robust regularization term, which can be used as a surrogate loss for the perturbation stability.

heading: 4.2 Local Lipschitzness and Network Width
text: Now we study how the network width affects the perturbation stability via studying the local Lipschitz constant.
Recently, a line of research emerges, which tries to theoretically understand the optimization and generalization behaviors of over-parameterized deep neural networks through the lens of the neural tangent kernel (NTK) [36, 3, 8, 73]. By showing the equivalence between over-parameterized neural networks and NTK in the finite width setting, this type of analysis characterizes the optimization and generalization performance of deep learning by the network architecture (e.g., network width, which we are particularly interested in). Recently, [21] also analyzed the convergence of adversarial training for over-parameterized neural networks using NTK. Here, we will show that the local Lipschitz constant increases with the model width.
In specific, let m be the network width and H be the network depth. Define an H-layer fully connected neural network as follows
f(x) = a>σ(W(H)σ(W(H−1) · · ·σ(W(1)x) · · · )),
where W(1) ∈ Rm×d, W(h) ∈ Rm×m, h = 2, . . . ,H are the weight matrices, a ∈ Rm is the output layer weight vector, and σ(·) is the entry-wise ReLU activation function. For notational simplicity, we denote by W = {W(H), . . . ,W(1)} the collection of weight matrices and by W0 = {W(H)0 , . . . ,W (1) 0 } the collection of initial weight matrices. Following [21], we assume the first layer and the last layer’s weights are fixed, and W is updated via projected gradient descent with projection set B(R) = {W : ‖W(h) −W(h)0 ‖F ≤ R/ √ m,h = 1, 2, . . . ,H}. We have the following lemma upper bounding the input gradient norm. Lemma 4.2. For any given input x ∈ Rd and `2 norm perturbation limit , if m ≥ max(d,Ω(H log(H))), R/ √ m + ≤ c/(H6(logm)3) for some sufficient small c > 0, then with probability at least 1−O(H)e−Ω(m(R/ √ m+ )2/3H), we have for any x′ ∈ B(x, ) and Lipschitz loss L, the input gradient norm satisfies
‖∇L(f(x′), y)‖2 = O (√ mH ) .
The proof of Lemma 4.2 can be found in the supplemental materials. Note that Lemma 4.2 holds for any x′ ∈ B(x, ), therefore, the maximum input gradient norm in the -ball is also in the order of O( √ mH). Lemma 4.2 suggests that the local Lipschitz constant is closely related to the neural network width m. In particular, the local Lipschitz constant scales as the square root of the network width. This in theory explains why wider networks are more vulnerable to adversarial perturbation.
In order to further verify the above theoretical result, we empirically calculate the local Lipschitz constant. In detail, for commonly used `∞ norm threat model, we evaluate the quantity supx′∈B(x, ){‖∇L(θ;x′, y)‖1} along
the adversarial training trajectory for networks with different widths. Note that solving this maximization problem along the entire training trajectory is computationally expensive or even intractable.
Therefore, we approximate this quantity by choosing the maximum input gradient `1-norm among the 10 attack steps for each iteration. Figure 4 shows that larger network width indeed leads to larger local Lipschitz constant values. This backup the theoretical results in Lemma 4.2.

heading: 5 Experiments
text: From Section 4, we know that wider networks have worse perturbation stability. This suggests that to fully unleash the potential of wide model architectures, we need to carefully control the decreasing of the perturbation stability on wide models. One natural strategy to do this is by adopting a larger robust regularization parameter λ in (1.1). In this section, we conduct thorough experiments to verify whether this strategy can mitigate the negative effects on perturbation stability and achieve better performances for wider networks.
It is worth noting that due to the high computational overhead of adversarial training on wide networks, previous works [70] tuned λ on smaller networks (ResNet18 [27]) and directly apply it on wider ones, neglecting the influence of model capacity. Our analysis suggests that using the same λ for models with different widths is suboptimal, and one should use a larger λ for wider models in order to get better model robustness.

heading: 5.1 Experimental Settings
text: We conduct our experiments on CIFAR10 [37] dataset, which is the most popular dataset in the adversarial training literature. It contains images from 10 different categories, with 50k images for training and 10k for testing. Here we first conduct our experiments using the TRADES [70] method. Networks are chosen from WideResNet [69] with different widen factor from 1, 5, 10. The batch size is set to 128, and we train each model for 100 epochs. The initial learning rate is set to be 0.1. We adopt a slightly different learning rate decay schedule: instead of dividing the learning rate by 10 after 75-th epoch and 90-th epoch as in [41, 70, 63], we halve the learning rate for every epoch after the 75-th epoch, for the purpose of preventing over-fitting. For evaluating the model robustness, we perform the standard PGD attack [41] using 20 steps with step size 0.007, and = 8/255. Note that previous works [70, 63] report their results using step size 0.003, which we found is actually less effective than ours. All experiments are conducted on a single NVIDIA V100 GPU.

heading: 5.2 Model Robustness with Larger Robust Regularization Parameter
text: We first compare the robustness performance of models with different network width using robust regularization parameters chosen from {6, 9, 12, 15, 18, 21} for TRADES [70]. Results of different evaluation metrics are presented in Table 1.
From Table 1, we can observe that the best robust accuracy for width-1 network is achieved when λ = 9, yet for width-5 network, the best robust accuracy is achieved when λ = 12, and for width-10 network, the best λ is 18. This suggests that wider networks indeed need a larger robust regularization parameter to unleash the power of wide model architecture fully. Our exploration also suggests that the optimal choice of λ for width-10 network is 18 under the same setting as [70], which is three times larger than the one used in the original paper, leading to an average improvement of 2.25% on robust accuracy. It is also worth noting that enlarging λ indeed leads to improved perturbation stability. Under the same λ, wider networks have worse perturbation stability. This observation is rather consistent with our empirical and theoretical findings in Sections 3 and 4. As stated in Section 3.2, the real trade-off is between natural accuracy and perturbation stability rather than robust accuracy. Also, the stability provides a clear hint for finding the best choice of λ.
We further show that our strategy also applies to the original adversarial training [41], as shown by the bottom part of Table 1. Proper adaptations should be made to boost the robust regularization for original (generalized) adversarial training. We show the detail of the adaptations in the Appendix. As shown by the table, the large improvements on both TRADES and adversarial training using our boosting strategy suggest that adopting larger λ is crucial in unleashing the full potential of wide models, which is usually neglected in practice.

heading: 5.3 Experiments on Different Datasets and Architectures
text: To show that our theory is universal and is applicable to various datasets and architectures, we conduct extra experiments on the CIFAR100 dataset and DenseNet model [31]. For the DenseNet models, the growth rate k denotes how fast the number of channels grows and thus becomes a suitable measure of network width. Following the original paper [31], we choose DenseNet-BC-40 and use models with different growth rates to verify our theory.
Experimental results are shown in Table 2. For completeness, we also report the results under four different attack methods and settings, including PGD [41], C&W [9], FAB [16], and Square [4]. We
Algorithm 1 Width Adjusted Regularization 1: Input: initial weights θ0, WAR parameter ζ, learn-
ing rate η, adversarial attack A 2: λ0 = 0, α = 0.1 3: for t = 1, . . . , T do 4: Get mini-batch {(x1, y1), . . . , (xm, ym)} 5: for i = 1, . . . ,m (in parallel) do 6: x̂i ← A(xi) 7: lnat ← L(θt;xi, yi) 8: lrob ← L(θt; x̂i, yi)− L(θt;xi, yi) 9: λt ← max(λt−1 + α · (ζ − (lnat/lrob), 0)
10: θt ← θt−1−(η/m) ∑m
i=1∇θ[lnat+λt ·lrob] 11: end for 12: end for
adopt the best λ from Table 1 and show the corresponding performance on models with different widths. It can be seen that our strategy of using a larger robust regularization parameter works very well across different datasets and networks. On the WideResNet model, we observe clear patterns as in Section 5.2. On the DenseNet model, although the best regularization λ is different from that of WideResNet, wider models, in general, still require larger λ for better robustness. On CIFAR100, our strategy raises the standard PGD score of the widest model from 30.48% to 32.98%.

heading: 5.4 Width Adjusted Regularization
text: Our previous analysis has shown that larger model width may hurt adversarial robustness without properly choosing the regularization parameter λ. However, exhaustively cross-validating λ on wider networks can be extremely time-consuming in practice. To address this issue, we investigate the possibility of automatically adjusting λ according to the model width, based on our existing knowledge obtained in fine-tuning smaller networks, which is much cheaper. Note that the key to achieving the best robustness is to well balance between the natural risk term and the robust regularization term in (1.1). Although the regularization parameter λ cannot be directly applied from thinner networks to wider networks (as suggested by our analyses), the best ratio between the natural risk and the robust regularization across different width models can be kept roughly the same. Following this idea, we design the Width Adjusted Regularization (WAR) method, which is summarized in Algorithm 1. Specifically, we first manually tune the best λ for a thin network and record the ratio ζ between the natural risk and the robust regularization when the training converges. Then, on training wider networks, we adaptively2 adjust λ to encourage the ratio between the natural risk and the robust regularization to stay close to ζ . Let’s take an example here. We first cross-validate λ on a thin network with widen factor 0.5 and identify the best λ = 6 and ζ = 30 with 18 GPU hours in total. Now we compare three different strategies for training wider models and summarize the results in Table 3: 1) directly apply λ = 6 with no fine-tuning on the current model; 2) exhaustive manual fine-tuning from λ = 6.0 to λ = 21.0 (6 trials) as in Table 1; 3) our WAR strategy. Table 3 shows that the final λ generated by WAR on wider models are consistent with the exhaustively tuned best λ. Compared to the exhaustive manual tuning strategy, WAR achieves even slightly better model robustness with much less overall training time (∼4 times speedup for WRN-34-10 model). On the other hand, directly using λ = 6 with no tuning on the wide models leads to much worse model robustness while having the same overall training time. This verifies the effectiveness of our proposed WAR method.

heading: 5.5 Comparison of Robustness on Wide Models
text: Previous experiments in Section 5.2 and Section 5.3 have shown the effectiveness of our proposed strategy on using larger robust regularization parameter for wider models. In order to ensure that this strategy does not lead to any obfuscated gradient problem [5] and gives a false sense of robustness, we further conduct experiments using stronger attacks. In particular, we choose to evaluate our best models on the AutoAttack algorithm [17], which is an ensemble attack method that contains four different white-box and black-box attacks for the best attack performances.
2the learning rate α for λt in Algorithm 1 is not sensitive and needs no extra tuning.
We evaluate models trained with WAR, with or without extra unlabeled data [10], and report the robust accuracy in Table 4. Note that the results of other baselines are directly obtained from the AutoAttack leaderboard3. From Table 4, we can see that our WAR significantly improves the baseline TRADES models on WideResNet. This experiment further verifies the effectiveness of our proposed strategy.
6 Conclusions
In this paper, we studied the relation between network width and adversarial robustness in adversarial training, a principled approach to train robust neural networks. We showed that the model robustness is closely related to both natural accuracy and perturbation stability, while the balance between the two is controlled by the robust regularization parameter λ. With the same value of λ, the natural accuracy is better on wider models while the perturbation stability actually becomes worse, leading to a possible decrease in the overall model robustness. We showed the origin of this problem by relating perturbation stability with local Lipschitzness and leveraging recent studies on the neural tangent kernel to prove that larger network width leads to worse perturbation
stability. Our analyses suggest that: 1) proper tuning of λ on wider models is necessary despite being extremely time-consuming; 2) practitioners should adopt a larger λ for training wider networks. Finally, we propose the Width Adjusted Regularization, which significantly saves the tuning time for robust training on wide models.

heading: 7 Acknowledgments
text: We thank the anonymous reviewers for their helpful comments. Boxi Wu, Deng Cai and Xiaofei He are supported in part by The National Key Research and Development Program of China (Grant Nos: 2018AAA0101400), The National Nature Science Foundation of China (Grant Nos: 62036009, U1909203, 61936006), and Innovation Capability Support Program of Shaanxi (Program No. 2021TD-05).

Review summaries:
The paper studies the connection between adversarial robustness and model capacity in the form of width. The key idea is to decompose robust accuracy into standard accuracy and stability---i.e., on what fraction of test inputs the prediction of the model cannot be changed by an adversary.  The authors find that while increased width tends to improve robust accuracy (as has also been previously observed) the gain are mostly coming from an improvement in the standard (test) accuracy of the model, while the stability of wider models is actually _decreased._ To counteract this phenomenon, they suggest increasing the regularization term corresponding to stability as the width of the model increases and indeed observe empirical performance improvements. The authors further support their hypothesis by theoretically analyzing the effect of width on robustness in an NTK setting and observing similar results. Finally, they propose a heuristic scheme for adjusting the stability regularization parameter during training and demonstrate promising results.

The paper discusses how the width of ResNets related to their robustness. They do adversarial training with a hyper-parameter for the strength of the robust regularization and show that making the model wider while keeping the hyper-parameter constant will increase clean accuracy but reduce the robust generalization.   They define a new metric, perturbation stability, which is the rate of samples keeping their label prediction under adversarial attacks, even if the label prediction is wrong without pertubations. The authors connect this metric to the local Lipschitzness and use it to study how the width of a network affects it. They show that both through an analytical calculation and empirical results that the local Lipschitz constant increases with the width of a network.  In further experiments the authors show that wider networks need a higher weight on the robust regularization loss to get optimal robust accuracy, while previous work often optimized this weight for smaller networks and then used the same value after increasing the width. The results are verified for other datasets and architectures and finally the authors present a strategy to adaptively choose the hyper-parameter for wider models by first optimizing it on smaller models and then optimizing during training to achieve the same ratio between natural loss and robust regularization loss for the wider model that was optimal for the smaller model.