Introducing Sample Robustness

1 INTRODUCTION : . In the age of automated machine learning , we shift our focus evermore towards regarding metahyperparameters such as model-type or training- and validation budget as variables of a loss function in the most abstract sense . For training sets , however , the mere number of samples often determines how well suited it is perceived for a particular task . The motivation of this work is to introduce a concept allowing for the use of datasets as variables of such a generalised loss function as well . Imagine , for example , patients who share almost identical medical records , but react differently to some prescribed treatment . They may pose a challenge to machine learning models similar to what is known as natural adversarial examples in vision tasks , see Hendrycks et al . ( 2019 ) . The relationship between medical features and appropriate personal treatments may be sensitive towards small input variations , i.e . not robust towards perturbations . In this work , we are to the best of our knowledge the first to introduce and analyse a model-agnostic measure for the robustness of data . We show that knowledge about the robustness distribution of a specific test ( sub ) set can allow for choosing a more appropriate training ( sub ) set in terms of performance optimisation . Finally , we discover that the optimal choice of hyperparameters may also depend on the robustness distributions of both training- and test data . Let us motivate the concept of sample robustness first on a high level . When collecting and processing a dataset for a pre-defined task , we identify certain features and expressive samples such that a model may be able to abstract and generalise from these finite points to the whole space of possible inputs . Assume we have a certain rectangle-shaped data-distribution in a circle-shaped feature space and a dataset labelled according to two distinct ground truth maps y∗ ∈ { × , ∗ } and z∗ ∈ { ◦ , } ( comp . Figure 1 ) . Here , one can imagine classifying images of horses and cats ( assuming ground truth y∗ ) and classifying images of animal-human pairs ( assuming ground truth z∗ ) . Evidently , the distance between differently labelled samples depends on the ground truth map labelling them . For every sample in a dataset , the intrinsic information of closeness to a differently labelled sample can be considered a feature itself . For regression tasks and label distributions which are not necessarily categorical one may also include the distance of the corresponding labels as additional information . By taking the quotient of these two and maximising it over the dataset , i.e . calculating a point-wise Lipschitz constant of the label map , one can measure how sensitive a sample is to label- changing perturbations . Precisely this is the non-formal basis of the concept we propose , namely sample robustness . Our work aims to analyse the connection between both model performance and aligning the robustness distributions of training- and test sets . 1.1 OUTLINE . After citing and discussing related work concerned with decision boundaries , model robustness and Lipschitz calculus in section 2 , we introduce the mathematical framework and the measure of sample robustness in section 3 . We also motivate the concept theoretically and show some natural relations to K-Nearest Neighbour models . Section 4 is completely devoted to the evaluation using different datasets ( CIFAR-10 , Online News Popularity Dataset ) and models ( Convolutional Neural Networks , K-Nearest Neighbour , Random Forest ) . Section 5 finally concludes the findings and discusses other research approaches . Letters A - F refer to sections in the appendix . 2 RELATED WORK : . Analysing the data-distribution before training yields a way to investigate ( and boost ) model performance from an earlier stage as is done by unsupervised pre-training ( Erhan et al. , 2010 ) ) . Many algorithms stemming from the unsupervised setting ( Chigirev & Bialek , 2003 ; Cayton , 2005 ) are devoted to extract information about the so-called data-manifold ( Fefferman et al. , 2013 ; Bernstein & Kuleshov , 2014 ) . Decoding the latent features which determine the data-distribution ( Bengio et al. , 2013 ) provides valuable insight and helps to understand the decision boundaries which a model learns throughout the training phase . Furthermore , understanding the data-manifold may provide a view into the ” black box ” transforming inputs to outputs ( Fawzi et al. , 2016 ; Liu et al. , 2017 ; Biggio et al. , 2013 ) . In this work , we want to use the intrinsic information of distance between samples in feature space and relate it to the distance of the corresponding labels to introduce a new dataset-dependent feature . The robustness of a sample can be regarded as its susceptibility to label-changing perturbations . Here , one is immediately reminded of adversarial examples ( Szegedy et al. , 2013 ) in the context of model robustness . The difference to our proposed concept , however , is that we only use the pre-defined labels instead of model predictions as additional input . The term robustness itself is one of the most prominent throughout the recent literature in many different contexts , from robust attacks to robust models/defences ( Evtimov et al. , 2017 ; Beggel et al. , 2019 ; Madry et al. , 2017 ; Weng et al. , 2018 ; Tsuzuku et al. , 2018 ) . State-of-the-art machine learning models are susceptible to noise , especially so when crafted purposefully ( Fawzi et al. , 2016 ) . It leaves these powerful machines vulnerable to attacks either at training- ( Zhu et al. , 2019 ) or at test stage ( Biggio et al. , 2013 ) , independent of the architecture used ( Papernot et al. , 2016b ) . We follow the idea that models are extensions of the label map from the ( metric ) subspace defined by a dataset to the whole feature space . Hence , they will inherit critical properties from the data . In this work we analyse the robustness distribution of datasets and the thereon dependent performances of models , but plan on investigating the connection to model-robustness in the future . Lipschitz calculus yields a mathematically well-understood approach to describe and measure model robustness as in Weng et al . ( 2018 ) or Tsuzuku et al . ( 2018 ) . Framing machine learning theory in terms of metric spaces ( and also building robustness concepts thereon ) has been done before in Wang et al . ( 2016 ) , however , not explicitly connecting it to Lipschitz calculus . In this work , we build the concept of sample robustness based on a point-wise Lipschitz constant of the label map for metric- and Banach spaces such that it applies to a wide range of different feature- and label spaces including an ample variety of metrics . Finally , investigating the dependence of model-hyperparameters on data has been done previously ( Nakkiran et al. , 2020 ) . The authors also showed that more data could sometimes decrease model performance . In this work , we will see similar results regarding these two aspects with the difference that we could identify such data even before training using the proposed measure of sample robustness . 3 SAMPLE ROBUSTNESS . Now we will introduce the primary concept of this work , namely sample robustness . It measures how sensitive samples are to label-changing perturbations relative to the magnitude of the label map . 3.1 DEFINITION : ( FRAMEWORK ) . Let FS be a feature space , i.e . a metric space with metric d : = dFS , let T S be a target- or label space , i.e . a real Banach space with norm ‖ · ‖ : = ‖ · ‖T S , let x , t ⊆ FS be finite ( data ) sets with # x , # t ≥ 2 and let y : x ∪ t→ T S be a map of labels with # y ( x ) = # y ( t ) ≥ 2 . 3.2 DEFINITION : ( REACH ) . Let x ∈ FS be a sample with label y ( x ) , ‖y ( x ) ‖ ≤ ‖y‖∞ , and Γx ( x ) : = { x̃ ∈ x | y ( x ) 6= y ( x̃ ) } . The reach of x is defined as the distance of x to Γx ( x ) : rx ( x ) : = dist ( x , Γx ( x ) ) = min x̃∈Γx ( x ) d ( x , x̃ ) In other words : Γx ( x ) is the set of samples x̃ in the dataset x that are labelled differently from x . One may notice that x̃ ∈ Γx ( x ) ⇔ x ∈ Γx ( x̃ ) . The reach of x ∈ x is exactly the minimal distance of the point representing the image of a ” cat ” to a differently labelled ( coloured ) point in Figure . 1 . If x is ” close ” to x̃ , one would expect their labels y ( x ) and y ( x̃ ) to be ” close ” as well . Taking the quotient then gives a measure of this error ( comp . 3.3 ) and normalising the latter with respect to the magnitude of y ( using ‖y‖∞ : = max x∈x ‖y ( x ) ‖ ) yields the main concept of sample robustness in 3.4 . 3.3 DEFINITION : ( POINT-WISE LIPSCHITZ CONSTANT ) . For x ∈ FS with label y ( x ) , ‖y ( x ) ‖ ≤ ‖y‖∞ , and Γx ( x ) as in 3.2 one defines a point-wise Lipschitz constant of y as : Qx ( x ) : = max x̃∈Γx ( x ) ‖y ( x ) − y ( x̃ ) ‖ d ( x , x̃ ) 3.4 DEFINITION AND PROPOSITION : ( SAMPLE ROBUSTNESS ) . Let x ∈ FS with label y ( x ) , ‖y ( x ) ‖ ≤ ‖y‖∞ , and Γx ( x ) as in 3.2 . The robustness of the sample x in x with respect to d is defined as : Rx ( x ) : = ‖y‖∞ Qx ( x ) + ‖y‖∞ ∈ ( 0 , 1 ) It is independent of rescaling the label map y ( comp . A.2 ) . Coming back to the example in the introduction , we can see now that the almost identical medical records of patients reacting differently to the same treatment are considered as less robust samples in the above sense . 3.5 THEORETIC MOTIVATION AND BACKGROUND . Assume we have datasets x and t where both are labelled using the same label map y with max x∈x ‖y ( x ) ‖ = max t∈t ‖y ( t ) ‖ . For any z ∈ x ∪ t it holds that : Qx ∪ t ( z ) = max { Qx ( z ) , Qt ( z ) } ⇔ Rx ∪ t ( z ) = min { Rx ( z ) , Rt ( z ) } In other words : the closerRx ( z ) is toRt ( z ) , the closer both values are to the robustness of z in the union x ∪ t. It follows : Rx ( z ) ≈ Rt ( z ) ⇒ Rx ( z ) ≈ Rx ∪ t ( z ) ≈ Rt ( z ) , where at least one side is an equality . For convenience , we write x ∼R t : ⇔ Rx ( z ) ≈ Rt ( z ) ∀ z ∈ x ∪ t. Assume now that F is an extension of the label map y from x to x ∪ t1 . For given t one can downsize the set x to x̃ ⊂ x in order to align both robustness distributions ; however , there will likely be a trade-off between this alignment and the distance of F to y as maps on t , because there are less points to extend from ( therefore allowing for a higher variance ) . For such an extension F it holds that F|x ≡ y|x , thus : Qx ( x ) = max x̃∈Γx ( x ) ‖y ( x ) − y ( x̃ ) ‖ d ( x , x̃ ) = max x̃∈Γx ( x ) ‖F ( x ) − F ( x̃ ) ‖ d ( x , x̃ ) ∀ x ∈ x Assuming x ∼R t then enables the following conclusion for z ∈ x ∪ t : ( ∗ ) Qx ∪ t ( z ) ≈ Qx ( z ) = max z̃∈Γx ( z ) ‖y ( z ) − y ( z̃ ) ‖ d ( z , z̃ ) = max z̃∈Γx ( z ) ‖ ( F ( z ) − y ( z̃ ) ) + z‖ d ( z , z̃ ) , where z : = y ( z ) −F ( z ) . Notably , the rights side depends at most on one point outside x . Therefore it includes at most one z compared to the naive approach including both z and z̃ : Qx ∪ t ( z ) = max z̃∈Γx ∪ t ( z ) ‖y ( z ) − y ( z̃ ) ‖ d ( z , z̃ ) = max z̃∈Γx ∪ t ( z ) ‖ ( F ( z ) − F ( z̃ ) ) + ( z − z̃ ) ‖ d ( z , z̃ ) To summarize : by assuming x ∼R t one can find a small γz such thatQx ∪ t ( z ) = Qx ( z ) + γz and trade z̃ ∈ T S for γz ∈ R. But whereas the first depends on the extension F , the latter only depends on the data . Let now L ( F − y ) be the Lipschitz constant of the map F − y on x ∪ t. Using ( ∗ ) and the reverse triangle inequality one can derive the following ( comp . A.4 ) : L ( F − y ) ≥ max z∈x ∪ t ∣∣∣ max z̃∈Γx ∪ t ( z ) ‖y ( z ) − y ( z̃ ) ‖ d ( z , z̃ ) − max z̃∈Γx ∪ t ( z ) ‖F ( z ) − F ( z̃ ) ‖ d ( z , z̃ ) ∣∣∣ = max z∈x ∪ t ∣∣∣ max z̃∈Γx ( z ) ‖ ( F ( z ) − F ( z̃ ) ) + z‖ d ( z , z̃ ) + γz − max z̃∈Γx ∪ t ( z ) ‖F ( z ) − F ( z̃ ) ‖ d ( z , z̃ ) ∣∣∣ Hence , z̃ and γz determine a lower bound on L ( F − y ) and decreasing it a priori may allow for finding an extension F that minimizes both ‖F − y‖∞ and L ( F − y ) at the same time . By aligning the robustness distributions of x and t this bound will not only depend on the extension F , but on the data ( trading the possibly uncontrollable for the controllable ) . Finally , the true motive for such an approach stems from functional analysis : the space of Lipschitz functions from x ∪ t to T S , i.e . Lip ( x ∪ t , T S ) , is a Banach space with respect to the norm ‖ · ‖sum : = ‖ · ‖∞ + L ( · ) ( comp . Cobzaş et al . ( 2019 ) ) . So by regarding extensions F of y that minimise ‖F − y‖sum we a priori restrict the size of the hypothesis space from arbitrary maps to Lipschitz maps . The completeness of Lip ( x ∪ t , T S ) is of importance as it prevents sequences of extensions ( Fn ) with ‖Fn−y‖sum → 0 to exit this smaller space2 . 1One may think of a machine learning model F trained on x making predictions on t. 2Training a machine learning model produces exactly such a sequence Fn .

Summary: This work investigates how to choose the right training set and hyper-parameter for a test set. The authors claim that they introduce a concept of sample robustness based on the Lipschitz constant of the label map. The authors then empirically evaluate the robustness distribution of two datasets and investigate the model performance when using training subsets from different parts of the robustness distribution.