A law of robustness for two-layers neural networks

√ n/k where n is the number of datapoints . In particular , this conjecture implies that overparametrization is necessary for robustness , since it means that one needs roughly one neuron per datapoint to ensure a O ( 1 ) -Lipschitz network , while mere data fitting of d-dimensional data requires only one neuron per d datapoints . We prove a weaker version of this conjecture when the Lipschitz constant is replaced by an upper bound on it based on the spectral norm of the weight matrix . We also prove the conjecture in the highdimensional regime n ≈ d ( which we also refer to as the undercomplete case , since only k ≤ d is relevant here ) . Finally we prove the conjecture for polynomial activation functions of degree p when n ≈ dp . We complement these findings with experimental evidence supporting the conjecture . 1 INTRODUCTION . We study two-layers neural networks with inputs in Rd , k neurons , and Lipschitz non-linearity ψ : R→ R. These are functions of the form : x 7→ k∑ ` =1 a ` ψ ( w ` · x+ b ` ) , ( 1 ) with a ` , b ` ∈ R and w ` ∈ Rd for any ` ∈ [ k ] . We denote by Fk ( ψ ) the set of functions of the form ( 1 ) . When k is large enough and ψ is non-polynomial , this set of functions can be used to fit any given data set ( Cybenko , 1989 ; Leshno et al. , 1993 ) . That is , given a data set ( xi , yi ) i∈ [ n ] ∈ ( Rd × R ) n , one can find f ∈ Fk ( ψ ) such that f ( xi ) = yi , ∀i ∈ [ n ] . ( 2 ) In a variety of scenarios one is furthermore interested in fitting the data smoothly . For example , in machine learning , the data fitting model f is used to make predictions at unseen points x 6∈ { x1 , . . . , xn } . It is reasonable to ask for these predictions to be stable , that is a small perturbation of x should result in a small perturbation of f ( x ) . A natural question is : how “ costly ” is this stability restriction compared to mere data fitting ? In practice it seems much harder to find robust models for large scale problems , as first evidenced in the seminal paper ( Szegedy et al. , 2013 ) . In theory the “ cost ” of finding robust models has been investigated from a computational complexity perspective in ( Bubeck et al. , 2019 ) , from a statistical perspective in ( Schmidt et al. , 2018 ) , and more generally from a model complexity perspective in ( Degwekar et al. , 2019 ; Raghunathan et al. , 2019 ; Allen-Zhu and Li , 2020 ) . We propose here a different angle of study within the broad model complexity perspective : does a model have to be larger for it to be robust ? Empirical evidence ( e.g. , ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ) ) suggests that bigger models ( also known as “ overparametrization ” ) do indeed help for robustness . Our main contribution is a conjecture ( Conjecture 1 and Conjecture 2 ) on the precise tradeoffs between size of the model ( i.e. , the number of neurons k ) and robustness ( i.e. , the Lipschitz constant of the data fitting model f ∈ Fk ( ψ ) ) for generic data sets . We say that a data set ( xi , yi ) i∈ [ n ] is generic if it is i.i.d . with xi uniform ( or approximately so , see below ) on the sphere Sd−1 = { x ∈ Rd : ‖x‖ = 1 } and yi uniform on { −1 , +1 } . We give the precise conjecture in Section 2 . We prove several weaker versions of Conjecture 1 and Conjecture 2 respectively in Section 4 and Section 3 . We also give empirical evidence for the conjecture in Section 5 . A corollary of our conjecture . A key fact about generic data , established in Baum ( 1988 ) ; Yun et al . ( 2019 ) ; Bubeck et al . ( 2020 ) , is that one can memorize arbitrary labels with k ≈ n/d , that is merely one neuron per d datapoints . Our conjecture implies that for such optimal-size neural networks it is impossible to be robust , in the sense that the Lipschitz constant must be of order √ d. The conjecture also states that to be robust ( i.e . attain Lipschitz constantO ( 1 ) ) one must necessarily have k ≈ n , that is roughly each datapoint must have its own neuron . Therefore , we obtain a trade off between size and robustness , namely to make the network robust it needs to be d times larger than for mere data fitting . We illustrate these two cases in Figure 1 . We train a neural network to fit generic data , and plot the maximum gradient over several randomly drawn points ( a proxy for the Lipschitz constant ) for various values of √ d , when either k = n ( blue dots ) or k = 10nd ( red dots ) . As predicted , for the large neural network ( k = n ) the Lipschitz constant remains roughly constant , while for the optimally-sized one ( k = 10nd ) the Lipschitz constant increases roughly linearly in √ d. Notation . For Ω ⊂ Rd we define LipΩ ( f ) = supx 6=x′∈Ω |f ( x ) −f ( x′ ) | ‖x−x′‖ ( if Ω = R d we omit the subscript and write Lip ( f ) ) , where ‖ · ‖ denotes the Euclidean norm . For matrices we use ‖ · ‖op , ‖ · ‖op , ∗ , ‖ · ‖F and 〈· , ·〉 for respectively the operator norm , the nuclear norm ( sum of singular values ) , the Frobenius norm , and the Frobenius inner product . We also use these notations for tensors of higher order , see Appendix A for more details on tensors . We denote c > 0 and C > 0 for universal numerical constants , respectively small enough and large enough , whose values can change in different occurences . Similarly , by cp > 0 and Cp > 0 we denote constants depending only on the parameter p. We also write ReLU ( t ) = max ( t , 0 ) for the rectified linear unit . Generic data . We give some flexibility in our definition of “ generic data ” in order to focus on the essence of the problem , rather than technical details . Namely , in addition to the spherical model mentioned above , where xi is i.i.d . uniform on the sphere Sd−1 = { x ∈ Rd : ‖x‖ = 1 } , we also consider the very closely related model where xi is i.i.d . from a centered Gaussian with covariance 1 d Id ( in particular E [ ‖xi‖ 2 ] = 1 , and in fact ‖xi‖ is tightly concentrated around 1 ) . In both cases we consider yi to be i.i.d . random signs . We say that a property holds with high probability for generic data , if it holds with high probability either for the spherical model or for the Gaussian model . 2 A CONJECTURED LAW OF ROBUSTNESS . Our main contribution is the following conjecture , which asserts that , on generic data sets , increasing the size of a network is necessary to obtain robustness : Conjecture 1 For generic data sets , with high probability1 , any f ∈ Fk ( ψ ) fitting the data2 ( i.e. , satisfying ( 2 ) ) must also satisfy : LipSd−1 ( f ) ≥ c √ n k . Note that for generic data , with high probability ( for n = poly ( d ) ) , there exists a smooth interpolation . Namely there exists g : Rd → R with g ( xi ) = yi , ∀i ∈ [ n ] and Lip ( g ) = O ( 1 ) . This follows easily from the fact that with high probability ( for large d ) one has ‖xi − xj‖ ≥ 1 , ∀i 6= j. Conjecture 1 puts restrictions on how smoothly one can interpolate data with small neural networks . A striking consequence of the conjecture is that for a two-layers neural network f ∈ Fk ( ψ ) to be as robust as this function g ( i.e. , Lip ( f ) = O ( 1 ) ) and fit the data , one must have k = Ω ( n ) , i.e. , roughly one neuron per data point . On the other hand with that many neurons it is quite trivial to smoothly interpolate the data , as we explain in Section 3.3 . Thus the conjecture makes a strong statement that essentially the trivial smooth interpolation is the best thing one can do . In addition to making the prediction that one neuron per datapoint is necessary for optimal smoothness , the conjecture also gives a precise prediction on the possible tradeoff between size of the network and its robustness . We also conjecture that this whole range of tradeoffs is actually achievable : Conjecture 2 Let n , d , k be such that C · nd ≤ k ≤ C · n and n ≤ d C where C is an arbitrarily large constant in the latter occurence . There exists ψ such that , for generic data sets , with high probability , there exists f ∈ Fk ( ψ ) fitting the data ( i.e. , satisfying ( 2 ) ) and such that LipSd−1 ( f ) ≤ C √ n k . The condition k ≤ C · n in Conjecture 2 is necessary , for any interpolation of the data must have Lipschitz constant at least a constant . The other condition on k , namely k ≥ C · nd , is also necessary , for that many neurons is needed to merely guarantee the existence of a data-fitting neural network with k neurons ( see Baum ( 1988 ) ; Yun et al . ( 2019 ) ; Bubeck et al . ( 2020 ) ) . Finally the condition n ≤ dC is merely used to avoid explicitly stating a logarithmic term in our conjecture ( indeed , equivalently one can replace this condition by adding a multiplicative polylogarithmic term in d in the claimed inequality ) . Our results around Conjecture 2 ( Section 3 ) . We prove Conjecture 2 for both the optimal smoothness regime ( which is quite straightforward , see Section 3.3 ) and for the optimal size regime ( here more work is needed , and we use a certain tensor-based construction , see Section 3.4 ) . In the latter case we only prove approximate data fitting ( mostly to simplify the proofs ) , and more importantly we need to assume that n is of order dp for some even integer p. It would be interesting to generalize the proof to any n. While the conjecture remains open between these two extreme regimes , we do give a construction in Section 3.3 which has the correct qualitative behavior ( namely increasing k improves the Lipschitz constant ) , albeit the scaling we obtain is n/k instead of √ n/k , see Theorem 1 . Our results around Conjecture 1 ( Section 4 ) . We prove a weaker version of Conjecture 1 where the Lipschitz constant on the sphere is replaced by a proxy involving the spectral norm of the weight matrix , see Theorem 3 . We also prove the conjecture in the optimal size regime , specifically when n = dp for an integer p and one uses a polynomial activation function of degree p , see Theorem 6 . For p = 1 ( i.e. , n ≈ d ) we in fact prove the conjecture for abritrary non-linearities , see Theorem 4 . 1We do not quantify the “ with high probability ” in our conjecture . We believe the conjecture to be true except for an event of exponentially small probability with respect to the sampling of a generic data set , but even proving that the statement is true with strictly positive probability would be extremely interesting . 2We expect the same lower bound to hold even if one only asks f to approximately fit the data . In fact our provable variants of Conjecture 1 are based proofs that are robust to only assuming an approximately fitting f . Further open problems . Our proposed law of robustness is a first mathematical formalization of the broader phenomenon that “ overparametrization in neural networks is necessary for robustness ” . Ideally one would like a much more refined understanding of the phenomenon than the one given in Conjecture 1 . For example , one could imagine that in greater generality , the law would read LipΩ ( f ) ≥ F ( k , ( xi , yi ) i∈ [ n ] , Ω ) . That is , we would like to understand how the achievable level of smoothness depends on the particular data set at hand , but also on the set where we expect to be making predictions . Another direction to generalize the law would be to extend it to multilayers neural networks . In particular one could imagine the most general law would replace the parameter k ( number of neurons ) by the type of architecture being used and in turn predict the best architecture for a given data set and prediction set . Finally note that our proposed law apply to all neural networks , but it would also be interesting to understand how the law interacts with algorithmic considerations ( for example in Section 5 we use Adam Kingma and Ba ( 2015 ) to find a set of weights that qualitatively match Conjecture 2 ) .

Summary: This submission studies the relationship between the hidden-layer size of a two-layer neural network and its robustness, that is measured by its Lipschitz constant here. This paper first makes a conjecture that any two-layer neural network with k-neurons and Lipschitz activation functions that perfectly fit the data must have its Lipschitz constant larger than \sqrt(n/k) (with n being the number of data points and k the number of hidden neurons). An implication of this conjecture is that overparameterization can help improve the network robustness (namely, by making \sqrt(n/k) with sufficiently large k). Furthermore, a weaker version of this conjecture was proved by replacing the Lipschitz constant with an upper bound on the spectral norm of the weight matrix. The conjecture was further proved for ReLU activation function and polynomial activation function in different data regimes. These theoretical findings were finally evidenced with numerical results.