A Universal Law of Robustness via Isoperimetry

1 Introduction . Solving n equations generically requires only n unknowns1 . However , the revolutionary deep learning methodology revolves around highly overparametrized models , with many more than n parameters to learn from n training data points . We propose an explanation for this enigmatic phenomenon , showing in great generality that finding a smooth function to fit d-dimensional data requires at least nd parameters . In other words , overparametrization by a factor of d is necessary for smooth interpolation , suggesting that perhaps the large size of the models used in deep learning is a necessity rather than a weakness of the framework . Another way to phrase the result is as a tradeoff between the size of a model ( as measured by the number of parameters ) and its “ robustness ” ( as measured by its Lipschitz constant ) : either one has a small model ( with n parameters ) which must then be non-robust , or one has a robust model ( constant Lipschitz ) but then it must be very large ( with nd parameters ) . Such a tradeoff was conjectured for the specific case of two-layer neural networks and Gaussian data in [ BLN21 ] . Our result shows that in fact it is a universal phenomenon , which applies to essentially any parametrized function class ( including in particular deep neural networks ) as well as a much broader class of data distributions . As in [ BLN21 ] we obtain an entire tradeoff curve between size and robustness : our universal law of robustness states that , for any function class smoothly parametrized by p parameters , and for any d-dimensional dataset satisfying mild regularity conditions , any function in this class that fits the data below the noise level must have its ( Euclidean ) Lipschitz constant larger than √ nd p . Theorem 1 ( Informal version of Theorem 3 ) . Let F be a class of functions from Rd → R and let ( xi , yi ) n i=1 be i.i.d . input-output pairs in Rd × [ −1 , 1 ] . Assume that : 1 . F admits a Lipschitz parametrization by p real parameters , each of size at most poly ( n , d ) . 1As in , for instance , the inverse function theorem in analysis or Bézout ’ s theorem in algebraic geometry . See also [ YSJ19 , BELM20 ] for versions of this claim with neural networks . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . 2 . The distribution µ of the covariates xi satisfies isoperimetry ( or is a mixture theoreof ) . 3 . The expected conditional variance of the output ( i.e. , the “ noise level ” ) is strictly positive , denoted σ2 : = Eµ [ V ar [ y|x ] ] > 0 . Then , with high probability over the sampling of the data , one has simultaneously for all f ∈ F : 1 n n∑ i=1 ( f ( xi ) − yi ) 2 ≤ σ2 − ⇒ Lip ( f ) ≥ Ω̃ ( √ nd p ) . Remark 1.1 . For the distributions µ we have in mind , for instance uniform on the unit sphere , there exists with high probability some O ( 1 ) -Lipschitz function f : Rd → R satisfying f ( xi ) = yi for all i . Indeed , with probability 1 − e−Ω ( d ) we have ||xi − xj || ≥ 1 for all 1 ≤ i 6= j ≤ n so long as n ≤ poly ( d ) . In this case we may apply the Kirszbraun extension theorem to find a suitable f regardless of the labels yi . More explicitly we may fix a smooth bump function g : R+ → R with g ( 0 ) = 1 and g ( x ) = 0 for x ≥ 1 , and then interpolate using the sum of radial basis functions f ( x ) = n∑ i=1 g ( ||x− xi|| ) yi . In fact this construction requires only p = n ( d + 1 ) parameters to specify the values ( xi , yi ) i∈ [ n ] and thus determine the function f . Hence p = n ( d+ 1 ) parameters suffice for robust interpolation , i.e . Theorem 3 is essentially best possible for L = O ( 1 ) . A similar construction shows the same conclusion for any p ∈ [ Ω̃ ( n ) , nd ] , essentially tracing the entire tradeoff curve . This is because one can first project onto a fixed subspace of dimension d̃ = p/n , and the projected inputs xi now have pairwise distances at least Ω ( √ d̃/d ) with high probability . The analogous construction on the projected points now requires only p = d̃n parameters and has Lipschitz constant L = O ( √ d/d̃ ) = O ( √ nd p ) . 1.1 Speculative implication for real data . To put Theorem 1 in context , we compare to the empirical results presented in [ MMS+18 ] . In the latter work , they consider the MNIST dataset which consists of n = 6 × 104 images in dimension 282 = 784 . They trained robustly different architectures , and reported in Figure 4 the size of the architecture versus the obtained robust test accuracy ( third plot from the left ) . One can see a sharp transition from roughly 10 % accuracy to roughly 90 % accuracy at around 2 × 105 parameters ( capacity scale 4 in their notation ) . Moreover the robust accuracy keeps climbing up with more parameters , to roughly 95 % accuracy at roughly 3× 106 parameters . How can we compare these numbers to the law of robustness ? There are a number of difficulties that we discuss below , and we emphasize that this discussion is highly speculative in nature , though we find that , with a few leaps of faith , our universal law of robustness sheds light on the potential parameter regimes of interest for robust deep learning . The first difficulty is to evaluate the “ correct ” dimension of the problem . Certainly the number of pixels per image gives an upper bound , however one expects that the data lies on something like a lower dimensional sub-manifold . Optimistically , we hope that Theorem 1 will continue to apply for an appropriate effective dimension which may be rather smaller than the literal number of pixels . This hope is partially justified by the fact that isoperimetry holds in many less-than-picturesque situations , some of which are stated in the next subsection . The next difficulty is to estimate/interpret the noise value σ2 . From a theoretical point of view , this noise assumption is necessary for otherwise there could exist a smooth classifier with perfect accuracy in F , defeating the point of any lower bound on the size of F . We tentatively would like to think of σ2 as capturing the contribution of the “ difficult ” part of the learning problem , that is σ2 could be thought of as the non-robust generalization error of reasonably good models , so a couple of % of error in the case of MNIST . With that interpretation , one gets “ below the noise level ” in MNIST with a training error of a couple of % . We believe that versions of the law of robustness might hold without noise ; these would need to go beyond representational power and consider the dynamics of learning algorithms . Finally another subtlety to interpret the empirical results of [ MMS+18 ] is that there is a mismatch between what they measure and our quantities of interest . Namely the law of robustness talks about two things : the training error , and the worst-case robustness ( i.e. , the Lipschitz constant ) . On the other hand [ MMS+18 ] measures the robust generalization error . Understanding the interplay between those three quantities is a fantastic open problem . Here we take the perspective that a small robust generalization error should imply a small training error and a small Lipschitz constant . Another important mismatch is that we stated our universal law of robustness for Lipschitzness in ` 2 , while the experiments in [ MMS+18 ] are for robustness in ` ∞ . We believe that a variant of the law of robustness remains true for ` ∞ , a belief again partially justified by how broad isoperimetry is ( see next subsection ) . With all the caveats described above , we can now look at the numbers as follows : in the [ MMS+18 ] experiments , smooth models with accuracy below the noise level are attained with a number of parameters somewhere in the range 2×105−3×106 parameters ( possibly even larger depending on the interpretation of the noise level ) , while the law of robustness would predict any such model must have at least nd parameters , and this latter quantity should be somewhere in the range 106 − 107 ( corresponding to an effective dimension between 15 and 150 ) . While far from perfect , the law of robustness prediction is far more accurate than the classical rule of thumb # parameters ' # equations ( which here would predict a number of parameters of the order 104 ) . Perhaps more interestingly , one could apply a similar reasoning to the ImageNet dataset , which consists of 1.4 × 107 images of size roughly 2 × 105 . Estimating that the effective dimension is a couple of order of magnitudes smaller than this size , the law of robustness predicts that to obtain good robust models on ImageNet one would need at least 1010 − 1011 parameters . This number is larger than the size of current neural networks trained robustly for this task , which sports between 108− 109 parameters . Thus , we arrive at the tantalizing possibility that robust models for ImageNet do not exist yet simply because we are a couple orders of magnitude off in the current scale of neural networks trained for this task . 1.2 Related work . Theorem 1 is a direct follow-up to the conjectured law of robustness in [ BLN21 ] for ( arbitrarily weighted ) two-layer neural networks with Gaussian data . Our result does not actually prove their conjecture , because we assume here polynomially bounded weights . While this assumption is reasonable from a practical perspective , it remains mathematically interesting to prove the full conjecture for the two-layer case . We prove however in Section A that the polynomial weights assumption is necessary as soon as one considers three-layer neural networks . Let us also mention the [ GCL+19 , Theorem 6.1 ] which showed a lower bound Ω ( nd ) on the VC dimension of any function class which can robustly interpolate arbitrary labels on all well-separated input sets ( x1 , . . . , xn ) . We also note that a relation between high-dimensional phenomenon such as concentration and adversarial examples has been hypothesized before , such as in [ GMF+18 ] . In addition to [ MMS+18 ] , several recent works have experimentally studied the relationship between a neural network scale and its achieved robustness , see e.g. , [ NBA+18 , XY20 , GQU+20 ] . It has been consistently reported that larger networks help tremendously for robustness , beyond what is typically seen for classical non-robust accuracy . We view our universal law of robustness as putting this empirical observation on a more solid footing : scale is actually necessary to achieve robustness . The law of robustness setting is closely related to the interpolation setting : in the former case one considers models optimizing “ beyond the noise level ” , while in the latter case one studies models with perfect fit on the training data . The study of generalization in this in- terpolation regime has been a central focus of learning theory in the last few years ( see e.g. , [ BHMM19 , MM19 , BLLT20 , NKB+20 ] ) , as it seemingly contradicts classical theory about regularization . More broadly though , generalization remains a mysterious phenomon in deep learning , and the exact interplay between the law of robustness ’ setting ( interpolation regime/worst-case robustness ) and ( robust ) generalization error is a fantastic open problem . Interestingly , we note that one could potentially avoid the conclusion of the law of robustness ( that is , that large models are necessary for robustness ) , with early stopping methods that could stop the optimization once the noise level is reached . In fact , this theoretically motivated suggestion has already been empirically tested and confirmed in the recent work [ RWK20 ] , showing again a close tie between the conclusions one can draw from the law of robustness and actual practical settings . Classical lower bounds on the gradient of a function include Poincaré type inequalities , but they are of a qualitately different nature compared to the law of robustness lower bound . We recall that a measure µ on Rd satisfies a Poincaré inequality if for any function f , one has Eµ [ ‖∇f‖2 ] ≥ C · Var ( f ) ( for some constant C > 0 ) . In our context , such a lower bound for an interpolating function f has essentially no consequence since the variance f could be exponentially small . In fact this is tight , as one easily use similar constructions to those in [ BLN21 ] to show that one can interpolate with an exponentially small expected norm squared of the gradient ( in particular it is crucial in the law of robustness to consider the Lipschitz constant , i.e. , the supremum of the norm of the gradient ) . On the other hand , our isoperimetry assumption is related to a certain strenghtening of the Poincaré inequality known as log-Sobolev inequality ( see e.g. , [ Led01 ] ) . If the covariate measure satisfies only a Poincaré inequality , then we could prove a weaker law of robustness of the form Lip & n √ d p ( using for example the concentration result obtained in [ BL97 ] ) . For the case of two-layer neural networks there is another natural notion of smoothness ( different from ` p norms of the gradient ) that can be considered , known as the Barron norm . In [ BELM20 ] it is shown that for such a notion of smoothness there is no tradeoff à la the law of robustness , namely one can simultaneously be optimal both in terms of Barron norm and in terms of the network size . More generally , it is an interesting challenge to understand for which notions of smoothness there is a tradeoff with size .

Summary: It is generally possible to interpolate train data as long as the number of parameters of our model exceeds the number of training points. The present paper asks how many parameters do we need if we want to interpolate in a smooth manner. If the smoothness is measured by Lipschitzness, the paper proves that one needs at least n d parameters to do so, where d is the ambient dimension (Theorem 1). The main assumptions are i) Lipschitz parametrization of the model with bounded parameters, ii) isoperimetric distribution of the train data, iii) positive noise level. This result, in particular, settles a conjecture by Bubeck, Li, and Nagaraj modulo assumption iii).