A Universal Law of Robustness via Isoperimetry

1 Introduction . Solving n equations generically requires only n unknowns1 . However , the revolutionary deep learning methodology revolves around highly overparametrized models , with many more than n parameters to learn from n training data points . We propose an explanation for this enigmatic phenomenon , showing in great generality that finding a smooth function to fit d-dimensional data requires at least nd parameters . In other words , overparametrization by a factor of d is necessary for smooth interpolation , suggesting that perhaps the large size of the models used in deep learning is a necessity rather than a weakness of the framework . Another way to phrase the result is as a tradeoff between the size of a model ( as measured by the number of parameters ) and its “ robustness ” ( as measured by its Lipschitz constant ) : either one has a small model ( with n parameters ) which must then be non-robust , or one has a robust model ( constant Lipschitz ) but then it must be very large ( with nd parameters ) . Such a tradeoff was conjectured for the specific case of two-layer neural networks and Gaussian data in [ BLN21 ] . Our result shows that in fact it is a universal phenomenon , which applies to essentially any parametrized function class ( including in particular deep neural networks ) as well as a much broader class of data distributions . As in [ BLN21 ] we obtain an entire tradeoff curve between size and robustness : our universal law of robustness states that , for any function class smoothly parametrized by p parameters , and for any d-dimensional dataset satisfying mild regularity conditions , any function in this class that fits the data below the noise level must have its ( Euclidean ) Lipschitz constant larger than √ nd p . Theorem 1 ( Informal version of Theorem 3 ) . Let F be a class of functions from Rd → R and let ( xi , yi ) n i=1 be i.i.d . input-output pairs in Rd × [ −1 , 1 ] . Assume that : 1 . F admits a Lipschitz parametrization by p real parameters , each of size at most poly ( n , d ) . 1As in , for instance , the inverse function theorem in analysis or Bézout ’ s theorem in algebraic geometry . See also [ YSJ19 , BELM20 ] for versions of this claim with neural networks . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . 2 . The distribution µ of the covariates xi satisfies isoperimetry ( or is a mixture theoreof ) . 3 . The expected conditional variance of the output ( i.e. , the “ noise level ” ) is strictly positive , denoted σ2 : = Eµ [ V ar [ y|x ] ] > 0 . Then , with high probability over the sampling of the data , one has simultaneously for all f ∈ F : 1 n n∑ i=1 ( f ( xi ) − yi ) 2 ≤ σ2 − ⇒ Lip ( f ) ≥ Ω̃ ( √ nd p ) . Remark 1.1 . For the distributions µ we have in mind , for instance uniform on the unit sphere , there exists with high probability some O ( 1 ) -Lipschitz function f : Rd → R satisfying f ( xi ) = yi for all i . Indeed , with probability 1 − e−Ω ( d ) we have ||xi − xj || ≥ 1 for all 1 ≤ i 6= j ≤ n so long as n ≤ poly ( d ) . In this case we may apply the Kirszbraun extension theorem to find a suitable f regardless of the labels yi . More explicitly we may fix a smooth bump function g : R+ → R with g ( 0 ) = 1 and g ( x ) = 0 for x ≥ 1 , and then interpolate using the sum of radial basis functions f ( x ) = n∑ i=1 g ( ||x− xi|| ) yi . In fact this construction requires only p = n ( d + 1 ) parameters to specify the values ( xi , yi ) i∈ [ n ] and thus determine the function f . Hence p = n ( d+ 1 ) parameters suffice for robust interpolation , i.e . Theorem 3 is essentially best possible for L = O ( 1 ) . A similar construction shows the same conclusion for any p ∈ [ Ω̃ ( n ) , nd ] , essentially tracing the entire tradeoff curve . This is because one can first project onto a fixed subspace of dimension d̃ = p/n , and the projected inputs xi now have pairwise distances at least Ω ( √ d̃/d ) with high probability . The analogous construction on the projected points now requires only p = d̃n parameters and has Lipschitz constant L = O ( √ d/d̃ ) = O ( √ nd p ) . 1.1 Speculative implication for real data . To put Theorem 1 in context , we compare to the empirical results presented in [ MMS+18 ] . In the latter work , they consider the MNIST dataset which consists of n = 6 × 104 images in dimension 282 = 784 . They trained robustly different architectures , and reported in Figure 4 the size of the architecture versus the obtained robust test accuracy ( third plot from the left ) . One can see a sharp transition from roughly 10 % accuracy to roughly 90 % accuracy at around 2 × 105 parameters ( capacity scale 4 in their notation ) . Moreover the robust accuracy keeps climbing up with more parameters , to roughly 95 % accuracy at roughly 3× 106 parameters . How can we compare these numbers to the law of robustness ? There are a number of difficulties that we discuss below , and we emphasize that this discussion is highly speculative in nature , though we find that , with a few leaps of faith , our universal law of robustness sheds light on the potential parameter regimes of interest for robust deep learning . The first difficulty is to evaluate the “ correct ” dimension of the problem . Certainly the number of pixels per image gives an upper bound , however one expects that the data lies on something like a lower dimensional sub-manifold . Optimistically , we hope that Theorem 1 will continue to apply for an appropriate effective dimension which may be rather smaller than the literal number of pixels . This hope is partially justified by the fact that isoperimetry holds in many less-than-picturesque situations , some of which are stated in the next subsection . The next difficulty is to estimate/interpret the noise value σ2 . From a theoretical point of view , this noise assumption is necessary for otherwise there could exist a smooth classifier with perfect accuracy in F , defeating the point of any lower bound on the size of F . We tentatively would like to think of σ2 as capturing the contribution of the “ difficult ” part of the learning problem , that is σ2 could be thought of as the non-robust generalization error of reasonably good models , so a couple of % of error in the case of MNIST . With that interpretation , one gets “ below the noise level ” in MNIST with a training error of a couple of % . We believe that versions of the law of robustness might hold without noise ; these would need to go beyond representational power and consider the dynamics of learning algorithms . Finally another subtlety to interpret the empirical results of [ MMS+18 ] is that there is a mismatch between what they measure and our quantities of interest . Namely the law of robustness talks about two things : the training error , and the worst-case robustness ( i.e. , the Lipschitz constant ) . On the other hand [ MMS+18 ] measures the robust generalization error . Understanding the interplay between those three quantities is a fantastic open problem . Here we take the perspective that a small robust generalization error should imply a small training error and a small Lipschitz constant . Another important mismatch is that we stated our universal law of robustness for Lipschitzness in ` 2 , while the experiments in [ MMS+18 ] are for robustness in ` ∞ . We believe that a variant of the law of robustness remains true for ` ∞ , a belief again partially justified by how broad isoperimetry is ( see next subsection ) . With all the caveats described above , we can now look at the numbers as follows : in the [ MMS+18 ] experiments , smooth models with accuracy below the noise level are attained with a number of parameters somewhere in the range 2×105−3×106 parameters ( possibly even larger depending on the interpretation of the noise level ) , while the law of robustness would predict any such model must have at least nd parameters , and this latter quantity should be somewhere in the range 106 − 107 ( corresponding to an effective dimension between 15 and 150 ) . While far from perfect , the law of robustness prediction is far more accurate than the classical rule of thumb # parameters ' # equations ( which here would predict a number of parameters of the order 104 ) . Perhaps more interestingly , one could apply a similar reasoning to the ImageNet dataset , which consists of 1.4 × 107 images of size roughly 2 × 105 . Estimating that the effective dimension is a couple of order of magnitudes smaller than this size , the law of robustness predicts that to obtain good robust models on ImageNet one would need at least 1010 − 1011 parameters . This number is larger than the size of current neural networks trained robustly for this task , which sports between 108− 109 parameters . Thus , we arrive at the tantalizing possibility that robust models for ImageNet do not exist yet simply because we are a couple orders of magnitude off in the current scale of neural networks trained for this task . 1.2 Related work . Theorem 1 is a direct follow-up to the conjectured law of robustness in [ BLN21 ] for ( arbitrarily weighted ) two-layer neural networks with Gaussian data . Our result does not actually prove their conjecture , because we assume here polynomially bounded weights . While this assumption is reasonable from a practical perspective , it remains mathematically interesting to prove the full conjecture for the two-layer case . We prove however in Section A that the polynomial weights assumption is necessary as soon as one considers three-layer neural networks . Let us also mention the [ GCL+19 , Theorem 6.1 ] which showed a lower bound Ω ( nd ) on the VC dimension of any function class which can robustly interpolate arbitrary labels on all well-separated input sets ( x1 , . . . , xn ) . We also note that a relation between high-dimensional phenomenon such as concentration and adversarial examples has been hypothesized before , such as in [ GMF+18 ] . In addition to [ MMS+18 ] , several recent works have experimentally studied the relationship between a neural network scale and its achieved robustness , see e.g. , [ NBA+18 , XY20 , GQU+20 ] . It has been consistently reported that larger networks help tremendously for robustness , beyond what is typically seen for classical non-robust accuracy . We view our universal law of robustness as putting this empirical observation on a more solid footing : scale is actually necessary to achieve robustness . The law of robustness setting is closely related to the interpolation setting : in the former case one considers models optimizing “ beyond the noise level ” , while in the latter case one studies models with perfect fit on the training data . The study of generalization in this in- terpolation regime has been a central focus of learning theory in the last few years ( see e.g. , [ BHMM19 , MM19 , BLLT20 , NKB+20 ] ) , as it seemingly contradicts classical theory about regularization . More broadly though , generalization remains a mysterious phenomon in deep learning , and the exact interplay between the law of robustness ’ setting ( interpolation regime/worst-case robustness ) and ( robust ) generalization error is a fantastic open problem . Interestingly , we note that one could potentially avoid the conclusion of the law of robustness ( that is , that large models are necessary for robustness ) , with early stopping methods that could stop the optimization once the noise level is reached . In fact , this theoretically motivated suggestion has already been empirically tested and confirmed in the recent work [ RWK20 ] , showing again a close tie between the conclusions one can draw from the law of robustness and actual practical settings . Classical lower bounds on the gradient of a function include Poincaré type inequalities , but they are of a qualitately different nature compared to the law of robustness lower bound . We recall that a measure µ on Rd satisfies a Poincaré inequality if for any function f , one has Eµ [ ‖∇f‖2 ] ≥ C · Var ( f ) ( for some constant C > 0 ) . In our context , such a lower bound for an interpolating function f has essentially no consequence since the variance f could be exponentially small . In fact this is tight , as one easily use similar constructions to those in [ BLN21 ] to show that one can interpolate with an exponentially small expected norm squared of the gradient ( in particular it is crucial in the law of robustness to consider the Lipschitz constant , i.e. , the supremum of the norm of the gradient ) . On the other hand , our isoperimetry assumption is related to a certain strenghtening of the Poincaré inequality known as log-Sobolev inequality ( see e.g. , [ Led01 ] ) . If the covariate measure satisfies only a Poincaré inequality , then we could prove a weaker law of robustness of the form Lip & n √ d p ( using for example the concentration result obtained in [ BL97 ] ) . For the case of two-layer neural networks there is another natural notion of smoothness ( different from ` p norms of the gradient ) that can be considered , known as the Barron norm . In [ BELM20 ] it is shown that for such a notion of smoothness there is no tradeoff à la the law of robustness , namely one can simultaneously be optimal both in terms of Barron norm and in terms of the network size . More generally , it is an interesting challenge to understand for which notions of smoothness there is a tradeoff with size .

Summary: This paper shows that if one wants to interpolate the data smoothly, the number of parameters required is $d$ times more than mere interpolation. More precisely, they show that for any function class smoothly parametrized by $p$ parameters, and for any $d$-dimensional dataset satisfying mild regularity conditions, any function in this class that fits the data below the noise level must have its (Euclidean) Lipschitz constant larger than $\sqrt{nd/p}$.   To demonstrate this, the authors show that for random labels, if the distribution satisfies isoperimetry then either the 0 level or 1 level set has probability upper bounded by $\exp(-d/C^2)$ where $C$ is the Lipschitz constant of $f$. A union bound then gives an upper bound on the probability of a function fitting the data.