Benign Overfitting in Adversarially Robust Linear Classification

1 INTRODUCTION . Modern machine learning methods such as deep learning have made many breakthroughs in a variety of application domains , including image classification ( He et al. , 2016 ; Krizhevsky et al. , 2012 ) , speech recognition ( Hinton et al. , 2012 ) and etc . These models are typically over-parameterized : the number of model parameters far exceeds the size of the training samples . One mystery is that , these over-parameterized models can memorize noisy training data and yet still achieve quite good generalization performances on the test data ( Zhang et al. , 2017 ) . Many efforts have been made to explain this striking phenomenon , which against what the classical notion of overfitting might suggest . A line of research works ( Soudry et al. , 2018 ; Ji & Telgarsky , 2019b ; Nacson et al. , 2019 ; Gunasekar et al. , 2018b ; a ) shows that there exists the so-called implicit bias ( Neyshabur , 2017 ) : the training algorithms tend to converge to certain kinds of solutions even with no explicit regularization . Specifically , Soudry et al . ( 2018 ) ; Ji & Telgarsky ( 2019b ) ; Nacson et al . ( 2019 ) demonstrate that gradient descent trained linear classifiers on logistic or exponential loss with no regularization asymptotically converge to the maximum L2 margin classifier . Recent works ( Bartlett et al. , 2020 ; Chatterji & Long , 2020 ; Cao et al. , 2021 ; Wang & Thrampoulidis , 2021 ; Tsigler & Bartlett , 2020 ) further shows that over-parameterized and implicitly regularized interpolators can indeed achieve small test error , and formulate this phenomenon as “ benign overfitting ” . More concretely , suppose the classification model f is parameterized by θ ∈ Θ and the loss is denoted as ` ( · ) . The population risk is define as P ( x , y ) ∼D [ fθ ( x ) 6= y ] , where data pair ( x , y ) is generated from certain data generation model . Chatterji & Long ( 2020 ) shows that with sufficient over-parameterization , gradient descent trained maximum L2 margin classifier can achieve nearly optimal population risk on noisy data for data generated from a sub-Gaussian mixture model . This suggests that the overfitting can be “ benign ” in the overparameterized setting . Besides these studies on the benign overfitting phenomenon , another well-known feature of modern machine learning methods is that they are vulnerable to adversarial examples . Recent studies ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) show that modern machine learning systems are brittle : slight input perturbation that is imperceptible to human eyes could mislead a well-trained classifier into wrong classification result . These malicious inputs are also known as the adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . Adversarial examples raise severe trustworthy issues and security concerns on the current machine learning systems especially in securitycritical applications . Various methods ( Kurakin et al. , 2016 ; Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2019 ; 2020 ) have been proposed to defend against the threats posed by adversarial examples . One of the notable approaches is adversarial training ( Madry et al. , 2018 ) . Specifically , adversarial training solves the following min-max optimization problem , min θ∈Θ 1 n n∑ i=1 max x′i∈B p ( xi ) ` ( fθ ( x ′ i ) , yi ) , where { ( xi , yi ) } ni=1 is the training set and Bp ( xi ) = { x : ‖x−xi‖p ≤ } denotes the -ball around xi in ` p norm ( p ≥ 1 ) . Many empirical or theoretical studies have been conducted trying to analyze or further improve adversarial training robustness ( Zhang et al. , 2019 ; Rice et al. , 2020 ; Wang et al. , 2020 ; Carmon et al. , 2019 ; Wang et al. , 2019 ; Raghunathan et al. , 2020 ) . A recent work ( Sanyal et al. , 2021 ) also pointed out that normally trained interpolators with the presence of label noise are unlikely to be adversarially robust , while adversarially robust classifiers can not overfit noisy labels under certain conditions . However , it is still not clear whether the benign overfitting phenomenon occurs for extremely over-parameterized models in the presence of adversarial examples . In this paper , we show that benign overfitting indeed occurs in adversarial training . In order to properly characterize the benign overfitting phenomenon on adversarial training , we also define the population adversarial risk , which is the counterpart for population risk in standard training scenario : P ( x , y ) ∼D [ ∃x′ ∈ Bp ( x ) s.t. , fθ ( x′ ) 6= y ] . The adversarial risk measures the misclassification rate of the target classifier under the presence of ` p-norm adversarial perturbations . It is easy to observe that the adversarial risk is always larger than standard risk as it requires the classifier to correctly classify the data examples within the entire local ` p norm ball . We summarize our contributions of this paper in the following • We show that the benign overfitting phenomenon can occur in adversarially robust linear classifiers with sufficient over-parameterization . Specifically , under moderate ` p norm perturbations , adversarially trained linear classifiers can achieve the near-optimal standard and adversarial risks , in spite of overfitting the noisy training data . • When the perturbation strength is set to be 0 , our adversarial risk bound reduces to the standard one . The resulting standard risk bound extends Chatterji & Long ( 2020 ) ’ s risk bound to further characterize the behavior of the linear classifier trained by t-step gradient descent . • We show that depending on the value of p ( perturbation norm ) , the adversarial risk bound can be different . The higher value of p ( typically for p ≥ 2 case ) actually leads to a larger gap between the adversarial risk and the standard risk with the same . Notation . we use lower case letters to denote scalars and lower case bold face letters to denote vectors . For a vector x ∈ Rd , we denote its ` p norm ( p ≥ 1 ) of x by ‖x‖p = ( ∑d i=1 |xi|p ) 1/p , the ` ∞ norm of x by ‖x‖∞ = maxdi=1 |xi| . We denote x◦p as the element-wise p-power of x . For p ≥ 1 , we denote Bpr ( x ) as the ` p norm ball of radius r centered at x . Given two sequences { an } and { bn } , we write an = O ( bn ) if there exists a constant 0 < C < +∞ such that an ≤ C bn . We denote an = Ω ( bn ) if bn = O ( an ) . We denote an = Θ ( bn ) if an = O ( bn ) and an = Ω ( bn ) . 2 RELATED WORK . There exists a large body of works on adversarial training , implicit bias and benign overfitting . In this section , we review the most relevant works with ours . Adversarial Training . Adversarial training ( Madry et al. , 2018 ) and its variants ( Zhang et al. , 2019 ; Wang et al. , 2019 ; 2020 ) are currently the most effective type of approaches to empirically defend against adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . And many attempts have been made to understand its empirical success . Charles et al . ( 2019 ) ; Li et al . ( 2020 ) showed that the adversarially trained linear classifier directionally converges to the maximum margin classifier . Gao et al . ( 2019 ) ; Zhang et al . ( 2020b ) showed that adversarial training with neural networks can achieve low robust training loss . Yet these conclusions can not explain the test ( population ) performances . Another line of research focuses on the generalization performance of adversarial training and the number of training samples . Schmidt et al . ( 2018 ) showed that adversarial models require more data than standard models to achieve certain test accuracy . Chen et al . ( 2020 ) showed that more data may actually increase the gap between the generalization error of adversarially-trained models and standard models . Yin et al . ( 2019 ) ; Cullina et al . ( 2018 ) studied the adversarial Rademacher complexity and VC-dimensions . Some other works focus on the trade-off between robustness and natural accuracy ( Zhang et al. , 2019 ; Tsipras et al. , 2019 ; Wu et al. , 2020 ; Raghunathan et al. , 2020 ; Yang et al. , 2020 ; Dobriban et al. , 2020 ; Javanmard & Soltanolkotabi , 2020 ) , adversarial model complexity lower bound ( Allen-Zhu & Li , 2020 ) , as well as the provable robustness upper bound ( Fawzi et al. , 2018 ; Zhang et al. , 2020a ) . Recently , some works also focus on studying the learning of robust halfspaces and linear models . Montasser et al . ( 2020 ) studied the conditions on the adversarial perturbation sets under which halfspaces are robustly learnable in the presence of random label noise . Diakonikolas et al . ( 2020 ) studied the computational complexity of adversarially robust halfspaces under ` p norm perturbations . Zou et al . ( 2021 ) showed that adversarially trained halfspaces are provably robust with low robust classification error in the presence of noise . Dan et al . ( 2020 ) proposed an adversarial signal to noise ratio and studied the excess risk lower/upper bounds for learning Gaussian mixture models . Taheri et al . ( 2020 ) ; Javanmard & Soltanolkotabi ( 2020 ) studied adversarial learning of linear models on Gaussian mixture data where the data dimension and the number of training data points have a fixed ratio . Implicit Bias . Several recent works studied the implicit bias of various training algorithms in overparameterized models . Soudry et al . ( 2018 ) studied the implicit bias of gradient descent trained on linearly separable data while Ji & Telgarsky ( 2019b ) studied the non-separable case . Gunasekar et al . ( 2018a ) studied the implicit bias of various optimization methods in linear regression and classification problems . Ji & Telgarsky ( 2019a ) studied the implicit bias for deep linear networks and Arora et al . ( 2019 ) ; Gunasekar et al . ( 2018b ) studied the implicit bias for matrix factorization . Lyu & Li ( 2020 ) studied the implicit regularization of homogeneous neural networks with exponential loss and logistic loss . Benign Overfitting and Double Descent . A series of recent works have studied the “ benign overfitting ” phenomenon Bartlett et al . ( 2020 ) that when training over-parameterized models , classifiers can still achieve good population risk even when overfitting the noisy training data . Bartlett et al . ( 2020 ) ; Tsigler & Bartlett ( 2020 ) studied the risk bounds for over-parameterized linear ( ridge ) regression and showed that under certain settings , the interpolating linear model with minimum parameter norm can have asymptotically optimal risk . Chatterji & Long ( 2020 ) ; Cao et al . ( 2021 ) ; Wang & Thrampoulidis ( 2021 ) studied the risk bounds in linear logistic regression and linear support vector machines . Belkin et al . ( 2018 ; 2019a ; b ) ; Hastie et al . ( 2019 ) ; Wu & Xu ( 2020 ) further quantified the dependency curve between the population risk and the degree of over-parameterization and showed that the curve has a double-descent shape .

Summary: This paper studies the clean test and adversarial test error obtained using   _Gradient Descent Adversarial Training_ (GDAT). The data distribution is the gaussian mixture model and the hypothesis class is lilinear classifiers.  In Theorem 4.4, the authors show that the clean test error is worse than than the inherent noise rate. However, benign overfitting still exists though a larger $\epsilon$ for the adversarial training hurts clean error.  In Theorem 4.8, the authors upper bound the robust test error obtained by GDAT. The result shows that adversarial error is certainly worse off than clean test error. Perhaps somewhat interesting this also shows that the perturbation radius needs to decrease with increasing $d$.