A law of robustness for two-layers neural networks

√ n/k where n is the number of datapoints . In particular , this conjecture implies that overparametrization is necessary for robustness , since it means that one needs roughly one neuron per datapoint to ensure a O ( 1 ) -Lipschitz network , while mere data fitting of d-dimensional data requires only one neuron per d datapoints . We prove a weaker version of this conjecture when the Lipschitz constant is replaced by an upper bound on it based on the spectral norm of the weight matrix . We also prove the conjecture in the highdimensional regime n ≈ d ( which we also refer to as the undercomplete case , since only k ≤ d is relevant here ) . Finally we prove the conjecture for polynomial activation functions of degree p when n ≈ dp . We complement these findings with experimental evidence supporting the conjecture . 1 INTRODUCTION . We study two-layers neural networks with inputs in Rd , k neurons , and Lipschitz non-linearity ψ : R→ R. These are functions of the form : x 7→ k∑ ` =1 a ` ψ ( w ` · x+ b ` ) , ( 1 ) with a ` , b ` ∈ R and w ` ∈ Rd for any ` ∈ [ k ] . We denote by Fk ( ψ ) the set of functions of the form ( 1 ) . When k is large enough and ψ is non-polynomial , this set of functions can be used to fit any given data set ( Cybenko , 1989 ; Leshno et al. , 1993 ) . That is , given a data set ( xi , yi ) i∈ [ n ] ∈ ( Rd × R ) n , one can find f ∈ Fk ( ψ ) such that f ( xi ) = yi , ∀i ∈ [ n ] . ( 2 ) In a variety of scenarios one is furthermore interested in fitting the data smoothly . For example , in machine learning , the data fitting model f is used to make predictions at unseen points x 6∈ { x1 , . . . , xn } . It is reasonable to ask for these predictions to be stable , that is a small perturbation of x should result in a small perturbation of f ( x ) . A natural question is : how “ costly ” is this stability restriction compared to mere data fitting ? In practice it seems much harder to find robust models for large scale problems , as first evidenced in the seminal paper ( Szegedy et al. , 2013 ) . In theory the “ cost ” of finding robust models has been investigated from a computational complexity perspective in ( Bubeck et al. , 2019 ) , from a statistical perspective in ( Schmidt et al. , 2018 ) , and more generally from a model complexity perspective in ( Degwekar et al. , 2019 ; Raghunathan et al. , 2019 ; Allen-Zhu and Li , 2020 ) . We propose here a different angle of study within the broad model complexity perspective : does a model have to be larger for it to be robust ? Empirical evidence ( e.g. , ( Goodfellow et al. , 2015 ; Madry et al. , 2018 ) ) suggests that bigger models ( also known as “ overparametrization ” ) do indeed help for robustness . Our main contribution is a conjecture ( Conjecture 1 and Conjecture 2 ) on the precise tradeoffs between size of the model ( i.e. , the number of neurons k ) and robustness ( i.e. , the Lipschitz constant of the data fitting model f ∈ Fk ( ψ ) ) for generic data sets . We say that a data set ( xi , yi ) i∈ [ n ] is generic if it is i.i.d . with xi uniform ( or approximately so , see below ) on the sphere Sd−1 = { x ∈ Rd : ‖x‖ = 1 } and yi uniform on { −1 , +1 } . We give the precise conjecture in Section 2 . We prove several weaker versions of Conjecture 1 and Conjecture 2 respectively in Section 4 and Section 3 . We also give empirical evidence for the conjecture in Section 5 . A corollary of our conjecture . A key fact about generic data , established in Baum ( 1988 ) ; Yun et al . ( 2019 ) ; Bubeck et al . ( 2020 ) , is that one can memorize arbitrary labels with k ≈ n/d , that is merely one neuron per d datapoints . Our conjecture implies that for such optimal-size neural networks it is impossible to be robust , in the sense that the Lipschitz constant must be of order √ d. The conjecture also states that to be robust ( i.e . attain Lipschitz constantO ( 1 ) ) one must necessarily have k ≈ n , that is roughly each datapoint must have its own neuron . Therefore , we obtain a trade off between size and robustness , namely to make the network robust it needs to be d times larger than for mere data fitting . We illustrate these two cases in Figure 1 . We train a neural network to fit generic data , and plot the maximum gradient over several randomly drawn points ( a proxy for the Lipschitz constant ) for various values of √ d , when either k = n ( blue dots ) or k = 10nd ( red dots ) . As predicted , for the large neural network ( k = n ) the Lipschitz constant remains roughly constant , while for the optimally-sized one ( k = 10nd ) the Lipschitz constant increases roughly linearly in √ d. Notation . For Ω ⊂ Rd we define LipΩ ( f ) = supx 6=x′∈Ω |f ( x ) −f ( x′ ) | ‖x−x′‖ ( if Ω = R d we omit the subscript and write Lip ( f ) ) , where ‖ · ‖ denotes the Euclidean norm . For matrices we use ‖ · ‖op , ‖ · ‖op , ∗ , ‖ · ‖F and 〈· , ·〉 for respectively the operator norm , the nuclear norm ( sum of singular values ) , the Frobenius norm , and the Frobenius inner product . We also use these notations for tensors of higher order , see Appendix A for more details on tensors . We denote c > 0 and C > 0 for universal numerical constants , respectively small enough and large enough , whose values can change in different occurences . Similarly , by cp > 0 and Cp > 0 we denote constants depending only on the parameter p. We also write ReLU ( t ) = max ( t , 0 ) for the rectified linear unit . Generic data . We give some flexibility in our definition of “ generic data ” in order to focus on the essence of the problem , rather than technical details . Namely , in addition to the spherical model mentioned above , where xi is i.i.d . uniform on the sphere Sd−1 = { x ∈ Rd : ‖x‖ = 1 } , we also consider the very closely related model where xi is i.i.d . from a centered Gaussian with covariance 1 d Id ( in particular E [ ‖xi‖ 2 ] = 1 , and in fact ‖xi‖ is tightly concentrated around 1 ) . In both cases we consider yi to be i.i.d . random signs . We say that a property holds with high probability for generic data , if it holds with high probability either for the spherical model or for the Gaussian model . 2 A CONJECTURED LAW OF ROBUSTNESS . Our main contribution is the following conjecture , which asserts that , on generic data sets , increasing the size of a network is necessary to obtain robustness : Conjecture 1 For generic data sets , with high probability1 , any f ∈ Fk ( ψ ) fitting the data2 ( i.e. , satisfying ( 2 ) ) must also satisfy : LipSd−1 ( f ) ≥ c √ n k . Note that for generic data , with high probability ( for n = poly ( d ) ) , there exists a smooth interpolation . Namely there exists g : Rd → R with g ( xi ) = yi , ∀i ∈ [ n ] and Lip ( g ) = O ( 1 ) . This follows easily from the fact that with high probability ( for large d ) one has ‖xi − xj‖ ≥ 1 , ∀i 6= j. Conjecture 1 puts restrictions on how smoothly one can interpolate data with small neural networks . A striking consequence of the conjecture is that for a two-layers neural network f ∈ Fk ( ψ ) to be as robust as this function g ( i.e. , Lip ( f ) = O ( 1 ) ) and fit the data , one must have k = Ω ( n ) , i.e. , roughly one neuron per data point . On the other hand with that many neurons it is quite trivial to smoothly interpolate the data , as we explain in Section 3.3 . Thus the conjecture makes a strong statement that essentially the trivial smooth interpolation is the best thing one can do . In addition to making the prediction that one neuron per datapoint is necessary for optimal smoothness , the conjecture also gives a precise prediction on the possible tradeoff between size of the network and its robustness . We also conjecture that this whole range of tradeoffs is actually achievable : Conjecture 2 Let n , d , k be such that C · nd ≤ k ≤ C · n and n ≤ d C where C is an arbitrarily large constant in the latter occurence . There exists ψ such that , for generic data sets , with high probability , there exists f ∈ Fk ( ψ ) fitting the data ( i.e. , satisfying ( 2 ) ) and such that LipSd−1 ( f ) ≤ C √ n k . The condition k ≤ C · n in Conjecture 2 is necessary , for any interpolation of the data must have Lipschitz constant at least a constant . The other condition on k , namely k ≥ C · nd , is also necessary , for that many neurons is needed to merely guarantee the existence of a data-fitting neural network with k neurons ( see Baum ( 1988 ) ; Yun et al . ( 2019 ) ; Bubeck et al . ( 2020 ) ) . Finally the condition n ≤ dC is merely used to avoid explicitly stating a logarithmic term in our conjecture ( indeed , equivalently one can replace this condition by adding a multiplicative polylogarithmic term in d in the claimed inequality ) . Our results around Conjecture 2 ( Section 3 ) . We prove Conjecture 2 for both the optimal smoothness regime ( which is quite straightforward , see Section 3.3 ) and for the optimal size regime ( here more work is needed , and we use a certain tensor-based construction , see Section 3.4 ) . In the latter case we only prove approximate data fitting ( mostly to simplify the proofs ) , and more importantly we need to assume that n is of order dp for some even integer p. It would be interesting to generalize the proof to any n. While the conjecture remains open between these two extreme regimes , we do give a construction in Section 3.3 which has the correct qualitative behavior ( namely increasing k improves the Lipschitz constant ) , albeit the scaling we obtain is n/k instead of √ n/k , see Theorem 1 . Our results around Conjecture 1 ( Section 4 ) . We prove a weaker version of Conjecture 1 where the Lipschitz constant on the sphere is replaced by a proxy involving the spectral norm of the weight matrix , see Theorem 3 . We also prove the conjecture in the optimal size regime , specifically when n = dp for an integer p and one uses a polynomial activation function of degree p , see Theorem 6 . For p = 1 ( i.e. , n ≈ d ) we in fact prove the conjecture for abritrary non-linearities , see Theorem 4 . 1We do not quantify the “ with high probability ” in our conjecture . We believe the conjecture to be true except for an event of exponentially small probability with respect to the sampling of a generic data set , but even proving that the statement is true with strictly positive probability would be extremely interesting . 2We expect the same lower bound to hold even if one only asks f to approximately fit the data . In fact our provable variants of Conjecture 1 are based proofs that are robust to only assuming an approximately fitting f . Further open problems . Our proposed law of robustness is a first mathematical formalization of the broader phenomenon that “ overparametrization in neural networks is necessary for robustness ” . Ideally one would like a much more refined understanding of the phenomenon than the one given in Conjecture 1 . For example , one could imagine that in greater generality , the law would read LipΩ ( f ) ≥ F ( k , ( xi , yi ) i∈ [ n ] , Ω ) . That is , we would like to understand how the achievable level of smoothness depends on the particular data set at hand , but also on the set where we expect to be making predictions . Another direction to generalize the law would be to extend it to multilayers neural networks . In particular one could imagine the most general law would replace the parameter k ( number of neurons ) by the type of architecture being used and in turn predict the best architecture for a given data set and prediction set . Finally note that our proposed law apply to all neural networks , but it would also be interesting to understand how the law interacts with algorithmic considerations ( for example in Section 5 we use Adam Kingma and Ba ( 2015 ) to find a set of weights that qualitatively match Conjecture 2 ) .

Summary: In this article, the authors investigated the fundamental trade-off between the size of a neural network and its robustness (measured by its Lipschitz constant), in the setting of a single-hidden-layer network with $k$ neurons and (approximately) Gaussian data, by proposing two conjectures, Conjecture 1 and 2, on the (lower and upper bound of the) network Lipschitz constant in perfectly fitting a given data set of size $n$ and data dimension $d$. Some weaker versions of the two proposed conjectures were proven, in Section 4 and 3, respectively. Empirical evidence for the proposed conjectures was shown in Section 5.