Benign Overfitting in Adversarially Robust Linear Classification

1 INTRODUCTION . Modern machine learning methods such as deep learning have made many breakthroughs in a variety of application domains , including image classification ( He et al. , 2016 ; Krizhevsky et al. , 2012 ) , speech recognition ( Hinton et al. , 2012 ) and etc . These models are typically over-parameterized : the number of model parameters far exceeds the size of the training samples . One mystery is that , these over-parameterized models can memorize noisy training data and yet still achieve quite good generalization performances on the test data ( Zhang et al. , 2017 ) . Many efforts have been made to explain this striking phenomenon , which against what the classical notion of overfitting might suggest . A line of research works ( Soudry et al. , 2018 ; Ji & Telgarsky , 2019b ; Nacson et al. , 2019 ; Gunasekar et al. , 2018b ; a ) shows that there exists the so-called implicit bias ( Neyshabur , 2017 ) : the training algorithms tend to converge to certain kinds of solutions even with no explicit regularization . Specifically , Soudry et al . ( 2018 ) ; Ji & Telgarsky ( 2019b ) ; Nacson et al . ( 2019 ) demonstrate that gradient descent trained linear classifiers on logistic or exponential loss with no regularization asymptotically converge to the maximum L2 margin classifier . Recent works ( Bartlett et al. , 2020 ; Chatterji & Long , 2020 ; Cao et al. , 2021 ; Wang & Thrampoulidis , 2021 ; Tsigler & Bartlett , 2020 ) further shows that over-parameterized and implicitly regularized interpolators can indeed achieve small test error , and formulate this phenomenon as “ benign overfitting ” . More concretely , suppose the classification model f is parameterized by θ ∈ Θ and the loss is denoted as ` ( · ) . The population risk is define as P ( x , y ) ∼D [ fθ ( x ) 6= y ] , where data pair ( x , y ) is generated from certain data generation model . Chatterji & Long ( 2020 ) shows that with sufficient over-parameterization , gradient descent trained maximum L2 margin classifier can achieve nearly optimal population risk on noisy data for data generated from a sub-Gaussian mixture model . This suggests that the overfitting can be “ benign ” in the overparameterized setting . Besides these studies on the benign overfitting phenomenon , another well-known feature of modern machine learning methods is that they are vulnerable to adversarial examples . Recent studies ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) show that modern machine learning systems are brittle : slight input perturbation that is imperceptible to human eyes could mislead a well-trained classifier into wrong classification result . These malicious inputs are also known as the adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . Adversarial examples raise severe trustworthy issues and security concerns on the current machine learning systems especially in securitycritical applications . Various methods ( Kurakin et al. , 2016 ; Madry et al. , 2018 ; Zhang et al. , 2019 ; Wang et al. , 2019 ; 2020 ) have been proposed to defend against the threats posed by adversarial examples . One of the notable approaches is adversarial training ( Madry et al. , 2018 ) . Specifically , adversarial training solves the following min-max optimization problem , min θ∈Θ 1 n n∑ i=1 max x′i∈B p ( xi ) ` ( fθ ( x ′ i ) , yi ) , where { ( xi , yi ) } ni=1 is the training set and Bp ( xi ) = { x : ‖x−xi‖p ≤ } denotes the -ball around xi in ` p norm ( p ≥ 1 ) . Many empirical or theoretical studies have been conducted trying to analyze or further improve adversarial training robustness ( Zhang et al. , 2019 ; Rice et al. , 2020 ; Wang et al. , 2020 ; Carmon et al. , 2019 ; Wang et al. , 2019 ; Raghunathan et al. , 2020 ) . A recent work ( Sanyal et al. , 2021 ) also pointed out that normally trained interpolators with the presence of label noise are unlikely to be adversarially robust , while adversarially robust classifiers can not overfit noisy labels under certain conditions . However , it is still not clear whether the benign overfitting phenomenon occurs for extremely over-parameterized models in the presence of adversarial examples . In this paper , we show that benign overfitting indeed occurs in adversarial training . In order to properly characterize the benign overfitting phenomenon on adversarial training , we also define the population adversarial risk , which is the counterpart for population risk in standard training scenario : P ( x , y ) ∼D [ ∃x′ ∈ Bp ( x ) s.t. , fθ ( x′ ) 6= y ] . The adversarial risk measures the misclassification rate of the target classifier under the presence of ` p-norm adversarial perturbations . It is easy to observe that the adversarial risk is always larger than standard risk as it requires the classifier to correctly classify the data examples within the entire local ` p norm ball . We summarize our contributions of this paper in the following • We show that the benign overfitting phenomenon can occur in adversarially robust linear classifiers with sufficient over-parameterization . Specifically , under moderate ` p norm perturbations , adversarially trained linear classifiers can achieve the near-optimal standard and adversarial risks , in spite of overfitting the noisy training data . • When the perturbation strength is set to be 0 , our adversarial risk bound reduces to the standard one . The resulting standard risk bound extends Chatterji & Long ( 2020 ) ’ s risk bound to further characterize the behavior of the linear classifier trained by t-step gradient descent . • We show that depending on the value of p ( perturbation norm ) , the adversarial risk bound can be different . The higher value of p ( typically for p ≥ 2 case ) actually leads to a larger gap between the adversarial risk and the standard risk with the same . Notation . we use lower case letters to denote scalars and lower case bold face letters to denote vectors . For a vector x ∈ Rd , we denote its ` p norm ( p ≥ 1 ) of x by ‖x‖p = ( ∑d i=1 |xi|p ) 1/p , the ` ∞ norm of x by ‖x‖∞ = maxdi=1 |xi| . We denote x◦p as the element-wise p-power of x . For p ≥ 1 , we denote Bpr ( x ) as the ` p norm ball of radius r centered at x . Given two sequences { an } and { bn } , we write an = O ( bn ) if there exists a constant 0 < C < +∞ such that an ≤ C bn . We denote an = Ω ( bn ) if bn = O ( an ) . We denote an = Θ ( bn ) if an = O ( bn ) and an = Ω ( bn ) . 2 RELATED WORK . There exists a large body of works on adversarial training , implicit bias and benign overfitting . In this section , we review the most relevant works with ours . Adversarial Training . Adversarial training ( Madry et al. , 2018 ) and its variants ( Zhang et al. , 2019 ; Wang et al. , 2019 ; 2020 ) are currently the most effective type of approaches to empirically defend against adversarial examples ( Szegedy et al. , 2013 ; Goodfellow et al. , 2015 ) . And many attempts have been made to understand its empirical success . Charles et al . ( 2019 ) ; Li et al . ( 2020 ) showed that the adversarially trained linear classifier directionally converges to the maximum margin classifier . Gao et al . ( 2019 ) ; Zhang et al . ( 2020b ) showed that adversarial training with neural networks can achieve low robust training loss . Yet these conclusions can not explain the test ( population ) performances . Another line of research focuses on the generalization performance of adversarial training and the number of training samples . Schmidt et al . ( 2018 ) showed that adversarial models require more data than standard models to achieve certain test accuracy . Chen et al . ( 2020 ) showed that more data may actually increase the gap between the generalization error of adversarially-trained models and standard models . Yin et al . ( 2019 ) ; Cullina et al . ( 2018 ) studied the adversarial Rademacher complexity and VC-dimensions . Some other works focus on the trade-off between robustness and natural accuracy ( Zhang et al. , 2019 ; Tsipras et al. , 2019 ; Wu et al. , 2020 ; Raghunathan et al. , 2020 ; Yang et al. , 2020 ; Dobriban et al. , 2020 ; Javanmard & Soltanolkotabi , 2020 ) , adversarial model complexity lower bound ( Allen-Zhu & Li , 2020 ) , as well as the provable robustness upper bound ( Fawzi et al. , 2018 ; Zhang et al. , 2020a ) . Recently , some works also focus on studying the learning of robust halfspaces and linear models . Montasser et al . ( 2020 ) studied the conditions on the adversarial perturbation sets under which halfspaces are robustly learnable in the presence of random label noise . Diakonikolas et al . ( 2020 ) studied the computational complexity of adversarially robust halfspaces under ` p norm perturbations . Zou et al . ( 2021 ) showed that adversarially trained halfspaces are provably robust with low robust classification error in the presence of noise . Dan et al . ( 2020 ) proposed an adversarial signal to noise ratio and studied the excess risk lower/upper bounds for learning Gaussian mixture models . Taheri et al . ( 2020 ) ; Javanmard & Soltanolkotabi ( 2020 ) studied adversarial learning of linear models on Gaussian mixture data where the data dimension and the number of training data points have a fixed ratio . Implicit Bias . Several recent works studied the implicit bias of various training algorithms in overparameterized models . Soudry et al . ( 2018 ) studied the implicit bias of gradient descent trained on linearly separable data while Ji & Telgarsky ( 2019b ) studied the non-separable case . Gunasekar et al . ( 2018a ) studied the implicit bias of various optimization methods in linear regression and classification problems . Ji & Telgarsky ( 2019a ) studied the implicit bias for deep linear networks and Arora et al . ( 2019 ) ; Gunasekar et al . ( 2018b ) studied the implicit bias for matrix factorization . Lyu & Li ( 2020 ) studied the implicit regularization of homogeneous neural networks with exponential loss and logistic loss . Benign Overfitting and Double Descent . A series of recent works have studied the “ benign overfitting ” phenomenon Bartlett et al . ( 2020 ) that when training over-parameterized models , classifiers can still achieve good population risk even when overfitting the noisy training data . Bartlett et al . ( 2020 ) ; Tsigler & Bartlett ( 2020 ) studied the risk bounds for over-parameterized linear ( ridge ) regression and showed that under certain settings , the interpolating linear model with minimum parameter norm can have asymptotically optimal risk . Chatterji & Long ( 2020 ) ; Cao et al . ( 2021 ) ; Wang & Thrampoulidis ( 2021 ) studied the risk bounds in linear logistic regression and linear support vector machines . Belkin et al . ( 2018 ; 2019a ; b ) ; Hastie et al . ( 2019 ) ; Wu & Xu ( 2020 ) further quantified the dependency curve between the population risk and the degree of over-parameterization and showed that the curve has a double-descent shape .

Summary: The paper considers the analysis of benign overfitting in linear regression, first described in Bartlett et al. (2020), and extends it to the case of adversarial linear classification. Previously, Chatterji & Long (2020) had studied the non-adversarial classification case, so the main new result is an extension to the adversarial case.