Robustness in deep learning: The good (width), the bad (depth), and the ugly (initialization)
Authors: Zhenyu Zhu
Fanghui Liu
Grigorios Chrysos
Volkan Cevher
Venue: NeurIPS 2022 Accept (2022)
Keywords: over-parameterized model
robustness
perturbation stability
initialization scheme

Abstract: We study the average robustness notion in deep neural networks in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy training settings. We prove that in the under-parameterized setting, width has a negative effect while it improves robustness in the over-parameterized setting. The effect of depth closely depends on the initialization and the training mode. In particular, when initialized with LeCun initialization, depth helps robustness with the lazy training regime. In contrast, when initialized with Neural Tangent Kernel (NTK) and He-initialization, depth hurts the robustness. Moreover, under the non-lazy training regime, we demonstrate how the width of a two-layer ReLU network benefits robustness. Our theoretical developments improve the results by [Huang et al. NeurIPS21; Wu et al. NeurIPS21] and are consistent with [Bubeck and Sellke NeurIPS21; Bubeck et al. COLT21].

Robustness in deep learning: The good (width), the bad (depth), and the ugly (initialization)
Zhenyu Zhu,
Fanghui Liu,
Grigorios Chrysos,
Volkan Cevher
EPFL, Switzerland
{[first name]. [surname] H@epfl.ch
Abstract
We study the average robustness notion in deep neural networks in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy training settings. We prove that in the under-parametent improves robustness in the over- peeepaaraeterized setting. The effect of depth closely depends on the initialization and the training mode. In particular, when initialized with LeCun initialization, depth helps robustness with the lazy training regime. contrast, when initialized with Neural Tangent Kernel (NTK) and He-initialization, depth hurts the robustness. Moreover, under the non-lazy training regime, we demonstrate how the width of two-layer ReL.U network benefits robustness. Our theoretical developments improve the results by Huang et al. [2021). Wu et al.
setting, width has negative effeec while it
[202]] and are consistent with Bubeck and Sellke [021 Bubeck al. 2021)
Introduction
It is now well-known that deep neural networks (DNNs) are susceptible to adversarially chosen, albeit imperceptible, perturbations to their inputs [Goodfellow et al. 2015 Szegedy et al. 2014]. This lack of robustness is worrying as DNNs are now deployed in many real-worid applications [Eykholt] ct al. 2018). As a result, new algorithms are more and more being developed to defend against adversarial attacks improve the DNN robustness. Among the current defense methods, the most commonly used and arguably the most successful method adversarial training based minimax optimization [Athalye et al. 2018, Croce and Hein 2020 Madry al.) 2018 To study adversarial attacks and defenses, we need to investigate the robustness of DNNs at first.
A plethora of aspects the robustness have been studied, ranging from algorithms to their initializa- tion as well as from the width neural networks to their depth (i.e., the architecture). On the practical side, Madryy al. [2018) advocate that adversarial training requires more parameters (e.g., width) for better performance in minimax optimization, which would fall into the so-called over over-parameterized regime [Zhang et al. 2017). On the theoretical side, recent works suggest that over parameterization
may damage the adversarial robustness (Huang et al. 2021 Wu et al., 2021 Zhou and Schoellig
2019
Hassani and Javanmard 2022]. In stark contrast, Bubeck and Sellke 2021] Bubeck al.
2021 argue that the robustness DNNs needs enough parameters to be guaranteed. See a detailed
discussion in/Section
Our work aims to investigate this apparent contradiction theory, and to close the gap as much as possible. We begin with a definition of the perturbation slability of DNNs, which can be used to describe the robustness. following the spirit Wf et al. (202I), Dohmatob and Bietti (2022).
Definition 1 (perturbation stability). The perturbation stability of a neural network f(; W)
2d + Re parameterized by the neural network parameter W under the data distribution Dx and
paer-pparmeteriieed regime requires the number of parameters in DNN be (much) larger than the number of training data.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Wi N
W, - Ni0,8
Wi e N(0,02)
CR
Wi
BxlU
W;
W;
RdNV
W2
f(w) CR
Figure I: Schematic of our deep fully connected ReLU neural network.
Table 1: Comparison of the perturbation stability of deep ReLU neural network (see ( 1 under three common Gaussian initializations with different variances. For a formal definition of this neural network please refer to Eq. (2)
Initialization name
Initialization form
Our bound for (S,c)//
LeCun et al.
2012
B1 V V 81 = V / a =1
(V Lom
mm/ emmmmm + Vē
( ( 12222-2
He et al. 2015
B1 v 3.. B Br. v a
L.m m/1.² mmmml-m/1
+/
Allen-Zhu 2019
3r mi B1. / aaa=
13m mm/h3 +1
perturbation radius 6 is defined as follows:
((f,c)= = Ee V[ (x 2)112 Ya ~ Dx, â Z)), (1)
where i is uniformly sampled from an Eg norm ball of x with radius e, denoted Unif(B(e, æ)).
Since our definition of the perturbation stability takes the expectation of the clean and the adversarial data points, natural to describe the average robustness of a neural network. can be noticed that the larger value of the perturbation stability means worse robustness in average, i.c., average robustness.
Based on the perturbation stability, we study the average robustness of neural networks under different initializations in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy" training settings. Generally, non-lazy training makes the analysis of neural networks intractable as DNNs this regime cannot be simplified as a indeenndeenneent model [Chizat and Bach 2018 and accordingly. the analysis in this regime is mainly restricted to the two-layer setting [Mei et al. 2018 2019)
Overall, our results suggest that the width (good) helps average robustness in the over- over-parametee parameterized regime but the depth (bad) can help only under certain initializations (ugly). To specific, we make the following contributions and findings under the lazy/non-lazy training regimes, see Table
In the lazy training regime, the derived upper-bounds for DNNs, suggest that
along with the increase in width, the robustness firstly becomes worse in the under- parameterized regime and then gets better, and finally tends to be constant in highly over- weer-paaaeetrrized regimes, which implies the existence of a phase transition.
the depth has more complex tendency on robustness, which largely depends on the initializa- tion and the training mode. It can be grouped into two main classes (cf., Table :): depth helps robustness in an exponential order under the LeCun initialization [LeCun et al. 201 2
whereas hurts robustness in a polynomial order under He-initialization [He et 2015
and under Neural Tangent Kernel (NTK) initialization [Alenn-hhu et al. 2019].
Surprisingly, standard tools on training dynamics of neural networks [Allen-Zhu et al., 2019 Du al. 2018 sufficient to obtain our bounds, which explain the relationship between robustness
Heee the lazy/non-lar training regime indicates that neural network parameters change little/much during training. These phases determined by different initializations (Woodworth al. 2020 Luo et al. 2021

---

and the structural/architeetraa parameters of neural network. Our theoretical developments improve the results by Huang et al. [02TT Wu al. [02T]. and are supported by empirical evidence.
In the non-lazy training regime, we derive upper-hounds for two-layer networks, suggesting that
the width improves the robustness under different initializations.
the convergence rates of the average robustness is affected by the initialization.
We also derive sufficient condition to identify when DNNs enter in this regime, first attempt on understanding DNNs in this regime. Our technical contribution lies in connecting robustness to changes of neural network parameters during the early stages of training, which could expand the application scope of deep learning theory beyond lazy training analysis Jacot et al. 2018
initial but
Allen-Zhu et al. 2019].
Notations: We use the shorthand [n]] := 21. for positive integer n. We denote by a(n) X b(n): there exists positive constant independent of such that a(n) & cb(n). The standard Gaussian distribution NN 1) with the zero-mean and the identity variance. Uniform distribution inside the sphere is Unif(B((e, .)) with the center x and radius e. We follow the standard Rachmann-Lander notation in complexity theory c.g., O, o, Q, and for order notation.
2 Related work
DNNs are demonstrated to be sensitive to ad adversarially chosen but undetectable noise both empirically
Szegedy al. [014] and theoretically (Huang al., [202]] Bubeck and Selkke 2021]. Adversarial training AAthlyy et al. 2018 Croce and Hein [2020] Zhang et al.) [020b] Is a reliable way to obtain adversarially robust neural network. Nevertheless, improving the overall robustness of neural networks is still an unsolved problem in machine learning, especially when coupling with
initializations and parameters.
ever-parameterized neural networks under lazy/non-lazy training regimes: Modern DNNs in practice (He al., (0166 work under the setting where the number of parameters is (much) larger than the number of training data. Analysis of DNNs in terms of optimization [Safran et al. 2021
Zhou et al. [021] and generalization [Cao and Gu
2019 has received great attention deep learning
theory [Zhang et al. 2017].
In deep learning theory, neural tangent kernel (NTK) [Jacot al. 2018 and mean field Mei et al. 2018) analysis are two powerful tools for neural network analysis. To be specific, NTK builds an equivalence between training dynamics by gradient- craseent-based algorithms of DNNs and kernel regression under a specific initialization, and thus allows the analysis of deep networks (Allen-Zuu et al.) 2019
Du et al. training regime [Chizat et al. 2019], where neural networks are able to achieve zero training loss but the parameters change little, or even remain unchanged during training. In contrast, mean-field theory establishes global convergence by casting the network weights during training as an evolution in the space of probability distributions under some certain initializations [Mei et al.) 2018 Chizat and Bach 2018]. This strategy goes beyond lazy training regime, which allows for neural networks parameters change in a constant order after training.
2019a 9a Chen al., 2020]. However, the NTK requires neural networks to belong in the lazy
If the neural networks parameters change a lot after training, or even tend to infinity, then neural networks work in the non-lazy training regime. Analysis of DNNs under this setting appears intractable and challenging, so the current work mainly focus as two-layer neural networks [Maennel
al. 2018 Luo al.. 2021].
Robustness and wwer-paraeteriizaionn Goodffllow et al. 2015 demonstrate that adversarial learning helps robustness and reduces overlitting. Many works focus influencing factors of adversarial examples and robustness of the neural network (Schmidt et al. 2018 Zhang et al. 2020al Allen-Zhu and Li 2022]. The relation between model capacity and robustness is empirically investigated by Madry et al. [2018). i.e., a neural network with insufficient capacity can seriously hurt the robustness, Bubeck al. [202]] theoretically study the inherent trade-off between the size of neural networks and their robustness, and they claim that over- peee-aaaatterizationn is necessary for the robustness of two-layer neural networks.
However, some recent works propose the opposite view. Under the lazy training regime, Huang et al. 2021 demonstrate that when over-parameteriizd neural networks get wider, the robustness
3

---

decreases in a polynomial order. Similarly, the depth hurts the robustness in an exponential order. Wu et al. [021]] affirm the view of Huang et al. [02T] on the width. However for depth, they derive a stronger bound that the robustness gets worse in polynomial decay as the depth increases, as
suggested by Hassani and Javanmard| [022]: : over-parameeerizaaioon hurts robustness. In addition, (Gao et al. [2019] also make similar view: an increased model capacity (i.e., wider width and deeper depth) deteriorates the robustness of neural networks. Nevertheless, we remark that, the results of Hassani and Javanmard [2022] work in slightly different setting than that of Bubeck et al. [2021] on data interpolation, which requires a careful comparison. Accordingly, we adopt a complementary view to the vast literature. We provide an in-depth theoretical analysis investigate this apparent contradiction in theory, and to close the gap as much as possible.
3 Problem setting
Let X C Rd and Y C Ro be compact metric spaces. We assume that the training set Der {1ri y: y:}} drawn from unknown probability measure D on X Y. Its marginal data distribution is denoted by Dx. The goal of the classification task is to learn a neural network f f + Y such that f(z W) parameterized by W good approximation of the label y e Y corresponding to new sample x E X. In this paper, we use the empirical risk L(W) = E. [2;; W) y) Then we make the following assumption.
Assumption 1. We assume that the data satisfy || =1
Remark: This assumption is standard in theory of over weerppaamettriiee neural networks and also commonly used in practice (Du et al. 2019b a Allen-Zhu et al. 2019 Oymak and Soltanolkotabi
2020 Malach et al. 2020)
3.1 Network
We focus on the typical depth-L fully-connected ReLU neural networks admitting the width my of the 1-th hidden layer, 44 E [L] (cf. Fig. 1p:
1 f(a;; W) = f: = - - Wrha.L-i e [ 1], i [m]
h200 = 03
h = (Wihh,t-))
where x E Rd, f(x) E R a is the scaling factor, and Φ = max(0, x) is the ReLU activation function. The neural network parameters formulate the tuple of weight matrices W := ( E (Rmxd x (RmxmyL-2 Roxm]. According the property d(x) x (x:) of ReLU, have h = Di,, Wih,,, where D is a diagonal matrix under the ReLU activation function defined as below.
Definition 2 (Diagonal sign matrix). For each i [n]. l e [L 1] and k [m]. the diagonal sign matrix D is defined as: (D.,)k.. = ((WWhhu, 2 0}.
In our setting, we consider the standard Gaussian initialization with different variances that includes three typical initialization schemes in practice.
Initialization: Let mg. d, my random initialization [Wilka ~ (0, (3) for every (i.j) E [m]] x [m-]i] and / E [L]. Choosing different variance, work holds for three commonly used Gaussian initializations, i.e., LeCun initialization [LeCun et al., 2012), He- de-initialization (He et al. [2015] and Neural Tangent Kernel (NTK) initialization [lleen al. 2019]. refer to the formal definition in Table I for details.
and m2
M_-1 m, we make the standard
3.2 Discussion on various robustness metrics
we have proposed our robustness metric: perturbation stability (cf., Definition I). This metric can be viewed as an expectation of the inner product of first-order approximation of adversarial risk (Madry et al. 2018 and the perturbations with the uniform distribution, which measures the average robustness of the neural network. As we mentioned before, under the same perturbation radius c, a smaller value of P(f.e <) implies better perturbation stability, that is better average robustness. Previous works [Hein and Andriushchenko, 2017 Weng et al.) 2018 Wu et al. 2021 Bubeck and Sellke 1 use Lipschitzness to describe the robustness of the network, suggesting that smaller Lipschitzness leads to robust models. However, Lipschitzness is only a worst-case measure, and cannot reasonably describe the average changes of the entire dataset. Instead, we follow the
In Section

---

measure of Wu et al. [022]] Dohmatob and Bietti [2022), that aims to comprehensively consider the overall distribution of the data, not only the extreme case. Besides, the worst-case robustness can be extended to probabilistic robustness view [Robey et al. [022], which shares a similar spirit as our average robustness concept. Schmidt et al. [2018] present another definition of robustness, depending on the misclassified error of an adversarial data point. Instead, our perturbation stability measures the
function value changes at the clean data point via Taylor expansion which can exclude the influence of the learning capacity of the network.
4 Main results
In this section, we state the main theoretical results. Firstly, in [Section 4.1 we provide the upper bound of the perturbation stability in lazy training regime for deep neural networks defined by|Eq. (2) The sufficient condition that the neural network [Eq. (2) under non-lazy training regime is given in SSection 4.2] Finally, in Section 4.3 we provide the upper bound on the perturbation stability during early training of two-layer network under the non-lazy training regime.
4.1 Upper bound of the perturbation stability of DNNs under the lazy training regime
We are now ready to state the main results under the lazy training regime. The following theorem provides the upper bound of the perturbation stability and connects to the width, and the depth of a deep fully-connected neural network under different standard Gaussian initializations. The proof of Theorem iis deferred to Appendix B
Theorem 1. Given an L-layer neural network f defined by Eq. (2) trained by ( u=));= i=1 satisfy- ing Assumption 7] for the convenience of analysis, we set a I and B == A2
BL-1, define
2 a constant ? = /// m. Then, under small perturbation e, we have the following:
o (ff+)) S (V13m23835e m//1 + mo 1-
Remark: Our results cover the effect of the width and depth of neural network on robustness under various common initializations depending on y _
Comparison with three commonly used initializations: For the initializations used in practice,
our theoretical results can be mainly divided into two classes: 1) The depth helps robustness in
(V
(V 1. mmmemmLL
an exponential order under the LeCun initialization:
Theorem implies that
VT
L-2,
2) The depth hurts the robustness in polynomial order under He-initialization
m/L
and under the NTK initialization
L m m/L²
+1
derived by Theo-
rem
When employing other initializations, the robustness could be hurted in a exponential order. Below, we elaborate on these three initalizations:
1) LeCun initialization (7 2
) The order has three main parts: V Lim -
m/L. and (22) L-2
Regarding the width m, the first part V 1,3m is increasing function of m and the second part e em/113 is a decreasing function of m. Accordingly, in the under- padder-pramttrrizeed region (c.g., m is small), V d plays major role, so the stability will increase as m increases. After a critical point, m/ L infinity, the first term of the bound tends to O. Hence the perturbation stability tends to be a constant and independent of the width m the width m tends to infinity. It means that there exists phase transition phenomenon between the perturbation stability and over werrpparamteerization in terms of the width m.
d'
18m
plays major role, the stability will decrease m increases. When tends to
Regarding the depth L, the constant 7 = v2 implies that the third part has a faster decrease speed than the first and second parts and plays a major role in the tendency. The perturbation slubility of the neural network exponentially decreases with respect to the depth. That means, for the LeCun initialization, the deeper the network, the better the robustness. Nevertheless, the energy of the LeCun
5

---

Table 2: Comparison of the orders of the proposed bound with other two recent works. Our results are general to cover both under- and over-paraman ner--aaraeteriieed regimes, which expands the application scope of previous results [Wu et al. 2021, Huang et al. 2021]. (The original result of [Wu et al. 2021 can be reduced to vmL as the
(log m) 2 L condition is required).
m
Metrics
Our result
Wu et al. 2021
Huang et al. 2021
(ff,c/e
v 1 e mm/
+
L'm 1/3 Vogm m + vmL
2 2
32-3
m
initialization decreases as the network depth increases due to the variance 3 m
Since the
activation function ReLU loses half the energy in every layer, training a deep network with the LeCun initialization is difficult. Hence, need trade off between robustness and training difficulty regarding the network depth in practice for the LeCun initialization.
2) He initialization and NTK initialization (7 1): the bounds for these two initializations are almost the same, and only differ in the feature dimension. We can see that phase transition phenomena exist under these two initializations regarding the width m, similar to the LeCun initialization. Regarding the depth, when L is large, the first part VL3 plays major role in the perturbation stability. So these two initializations hurt the robustness of the neural network at a polynomial order.
All of the three initializations admit < 1. If some initialization schemes admit 7 > 1, then the depth will hurt the robustness of the neural network at an exponentially increasing rate.
Comparison with previous work: Theorem I provides a new relationship between the robustness with width and depth of DNNs. We compare our result with [Wu et al. 2021 Huang et al., 2021] using a basic NTK initialization [Allen-Zhu et al. 2019] (suppose that m >> and m >> d). For a better comparison, we derive their results under our robustness metric perturbation stability, as reported by Table
Our results indicate behavior transition on the width. For the over perr-parameterized regime, the robustness of the neural network only depends on the perturbation energy. and it is almost independent of the width m. The results on the width significantly better than the previous results increasing as the square root of m. For depth L, our results provide a tighter and more precise estimate as compared to [Wu al. 2021] in two-degree polynomial increasing order and [Huang et al.) 2021 in an exponential increasing order.
Furthermore, compared with the results of Bubeck al. [021] showing that the robustness of the two-layer neural network becomes better with the increase of the number of neurons (i.e., width), we provide more detailed and refined result the robustness of DNNs under different initializations and under-parand paader--rrmeterizeee regimes.
4.2 Sufficient condition for neural network under non-lazy training regime
Beyond the lazy training regime, turn attention to the non-lazy training regime and provide a sufficient condition for a (well-chosen) initialization of neural networks when entering into the non-lazy training regime. This is first attempt to understand the training dynamics of DNNs in this regime.
Our result requires a further assumption on the data and the empirical risk as follows.
Assumption 2. For a single-output network defined En. (2) we assume that maX4e()) ys 2 C1 > O for some constant C1. We also assume that the neural network can be well-trainer such that the empirical risk is (2))
Remark:
This is a common assumption in the field of optimization [Song al. 2021 in the under- and over- pee--parameterized regime, and we can even assume zero risk. Here we follow the specific assumption of Luo al. [2021].
Now we are ready to present our result: a sufficient condition to identify when deep ReLU neural networks fall into the non-lazy training regime, promising extension of Luo et al. [021] on two-layer neural networks. To avoid cluttering the analysis, we assume single-output i.e.
The proof of Theorem 2 is deferred to Appendix C

---

Theorem 2. Given an L-layer neural network f defined by Eq. (2) with = 1, trained by
{ y 1== under Assumptions 1 and 2 suppose that a > (m E' 3.)+ and > d
in Eq. (2) then for sufficiently large m, with probability at least (L 2) cxp(-O(m²)) -
(ap(=O(md)) - expl (mxp(((mm) over the initialization, we have:
[ii(t) - WIOLEl >1, E
sup (0,++000
[W](0)l
The condition > (m B:) implies that, neural network falls in a non-lazy training regime when the variance of the Gaussian initialization very small. can be achieved by typical case: taking m >> L2, choosing a 1 and VI E [4]; 8r = I initializations such as NTK initialization, LeCun initialization, He's initialization lead lazy training.
Remark:
m Commonly used
4.3 Upper bound of the perturbation stability for two-layer networks in non-lazy training
Unlike lazy training, weights of non-lazy training concentrate on few directions determined by the input data in the early stages of training (Luo et al. 202T]. The following theorem describes the neural network perturbation stability in the early training stage as function of network width in the non-lazy training regime. For ease of description, here we consider a special initialization scheme under the non-lazy regime, the proof Theorem is deferred to Appendix D
Theorem 3. Given a two-layer neural network with single output ft defined by Eq. (2) and trained by {x y satisfying Assumption 1 using gradient descent under the squared loss, consider the following initialization and training time less than a constant that only depends on m and λo then for a small range of perturbation e, with probability at least 1- exp(- 2)- over initialization, we have the following:
Eq. (2) L a 31 B3 ~ 3 1 with c 2 1.5, m n²
m
((fere <0 C
VVllog m + n
m=-1
Vn3mm
m m.- 0.5
Remark: Under this setting non-lazy training regime, the robustness and width of the neural network are positively correlated in the early stages of training. That is, as the width m increases in the over- weer-paameetrrzzed regime, a Gaussian initialization with smaller variance leads to the robustness increasing in faster decay. Our result holds for other initialization schemes in the non-lazy training
regime, e.g., c 2 leads to (ft,,)) S @
vn log m
and = 3 leads to (ft,)))e S
m
/n log m-+-- m14.6
5 Numerical evidence
We validate our theoretical results with series of experiments. In Inctioion 5.2 we firstly verify that our initialization settings belong in the lazy and the non-lazy training regimes. In Section 5.3 we explore the effect of varying widths from under- anddr-parameterizee to wver-aarameterized regions on the perturbation stability of neural networks. In [Section 5.4, we finally compare the effect of two different initializations and the network depth on the perturbation stability. Additional experimental results can be found in Appendix E
5.1 Experimental settings
Here we present our experimental setting including models, hyper-parameterr. the choice of width and depth, and initialization schemes. We use the popular datasets of MNIST [Lecun et al. 1998 and CIFAR-10
(Krizhevsky et al. 2014] for experimental validation.
Models: We report results using the following models: fully connected ReLU neural network named "FCN" in main paper and convolutional ReLU neural network named "CNN" in Appendix E
:yppe--arammters: Unless mentioned otherwise, models are trained for epochs with a batch size of 64. The initial value of the learning rate is 0.001. After the first 25 epochs, the learning rate is
7

---

0.007
0.04
L=2, Lazy
Lazy
0.006
0.03
0.02
0.005
0.01
0.004
0
10
20
30
40
50
2
2
2
2
2
Epochs
Width
(a)
(b)
Figure 2: (a) Tendency with respect time (training epochs) and (b) relationship between width and lazy training ratio of neural networks. Fig. shows that ratio x is small and almost unchanged, recognized lazy Iraining. In Fig. 2(b)
can that the decreases with the increasing width.
multiplied by a factor of 0.1 every epochs. The SGD used to optimize all the models, while the cross-entropy loss is used.
Width and depth: In order to verify our theoretical results, conduct series of experiments with different depths and widths of the same type neural network. Specifically, our experiments include 11 different widths from 2 to 2-4, and four different choices of depths, i.e., 2, 4, 6,8, 10.
We report results using the following initializations: 1) He initialization where We (0, ). 2) LeCun initialization where Wij NoO, _L) and 3) an initialization that
Initialization:
allows for non-lazy training regime on two-layer networks, i.e., B1 32 1/m² and 1.
5.2 Validation of lazy and non-lazy training regimes
Before verifying our results, need to identify the lazy and non-lazy training regime under different initializations. To this end, we define a measure for the lazy training ratio, i.e., n = El., ((()) [W((t))Wi(o)) This measure evaluates whether the neural network under the lazy training
ΣE. W:O0)lp
regime. A smaller implies that the neural network is close to lazy training.
According to the theory, we employ the He initialization and the non lazy training initialization we state in Section 5.1 conduct the experiment under two-layer neural networks to verify that their lazy training ratio matches the theoretical results of lazy training and non-lazy training (i.e., the experiment is under the correct regime). |Fig. 2(a) and Fig. 2(b) show the tendency of ratio with respect to time (training epochs) and relationship between width and lazy training ratio of neural networks under lazy training regime, respectively. We find that the ratio of lazy traing regime is almost a constant that does not change with time, and this constant decreases as width of the network increases. This is in line with what we know about lazy training [Chizat et al.) 2019]
shows the ratio tendency with time and width under non-lazy training regime. The ratio increases almost linearly over time in Fig. 3(a) In epoch 25 we decrease the learning rate, which decreases the rate that increases. At the same time, Fig. 3(b) shows similar tendency between the width and lazy training ratio as lazy training. However, the value of k is much higher than that of lazy training regime. Combining the results about tendency with time, the ratio will be expected to increase as the time until infinity.
Likewise, Fig. 3)
5.3
Validation for width
We verify the relationship between the perturbation stability and the width network as illustrated by Eqs. (3) and (4) We conduct series of experiments MNIST dataset using FCN with different
widths. Fig. 4 shows the relationship between the perturbation stability and width of FCN with different depths and training regimes. Here for lazy training and non-lazy training use the same
initialization as Seectio 5.2
Fig. 4(a) exhibits the relationship between the perturbation stability and the width of neural networks with different depths for 2, 4, 6, 8, and 10. All of the five curves confirm the phase transition with width: the perturbation stability firstly increases and then decreases with width, which match our

---

300
Non lazy
200
4
100
45
0.5
45
2
L=2, Non-lazy
0
30
40
50
2
2
2
2
Epochs
Width
(a)
(b)
Figure 3: (a) Tendency with respect time (training epochs) and relationship with width of non-lazy training ratio of neural networks. Fig. 3(a) shows that ratio k is changed a lot (increasing and then remains unchanged), recognized non-lazy training. The tendency of for non-lazy training is increasing with the width and then decreasing, i.c., phase transition in Fig. 3(b)
Non lazy training
Lnd
Stability
0.6
L-10
0.30
0.2
0.06
0.1
0.0
2
2
2
2 Width
215
21
212
2
2
0.0
21
2
2
2
2 Width
210
24
2
2
(a) Lazy training with different widths and depths
(b) Lazy and non-lazy training under different widths
Figure 4: Influence of width of neural network the perturbation stability. (a) phase transition of the perturbation stability vs. width with five different depths under lazy training. (b) the difference between lazy training and non-lazy training regimes for two layer neural networks.
theoretical results. Fig. 4(b) shows the difference of the effect of width on the perturbation stability of lazy and non-lazy training for two-layer neural networks. The perturbation stability of non-lazy training is significantly smaller than that of lazy training, which means non-lazy training regime is more robust. Besides, the perturbation stability of non-lazy training decreases with the width of the neural network increases, which coincides with our theoretical result, i.e., no phase transition phenomenon.
5.4 Validation for depth and initialization
Let us explore the effect depth on the perturbation stability under lazy training regime with different initializations in Fig. S(a)and and Fig. 5(b) Our results show the tendency of the perturbation stability for FCN with different widths and depths under the He initialization and the LeCun initialization. respectively. We observe similar phase transition phenomenon, and find that, the perturbation stability under He initialization increases with depth, while the LeCun initialization shows the opposite tendency, which verified our theory.
6 Conclusions
In this work, we explore the interplay of the width, the depth and the initialization of neural networks on their average robustness with new theoretical bounds in effort address the apparent contradic- tion in the literature. Our theoretical results hold in both the under- and over-parameterized regimes. Intriguingly, we find a change of behavior in average robustness with respect to the depth, initially ex- acerbating robustness and then alleviating it. We suspect that this could help explain the contradictory messages the literature. We also characterize the average robustness in the non-lazy training regime for two layer neural networks and find that width always help, coinciding with the results [Bubeck]

---

0.4
L-6
Stability
0.6
L-10
0.3
L-10
0.2
0.1
2
2
2
Width
Width (a)
(b)
Figure Relationship between the perturbation stability and depth of FCN under the He initialization
(a) and the LeCun initialization (b) different depths of T. = 2, 4, 6, 8 and 10.
and Sellke 202 Bubeck al. 2021] We also provide numerical evidence support the theoretical
developments. Our results demonstrate the rationale behind robustness of over parameterized neural networks and might be beneficial analyze the highly wer-parameterized foundation models, which have demonstrated exceptional performance in zero-shot performance [Brown et al. [0200]
Acknowledgements
are also thankful to the reviewers for providing constructive feedback. Research was sponsored by the Army Research Office and accomplished under Grant Number W91
This work was supported by Hasler Foundation Program: Hasler Responsible AI (project number 21043). This work supported by SNF project Deep Optimisation of the Swiss National Science Foundation (SNSF) under grant number 200021 222001 This work was supported by Zeiss. This project has received funding from the European Research Council (ERC) under the European Union's 's Horizon 2020 research and innovation programme (grant agreement n 725594 time-data). Corresponding authors: Fanghui Liu and Zhenyu Zhu.
10

---

References
Z. Allen-Zhrt and Li. Feature purification: How adversarial training performs robust deep learning. In IEEE Annual Symposium on Foundations of Computer Science (FOCS), 2022.
Z. Allen-Zhu, Y. Li, and Z. Song. A convergence theory for deep learning via over- wer-paramettrrization. In International Conference on Machine Learning (ICML), 2019.
A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give false sense of security: Cir- cumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), 2018.
A. Bietti and J. Mairal. On the inductive bias of neural tangent kernels. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
T. Brown, B. Mann, N. Ryder, M. Subbiah, D. Kaplan, Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert- Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. Ziegler, J. Wu, Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei. Language models are few-shot learners. In Advances Neural Information Processing Systems (NeurIPS). 2020.
Bubeck and M. Sellke. A universal law robustness via isoperimetry. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
S. Bubeck, Y. Li, and D. M. Nagaraj. A law of robustness for two-layers neural networks. In Conference on Learning Theory (COLT), 2021.
Y. Cao and Q Gu. Generalization bounds of stochastic gradient descent for wide and deep neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
L. Chen and S. Xu. Deep neural tangent kernel and laplace kernel have the same rkhs. In International Conference on Learning Representations (ICLR), 2021.
Z. Chen, Y. Cao, D. Zou, and Q. Gu. How much over parameterization is sufficient to learn deep ReLU networks? In International Conference on Learning Representations (ICLR), 2020.
L. Chizat and Bach. On the global convergence of gradient descent for over-paranann peer-paramttrizeed models using optimal transport. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
L. Chizat, E. Oyallon, and F. Bach. On lazy training in differentiable programming. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference Machine Learning (ICML), 2020.
E. Dohmatob and A. Bietti. On the (non- tronsttoouss of two-layer neural networks in different learning regimes, 2022.
S. Du, J. Lee, H. Li, L. Wang, and X. Zhai. Gradient descent finds global minima of deep neural networks. In International Conference on Machine Learning (ICML), 2019a.
S. Du, W. Hu, and J. D. Lee. Algorithmic regularization in learning deep homogeneous models: Layers are automatically balanced. In Advances in Neural Information Processing Systems (NeurIPS), 2018
S. S. Du, X. Zhai, B. Poczos, and A. Singh. Gradient descent provably optimizes over-parameterized neural networks. In International Conference on Learning Representations (ICLR), 2019b.
K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song. Robust physical-worle attacks on deep learning visual classification, In Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
R. Gao, T. Cai, H. Li, C.-. Hsieh, L. Wang, and J. D. Lee. Convergence of adversarial training in overparametrized neural networks. In Advances Neural Information Processing Systems (NeurIPS), 2019.
11

---

A. Geifman, A. Yadav, Y. Kasten, M. Galun, D. Jacobs, and R. Basri. On the similarity between the laplace and neural tangent kernels. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and hamnessing adversarial examples. In International Conference on Learning Representations (ICLR), 2015. 2015.
H. Hassani and A. Javanmard. The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression, 2022.
K. He, X. Zhang, S. Ren, and J. Sun. Delving deep into rectifiers: Surpassing human-level per- formance imagenet classification. In International Conference Computer Vision (ICCV), 2015.
K. He, X. Zhang. S. Ren, and J. Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
M. Hein and M. Andriushchenko. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
H. Huang, Y. Wang. S. M. Erfani. Q. Gu, J. Bailey, and X. Ma. Exploring architectural ingredients of adversarially robust deep neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2021.
A. Jacot, F. Gabriel, and C. Hongler. Neural tangent kernel: Convergence and generalization in neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
A. Krizhevsky, V. Nair, and G. Hinton. The cifar-10 dataset. online: http://www. cs. toronto. edu/kriz/cifar. html, 2014.
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 1998.
Y. A. LeCun, L. Bottou, G. B. Orr, and K.-R. Müller. Efficient backprop. In Neural networks: Tricks of the trade. 2012.
Luo, Z.-Q. J. Xu, Z. Ma, and Y. Zhang. Phase diagram for two-layer relu neural networks at infinite-width limit. Journal of Machine Learning Research, 2021.
A. Madry, A. Makelov, Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018.
H. Maennel, O. Bousquet, and S. Gelly. Gradient descent quantizes relu network features, 2018.
E. Malach, G. Yehudai, S. Shalev-Schwarzz, and O. Shamir. Proving the lottery ticket hypothesis: Pruning is all you need. In International Conference on Machine Learming (ICML), 2020.
S. Mei, A. Montanari, and P.-M. Nguyen. A mean field view of the landscape of two-layers neural networks. Proceedings of the National Academy of Sciences (PNAS), 2018
S. Mei, T. Misiakiewicz, and A. Montanari. Mean-field theory of two-layers neural networks: dimension-free bounds and kernel limit. In Conference on Learning Theory (COLT), 2019.
Q Nguyen, M. Mondelli, and G. Montufar. Tight bounds on the smallest eigenvalue of the neural tangent kernel for deep relu networks. In International Conference on Machine Learning (ICML), 2021.
S. Oymak and M. Soltanolkotabi. Toward moderate overparameterization:: Global convergence guarantees for training shallow neural networks. IEEE Journal Selected Areas in Information Theory, 2020.
A. Robey, L. F. O. Chamon, G. J. Pappas, and H. Hassani. Probabilistically robust learning: Balancing average- and worst-case performance. International Conference on Machine Learning (ICML.), 2022.
12

---

I. M. Safran, G. Yehudai, and O. Shamir. The effects of mild over- parameterrriznno on the optimization landscape of shallow relu neural networks. In Conference on Learning Theory (COLT). 2021.
L. Schmidt, Santurkar, D. Tsipras, K. Talwar, and A. Madry. Adversarially robust generalization requires more data. In Advances in Neural Information Processing Systems (NeurIPS), 2018.
C. Song, A. Ramezani- -ebrry,, T. Pethick, A. Eftekhari, and V. Cevher. Subquadratic overparame- terization for shallow neural networks. In Advances in Neural Information Processing Systems (NeurlPS), 2021.
C. Szegedy, W. Zaremba, I. Sutskever. Bruna, Erhan, I. Goodfellow, and Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014.
R. Vershynin. High--Dimensooall Probability: An Introduction with Applications Data Science. 2018.
T.W. Weng, H. Zhang, P.-Y. Chen, J. Yi, D. Su, Y. Gao, C.-J. Hsich, and L. Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. In International Conference on Learning Representations (ICLR), 2018.
B. Woodworth, Gunasekar, D. Lee, Moroshko, P. Savarese, Golan, D. Soudry, and N. Srebro. Kernel and rich regimes in overparametrized models. In Conference on Learning Theory (COLT), 2020.
B. Wu, Chen, D. Cai, X. He, and Q. Gu. Do wider neural networks really help adversarial robustness? In Advances in Neural Information Processing Systems (NeurIPS), 2021.
C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals. Understanding deep learning (still) requires rethinking generalization. In International Conference on Learning Representations (ICLR), 2017.
X. Zhang. Chen, Q Gu, and D. Evans. Understanding the intrinsic robustness of image distributions using conditional generative models. In International Conference Artificial Intelligence and Statistics (AISTATS), 2020a.
Y. Zhang, O. Plevrakis, S. S. Du, X. Li, Z. Song, and S. Arora. Over-parameterizeed adversarial training: An analysis overcoming the curse of dimensionality. In Advances in Neural Information Processing Systems (NeurIPS), 2020b.
M. Zhou, R. Ge, and C. Jin. A local convergence theory for mildly oerrpaaraeterrized two-layer neural network. In Conference on Learning Theory (COLT), 2021.
Zhou and A. P. Schoellig. An analysis of the expressiveness of deep neural network architectures based on their lipschitz constants, 2019,
13

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] We clearly discuss the limitation
of this work in the Appendix
(c) Did you discuss any potential negative societal impacts of your work? [Yes] We clearly discuss the societal impact of this work in the (ppeeddix G
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes] We have detailed the rationale of the applied assumptions in this paper.
(b) Did you include complete proofs of all theoretical results? [Yes] We include the complete proofs our theoretical results.
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as a URL)? [No] The datasets we in this work are all in the public domain and standard for image-related tasks. Thus, our setup can be reproduced by interested practitioners. The code will be open-sourced upon the acceptance of the paper.
(b) Did you specify all the training details (e.g.. data splits, hyperparameters, how they were chosen)? [Yes] Our experiments are mainly for validation our theory, all of the settings and prper-parameters are mentioned in the main paper.
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] All our experiments are conducted on single GPU in our internal cluster.
4. If you using existing assets (e.g., code, data, models) curating/releusing assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] We cite all the corresponding papers that provide the assets we use.
(b) Did you mention the license of the assets? [Yes] All the datasets used in this work are publicly available datasets. All the datasets enable their use for research purposes.
(c) Did you include any new assets either the supplemental material or as URL? [No] (d) Did you discuss whether and how consent was obtained from people whose data you're 're using/curating? [N/A] The datasets we utilize are publicly available and contain tens or hudrends of thousands of images. We refer to the authors original papers describing the datasets.
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A] Our experiments rely on a) synthetic data, b) public benchmarks that do not contain personally identifiable information offensive content.
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "FKkunmJH_ih", "reviewer": "Reviewer_xjE9", "summary": "The paper analyzes perturbation stability of fully connected feed-forward ReLU networks with respect to the networks width, depth, and initialization for the NTK regime, and with respect to width in the \"non-lazy\" regime. The results indicate that for overparameterized networks, stability increases with the width and that depth can increase or decrease robustness depending on the initialization. Moreover, the paper provides a criterion under which a network will train in the non-lazy regime (i.e., with large changes to the weights). The theoretical results are supported by an empirical evaluation.\n\nThe paper is well-written, the results are significant and interesting. The theoretical results are properly interpreted and empirically tested. This makes them quite insightful. This is a good paper. I vote for acceptance.", "questions": "- please define average robustness directly or at least be more clear how you use the terms (in the introduction, you use average robustness and $\\epsilon$-stability interchangeably, in the remark after Def. 2 you clarify that $\\epsilon$-stability is an approximation to average robustness).\n- Def. 2 is a repitition from the intro and could be avoided\n- the interpretation of the results could be written a bit clearer, in particular by using only $\\epsilon$-stability or average robustness, so that it is more intuitive what it means if it goes up or down (also, exacerbate is a bit ambiguous here, since it can mean \"make worse\" or \"enlarge\", which was a bit confusing to me, in particular since I was not sure which of the two would be good).\n- Out of curiosity: the results in [2] seem to indicate that flatness of the loss surface wrt. a single layer (independent of the rest of the network) implies average robustness. Can these results be related, e.g., through impacts of width and depth on flatness?", "limitations": "Please add a brief discussion on the difference of perturbation stability in expectation (as in Def. 2), and the also often used stability wrt. all data points (cf. [1]).\n\n[1] Schmidt, Ludwig, et al. \"Adversarially robust generalization requires more data.\" Advances in neural information processing systems 31 (2018).\n\n[2] Petzka, Henning, et al. \"Relative flatness and generalization.\" Advances in Neural Information Processing Systems 34 (2021): 18420-18432.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- insightful theoretical results\n- empirical validation of theory\n- in-depth interpretation of results\n- reproducible (code is provided)\n\nWeaknesses:\n- some minor improvements in clarity are necessary", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "AnYtVgmpgZu", "reviewer": "Reviewer_akix", "summary": "This paper discusses interplay of network width, depth and initialization on their average robustness with theoretical bounds. The authors show that width hurts robustness in the under-parameterized setting and improves robustness in the over-parameterized setting. Effect of depth depends on network intialization and training mode. In lazy training regime, depth helps robustness with LeCun initialization but hurts robustness with NTK and He-initialization. Under non-lazy training regime they demonstrate width helps robustness of a two-layer ReLU network. ", "questions": "1. Some statements in the paper is confusing: definition 2 calls the mesaurement perturbation stability while inidicating a small measurement implies more robust function: so low stability means high robustness ? Same goes for the remak in 4.1 \n2. In numerical evidence section 5.4, validation for depth only showed 2 choices of depth which could take more choices to be more convincing. NTK is also missing for validation. ", "limitations": "Theoretical assumptions are properly stated and explained. ", "rating": 5, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n* Originality: The theoretical bounds derived by the authors studying network robustness wrt. depth, width and initialization are original. \n* Quality: The theoretical derivation are well established with analysis and numerical evidence. \n\nWeakness: \n* Clarity: Some statements in the paper is confusing: definition 2 calls the mesaurement perturbation stability while inidicating a small measurement implies more robust function: so low stability means high robustness ? Same goes for the remak in 4.1 \n* Significance: The authors discussed the interplay of width, depth and initialization on network robustness and given the theoretical derivation found the effect on robustness has a change of phase as network goes from under-parameterized to over-parameterized which may settle some contradiction in previous literature, making a fair significance contribution. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "AG4lnCFip5s", "reviewer": "Reviewer_rKts", "summary": "This work explores the (average) robustness of neural networks with respect to the width, the depth, and the initialization. After related work and problem settings, it derives theoretical bounds on average robustness (measured by perturbation stability, defined therein) for lazy (Theorem 1) and non-lazy (Theorem 3) training regimes. Interpreting these results novel conclusions are derived shedding light on contradictions in the previous literature outlined in Related Work. The experimental section is brief (FFN on MNIST dataset, accompanied by CNN experiments on CIFAR10 in Appendix) but well selected and clearly in support of theoretical results derived.", "questions": "Experiments use early stopping after 50 epochs. I understand that accuracy is not of concern given the scope of the work. Yet to confirm training has reached a somewhat reasonable level of loss, I suggest reporting on training/validation losses after early stopping is applied. It would further add to the clarity and relevance of the results. ", "limitations": "Nothing to add to what is elaborated on in appendices F and G.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "To the best of the reviewer's knowledge, the work contains novel results and significantly extends the previous results on the robustness of neural networks. Experiments neatly presented in Figures, emphasize the main conclusions and suitably underpin the main narrative.\n\nSignificance is two-fold: \nFirstly, it is due to improving previous perturbation stability bounds by Theorem 1 (and 3 for non-lazy training regime), neatly captured in Table 1. making the difference obvious. \nThe second novel result and perhaps evenly impactful is due to shedding light on previously contradicting results of the role of width related to robustness (discussed in the Related Works section as well). This is done by interpreting Theorem 1 (average perturbation stability upper bound for lazy training) and revealing a phase-transition-like phenomenon occurring in average stability w.r.t. width under a lazy training regime! This was only possible due to the less vacuous result of Theorem 1, compared to previous works.\n\nOverall, the presented work is of high quality, clearly written, self-contained and wide in scope. Including a well-built argument and reasonably detailed proofs with preparatory lemmas (in appendix). The scope covers three different yet realistic initialization schemes (He, LeCun, and NTK) as well as lazy and non-lazy (limited to the two-layer net, but well-argued why in the appendix) training regimes.\n\nBesides detailed proofs and additional experiments, the appendix includes a useful table of notation and analysis of the limitations of the work + comments on Societal Impact.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept