Title: PAC-Bayesian Spectrally-Normalized Bounds for Adversarially Robust Generalization
Venue: NeurIPS 2023
Accepted: yes
Keywords: Pac-Bayes

Adversarial Robustness

Generalization
Abstract: Deep neural networks (DNNs) are vulnerable to adversarial attacks. It is found empirically that adversarially robust generalization is crucial in establishing defense algorithms against adversarial attacks. Therefore, it is interesting to study the theoretical guarantee of robust generalization. This paper focuses on norm-based complexity, based on a PAC-Bayes approach (Neyshabur et al., 2017). The main challenge lies in extending the key ingredient, which is a weight perturbation bound in standard settings, to the robust settings. Existing attempts heavily rely on additional strong assumptions, leading to loose bounds. In this paper, we address this issue and provide a spectrally-normalized robust generalization bound for DNNs. Compared to existing bounds, our bound offers two significant advantages: Firstly, it does not depend on additional assumptions. Secondly, it is considerably tighter, aligning with the bounds of standard generalization. Therefore, our result provides a different perspective on understanding robust generalization: The mismatch terms between standard and robust generalization bounds shown in previous studies do not contribute to the poor robust generalization. Instead, these disparities solely due to mathematical issues. Finally, we extend the main result to adversarial robustness against general non-$\ell_p$ attacks and other neural network architectures.

PAC-Bayesian Spectrally-Normalized Bounds for Adversarially Robust Generalization

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial attacks. It is found empirically that adversarially robust generalization is crucial in establishing defense algorithms against adversarial attacks. Therefore, it is interesting to study the theoretical guarantee of robust generalization. This paper focuses on norm-based complexity, based on a PAC-Bayes approach (Neyshabur et al., 2017b). The main challenge lies in extending the key ingredient, which is a weight perturbation bound in standard settings, to the robust settings. Existing attempts heavily rely on additional strong assumptions, leading to loose bounds. In this paper, we address this issue and provide a spectrally-normalized robust generalization bound for DNNs. Compared to existing bounds, our bound offers two significant advantages: Firstly, it does not depend on additional assumptions. Secondly, it is considerably tighter, aligning with the bounds of standard generalization. Therefore, our result provides a different perspective on understanding robust generalization: The mismatch terms between standard and robust generalization bounds shown in previous studies do not contribute to the poor robust generalization. Instead, these disparities solely due to mathematical issues. Finally, we extend the main result to adversarial robustness against general nonℓ p attacks and other neural network architectures.

1 Introduction

Even though deep neural networks (DNNs) have impressive performance on many machine learning tasks, they are often highly susceptible to adversarial perturbations imperceptible to the human eye (Goodfellow et al., 2015; Madry et al., 2018). They have received enormous attention in the machine learning literature over recent years and a large number of defense algorithms (Gowal et al., 2020; Rebuffi et al., 2021) are proposed to improve the robustness in practice. Nonetheless, it still fails to deliver satisfactory performance. One major challenge stems from adversarially robust generalization. For example, Madry et al. (2018) demonstrated that the robust generalization gap can extend up to 50% on CIFAR-10. In contrast, the standard generalization gap is notably small in practical settings. Hence, a theoretical question arises: Why is there a huge difference between standard generalization and robust generalization? This paper focuses on norm-based generalization analysis.

In classical learning theory, one of the most well-known findings is that the generalization bound for neural networks depends on the norms of their layers (Bartlett, 1998). To further explore the generalization of deep learning, a series of work aimed at improving the norm-based bound (Bartlett &

Mendelson, 2002; Neyshabur et al., 2015; Golowich et al., 2018), mainly using tools of Rademacher complexity. The tightest bound is given by Bartlett et al. (2017), using a covering number approach. Neyshabur et al. (2017b) gave a different and simpler proof based on PAC-Bayes analysis, presented an almost equally tight bound. The key step involves bounding the change in output of the predictors in response to slight variations in the predictor parameters. In particular, considering f w ( x ) as the predictor parameterized by w , the crucial component for providing the generalization bound lies in bounding the gap | f w ( x ) -f w ′ ( x ) | , where w and w ′ are close. The weight perturbation bound, which addresses this aspect, is presented in Lemma 2 of Neyshabur et al. (2017b).

To comprehend the limited robust generalization capabilities of deep learning, a line of research endeavors to extend the norm-based bounds into robust settings. However, this has proven to be a challenging mathematical problem, as researchers have attempted the mentioned approaches including the Rademacher complexity (Khim & Loh, 2018; Yin et al., 2019; Awasthi et al., 2020), covering number (Gao & Wang, 2021; Xiao et al., 2022a; Mustafa et al., 2022), and the PAC-Bayes analysis (Farnia et al., 2018), yet a satisfactory solution remains elusive. For more details, see Section 2.

We use the PAC-Bayesian approach as an example to illustrate the mathematical challenge. The weight perturbations in adversarial settings differ from those in standard settings. When considering two predictors f w ( · ) and f w ′ ( · ) , the adversarial examples against these predictors are distinct, leading to a gap referred to as robust weight perturbation (defined later in Problem 1). It remains unclear how to establish a bound for robust weight perturbation. The combined changes in input and weights can potentially cause a significant alteration in the function value. The main challenge is illustrated in Figure 1, the details of which will be provided in Section 6.2. As a result, Farnia et al. (2018) introduced additional assumption to control this

WeightPerturbationBounds

StandardGeneralization

(Lemma 2inNeyshabur etal.,

Bound

2017)

(Theorem2)

Mainchallenge

Not imply

Lemma 10

RobustWeightPerturbation

RobustGeneralizationBound

(Problem1)

(TargetProblem)

gap and provide bounds in adversarial settings. However, the assumption imposed limitations on the effectiveness of the bounds due to two reasons: Firstly, the assumption of sharp gradients throughout the domain is a strong requirement. Secondly, without this assumption, the bounds become unbounded (= + ∞ ). Similarly, other existing norm-based bounds also depend on additional assumptions or involve higher-order terms in certain factors.

Given that the existing robust generalization bounds are much larger than standard generalization bounds, these results suggest a possible hypothesis: The significant disparity between standard and robust generalization in practical scenarios could potentially be attributed to the mismatch terms between the standard bounds and the robust bounds. However, verifying this hypothesis is challenging because it remains unclear whether the existence of these terms or assumptions is due to mathematical issues. Therefore, the current bounds are insufficient to address the main theoretical question.

In this paper, we address this problem and present a PAC-Bayes spectrally-normalized robust generalization bound without additional assumptions. Our robust generalization bound is as tight as the standard generalization bound, with an additional factor representing the perturbation intensity ϵ . Furthermore, our bound is strictly smaller than the previous generalization bounds proposed in adversarial robustness settings. To provide an initial overview of the main result, we begin by defining the spectral complexity of a d -layer neural network f w as follows:

where W i is the weights of f w in each of the d layers.

Theorem (Informal) . Let m be the number of samples and the training samples x is bounded by B . ϵ is the attack intensity. Let f w : X → R k be a d -layer feedforward network. Then, with high probability, we have

When ϵ = 0 , the bound reduces to the standard generalization bound presented by Neyshabur et al. (2017b). Our results give a different perspecitve from existing bounds. The additional factors or assumptions are solely due to mathematical considerations. Our findings suggest that the implicit difference of the spectral complexity Φ( f w ) likely contributes to the significant disparity between standard and robust generalization.

Technical Proof. It is shown that the robust weight perturbation is not controllable without additional assumptions. Therefore, existing tools are not sufficient to derive the bounds. The main technical tools to derive the bounds are two folds. Firstly, we introduce a crucial inequality to address this problem, which is the preservation of weight perturbation bound under ℓ p attack. Secondly, we restructure the proof by (Neyshabur et al., 2017b) in terms of the margin operator. This modification enables the application of the aforementioned inequality. To further extend the bound to more general settings, we establish a framework that allows us to derive a robust generalization bound from its corresponding standard generalization bound. The

Perturbation of

Lemma 7.1

Standard Generalization

MarginOperator

Bound

(Lemma 6.1)

(Theorem 2)

imply

Perturbation of

Lemma 7.2

RobustMargin Operator

RobustGeneralizationBound

(Thoerem 1)

framework's demonstration is presented in Figure 2, and detailed information regarding Figure 2 will be provided in Section 6.3.

Furthermore, we extend the results to encompass general settings. Firstly, although ℓ p adversarial attacks are widely used, real-world attacks are not always bounded by the ℓ p norm. Hence, we extend the results to cover general attacks. Secondly, as the current state-of-the-art robust performance is achieved with WideResNet (Rebuffi et al., 2021; Croce et al., 2021), we demonstrate that the results can be extended to other DNN structures, such as ResNet.

The contributions are listed as follows:

Main result: We provide a PAC-Bayesian spectrally-normalized robust generalization bound without any additional assumption. The derived bound is as tight as the standard generalization bound and tighter than the existing robust generalization bound.

Our results give a different perspecitve from existing bounds. The significant disparity between standard and robust generalization in practical scenarios is not attributed to the mismatch terms between the standard bound and the robust bound. The implicit difference of the spectral complexity Φ( f w ) possibly contributes to the significant disparity.

We provide a general framework for robust generalization analysis. We show how to obtain a robust generalization bound from a given standard generalization bound.

We extend the result to general adversarial attacks and other neural networks architectures.

2 Related Work

Adversarial Attack. Adversarial examples were first introduced in (Szegedy et al., 2014). Since then, adversarial attacks have received enormous attention (Papernot et al., 2016; Moosavi-Dezfooli et al., 2016; Carlini & Wagner, 2017). Nowadays, attack algorithms have become sophisticated and powerful. For example, Autoattack (Croce & Hein, 2020) and Adaptive attack (Tramer et al., 2020). Therefore, we consider theoretical analysis on robust margin loss (defined later in Eq. (4)) against any norm-based attacks. Real-world attacks are not always norm-bounded (Kurakin et al., 2018). Therefore, we also consider nonℓ p attacks (Lin et al., 2020; Xiao et al., 2022c) in Sec. 7.

Adversarially Robust Generalization. Even enormous algorithms were proposed to improve the robustness of DNNs (Madry et al., 2018; Tramèr et al., 2018; Gowal et al., 2020; Rebuffi et al., 2021), the performance was far from satisfactory. One major issue is the poor robust generalization, or robust overfitting (Rice et al., 2020). A series of studies (Xing et al., 2021; Xiao et al., 2022b,d; Ozdaglar et al., 2022) have delved into the concept of uniform stability within the context of adversarial training.

However, these analyses focused on general Lipschitz functions, without specific consideration for neural networks.

Rademacher Complexity. Rademacher complexity can provide similar spectral norm generalization bound as PAC-Bayesian bound (Theorem 2). Rademacher complexity was extended to adversarial settings for linear classifier (Khim & Loh, 2018; Yin et al., 2019) and two-layers neural networks (Awasthi et al., 2020). As for DNNs, they found that it was mathematically difficult and provided some discussions on surrogate losses rather than the adversarial loss.

Covering Number. Rademacher complexity can be bounded in terms of the covering number of the function class, as discussed in (Bartlett et al., 2017). Nevertheless, calculating the covering number for an adversarial function class is also shown to be a challenging problem. Gao & Wang (2021) considered adversarial loss against FGSM attacks, employing similar assumptions to those of (Farnia et al., 2018), resulting in a bound similar to Theorem 3. Additionally, Xiao et al. (2022a) and Mustafa et al. (2022) introduced two different methods, respectively, to compute the covering number for adversarial function classes. However, the bounds obtained through these methods remain notably larger when compared to those in standard settings. The related research on Rademacher complexity and covering number help proves the difficulty of the problem we are addressing.

PAC-Bayes Analysis. We mainly compare our results to the previous PAC-Bayesian spectrallynormalized bounds (Neyshabur et al., 2017b; Farnia et al., 2018), which we have already discussed in the introduction. We will provide more details later. The workshop version of this paper is presented in (Xiao et al., 2023). Other PAC-Bayes frameworks for tackling adversarial robustness also exist. Viallard et al. (2021) explored a distinct adversarial attack targeting the loss of the Q -weighted majority vote over the posterior distribution Q . Mustafa et al. (2023) introduced a non-vacuous PAC-Bayes bound designed for stochastic neural networks.

3 Preliminaries

3.1 Notations

We mainly follow the notations of (Neyshabur et al., 2017b). Consider the classification task that maps the input x ∈ X to the label y ∈ R k . The output of the model is a score for each of the k classes. The class with the maximum score will be the prediction of the label of x . A sample dataset S = { ( x 1 , y 1 ) , · · · , ( x m , y m ) } with m training samples is given. The l 2 norm of each of the samples x i is bounded by B , i.e., ∥ x i ∥ 2 ≤ B , i = 1 , · · · , m . Let ∥ W ∥ F and ∥ W ∥ 2 denote the Frobenius norm and the spectral norm of the weights W , respectively.

Fully-Connected Neural Networks. Let f w ( x ) : X → R k be the function computed by a d -layer feed-forward network for the classification task with parameters w = vec ( { W i } d i =1 ) , f w ( x ) = W d ϕ ( W d -1 ϕ ( ....ϕ ( W 1 x ))) , here ϕ is the ReLU activation function. Let f i w ( x ) denote the output of layer i before activation and h be an upper bound on the number of output units in each layer. We can then define fully-connected feed-forward networks recursively: f 1 w ( x ) = W 1 x and f i w ( x ) = W i ϕ ( f i -1 w ( x )) . In Section 7, we extend the results to ResNet (He et al., 2016), since the state-of-the-art robust performance is built on WideResNet (Rebuffi et al., 2021; Croce et al., 2021).

3.2 Standard Margin Loss and Robust Margin Loss

Standard Margin Loss. For any distribution D and margin γ > 0 , the expected margin loss is defined as follows:

̸

Let ̂ L γ ( f w ) be the empirical estimate of the above expected margin loss. Since setting γ = 0 corresponds to the classification loss, we will use L 0 ( f w ) and ̂ L 0 ( f w ) to refer to the expected loss and the training loss. The loss L γ defined this way is bounded between 0 and 1.

Robust Margin Loss. Adversarial examples are usually crafted by an attack algorithm. Let δ adv w ( x ) be an algorithm output and δ ∗ w ( x ) be the maximizer of the following maximization problem

where ℓ is the loss function of the predicted label and true label. Without explicit specification, ∥ · ∥ refers to the ℓ 2 norm. The robust margin loss is defined as follows:

̸

̸

Let ˆ R γ ( f w ) be the empirical estimate of the above expected robust margin loss. The robust margin loss requires the whole norm ball around the original example x to be labelled correctly, which is the goal of norm-based adversarial robustness. By replacing δ ∗ w ( x ) by δ adv w ( x ) in the above definition, we denote R adv γ ( f w ) as the margin loss against attacks adv . The work of (Farnia et al., 2018) consider three attacks: fast gradient sign method (FGSM or FGM), projected gradient method (PGM), and wasserstein risk minimization (WRM), i.e., adv = FGSM, PGM, and WRM. They provided three different bounds for these adversarial attacks respectively. However, methods for generating these adversarial examples are becoming significantly more sophisticated and powerful. For example, Autoattack (Croce & Hein, 2020) in default settings is a collection of four attacks to find adversarial examples. Therefore, a bound of robust margin loss against a single attack provides a limited robustness guarantee to a machine learning model. In fact, Autoattack collects different attacks to attempt and to provide a close lower estimation of R 0 ( f w ) . Therefore, this paper focuses on the robust margin loss.

4 Robust Generalization Bound

In this section, we will first provide our main result of robust generalization.

Theorem 1 ( Main Result: Robust Generalization Bound) . For any B,d,h,ϵ > 0 , let f w : X → R k be a d -layer feedforward network with ReLU activations. Then, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

where Φ( f w ) = Π d i =1 ∥ W i ∥ 2 2 ∑ d i =1 ∥ W i ∥ 2 F ∥ W i ∥ 2 2 is the spectral complexity of f w .

Remark. Theorem 1 is presented under ℓ 2 attacks to simplify the notation. For other ℓ p attacks, suppose all the samples x i have ℓ p norm bounded by B and ∥ δ ∥ p ≤ ϵ , the robust generalization bound is to replace ( B + ϵ ) by max { 1 , n 1 2 -1 p } ( B + ϵ ) in Theorem 1, where n is the dimension of the samples x i .

Theorem 1 provides the first PAC-Bayesian bound in adversarial robustness settings without introducing new assumptions. Fixing other factors, the generalization gap goes to 0 as m →∞ .

Theorem 2 (Standard Generalization Bound (Neyshabur et al., 2017b)) . For any B,d,h > 0 , let f w : X → R k be a d -layer feedforward network with ReLU activations. Then, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

where Φ( f w ) = Π d i =1 ∥ W i ∥ 2 2 ∑ d i =1 ∥ W i ∥ 2 F ∥ W i ∥ 2 2 .

Comparison with Existing Standard Generalization Bounds. Comparing the robust generalization bound in Theorem 1 with the standard generalization bound in Theorem 2, the only difference is a factor of the attack intensity ϵ , which is unavoidable in adversarial settings. In other words. B and B + ϵ are the magnitudes of the clean and adversarial examples, respectively. Therefore, our main result is as tight as the standard generalization bound in Theorem 2.

Theorem 3 (Robust Generalization Bound (Farnia et al., 2018)) . For any B,d,h > 0 , let f w : X → R k be a d -layer feedforward network with ReLU activations. Consider an FGM attack with noise power ϵ according to Euclidean norm ∥ · ∥ 2 . Assume that ∥∇ x ℓ ( f w ( x ) , y ) ∥ ≥ κ , ∀ x ϵ -close to X . Then, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

Remark: For robust generalization bounds of PGM or WRM adversarial attacks, the bounds have similar forms as in Theorem 3, with different constants C pgm and C wrm .

Comparison with Existing Robust Generalization Bounds. Comparing Theorem 1 and Theorem 3, the difference of the upper bounds is the difference of Φ and Φ fgm , where Φ fgm contains an additional term C fgm . Therefore, our bound is tighter. Moreover, the robust generalization gap is much larger than the FGSM generalization gap based on the observation in practice. We provide a tighter upper bound for a larger generalization gap.

Additionally, the term C fgm could be very large. Notice that Theorem 3 requires ℓ ( f w ( x ) , y ) to be sharp w.r.t. x for all x ∈ X . It is hard to verify and κ could be small. Therefore, if we remove the additional assumption ∥∇ x ℓ ( f w ( x ) , y ) ∥ ≥ κ , we have C fgm → + ∞ as κ → 0 and the upper bound in Theorem 3 goes to infinity.

It is also worth noting that our bound is tighter than other norm-based robust generalization bounds derived in Rademacher complexity and covering number approaches, since these bounds are larger than their standard counterpart, the bound given by (Bartlett et al., 2017).

5 Analysis of Adversarially Robust Generalization

As mentioned in the introduction, the robust generalization gap is much larger than the standard generalization gap in practical scenarios. What factors contribute to such a significant difference? Previous norm-based bounds might lead to the following hypothesis: The significant disparity could potentially be attributed to the additional terms or assumptions between the standard bound and the robust bound. Our result provides a different perspective: They are solely due to mathematical considerations. The following three factors are (implicitly) different in Theorem 1 and Theorem 2 and possibly contribute to the significant disparity.

Clean Sample and Adversarial Example ( B and B + ϵ ). The only difference between the bounds in Theorem 1 and Theorem 2 lies in the factor ϵ . In this context, B represents the magnitude of clean samples, while B + ϵ signifies the magnitude of adversarial examples. This factor holds less significance in improving robust generalization, as it is unlikely to be controlled during the training of DNNs.

Standard Margin and Robust Margin ( γ ). The margin γ remains consistent in both of these two bounds, but it is implicitly different in the definitions of standard margin loss and robust margin loss. The robust margin is smaller due to the smaller distance between two adversarial examples. As it is discussed in (Neyshabur et al., 2017a), γ is usually considered to normalize the spectral complexity discussed below.

Standard-Trained and Adversarially-Trained Parameters ( Φ( f w ) ). The spectral complexity Φ( f w ) is implicitly different because the weights w of the standard-trained and adversarially-trained models are distinct. The spectral complexity Φ( f w ) induced by adversarial training is significantly larger. We conducted experiments training MNIST, CIFAR-10, and CIFAR-100 datasets on VGG networks, see Appendix C. See also the work of (Xiao et al., 2022a) for more discussion about the experiments of weights norm of adversarially-trained models. The margin-normalized spectral complexity Φ( f w ) likely contributes to the huge difference between standard generalization and robust generalization.

6 Main Challenge of Robust Generalization Bound and Proof Sketch

6.1 PAC-Bayesian Framework

The PAC-Bayesian framework (McAllester, 1999) provides generalization guarantees for randomized predictors drawn from a learned distribution Q (as opposed to a single predictor) that depends on the training data set. In particular, let f w be a predictor parameterized by w . We consider the distribution Q over predictors of the form f w + u , where u is a random variable and w is considered to be fixed. Given a prior distribution P over the set of predictors that is independent of the training data, the PAC-Bayes theorem states that with probability at least 1 -δ , the expected loss of f w + u can be bounded as follows

To get a bound on the margin loss L 0 ( f w ) for a single predictor f w , we need to relate the expected loss, E u [ L 0 ( f w + u )] over a distribution Q , with the loss L 0 ( f w ) for a single model. The following lemma provides this relation.

Lemma 4 (Neyshabur et al. (2017b)) . Let f w ( x ) : X → R k be any predictor (not necessarily a neural network) with parameters w , and P be any distribution on the parameters that is independent of the training data. Then, for any γ, δ > 0 , with probability ≥ 1 -δ over the training set of size m , for any w , and any random perturbation u s.t. P u [ max x ∈X | f w + u ( x ) -f w ( x ) | ∞ < γ 4 ] ≥ 1 2 , we have:

As it is discussed in (Neyshabur et al., 2017a), the KL-divergence is evaluated for a fixed w and u is random. Lemma 4 is not specific to neural networks and generally holds for any functions. Providing Lemma 4, it is left to provide a bound of ∥ f w + u ( x ) -f w ( x ) ∥ 2 to obtain the final generalization bound. 3 This framework can be directly extended to adversarially robust settings by replacing ∥ f w + u ( x ) -f w ( x ) ∥ 2 by ∥ f w + u ( x + δ adv w + u ( x )) -f w ( x + δ adv w ( x )) ∥ 2 (Farnia et al., 2018). For more details, see Appendix B.

6.2 Main Challenge

Based on Lemma 4, to provide an upper bound of robust margin loss is to solve the following problem:

Problem 1. How to provide a bound of

We refer to the gap in Eq. (6) as robust weight perturbation. To the best of our knowledge, it remains unclear how to establish a bound for robust weight perturbation. In standard settings, when we perturb the weights from w to w + u , the input x remains the same. The change in function values is solely attributable to the change in weights. However, the situation becomes much more complex in adversarial settings. If we perturb the weights from w to w + u , the adversarial attacks also vary from δ adv w ( x ) to δ adv w + u ( x ) . The combined changes in input x and weights w may result in a substantial change in function values. The challenge of Problem 1 can be observed in previous studies.

Farnia et al. (2018) introduced additional assumptions to bound Eq. (6). For instance, for FGSM and PGM attacks, they assumed |∇ x ℓ ( f w ( x ) , y ) | ≥ κ for all x ϵ -close to X . This parameter κ appears in the bound of Eq. (6) as well as in the final generalization bound. To the best of our knowledge, there has been no attempt at δ ∗ w ( x ) . It is not because such research is unimportant (as mentioned in Sec. 3), but rather due to the challenge presented by Problem 1. In this case, it remains unclear what assumptions can be made to bound Eq. (6). The related work on Rademacher complexity analysis demonstrates the difficulty, as researchers have found it challenging to bound robust margin loss and have instead resorted to bounding robust loss against soled attack with additional assumptions. Further discussion on this topic can be found in Sec. 2.

Our solution to this problem consists of two steps. Step 1: We recognize that a general and reasonable bound for Eq. (6) without additional assumptions may not exist. To address this, we establish a bound for a similar expression, namely the weight perturbation of margin operator, without requiring any additional assumptions. To develop this bound, we introduce a generalization framework called "Perturbation Bounds of Robustified Function", which can be further extended to analyze other neural network structures. Step 2: We modify Lemma 4 to incorporate the weight perturbation bound that we have introduced. By combining these two steps, we are able to address the challenges and provide a robust generalization bound.

6.3 Perturbation Bounds of Robustified Function

In this section, we consider functions g w ( x ) parameterized by the weights of a neural network. We mainly consider scalar value functions g w ( x ) : X → R . For example, g w ( x ) can be the i th output of a neural network f w ( x )[ i ] , the margin operator f w ( x )[ y ] -max j = y f w ( x )[ j ] , or the robust margin operator.

̸

Definition 1 (Local Perturbation Bounds) . Given x ∈ X , we say g w ( x ) has a ( L 1 , · · · , L d ) -local perturbation bound w.r.t. w , if

where L i can be related to w , w ′ and x .

Eq. (7) controls the change of the output of functions g w ( x ) given a slight perturbation on the weights of DNNs. The following Lemma is the key Lemma to estimate perturbation bounds of the robustified function, which is defined as inf ∥ x -x ′ ∥≤ ϵ g w ( x ′ ) . The reason why we require g w ( x ) to be scalar functions is that we can define their corresponding robustified functions.

Lemma 5 ( Key Lemma ) . if g w ( x ) has a ( A 1 | x | , · · · , A d | x | ) -local perturbation bound, i.e.,

the robustified function inf ∥ x -x ′ ∥≤ ϵ g w ( x ′ ) has a ( A 1 ( | x | + ϵ ) , · · · , A d ( | x | + ϵ )) -local perturbation bound.

It is because g w ( x ( w )) -g w ′ ( x ( w ′ )) ≤ g w ( x ( w ′ )) -g w ′ ( x ( w ′ )) and g w ′ ( x ( w ′ )) -g w ( x ( w )) ≤ g w ′ ( x ( w )) -g w ( x ( w )) . Therefore,

Lemma 5 shows that the local perturbation bound of the robustified function inf ∥ x -x ′ ∥≤ ϵ g w ( x ′ ) can be estimated by the local perturbation bound of the function g w ( x ) , which is the key to provide robust generalization bounds.

6.4 Perturbation Bounds of Margin Operator

It should be noted that Lemma 5 is unable to provide a bound for Problem 1. In order to utilize Lemma 5, we shift our focus to the margin operator, which is a scalar function.

Margin Operator. Following the notation of (Bartlett et al., 2017), we define the margin operator of the true label y given x and of a pair of two classes ( i, j ) as

̸

Robust Margin Operator. Similarly, we define the robust margin operator of the true label y and of a pair of two classes ( i, j ) given x as

̸

respectively. Based on Lemma 5, it is left to provide the form of A i for the margin operator.

Lemma6. Let f w be a d -layer neural networks with Relu activation. The following local perturbation bounds hold.

Given x and i, j , the margin operator M ( f w ( x ) , i, j ) has a ( A 1 | x | , · · · , A d | x | ) -local perturbation bound w.r.t. w , where A i = 2 e ∏ d l =1 ∥ W l ∥ 2 / ∥ W i ∥ 2 . And

Given x and i, j , the robust margin operator RM ( f w ( x ) , i, j ) has a locally ( A 1 ( | x | + ϵ ) , · · · , A d ( | x | + ϵ )) -local perturbation bound w.r.t. w . And

The proof of Lemma 6.1 is adopted from Lemma 2 in (Neyshabur et al., 2017b), and the proof of Lemma 6.2 is a combination of Lemma 5 and Lemma 6.1. It is important to note that Eq. (9) provides a bound for a similar but different form of robust weight perturbation compared to Eq. (6), indicating that Problem 1 has not been fully resolved. However, we are fortunate that the subsequent lemma demonstrates that Eq. (9) is sufficient to yield the final robust generalization bound.

Lemma 7. Let f w ( x ) : X → R k be any predictor with parameters w , and P be any distribution on the parameters that is independent of the training data. Then, for any γ, δ > 0 , with probability ≥ 1 -δ over the training set of size m , for any w , and any random perturbation u s.t.

P u [max i,j ∈ [ k ] , x ∈X | M ( f w + u ( x ) , i, j ) -M ( f w ( x ) , i, j ) | < γ 2 ] ≥ 1 2 , we have:

P u [max i,j ∈ [ k ] , x ∈X | RM ( f w + u ( x ) , i, j ) -RM ( f w ( x ) , i, j ) | < γ 2 ] ≥ 1 2 , we have:

Remark: Lemma 7 shows that we can replace the robust weight perturbation (Eq. (6)) by the weight perturbation of the robust margin operator. The proof is deferred to the Appendix.

Now that we have established the complete framework of the perturbation bound of robustified function to derive the robust generalization bound, we are ready to prove Theorem 1. By following the proof of (Neyshabur et al., 2017b), we can replicate the standard generalization bound by combining Lemma 6.1 and 7.1. Similarly, we can obtain the robust generalization bound by combining Lemma 6.2 and 7.2. The flowchart illustrating this process is presented in Figure 2. Additionally, Lemma 5 serves as a crucial link between the robust margin operator and the margin operator, thus establishing the connection between the robust generalization bound and the standard generalization bound.

7 Extension of the Main Result

The provided framework allows us to extend the result to 1) general nonℓ p adversarial attacks and 2) other neural network structures.

Extension to Nonℓ p Adversarial Attacks. Even though most of the adversarial robustness studies focused on norm-bounded attacks, real-world attacks are not restricted in the ℓ p -ball. We consider the following general adversarial attack problem:

where C ( x ) can be any reasonable constraint given the original example x . Assume that max x ∈ S max x ′ ∈ C ( x ) | x ′ | = D . In words, the norm of the adversarial examples is bounded by D .

Theorem 8 (Robust Generalization Bound for nonℓ p attack.) . For any D,d,h , let f w : X → R k be a d -layer feedforward network with ReLU activations. Then, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

where Φ( f w ) = Π d i =1 ∥ W i ∥ 2 2 ∑ d i =1 ∥ W i ∥ 2 F ∥ W i ∥ 2 2 and nl stands for nonℓ p adversarial attacks.

The proof is based on a slight modification of Lemma 5.

Extension to Other Neural Networks Structure. The framework we have established enables us to extend the PAC-Bayesian generalization bound from standard settings to robust settings, provided that the standard generalization bound is also obtained using this framework. Importantly, this extension is independent of the structure of the neural networks.

ResNet. Consider a neural network: f 1 w ( x ) = W 1 x and f i w ( x ) = W i ϕ ( f i -1 w ( x )) + f i -1 w ( x ) . ResNet in practice could be complicated. We use this structure for illustration.

Theorem 9 (Robust Generalization Bound for ResNet) . For any D,d,h , let f w : X → R k be a d -layer ResNet with ReLU activations. Then, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

where Φ( f RN ) = Π d i =1 ( ∥ W i ∥ 2 +1) 2 ∑ d i =1 ∥ W i ∥ 2 F ( ∥ W i ∥ 2 +1) 2 .

8 Conclusion

Limitation. The primary limitation lies in the fact that norm-based bounds tend to be excessively large in practical scenarios. As illustrated in Table 1, the bounds for VGG networks surpass 10 9 in the experiments on CIFAR-10 dataset. The challenge at hand is how to achieve smaller norm-based bounds in practical contexts, not only in adversarial settings but also in standard settings. This remains an open problem.

In this paper, we introduce a PAC-Bayesian spectrally-normalized robust generalization bound. The proof is constructed based on the framework of the perturbation bound of the robustified function. This established framework enables us to extend the generalization bound from standard settings to robust settings, as well as to generalize the results to encompass various adversarial attacks and DNN architectures. The simplicity of this framework makes it a valuable tool for analyzing robust generalization in machine learning.

References

Awasthi, P., Frank, N., and Mohri, M. Adversarial learning guarantees for linear hypotheses and neural networks. In International Conference on Machine Learning , pp. 431-441. PMLR, 2020.

Bartlett, P. L. The sample complexity of pattern classification with neural networks: the size of the weights is more important than the size of the network. IEEE transactions on Information Theory , 44(2):525-536, 1998.

Bartlett, P. L. and Mendelson, S. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research , 3(Nov):463-482, 2002.

Bartlett, P. L., Foster, D. J., and Telgarsky, M. J. Spectrally-normalized margin bounds for neural networks. Advances in neural information processing systems , 30, 2017.

Carlini, N. and Wagner, D. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pp. 39-57. IEEE, 2017.

Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pp. 2206-2216. PMLR, 2020.

Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2) , 2021.

Farnia, F., Zhang, J., and Tse, D. Generalizable adversarial training via spectral normalization. In International Conference on Learning Representations , 2018.

Gao, Q. and Wang, X. Theoretical investigation of generalization bounds for adversarial learning of deep neural networks. Journal of Statistical Theory and Practice , 15(2):1-28, 2021.

Golowich, N., Rakhlin, A., and Shamir, O. Size-independent sample complexity of neural networks. In Conference On Learning Theory , pp. 297-299. PMLR, 2018.

Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. stat , 1050:20, 2015.

Gowal, S., Qin, C., Uesato, J., Mann, T., and Kohli, P. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 , 2020.

He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 770-778, 2016.

Khim, J. and Loh, P.-L. Adversarial risk bounds via function transformation. arXiv preprint arXiv:1810.09519 , 2018.

Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In Artificial intelligence safety and security , pp. 99-112. Chapman and Hall/CRC, 2018.

Lin, W.-A., Lau, C. P., Levine, A., Chellappa, R., and Feizi, S. Dual manifold adversarial robustness: Defense against lp and non-lp adversarial attacks. Advances in Neural Information Processing Systems , 33:3487-3498, 2020.

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

McAllester, D. A. Pac-bayesian model averaging. In Proceedings of the twelfth annual conference on Computational learning theory , pp. 164-170, 1999.

Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 2574-2582, 2016.

Mustafa, W., Lei, Y., and Kloft, M. On the generalization analysis of adversarial learning. In International Conference on Machine Learning , pp. 16174-16196. PMLR, 2022.

Mustafa, W., Liznerski, P., Wagner, D., Wang, P., and Kloft, M. Non-vacuous pac-bayes bounds for models under adversarial corruptions. 2023.

Neyshabur, B., Tomioka, R., and Srebro, N. Norm-based capacity control in neural networks. In Conference on Learning Theory , pp. 1376-1401. PMLR, 2015.

Neyshabur, B., Bhojanapalli, S., McAllester, D., and Srebro, N. Exploring generalization in deep learning. Advances in neural information processing systems , 30, 2017a.

Neyshabur, B., Bhojanapalli, S., and Srebro, N. A pac-bayesian approach to spectrally-normalized margin bounds for neural networks. arXiv preprint arXiv:1707.09564 , 2017b.

Ozdaglar, A., Pattathil, S., Zhang, J., and Zhang, K. What is a good metric to study generalization of minimax learners? Advances in Neural Information Processing Systems , 35:38190-38203, 2022.

Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., and Swami, A. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) , pp. 372-387. IEEE, 2016.

Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946 , 2021.

Rice, L., Wong, E., and Kolter, Z. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning , pp. 8093-8104. PMLR, 2020.

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014 , 2014.

Tramèr, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., and McDaniel, P. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations , 2018.

Tramer, F., Carlini, N., Brendel, W., and Madry, A. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems , 33:1633-1645, 2020.

Tropp, J. A. User-friendly tail bounds for sums of random matrices. Foundations of computational mathematics , 12:389-434, 2012.

Viallard, P., VIDOT, G. E., Habrard, A., and Morvant, E. A PAC-bayes analysis of adversarial robustness. In Beygelzimer, A., Dauphin, Y., Liang, P., and Vaughan, J. W. (eds.), Advances in Neural Information Processing Systems , 2021. URL https://openreview.net/forum?id= sUBSPowU3L5 .

Xiao, J., Fan, Y ., Sun, R., and Luo, Z.-Q. Adversarial rademacher complexity of deep neural networks. arXiv preprint arXiv:2211.14966 , 2022a.

Xiao, J., Fan, Y., Sun, R., Wang, J., and Luo, Z.-Q. Stability analysis and generalization bounds of adversarial training. Advances in Neural Information Processing Systems , 35:15446-15459, 2022b.

Xiao, J., Yang, L., Fan, Y., Wang, J., and Luo, Z.-Q. Understanding adversarial robustness against on-manifold adversarial examples. arXiv preprint arXiv:2210.00430 , 2022c.

Xiao, J., Zhang, J., Luo, Z.-Q., and Ozdaglar, A. E. Smoothed-sgdmax: A stability-inspired algorithm to improve adversarial generalization. In NeurIPS ML Safety Workshop , 2022d.

Xiao, J., Sun, R., and Luo, Z.-Q. Pac-bayesian adversarially robust generalization bounds for deep neural networks. In The Second Workshop on New Frontiers in Adversarial Machine Learning , 2023.

Xing, Y., Song, Q., and Cheng, G. On the algorithmic stability of adversarial training. In Thirty-Fifth Conference on Neural Information Processing Systems , 2021. URL https://openreview.net/ forum?id=xz80iPFIjvG .

Yin, D., Kannan, R., and Bartlett, P. Rademacher complexity for adversarially robust generalization. In International Conference on Machine Learning , pp. 7085-7094. PMLR, 2019.

A Proof of Theorems

The proof of the key lemma (Lemma 5), which establishes a connection between the margin operator and the robust margin operator, is presented in the main content.

We still need to demonstrate that the properties in PAC-Bayes analysis hold for both the margin operator and the robust margin operator. The following proofs are adapted from the work of (Neyshabur et al., 2017b), with the steps being kept independent of the (robust) margin operator. We will begin by finishing the proofs of Lemma 6 and Lemma 7. Afterward, we will proceed to complete the proof of Theorem 1, which is our primary result.

A.1 Proof of Lemma 6

Proof of Lemma 6.1:

For any i ∈ [ k ] ,

For any i, j ∈ [ k ] ,

Therefore, it is left to bound ∥ f w + u ( x ) -f w ( x ) ∥ . It is provided in (Neyshabur et al., 2017b), we provide the proof here for reference. Let ∆ i = ∣ ∣ f i w + u ( x ) -f i w ( x ) ∣ ∣ 2 . We will prove using induction that for any i ≥ 0 :

The above inequality together with ( 1 + 1 d ) d ≤ e proves the lemma statement. The induction base clearly holds since ∆ 0 = | x -x | 2 = 0 . For any i ≥ 1 , we have the following:

where the last inequality is by the Lipschitz property of the activation function and using ϕ (0) = 0 . The ℓ 2 norm of outputs of layer i is bounded by | x | 2 Π i j =1 ∥ W j ∥ 2 and by the lemma assumption we have ∥ U i +1 ∥ 2 ≤ 1 d ∥ W i +1 ∥ 2 . Therefore, using the induction step, we get the following bound:

Then we complete the proof of Lemma 6.1. By combining Lemma 6.1 and Lemma 5, we directly obtain Lemma 6.2.

A.2 Proof of Lemma 7

The proof of Lemma 7.1 and 7.2 is similar. We provide the proof of Lemma 7.2 below. The proof of Lemma 7.1 follows the proof of Lemma 7.2 by replacing the robust margin operator by the margin operator.

Let w ′ = w + u . Let S w be the set of perturbations with the following property:

Let q be the probability density function over the parameters w ′ . We construct a new distribution ˜ Q over predictors f ˜ w where ˜ w is restricted to S w with the probability density function:

Here Z is a normalizing constant and by the lemma assumption Z = P [ w ′ ∈ S w ] ≥ 1 2 . By the definition of ˜ Q , we have:

Since the above bound holds for any x in the domain X , we can get the following a.s.:

Now using the above inequalities together with the equation (5), with probability 1 -δ over the training set we have:

The last inequality follows from the following calculation.

Let S c w denote the complement set of S w and ˜ q c denote the density function q restricted to S c w and normalized. Then,

where H ( Z ) = -Z ln Z -(1 -Z ) ln(1 -Z ) ≤ 1 is the binary entropy function. Since KL is always positive, we get,

A.3 Proof of Theorem 1

Given the local perturbation bound of the robust margin operator and Lemma 5, the proof of Theorem 1 follows the procedure of the proof of Theorem 2.

Let β = ( ∏ d i =1 ∥ W i ∥ 2 ) 1 /d and consider a network with the normalized weights ˜ W i = β ∥ W i ∥ 2 W i . Due to the homogeneity of the ReLU, we have that for feedforward networks with ReLU activations

f ˜ w = f w , and so the (empirical and expected) loss (including margin loss) is the same for w and ˜ w . We can also verify that ( ∏ d i =1 ∥ W i ∥ 2 ) = ( ∏ d i =1 ∥ ∥ ∥ ˜ W i ∥ ∥ ∥ 2 ) and ∥ W i ∥ F ∥ W i ∥ 2 = ∥ ˜ W i ∥ F ∥ ˜ W i ∥ 2 , and so the excess error in the Theorem statement is also invariant to this transformation. It is therefore sufficient to prove the Theorem only for the normalized weights ˜ w , and hence we assume w.l.o.g. that the spectral norm is equal across layers, i.e. for any layer i , ∥ W i ∥ 2 = β .

Choose the distribution of the prior P to be N (0 , σ 2 I ) , and consider the random perturbation u ∼ N (0 , σ 2 I ) , with the same σ , which we will set later according to β . More precisely, since the prior cannot depend on the learned predictor w or its norm, we will set σ based on an approximation ˜ β . For each value of ˜ β on a pre-determined grid, we will compute the PAC-Bayes bound, establishing the generalization guarantee for all w for which | β -˜ β | ≤ 1 d β , and ensuring that each relevant value of β is covered by some ˜ β on the grid. We will then take a union bound over all ˜ β on the grid. For now, we will consider a fixed ˜ β and the w for which | β -˜ β | ≤ 1 d β , and hence 1 e β d -1 ≤ ˜ β d -1 ≤ eβ d -1 .

Since u ∼ N (0 , σ 2 I ) , we get the following bound for the spectral norm of U i (Tropp, 2012):

Taking a union bond over the layers, we get that, with probability ≥ 1 2 , the spectral norm of the perturbation U i in each layer is bounded by σ √ 2 h ln(4 dh ) . Plugging this spectral norm bound into the Lipschitz of robust margin operator we have that with probability at least 1 2 ,

where we choose σ = γ 42 d ( B + ϵ ) ˜ β d -1 √ h ln(4 hd ) to get the last inequality, the first inequality is Lemma 6.2. The second inequality is the tail bound above. Hence, the perturbation u with the above value of σ satisfies the assumptions of the Lemma 4.

We now calculate the KL-term in Lemma 4 with the chosen distributions for P and u , for the above value of σ .

KL

(

w

+

u

||

P

)

Hence, for any ˜ β , with probability ≥ 1 -δ and for all w such that, | β -˜ β | ≤ 1 d β , we have:

For other ℓ p attacks, the results are directly obtained by Lemma 4 of (Xiao et al., 2022a).

A.4 Proof of Theorem 8

It is based on a slight modification of the key lemma. if g w ( x ) has a ( A 1 | x | , · · · , A d | x | ) -local perturbation bound, i.e.,

the robustified function inf x ′ ∈ C ( x ) g w ( x ′ ) has a ( A 1 D, · · · , A d D )-local perturbation bound. Proof: Let

Then, max {| g w ( x ( w )) -g w ′ ( x ( w )) | , | g w ( x ( w ′ )) -g w ′ ( x ( w ′ )) |} . It is because g w ( x ( w )) -g w ′ ( x ( w ′ )) ≤ g w ( x ( w ′ )) -g w ′ ( x ( w ′ )) and g w ′ ( x ( w ′ )) -g w ( x ( w )) ≤ g w ′ ( x ( w )) -g w ( x ( w )) . Therefore,

Therefore, combining the local perturbation bound and Lemma 7.2, we complete the proof.

A.5 Proof of Theorem 9

As shown in the proof of Lemma 6, it is left to bound ∥ f w + u ( x ) -f w ( x ) ∥ . Let ∆ i = ∣ ∣ f i w + u ( x ) -f i w ( x ) ∣ ∣ 2 . We will prove using induction that for any i ≥ 0 :

The above inequality together with ( 1 + 1 d ) d ≤ e proves the lemma statement. The induction base clearly holds since ∆ 0 = | x -x | 2 = 0 . For any i ≥ 1 , we have the following:

where the last inequality is by the Lipschitz property of the activation function and using ϕ (0) = 0 . The ℓ 2 norm of outputs of layer i is bounded by | x | 2 Π i j =1 ( ∥ W j ∥ 2 +1) and by the lemma assumption we have ∥ U i +1 ∥ 2 ≤ 1 d ∥ W i +1 ∥ 2 . Therefore, using the induction step, we get the following bound:

Therefore, the margin operator of ResNet is locally ( A 1 | x | , · · · , A d | x | ) -Lipschitz w.r.t. w , where

For any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

By a combination of Lemma 5 and Lemma 7, for any δ, γ > 0 , with probability ≥ 1 -δ over a training set of size m , for any w , we have:

where Φ( f RN ) = Π d i =1 ( ∥ W i ∥ 2 +1) 2 ∑ d i =1 ∥ W i ∥ 2 F ( ∥ W i ∥ 2 +1) 2

B PAC-Bayesian Framework for Robust Generalization

PAC-Bayes analysis (McAllester, 1999) is a framework to provide generalization guarantees for randomized predictors drawn from a learned distribution Q (as opposed to a single predictor) that depends on the training data set. The expected generalization gap over the posterior distribution Q can be bounded in terms of the Kullback-Leibler divergence between the prior distribution P and the posterior distribution Q , KL ( P ∥ Q ) .

A direct corollary of Eq. (5) is that, the expected robust error of f w + u can be bounded as follows

By a slight modification of Lemma 4, the following lemma given in the work of (Farnia et al., 2018) shows how to obtain an robust generalization bound.

Lemma 10 (Farnia et al. (2018)) . Let f w ( x ) : X → R k be any predictor (not necessarily a neural network) with parameters w , and P be any distribution on the parameters that is independent of the training data. Then, for any γ, δ > 0 , with probability ≥ 1 -δ over the training set of size m , for any w , and any random perturbation u s.t. P u [max x ∈X ∣ ∣ f w + u ( x + δ adv w + u ( x )) -f w ( x + δ adv w ( x )) ∣ ∣ ∞ < γ 4 ] ≥ 1 2 , we have:

C Empirical Study of the Generalization Bounds

The spectral complexity Φ( f w ) induced by adversarial training is significantly larger. We conducted experiments training MNIST, CIFAR-10, and CIFAR-100 datasets using VGG-19 networks, following

the training parameters described in (Neyshabur et al., 2017a). 4 The results are presented in Table 1. It is evident that adversarial training can induce a larger spectral complexity, resulting in a larger generalization bound. 5 We refer the readers to our previous work (Xiao et al., 2022a) for more experiments results about norm-based complexity of adversarially-trained models. These experiments align with the findings presented by (Bartlett et al., 2017), indicating: 1) spectral complexity scales with the difficulty of the learning task, and 2) the generalization bound is sensitive to this complexity.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work tries to develop a PAC-Bayesian spectrally-normalized robust generalization bound.\n\nSTRENGTHS:\nThis work tries to understand robustness from theoretical perspective.\n\nWEAKNESSES:\n1. unclear definitions:  \nsecond line in Eq. (4)  \n$\\mathbf{x}(\\mathbf{w})=\\arg \\inf_{\\left\\|\\mathbf{x}-\\mathbf{x}^{\\prime}\\right\\| \\leq \\epsilon} g_{\\mathbf{w}}(\\mathbf{x})$ (I guess it's $\\mathbf{x}(\\mathbf{w})=\\arg \\inf_{\\left\\|\\mathbf{x}-\\mathbf{x}^{\\prime}\\right\\| \\leq \\epsilon} g_{\\mathbf{w}}(\\mathbf{x'})$)  \n$\\mathbf{x}(\\mathbf{w}')=\\arg \\inf_{\\left\\|\\mathbf{x}-\\mathbf{x}^{\\prime}\\right\\| \\leq \\epsilon} g_{\\mathbf{w}'}(\\mathbf{x})$  \n$\\inf_{\\left\\|\\mathbf{x}-\\mathbf{x}^{\\prime}\\right\\| \\leq \\epsilon} g_{\\mathbf{w}}(\\mathbf{x})$  \netc\n\n2. Assumptions are not clearly described before theorem 1:  \nWhat are the conditions on $B$ and $\\gamma$ for your theorem?  \nE.g., Neyshabur et al. (2017b) assumes $\\mathcal{X}_{B, n}=[ \\mathbf{x} \\in \\mathbb{R}^n \\quad | \\quad ||\\mathbf{x}||_2 \\leq B ]$  and  $\\mathbb{P}_\\mathbf{u} [\\max_\\mathbf{x} | f_\\mathbf{w+u}(\\mathbf{x})-f_\\mathbf{w}(\\mathbf{x}) |_\\infty<\\frac{\\gamma}{4} ] \\geq \\frac{1}{2}$ (or $\\ell_2$ norm).  \n\n3. Miss citation for Line 482.  \n\n4. What is $||W_i-W_i||$?\n\n5. Please provide the details from Eq. (10) to Eq. (11).  \n\n6. As claimed in the contribution: **without any additional assumption**, **as tight as**, **how to obtain a robust generalization bound**.  \nMy concerns are: **Does this bound provide new information for us?**  In my opinion, for (middle or large) DNNs, PAC-Bayes is not a tight bound but may provide inspiration for us to get a better generalization model. For the bound of this work, it just replaces $B$ with $B+\\epsilon$. To me, it simply implies that $||\\mathbf{x}||_2\\le B$ (clean data), $||\\delta||_2\\le \\epsilon$ (attack radius) thus $||\\mathbf{x}+\\delta||_2\\le B+\\epsilon$ (adversarial data), but it holds no significant meaning.  \n\nFor the above reasons, I think this work should be rejected.\n\nQUESTIONS:\nref Weaknesses\n\nLIMITATIONS:\nref Weaknesses", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper improves previous PAC-Bayesian bounds on robust generalization. The previous bound in Farnia et al. (2018) has a term that is not bounded, and this work provides a bound to that term using the Lipschitzness of feed-forward ReLU networks. The basic idea is that coordinate-wise Lipschitzness preserves under L-inf perturbation.\n\nSTRENGTHS:\nI am quite familiar with this field and spent 3 hours reviewing this paper. Though I do not closely follow the robust generalization line of research, I believe that this work could be helpful to people working in the same direction. The overall framework is very clear and the results are intuitive and easy to understand. Though there are some confusing parts in some sections and the writing can still be improved, overall this looks like a nice paper and should make it to NeurIPS.\n\nThe overall framework is clean, and the proofs are easy to read. I quickly checked all the proofs, and they look good to me. I am not 100% sure that all proofs are sound, but even if there are small errors, they should be fixable because the results are very intuitive.\n\nWEAKNESSES:\nMy only concern is that the significance of this work might not be obvious to a person who is not very familiar with this field. This work is addressing a very specific issue in a previous theorem, and while this issue is important, I think the authors should clarify more about why it is important, what is the main challenge and how this paper fixes it, right at the beginning of the paper. Right now I would say that those things are quite scattered. For example, the main challenge is in Section 6.2. I think the authors could include the following in the intro:\n- What is the main issue in the previous PAC-Bayes bounds?\n- Why is it difficult to fix this issue?\n- What additional assumptions does this work make in order to fix this issue?\n- What is the main technical contribution in the proof of this work?\n\nAs someone very familiar with learning theory and adversarial robustness, I can find the answers to these questions easily in the paper. However, if the authors want to appeal this work to a more general audience, I suggest them rearrange the paper a little bit, and discuss these questions in the intro.\n\nQUESTIONS:\nSee above.\n\n**Post rebuttal note:** I have read the rebuttal and other reviews. I prefer to keep my score.\n\nLIMITATIONS:\nLimitations are not discussed.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this work, authors use PAC-Bayesian bound to characterize the generalization gap of adversarial robustness. Their work is mostly based on the bound derived from (Neyshabur et al., 2017b) so the resulting bound is valid for a deterministic model.\n\nSTRENGTHS:\nThe major contribution from this work is the new PAC-Bayesian bound for adversarial robustness. The bound works for both Lp and non-Lp cases on both feed-forward networks and ResNets. Authors also compare their bounds with existing ones that only target specific attacks, and show their bounds are more generic. I appreciate the paper’s contribution of the bound (but I do have a question regarding the tightness of the bound which I will elaborate in the next part). The paper has pushed the use of PAC-Bayesian theories to scenarios beyond standard generalization.\n\nWEAKNESSES:\nThe first weakness of the paper is probably that this newly derived bound largely relies on the work from Neyshabur et al., which has been phrased as an advantage of Theorem 1 being tight at least as Neyshabur et al.’s. However, this might be misleading as I believe the correct description would be when $\\epsilon=0$ Theorem 1 reduces to Theorem 2 so they are as tight as each other. I am not sure I understand what does it mean for Theorem 1 and 2 to be equally tight when $\\epsilon > 0$? Do you mean that what is in the big O notation is around the same magnitude? However, I do not see the value of $p$ (in $\\ell_p$) plays any role in the new bound and the paper talks about the general $\\ell_p$ robustness, thus I assume the bound works in any $\\ell_p$ space. I hereby have the following question, if the bound is p–norm-agnostic, how come it is equally tight for all $p$? Does this bound simply characterize the robustness of the model in the largest ($\\ell_\\infty$) perturbation ball for a given $\\epsilon$? If that is the case, perhaps the derived bound is pretty loose for $\\ell_2$ perturbations. Can you elaborate more here (and in the paper) about the tightness of the bound for different $p$. \n\nAnother weakness is the empirical study to demonstrate the tightness of the bound in Table 1. This table is poorly captioned because I do not know how these models are trained, what architectures are used, what $\\epsilon$ and attack techniques are used to report the numbers. Also, what does $\\infty$ means for Theorem 3? Does this mean the assumption about gradient norm in Theorem 3 does not hold? Do you have experiments about the gradient norms? Moreover, I think it might be useful to use more models and more statistically significant numbers to show the proposed bound is tighter, like the measurement done in this paper [1]. \n[1] Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., & Bengio, S. (2019). Fantastic Generalization Measures and Where to Find Them. ArXiv, abs/1912.02178.\n\nQUESTIONS:\nI do not have further questions. I think the theoretical contribution is incremental so it may further increase my score if more empirical evaluations are conducted.\n\nLIMITATIONS:\nIt might be nice to include such a paragraph.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

comments: SUMMARY:
This paper provides a tighter bounds for robust generalization compared to previous results and as tight as standard generalization.

STRENGTHS:
1. The paper studies an important topic on adversarial robustness and provide a tighter bound with detailed theoretical analysis.
2. The paper is well-written and the conclusions are sound as far as I understand (I didn't check the proof in Appendix).

WEAKNESSES:
* As the paper is an improvement on Farnia et al. (2018), thus the technical novelty is less significant. 
* The authors should explain why a tighter upper bound is insightful for the robustness community. In my understanding, the robust generalization bound is usually used to explain which factor affects the robust generalization, or why robust generalization is worse than standard generalization. The authors should discuss more on the implications from the new result.

QUESTIONS:
Please see the weaknesses part.

LIMITATIONS:
There is no discussion on limitations.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-07