Title: Robustness Guarantees for Adversarially Trained Neural Networks
Venue: NeurIPS 2023
Accepted: yes
Keywords: Adversarial training

neural networks

robustness

guarantees
Abstract: We study robust adversarial training of two-layer neural networks as a bi-level optimization problem. In particular, for the inner loop that implements the adversarial attack during training using projected gradient descent (PGD), we propose maximizing a \emph{lower bound} on the $0/1$-loss by reflecting a surrogate loss about the origin. This allows us to give a convergence guarantee for the inner-loop PGD attack. Furthermore, assuming the data is linearly separable, we provide precise iteration complexity results for end-to-end adversarial training, which holds for any width and initialization. We provide empirical evidence to support our theoretical results.

Robustness Guarantees for Adversarially Trained Neural Networks

Abstract

We study robust adversarial training of two-layer neural networks as a bi-level optimization problem. In particular, for the inner loop that implements the adversarial attack during training using projected gradient descent (PGD), we propose maximizing a lower bound on the 0 / 1 -loss by reflecting a surrogate loss about the origin. This allows us to give a convergence guarantee for the inner-loop PGD attack. Furthermore, assuming the data is linearly separable, we provide precise iteration complexity results for end-to-end adversarial training, which holds for any width and initialization. We provide empirical evidence to support our theoretical results.

1 Introduction

Despite the tremendous success of deep learning, neural network-based models are highly susceptible to small, imperceptible, adversarial perturbations of data at test time [Szegedy et al., 2014]. Such vulnerability to adversarial examples imposes severe limitations on the deployment of neural networks-based systems, especially in critical high-stakes applications such as autonomous driving, where safe and reliable operation is paramount.

An abundance of studies demonstrating adversarial examples across different tasks and application domains [Goodfellow et al., 2014, Moosavi-Dezfooli et al., 2016, Carlini and Wagner, 2017] has led to a renewed focus on robust learning as an active area of research within machine learning. The goal of robust learning is to find models that yield reliable predictions on test data notwithstanding adversarial perturbations. A principled approach to training models that are robust to adversarial examples that has emerged in recent years is that of adversarial training [Madry et al., 2018]. Adversarial training formulates learning as a min-max optimization problem wherein the 0-1 classification loss is replaced by a convex surrogate such as the cross-entropy loss, and alternating optimization techniques are used to solve the resulting saddle point problem.

Despite empirical success of adversarial training, our understanding of its theoretical underpinnings remain limited. From a practical standpoint, it is remarkable that gradient based techniques can efficiently solve both inner maximization problem to find adversarial examples and outer minimization problem to impart robust generalization. On the other hand, a theoretical analysis is challenging because (1) both the inner- and outer-level optimization problems are non-convex, and (2) it is unclear a-priori if solving the min-max optimization problem would even guarantee robust generalization.

In this work, we seek to understand adversarial training better. In particular, under a margin separability assumption, we provide robust generalization guarantees for two-layer neural networks with Leaky ReLU activation trained using adversarial training. Our key contributions are as follows.

We identify a disconnect between the robust learning objective and the min-max formulation of adversarial training. This observation inspires a simple modification of adversarial training -

we propose reflecting the surrogate loss about the origin in the inner maximization phase when searching for an 'optimal' perturbation vector to attack the current model.

We provide convergence guarantees for PGD attacks on two-layer neural networks with leaky ReLU activation. This is the first of its kind result to the best of our knowledge.

We give global convergence guarantees and establish learning rates for adversarial training for two-layer neural networks with Leaky ReLU activation function. Notably, our guarantees hold for any bounded initialization and any width - a property that is not present in the previous works in the neural tangent kernel (NTK) regime [Gao et al., 2019, Zhang et al., 2020].

Weprovide extensive empirical evidence showing that reflecting the surrogate loss in the inner loop does not have a significant impact on the test time performance of the adversarially trained models.

Notation. We denote matrices, vectors, scalar variables, and sets by Roman capital letters, Roman lowercase letters, lowercase letters, and uppercase script letters, respectively (e.g. X , x , x , and X ). For any integer d , we represent the set { 1 , . . . , d } by [ d ] . The ℓ 2 -norm of a vector x and the Frobenius norm of a matrix X are denoted as ∥ x ∥ and ∥ X ∥ F , respectively. Given a set C , the operator Π C (x) = min x ′ ∈C ∥ x -x ′ ∥ projects onto the set C with respect to the ℓ 2 -norm.

1.1 Related Work

Linear models. Adversarial training of linear models was recently studied by Charles et al. [2019], Li et al. [2020], Zou et al. [2021]. In particular, Charles et al. [2019], Li et al. [2020] give robust generalization error guarantees for adversarially trained linear models under a margin separability assumption. The hard margin assumption was relaxed by Zou et al. [2021] who give robust generalization guarantees for distributions with agnostic label noise. We note that the optimal attack for linear models has a simple closed-form expression, which mitigates the challenge of analyzing the inner loop PGD attack. In contrast, one of our main contributions is to give convergence guarantees for the PGD attack. Nonetheless, as the Leaky ReLU activation function can also realize the identity map for α = 1 , our results also provide robust generalization error guarantees for training linear models.

Non-linear models. Wang et al. [2019] propose a first order stationary condition to evaluate the convergence quality of adversarial attacks found in the inner loop. Zhang et al. [2021] study adversarial training as a bi-level optimization problem and propose a principled approach towards the design of fast adversarial training algorithms. Most related to our results are the works of Gao et al. [2019] and Zhang et al. [2020], which study the convergence of adversarial training in non-linear neural networks. Under specific initialization and width requirements, these works guarantee small robust training error with respect to the attack that is used in the inner-loop, without explicitly analyzing the convergence of the attack. Gao et al. [2019] assume that the activation function is smooth and require that the width of the network, as well as the overall computational cost, is exponential in the input dimension. The work of Zhang et al. [2020] partially addresses these issues. In particular, their results hold for ReLU neural networks, and they only require the width and the computational cost to be polynomial in the input parameters.

Our work is different from that of Gao et al. [2019] and Zhang et al. [2020] in several ways. Here we highlight three key differences.

First, while the prior work analyzes the convergence in the NTK setting with specific initialization and width requirements, our results hold for any initialization and width.

Second, none of the prior works studies computational aspects of finding an optimal attack vector in the inner loop. Instead, the prior work assumes oracle access to optimal attack vectors. We provide precise iteration complexity results for the projected gradient method (i.e., for the PGD attack) for finding near-optimal attack vectors.

Third, the prior works focus on minimizing the robust training loss, whereas we provide computational learning guarantees on the robust generalization error.

The rest of the paper is organized as follows. In Section 2, we give the problem setup and introduce the adversarial training procedure with the reflected surrogate loss in the inner loop. In Section 3, we present our main results, discuss the implications and give a proof sketch. We support our theory with empirical results in Section 4 and conclude with a discussion in Section 5.

Algorithm 1 Atk PGD Attack

Input:

Sample (x , y ) , Weights W , Stepsize η atk , # Iters T atk

1: Initialize δ 1 ← x

2: for t = 1 to T do

3: δ t +1 ← Π ∆(x) ( δ t + η atk ∇ δ ℓ - ( yf W ( δ t )))

4: end for

Output:

δ τ , where τ ∈ arg max t ∈ [ T ] ℓ - ( yf W ( δ t ))

2 Preliminaries

We focus on two-layer networks with m hidden nodes computing f (x; a , W) = a ⊤ σ (Wx) , where W ∈ R m × d and a ∈ R m are the weights of the first and the second layers, respectively, and σ ( z ) = max { αz, z } is the Leaky ReLU activation function. We randomly initialize the weights a r ∼ Unif ( {-κ, + κ } ) for all hidden nodes r ∈ [ m ] , and randomly initialize W such that ∥ W ∥ F ≤ ω , for some positive real numbers κ and ω . The top linear layer (i.e., weights a ) is kept fixed, and the hidden layer (i.e., W ) is trained using stochastic gradient descent (SGD).

For simplicity of notation, we represent the network as f (x; W) , suppressing the dependence on the top layer weights. Further, with a slight abuse of notation, we denote the function by f W (x) when optimizing over the input adversarial perturbations, and by f x (W) when training the network weights.

Formally, adversarial learning is described as follows. Let X ⊆ R d and Y = {± 1 } denote the input feature space and the output label space, respectively. Let D be an unknown joint distribution on X × Y . For any fixed x ∈ X , we consider norm-bounded adversarial perturbations in the set ∆(x) := { δ : ∥ δ -x ∥ ≤ ν } , for some fixed noise budget ν .

Given a training sample S := { (x i , y i ) } n i =1 ∼ D n drawn independently and identically from the underlying distribution D , the goal is to find a network with small robust misclassification error

where ¯ W:= W / ∥ W ∥ F is the weight matrix normalized to have unit Frobenius norm. Note that, due to the homogeneity of Leaky ReLU, such normalization has no effects on the robust error whatsoever.

In adversarial training, the 0 -1 loss inside the expectation is replaced with a convex surrogate such as cross entropy loss ℓ ( z ) = log(1 + e -z ) , and the expected value is estimated using a sample average:

Notwithstanding the conventional wisdom, adversarial training entails maximizing an upper bound as opposed to a lower bound on the 0 -1 loss. In contrast, we propose using a concave lowerbound on the 0 -1 loss to solve the inner maximization problem. Let ℓ -( z ) = -ℓ ( -z ) = -log(1 + e z ) denote the reflected loss . In Figure 1, we plot the 0-1 loss, the cross-entropy loss, and the reflected cross-entropy loss. Starting from δ 1 = x , the PGD attack updates iterates via

as described in Algorithm 1. We emphasize that the only difference between standard adversarial training and what we propose in Algorithm 2 and Algorithm 1 is that we reflect the loss (about the origin) in Algorithm 1.

-4

-2

2

4

-4

-2

2

4

3 Main Results

We consider a slightly weaker version of the robust error. In particular, we are interested in adversarial attacks that can fool the learner with a margin - for some small, non-negative constant β , we define the β -robust misclassification error as: ε β (W) = P { min δ ∈ ∆(x) yf ¯ W ( δ ) < -β } . In particular, as β tends to zero, ε β (W) → ε rob (W) . When β is a small positive constant bounded away from zero, (x , y ) contributes to ε β (W) only if there exists an attack δ ∈ ∆(x) such that f ¯ W confidently makes a wrong prediction on δ . In other words, β -robust misclassification error is the probability that for (x , y ) ∼ D , a β -effective attack exists.

Definition 3.1 (Effective Attacks) . Given a neural networks with parameters (a , W) and a data point (x , y ) and some constant β > 0 , we say that δ ∗ ∈ ∆(x) is a β -effective attack if yf ¯ W ( δ ∗ ) ≤ -β, where ¯ W=W / ∥ W ∥ F .

Our bounds depend on several important problem parameters. Before stating the main results of the paper, we remind the reader of these important quantities. ν denotes the attack size. κ and ω are the bounds on the norm of the parameters a and W at the initialization. Finally, α is the Leaky-ReLU parameter. Our first result stated in the following theorem 1 gives convergence rates for Algorithm 1 in terms of the and the negated loss derivative -ℓ ′ ( · ) under the assumption that an effective attack exists. The negative derivative, -ℓ ′ ( · ) , of the loss function has been used in several previous works to give an upper bound on the error Cao and Gu [2019]; here, we borrow similar ideas from Frei et al. [2021]. In particular, as it will become clear later, we will use positivity and monotonicity of -ℓ ′ ( · ) to give an upper bound on the β -robust loss using Markov's inequality.

Theorem 3.2. Let δ ∗ be a β -effective attack for a given network with weights (a , W) and a given example (x , y ) , with β ≥ 2 ν (1 -α ) κ √ m . Then, after T atk iterations, PGD with step size η atk ≤ 1 κ 2 m ∥ W ∥ 2 F generates an attack δ atk such that -ℓ ′ ( yf W ( δ ∗ )) ≤ -2 ℓ ′ ( yf W ( δ atk )) + 4 ν 2 η atk T atk .

Theorem 3.2 establishes that under proper initialization ( κ = 1 / √ m ), when a β -effective attack exists, Algorithm 1 finds a ϵ -suboptimal attack vector in O ( β 2 /ϵ ) iteration. We next study convergence of Algorithm 2 under the following distributional assumption.

Assumption 3.3. Samples (x , y ) are drawn i.i.d. from an unknown joint distribution D that satisfies:

∥ x ∥ ≤ R with probability 1 .

There exists a unit norm vector v ∗ ∈ R d , ∥ v ∗ ∥ = 1 , such that for ( x, y ) ∼ D , we have with probability 1 that y (v ∗ · x) ≥ γ > 0 .

The first assumption requires that the inputs are bounded, which is standard in the literature and is satisfied for most practical applications. The second assumption implies that D is linearly separable with margin γ > 0 . Of course, we do not need a non-linear neural network to robustly learn a predictor under such a distributional assumption. But can we even guarantee robust learnability of neural networks for such simple settings? Nothing is known as far as we know. We note that even for standard (non-robust) training of two-layer neural networks using SGD, the convergence guarantees in the hard margin setting were unknown until recently [Brutzkus et al., 2018]. The following theorem establishes that adversarial training can efficiently find a network with small β -robust error.

Theorem 3.4 (Convergence of Algorithm 2) . For any ϵ > 0 , in at most T tr ≤ 64( R + ν ) 2 (1+ ωγακ √ mϵ ) ( γ -ν ) 2 α 2 ϵ 2 iterations, Algorithm 2 with step-size η tr ≤ 1 mκ 2 ( R + ν ) 2 finds an iterate τ that, in expectation over { (x t , y t ) } T tr t =1 , satisfies ε β (W τ ) ≤ 2 ϵ for any β ≥ 2 ν (1 -α ) κ √ m , provided that for all t ∈ [ T ] , η atk ≤ 1 κ 2 m ∥ W t ∥ 2 F and T atk ≥ 8 ν 2 η atk ϵ .

Some remarks are in order.

Beyond Neural Tangent Kernel. As opposed to the convergence results in the previous work [Gao et al., 2019, Zhang et al., 2020] which requires certain initialization and width requirements specific to the NTK regime, our results holds for any bounded initialization and any width m .

Role of the Robustness Parameter ν . Our guarantee holds only when the desired robustness parameter ν is smaller than the distribution margin γ . Furthermore, the iteration complexity increases gracefully as O ( ν 2 / ( γ -ν ) 2 ) as the attacks become stronger, i.e., as the size of adversarial perturbations tends to the margin. Intuitively, as ν → 0 , the attack becomes trivial, and the adversarial training reduces to the standard non-adversarial training. This is fully captured by our results - as ν → 0 , the number of attack iterates T atk goes to zero, and we recover the overall runtime of O ( γ -2 ϵ -2 ) as in the previous work [Brutzkus et al., 2018, Frei et al., 2021].

Computational Complexity. To guarantee ϵ -suboptimality in the β -robust misclassification error, we require T tr = O (( γ -ν ) -2 ϵ -2 ) iterations of Algorithm 2. Each iteration invokes the PGD attack in Algorithm 1, which itself requires T atk = O ( ν 2 /ϵ ) gradient updates. Therefore, the overall computational cost of adversarial training to achieve ϵ -suboptimality is O ( ν 2 ( γ -ν ) 2 ϵ 3 ) . Note that T atk is a purely computational requirement, and the statistical complexity of adversarial training is fully captured by T tr . Remarkably, there is only a mild O ( γ 2 / ( γ -ν ) 2 ) statistical overhead for β -robustness, and the computational cost increases gracefully by a multiplicative factor of O ( ν 2 γ 2 ( γ -ν ) 2 ϵ ) .

Learning Robust Linear Halfspaces. When α = 1 , the Leaky ReLU activation equals the identity map, and the network reduces to a linear predictor. In this case, we retrieve strong robust generalization guarantees for learning halfspaces, as the lower bound required for β in Theorem 3.4 vanishes. The following corollary instantiates such a robust generalization guarantee.

Corollary 3.5. Let κ = 1 / √ m , ω = 1 /γ , and η tr = ( R + ν ) -2 . For any ϵ > 0 , in at most T tr ≤ 128( R + ν ) 2 ( γ -ν ) 2 ϵ 2 iterations, Algorithm 2 finds an iterate τ , that in expectation over { (x t , y t ) } T tr t =1 , satisfies ε rob (W τ ) ≤ 2 ϵ, provided that for all t ∈ [ T ] , η atk ≤ ∥ W t ∥ -2 F and T atk ≥ 8 ν 2 η atk ϵ .

Dependence on the Norm of Iterates. The iteration complexity of Algorithm 1 is inversely proportional to the learning rate η atk , and therefore increases with ∥ W t ∥ 2 F . Thus, when calculating the overall computational complexity, one needs to compute an upper bound on the norm of the iterates. As we show in Equation (5) in the appendix, it holds for all iterates that ∥ W t +1 ∥ 2 F ≤ ∥ W 1 ∥ 2 F +3 η tr t . Therefore, if we set κ = 1 / √ m and ω 2 = 3 / ( R + ν ) 2 , we have the following worst-case weightindependent bound on the overall computational cost:

Therefore, the worst-case overall computational cost is of order O (( γ -ν ) -4 ϵ -5 ) . Wenote again that this cost is purely computational - the statistical complexity is still in the order of O ( ( γ -ν ) -2 ϵ -2 ) .

Adversarial Robustness for any β . As we discussed earlier, as β → 0 , the β -robust error tends to the robust error, i.e., ε β (W) → ε rob (W) . Although Theorem 3.4 does not hold for β = 0 (except

for the linear case discussed above), it is possible to guarantee robust generalization with arbitrarily small β , as stated in the following corollary.

Corollary 3.6. For any desirable β > 0 , let κ = β 2 ν (1 -α ) √ m . For any ϵ > 0 , in at most T tr ≤ 64( R + ν ) 2 (1+ ωγαβϵ/ (2 ν (1 -α ))) ( γ -ν ) 2 α 2 ϵ 2 iterations, Algorithm 2 with step-size η tr ≤ 4 ν 2 (1 -α ) 2 β 2 ( R + ν ) 2 finds an iterate τ that, in expectation over { (x t , y t ) } T tr t =1 , satisfies ε β (W τ ) ≤ 2 ϵ provided that for all t ∈ [ T ] , η atk ≤ 4 ν 2 (1 -α ) 2 β 2 ∥ W t ∥ 2 F and T atk ≥ 2(1 -α ) 2 β 2 ∥ W t ∥ 2 F ϵ .

3.1 Proof Sketch

In this section, we highlight the key ideas and insights based on our analysis, and give a sketch of the proof of the main result. Using Definition 3.1, the proof of Theorem 3.4 crucially depends on the following two facts. First, whenever there exists a β -effective attack, we show that Algorithm 1 will efficiently find a sufficiently good attack (in the sense of Theorem 3.2). Second, leveraging the Perceptron analysis from the prior works of Frei et al. [2021], Brutzkus et al. [2018], we show that as long as the attack size ν is smaller than the margin γ , robust training is not much harder than standard training. In particular, the following Lemma establishes that the expected value of the negative loss derivative eventually becomes arbitrarily small.

Lemma 3.7. For any ϵ > 0 , Algorithm 2 with stepsize η tr ≤ m -1 κ -2 ( R + ν ) -2 finds an iterate τ that, in expectation over { (x t , y t ) } T tr t =1 , satisfies E D [ -ℓ ′ ( yf W τ ( δ atk (x)))] ≤ ϵ in at most T tr ≤ 4(1+ ∥ W 1 ∥ F γακ √ mϵ ) η tr ( γ -ν ) 2 α 2 κ 2 mϵ 2 iterations.

We remark that the result in Lemma 3.7 holds for any attack algorithm Atk , as long as it respects the condition δ atk (x) ∈ ∆(x) for all x . We are now ready to present the proof of the main result.

Proof of Theorem 3.4. Recall, that β -robust misclassification error is defined as:

A key step in the proof is to give an upper bound on ϵ β in terms of the attack returned by PGD, i.e., δ atk (x) , rather than the optimal attack min δ ∈ ∆(x) yf W ( δ ) . Theorem 3.2 does provide us with such an upper bound; however, (1) it only holds in expectation, and 2) it is conditioned on existence of an effective attack at the given example (x , y ) and the weights W . Naturally, we can use Markov's inequality to bound the probability above. In order to address the conditional nature of the result in Theorem 3.2, we introduce a truncated version of the negative loss derivative. In particular, for any c , let ℓ ′ c ( z ) = ℓ ′ ( z ) I [ z ≤ c ] be the loss derivative thresholded at c . Note that z ≤ c implies that -ℓ ′ c ( z ) ≥ -ℓ ′ c ( c ) - therefore, P { z ≤ c } ≤ P {-ℓ ′ c ( z ) ≥ -ℓ ′ c ( c ) } . Let β τ := β ∥ W τ ∥ F , where W τ is the iterate guaranteed by Lemma 3.7. We have

Given W τ , for any (x , y ) ∼ D , one of the two following cases can happen:

There exists a β -effective attack. In this case, by Definition 3.1, it holds that min δ ∈ ∆(x) yf W τ ( δ ) ≤ -β ∥ W τ ∥ F = -β τ . Therefore, by definition of the truncated negative loss derivative, it also holds that -ℓ ′ β τ (min δ ∈ ∆(x) yf W τ ( δ )) = -ℓ ′ (min δ ∈ ∆(x) yf W τ ( δ )) . Now, using Theorem 3.2, we get that

0

2

4

6

8

10

Top 10 Attacks, Sorted by the Corresponding Loss

0

0.5

1

1.5

2

2.5

3

3.5

4

Number of Optimal Attacks

Cross Entropy

Reflected Cross Entropy

0

20

40

60

80

100

Top 100 Attacks, Sorted by the Corresponding Loss

0

5

10

15

20

25

30

35

40

Number of Optimal Attacks

0

200

400

600

800

1000

Top 1000 Attacks, Sorted by the Corresponding Loss

0

50

100

150

200

250

300

350

400

Number of Optimal Attacks

There does not exist a β -effective attack. In this case, by Definition 3.1, it holds that min δ ∈ ∆(x) yf W τ ( δ ) > -β ∥ W τ ∥ F = -β τ . Therefore, by definition of the truncated negative loss derivative, it also holds that -ℓ ′ β τ (min δ ∈ ∆(x) yf W τ ( δ )) = 0 , which is trivially bounded by the upper bound in the first case above, given by Equation (3).

Putting back the above cases in the upper bound on the β -robust error, we arrive at:

where the first inequality follows from Theorem 3.2, the second inequality follows from Lemma 3.7 given the proper choice of T Tr , and the final inequality holds by setting T atk ≥ 8 ν 2 η atk ϵ .

4 Empirical Results

Adversarial training is widely used in training robust models and has been shown to be fairly effective in practice. The goal of this section is not to attest or reproduce previous empirical findings. Instead, since the focus in this paper is on the theoretical analysis of adversarial training in non-linear networks, the goal of this section is merely to empirically study the effect of using reflected loss in Algorithm 1.

The experimental results are organized as follows. First, in Sec. 4.1, we compare the optimal attacks found by a grid search on the surrogate loss and its reflected version. In Sec. 4.2, we empirically study adversarial training with reflected loss in the binary classification setting. Finally, in Sec. 4.3, we generalize the reflected loss, which is key to our theoretical analysis, to multi-class classification setting. We then report the results on the CIFAR-10 dataset using a deep residual network.

4.1 Grid Search Optimization

We look at the following simple 3-dimensional 3-class classification problem. Consider the point (x , y ) where x = [3 , 2 , 1] and y = 1 . We focus on the simplest non-trivial function, i.e., the identity mapping, given by f (x) = x . Obviously, f correctly assigns x to the first class because the first dimension is larger than the others. Also, a perturbation of the form δ = [ -0 . 501 , 0 . 5 , 0] with ∥ δ ∥ = 0 . 7078 can flip the label, since f (x + δ ) = [2 . 499 , 2 . 5 , 1] incorrectly predicts the second class.

We restrict the attack to the set { δ ∈ ( -0 . 51 , +0 . 51) 3 | ∥ δ ∥ ≤ 0 . 7078 } . We look at every possible attack vector on a grid of size 800 × 800 × 800 . We then sort these vectors in a descending order of the corresponding loss function, i.e., the cross entropy loss and its reflected version, and simply count how many of the topk attack vectors actually induce a label flip. We take this as a measure of how effective is the corresponding loss maximization problem at finding a good attack vector. As we can see in Figure 2, the proposed method of maximizing the reflected cross entropy loss is a far more effective way of generating the attacks than maximizing the cross entropy loss.

4.2 Binary Classification

Experimental Setup. We extract digits 0 and 1 from the MNIST dataset [LeCun et al., 1998], which provides a (almost) separable distribution, consistent with our theoretical setup. The dataset contains

12665 training samples and 2115 test samples. We evaluate the generalization error as well as the robust generalization error of fully-connected two-layer neural networks which are adversarially trained with and without reflecting the loss. The network has 100 hidden nodes with ReLU activations.

The outer loop consists of 20 epochs over the training data with batch size equal to 64, randomly shuffled at the beginning of each epoch. The initial learning rate is set to 1, and is decayed by a multiplicative factor of 0.2 every 5 epochs. We use several benchmark attacks with and without reflecting the loss. The benchmarks include the Fast Gradient Sign Method (FGSM) Goodfellow et al. [2015], the Basic Iterative Method (BIM) Kurakin et al. [2017], and the PGD attack with ℓ 2 constraint (PGD2 ) and ℓ ∞ constraint (PGD-∞ ). For each of these attack strategies, we have a corresponding approach that involves reflecting the surrogate loss - we denote the resulting methods as R-FGSM, R-BIM, R-PGD2 , and R-PGD-∞ , respectively. The perturbation size for FGSM, PGD-∞ , and BIM (and their corresponding reflected version) is set to ν = 0 . 1 . For PGD2 and R-PGD2 , we let a larger perturbation size of ν = 2 as recommended in the Adversarial ML Tutorial.

In the inner-loop, if the attack is iterative, we use a step-decay scheduler with initial step-size of 10, which decreases the step-size every 10 steps by a multiplicative factor of 0.2. In Table 1, we report the standard test accuracy as well as the adversarial test accuracy of the trained models over 10 independent random runs of the experiment. Different rows and columns correspond to different training algorithms and different attack models, respectively.

Analysis. We make the following observations in Table 1. First, reflecting the loss has a minimal effect on FGSM and BIM attacks, in terms of robust test accuracy of the trained models. In particular, the columns 1 and 2 (similarly columns 5 and 6) are identical up to the third decimal point.

Second, in PGD2 attacks, reflecting the loss generally yields a stronger attack - note the striking differences in the last two columns between PGD2 and R-PGD2 . We observe a milder trend for PGD-∞ attacks, where R-PGD-∞ attacks turns out to be only slightly stronger, except for the standard training setting where reflecting the loss has a huge impact on the robust error.

Third, we would like to remark on the performance of adversarially trained models. We can see that reflecting the loss in general helps robustness. In particular, second and fourth rows (PGD-∞ and PGD2 ) are completely dominated by the third and fifth rows (R-PGD-∞ and R-PGD2 ), respectively.

Finally, it is notable that even though PGD2 and PGD-∞ are much weaker than their reflected counterparts, they are still competitive in terms of the robustness when used in adversarial training. Thissuggests that finding a 'strong' attack is not a necessity for adversarial training to succeed.

4.3 Extension to multi-label setting

In binary classification using the logistic loss, in essence, adversarial training finds an attack that minimizes the log-likelihood of the correct class. Using the reflected loss, instead, we aim at maximizing the log-likelihood of the wrong class. In a multiclass classification scenario, there are multiple such wrong classes. Therefore, an important design question is which wrong class should be targeted in the attack phase? Here, we focus on the most natural choice: we target the wrong class with the highest log-likelihood. This greedy approach is easy to implement, and has minimal computational overhead over standard adversarial training.

We emphasize though that the greedy approach (described above) is sub-optimal, even in a simple linear setting. Intuitively, when the parameters are such that the logits for the true class correlate

with the logits for the most likely wrong class, the greedy approach fails. In particular, consider the following 3-class classification problem in R 2 . Let f W (x) = Wx , where W=[2e 1 , e 1 , 10e 2 ] ∈ R 3 × 2 . Here, e i denotes the i -th standard basis. Consider the point x = [1 , 0] . Clearly, class 1 and 3 have the highest and the smallest likelihoods, respectively. Given a perturbation size ∥ x ′ -x ∥ ≤ 0 . 3 , the likelihood of the second class will never dominate that of the first class:

where the inequality follows by using the fact that x 1 = 1 and | δ 1 | ≤ 0 . 3 . Therefore, the greedy approach fails here. Whereas, within the specified perturbation budget, maximizing the likelihood of the third class can indeed find a label-flipping attack. For example, with δ = [0 , 0 . 3] , the point x ′ = [1 , 0 . 3] will be assigned to the third class, because w ⊤ 3 x ′ = 3 > w ⊤ 1 x = 2 > w ⊤ 2 x = 1 .

Weuse adversarial training with and without reflected loss (denoted by R-PGD and PGD, respectively) to train a PreActResNet (PARN) He et al. [2016] on the CIFAR-10 dataset Krizhevsky et al. [2009]. In the training phase, we conduct experiments for attack size ν ∈ { 2 , 4 , 8 , 16 } / 255 . We build on the PyTorch implementation in Zhang et al. [2021], and we follow their experimental setup, which is described next. We use a SGD optimizer with a momentum parameter of 0 . 9 and weight decay parameter of 5 × 10 -4 . We set the batch size to 128 and train each model for 20 epochs. We use a cyclic scheduler which increases the learning rate linearly from 0 to 0 . 2 within the first 10 epochs and then reduces it back to 0 in the remaining 10 epochs. We report robust test accuracy (RA) of an adversarially-trained model against PGD attacks Madry et al. [2018] (RA-PGD), where we take 50-step PGD with 10 restarts. We report the results for test-time attack size ν = 8 / 255 . Based on our empirical results, using the (greedy) reflected loss in adversarial training does not significantly impact the standard/robust generalization performance of the learned models.

5 Discussion

We study robust adversarial training of two-layer neural networks as a bi-level optimization problem. We propose reflecting the surrogate loss about the origin in the inner maximization phase when searching for an 'optimal' perturbation vector to attack the current model. We give convergence guarantee for the inner-loop PGD attack and precise iteration complexity results for end-to-end adversarial training, which hold for any width and initialization under a margin assumption. We also provide an empirical study on the effect of reflecting the surrogate loss in real datasets. Next, we list few natural research directions for future work.

Extension to multiclass setting. In binary classification, which is the focus of this paper, reflecting the loss about the origin provides a concave lower-bound for the zero one loss (see Figure 1). Maximizing the reflected loss then corresponds to maximizing the likelihood of the wrong class. This simple modification enables us to guarantee the convergence of PGD2 attacks, and yield stronger

attacks in our experiments. However, extending this idea to the multiclass setting is not trivial. In particular, the idea of maximizing the likelihood of the wrong class does not trivially generalize to the multiclass setting due to plurality of wrong classes. Nonetheless, as we show in the experimental section, a naive greedy approach to choose a wrong class seems to provide competitive performance in terms of standard/adversarial test error. Is there a simple, principled approach to obtain a lower-bound for the misclassification error in the multiclass setting? It would be interesting to explore theoretical and empirical aspects of such possible extensions.

Beyond β -robustness. The notion of β -robustness is crucial in our analysis. Although we provide robustness guarantees for arbitrarily small positive β (see Corollary 3.6), our current analysis does not allow for standard robustness guarantees ( β = 0) except for the linear setting ( α = 1 ). At a high level, the main challenge here is to guarantee that the attack can always find an adversarial example - if there exists one - regardless of whether the attack is β -effective or not. This is, in particular, challenging to establish for iterative attacks such as PGD, because they can only guarantee getting sufficiently close to an optimal attack in finite time. Therefore, if the optimal attack can just barely flip the sign, the computational time for finding it can grow unboundedly. Therefore, providing robust generalization guarantees ( β = 0 ) is an interesting research direction for future work.

Optimization geometry. In our theoretical results, we focus on PGD2 attacks, which are based on steepest descent with respect to the ℓ 2 geometry. In our experiments, we also provide empirical results for steepest descent attacks with respect to ℓ ∞ geometry (including FGSM and BIM) on the reflected loss. We leave the theoretical analysis of such attacks to future work.

References

Alon Brutzkus, Amir Globerson, Eran Malach, and Shai Shalev-Shwartz. SGD learns overparameterized networks that provably generalize on linearly separable data. In International Conference on Learning Representations , 2018.

Yuan Cao and Quanquan Gu. Generalization bounds of stochastic gradient descent for wide and deep neural networks. Advances in Neural Information Processing Systems , 32:10836-10846, 2019.

Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE symposium on security and privacy , pages 39-57. IEEE, 2017.

Zachary Charles, Shashank Rajput, Stephen Wright, and Dimitris Papailiopoulos. Convergence and margin of adversarial training on separable data. arXiv preprint arXiv:1905.09209 , 2019.

Spencer Frei, Yuan Cao, and Quanquan Gu. Provable generalization of SGD-trained neural networks of any width in the presence of adversarial label noise. arXiv preprint arXiv:2101.01152 , 2021.

Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D Lee. Convergence of adversarial training in overparametrized neural networks. Advances in Neural Information Processing Systems , 32:13029-13040, 2019.

Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations , 2015. URL http://arxiv. org/abs/1412.6572 .

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision , pages 630-645. Springer, 2016.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009.

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world, 2017.

Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE , 86(11):2278-2324, 1998.

Yan Li, Ethan X.Fang, Huan Xu, and Tuo Zhao. Implicit bias of gradient descent based adversarial training on separable data. In International Conference on Learning Representations , 2020. URL https://openreview.net/forum?id=HkgTTh4FDH .

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2574-2582, 2016.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014 , 2014.

Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning , volume 97 of Proceedings of Machine Learning Research , pages 6586-6595. PMLR, 09-15 Jun 2019. URL https://proceedings.mlr.press/v97/wang19i.html .

Yi Zhang, Orestis Plevrakis, Simon S Du, Xingguo Li, Zhao Song, and Sanjeev Arora. Overparameterized adversarial training: An analysis overcoming the curse of dimensionality. In NeurIPS , 2020.

Yihua Zhang, Guanhuan Zhang, Prashant Khanduri, Mingyi Hong, Shiyu Chang, and Sijia Liu. Revisiting and advancing fast adversarial training through the lens of bi-level optimization. arXiv preprint arXiv:2112.12376 , 2021.

Difan Zou, Spencer Frei, and Quanquan Gu. Provable robustness of adversarial training for learning halfspaces with noise. In Proceedings of the 38th International Conference on Machine Learning , volume 139 of Proceedings of Machine Learning Research , pages 13002-13011. PMLR, 18-24 Jul 2021. URL https://proceedings.mlr.press/v139/zou21a.html .

A Appendix

For simplicity of the notation, in our analysis of the PGD attack, we drop the subscripts denoting the iterates. That is, at the t -th iterate of the outer loop, the weight matrix and the sample point is denoted by W and x , y , instead of W t and x t , y t . We can then use the same variable t to measure the progress of the attack in the inner loop. PGD updates are therefore given by Π ∆(x) [ δ t + η ∇ ℓ -( yf W ( δ t ))] .

Proof of Theorem 3.2. We first bound the norm of the gradient of the iterates as follows:

We analyze the distance of iterates from δ ∗ :

where f W ,t ( δ ∗ ) := ⟨∇ f W ( δ t ) , δ ∗ ⟩ . Averaging over iterates, rearranging, and cancelling telescopic terms, we arrive at:

Next, we show that if δ ∗ is an effective attack on f W , then it's also effective on f W ,t . In other words, we have that:

̸

Let I t := { j ∈ [ m ] | σ ′ (w j · δ t ) = σ ′ (w j · δ ∗ ) } be the set of nodes whose pre-activation sign at time t is different from the optimal δ ∗ . The second term can be bounded as follows:

Given that there exist a β -effective, i.e. there exist δ ∗ such that yf W ( δ ∗ ) ≤ -β ∥ W ∥ F , we have:

Together with the previous inequality on the average of instantaneous loss, we arrive at:

Therefore, we have

Next, we show that for any z, z ′ , and ϵ > 0 , the inequality 2 ℓ -( z/ 2) ≤ ℓ -( z ′ ) + ϵ implies that -ℓ ′ ( z ) ≤ -2 ℓ ′ ( z ′ ) + 4 ϵ . The following inequalities hold true:

Let z ∗ := yf ¯ W ( δ ∗ ) , z att := yf ¯ W ( δ att ) and ϵ ′ := ν 2 η att T . Using the above inequality, sub-optimality in terms of ℓ -( · ) , as given in Equation (3), implies sub-optimality in terms of -ℓ ′ ( · ) :

That is, for any (x , y ) ∼ D , it holds with probability one that

Let E AdvTr [ · ] denote the expectation over a random draw of samples (x i , y i ) t i =1 for Adversarial Training given in Algorithm 2. Let ˆ H t := ⟨ W t , V ∗ ⟩ , ˆ G t 2 = ∥ W t ∥ 2 F , and let H t := E AdvTr [ ˆ H t ] , G 2 t := E AdvTr [ ˆ G 2 t ] be their corresponding population version.

Proof of Lemma 3.7. The proof heavily builds on the prior works of Frei et al. [2021]; we include it here for completeness. Let V ∗ ∈ R m × d be such that v r = 1 √ m sgn( a r )v ∗ . We define the correlation between the iterates and V ∗ as follows ˆ H t := ⟨ W t , V ∗ ⟩ . This correlation evolves as:

Recall that ∂ ∂ w r f δ (W) = a r σ ′ (w r · δ ) δ . Therefore, we have that:

Note that

On the other hand, for leaky ReLU, it holds that σ ′ ( · ) ≥ α . Therefore, we arrive at

Therefore, we have that

The gradient norm is bounded as follows:

Next, we analyze the norm of the iterates, i.e., ˆ G 2 t = ∥ W t ∥ 2 F . It is also easy to verify that -ℓ ′ ( z ) z = ze -z 1+ e -z = z 1+ e z ≤ 1 . We have:

Therefore, taking expectation E AdvTr on both sides, we have that

and using √ a + b ≤ √ a + √ b , we have G T ≤ G 1 + √ 3 η tr T . Also, we have that H 2 t = ( E AdvTr ⟨ W t , V ∗ ⟩ ) 2 ≤ E AdvTr ∥ W t ∥ 2 F ∥ V ∗ ∥ 2 F ≤ G 2 t so that | H t | ≤ G t . Putting all together, we get:

We now argue that for any ϵ , there exist an iterate t such that -E AdvTr ℓ ′ ( y t f δ t (W t )) ≤ ϵ . Assume otherwise, then we get:

Therefore, we have that

which completes the proof.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the optimization convergence of adversarial training in two-layer neural networks. This paper also proposes a reflecting loss which search for a better attack.\n\nSTRENGTHS:\nThe paper is clear and easy to understand.\n\nWEAKNESSES:\nMy major concern regarding this paper is that the condition on the attack strength $\\nu$ is too strong. The constraint $\\nu\\leq \\beta/(2(1-\\alpha)\\kappa\\sqrt{m})$ is exactly used in Page 13 (in the appendix) so that the attack on the current model $f_{W,t}$ is closed to the one for the model $f_{W}$. However, in such a scenario, there is almost no difference between clean training and adversarial training. The authors need to relax this condition and provide more insights on the role of the attack strength and the difficulty when it gets larger.\n\nBesides the major concern on the theoretical contribution, there are some issues in the experiments. First, the experiment in CIFAR-10 does not obtain a significant improvement. In Table 2, if counting the colored cells, PGD takes up 4, and R_PGD takes up 3, i.e., PGD may be even better than R-PGD in some cases. Second, there is no error bar information in this paper. Given that the difference between benchmarks and the proposed method is only of a small quantity, the authors need to run experiments for multiple times to obtain a standard error of the accuracies to verify that the improvements are statistically significant.\n\nFinally, in addition to the weakness of the assumption on the attack strength, there is also another gap between the theoretical study and the experiments: the authors may consider theoretical justification on the generalization performance of adversarial training in the linear separable data. I would suggest the authors to investigate the effect on $\\beta$ towards the generalization performance. In many existing literature, people study the generalization performance in simple models, e.g., Gaussian mixture model, linear regression model, but there is limited understanding on linear separable data.\n\nQUESTIONS:\nPlease try to address my major concern (the first paragraph).\n\nLIMITATIONS:\nNo ethical concern.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-16"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies robust training in 2-layer networks. This problem is studied as a 2-spet procedure - finding adversarial samples, and training over these samples. The main result is given a linearly separable dataset, then a 2-layer network with leaky-ReLU activation trained robustly with SGD converges to a robust network in polynomial time. Several experiments are given to support the theoretical results.\n\nSTRENGTHS:\n- I think it is interesting to study robust optimization in a rigorous way, and the main result of this paper- namely that robust SGD converges to a robust network in polynomial time is nice.\n- The empirical result complements the theoretical results, while also generalizing to a multi-class setting.\n- I think the proof sketch gives a nice and intuitive explanation of the main result\n\nWEAKNESSES:\n- The use of the reflected loss seems like a crucial part of the proof, although I don’t think it is motivated enough. Is it used just for some technical part of the proof? or is there more to it? I think if it is indeed a crucial part, then there should be a more in-depth explanation of why it is used. \n- The model analyzed is a 2-layer network without biases.  It is not clear whether removing the bias is done just for simplicity, or it is indeed necessary. I think the proof uses homogeneity w.r.t x, which may be the cause for the bias-less network, but if so, can the results be generalized to networks with bias terms?\n- More of a suggestion: Are the convergence results of algorithms 1 & 2 can be decoupled? i.e. will Theorem 3.4 about the convergence of algorithm 2 will hold when instead of algorithm 1 we use any other attack? If so, I think it is good to mention it.\n\nQUESTIONS:\n- Will the proof work also on networks with bias terms?\n- Why is the reflection loss used in the analysis?\n\nLIMITATIONS:\nThe authors adequately address the limitations of their work.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the convergence of adversarial training of two layer neural network, with gradient descent ascent (GDA) type algorithm. The algorithm considered here solvies inner max problem on a surrogate concave loss, and solves outer minimization problem on log-exp loss. Finally, the authors show the convergence to $\\epsilon$ weaker robust error with no more than $O(1/\\epsilon^2)$ iterations. The proof contains two parts, first they show that, solving the surrogate concave loss will yield a pertubation, which is almost as good as the true optimal adversarial perturbation, and then they borrow the existing analysis of two layer classification neural network training, to show that under the solved perturbation, the outer minimization problem can converge to global minima. To the best of my knowledge, this is the first work towards analyzing behavior of GDA on adversarial neural network training.\n\nSTRENGTHS:\nThe convergence of adversarial neural network training is a longstanding problem. The most relevant work is [Gao et al 2019], where they assume the inner max problem is solved by some oracle, not PGD, and hence they only need to perform minimization convergence analysis on the adversarial loss. This paper, for the first time, consider algorithm-based convergence, where they study the case that the inner max problem is solved by projected gradient ascent.\n\nWEAKNESSES:\n1. My main concern is that, the proof seems to be heavily depending on previous result, and the main technical novelty is the idea of running PGD on concave surrogate, and show the converegnce of PGD.\n\n2. Running PGD on concave surrogate loss is not widely used in practice. In practice, the gradient descent and ascent steps are usually performed on the same loss function.\n\nQUESTIONS:\n1. I notice that [Allen-Zhu and Li 2022] also studies adversarial training, where they consider Fast gradient method to solve inner max problem. Could the authors do some comparison with this paper?\n\n\n\nAllen-Zhu, Zeyuan, and Yuanzhi Li. \"Feature purification: How adversarial training performs robust deep learning.\" In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS), pp. 977-988. IEEE, 2022.\n\nLIMITATIONS:\nOne limitation as I mentioned is that the algorithm used here is not exactly consistent with what people use in practice. I do not see any societal impact.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the adversarial training of two-layer neural networks on linearly separable data. The authors propose to reflect the commonly used convex surrogate loss during the inner loop that generates adversarial attack via the PGD method, and derives guarantee on the convergence of the attack. Meanwhile, this paper also provides theoretical results on iteration complexity for the adversarial training on linearly separable data that holds for any width and initialization of the network. Numerical studies are conducted to show the performance.\n\nSTRENGTHS:\n1.\tThe investigated topic of adversarial training of neural networks is important and has many applications in real world, while the theoretical aspects have not been well-studied. The results presented in this paper are non-trivial contribution to the field, and might help with better understanding of adversarial training of neural networks in more complicated settings. \n2.\tThe theoretical analysis seems solid. The authors introduce some interesting terms such as $\\beta$-effective attack and $\\beta$-robust to help the analysis, which might help in other study.\n3.\tOverall, the paper is well-organized and easy to follow.\n\nWEAKNESSES:\n1.\tThe empirical results with MNIST and CIFAR-10 do not show significant difference between the performance of standard adversarial training and adversarial training using proposed reflected loss function.\n\n2.\tThere are some space of improvement regarding the experiments. Specifically, please consider the followings:\n\n(1)\tThe result presented in Figure 2 does not seem convincing to me because (a) the setting is too simple and hand-crafted, while the real data can behave very differently; (b) Only one specific data point ($x=[3,2,1]$) is considered. It is doubtful whether it is cherry-picked or not.\n\n(2)\tIn Table 1, the robust testing error for standard training model under standard PGD attack (0.033) is much smaller than FGSM (0.286), which is unlikely since PGD usually generates stronger attack through multiple iterations. Please double-check the correctness. \n\n(3)\tIn Table 1, please consider including the evaluation of different models over clean testing data (un-attacked) for better comparison. Also, for Tables 1 and 2, please consider including the evaluation under other attacks, e.g., CW attack [1] and AutoAttack [2].\n\nPlease also consider my questions in the next part.\n\n\n[1] Carlini, N., & Wagner, D. (2017, May). Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) (pp. 39-57). ieee.\n\n[2] Croce, F., & Hein, M. (2020, November). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning (pp. 2206-2216). PMLR.\n\nQUESTIONS:\n1.\tWhat feature of the reflected loss function enables the derivation of the theoretical results, or why the standard loss function make the analysis difficult? Can one replace the reflected loss function with a more general loss function? \n\n2.\tTheorem 3.4 says that \"in at most $T_{tr}\\cdots$ iterations, Algorithm 2 $\\cdots$ $\\textit{finds an iterate}$ $\\tau$” with certain property. What does that mean exactly? Is it guaranteed that the model at the end of iteration $T_{tr}$ maintain such property? Or, is any early-stopping criteria necessary in order to guarantee the property?\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations of the work.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-09"}