Robustness in deep learning: The width (good), the depth (bad), and the initialization (ugly)
Anonymous Author(s)
AffiliationAddress
Abstract
We study the average robustness notion in deep neural networks in (selected) wideand narrow, deep and shallow, as well as lazy and non-lazy training settings.
Weprove that in the under-parameterized setting, width has a negative effect while itimproves robustness in the over-parameterized setting.
The effect of depth closelydepends on the initialization and the training mode.
In particular, when initializedwith LeCun initialization, depth helps robustness with lazy training regime.
Incontrast, when initialized with Neural Tangent Kernel (NTK) and He-initialization,depth exacerbates the robustness.
Moreover, under non-lazy training regime, wedemonstrate how the width of a two-layer ReLU network benefits robustness.
Ourtheoretical developments improve the results by [Huang et al., 2021, Wu et al.,2021] and are consistent with [Bubeck and Sellke, 2021, Bubeck et al., 2021].
Introduction
It is now well-known that deep neural networks (DNNs) are susceptible to adversarially chosen,albeit imperceptible perturbations to their inputs [Goodfellow et al., 2015, Szegedy et al., 2014].
Thislack of robustness is worrying as DNNs are now deployed in many real-world applications [Eykholtet al., 2018].
As a result, new algorithms are more and more being developed to defend againstadversarial attacks to improve the DNN robustness.
Among the current defense methods, the mostcommonly used and arguably the most successful method is adversarial training based minimaxoptimization [Athalye et al., 2018, Croce and Hein, 2020, Madry et al., 2018].
The literature focuses on several aspects of the robustness issue, from algorithms to their initializationas well as from width of neural networks to their depth (i.e., the architecture).
On the practical side,
Madry et al.
[2018] advocate that adversarial training requires more parameters (e.g., width) forbetter performance in minimax optimization, which would fall into the so-called over-parameterizedregime 1 [Zhang et al., 2021].
On the theory side, recent works suggest that over-parameterizationmay damage the adversarial robustness [Huang et al., 2021, Wu et al., 2021, Zhou and Schoellig,2019].
In stark contrast, Bubeck and Sellke [2021], Bubeck et al.
[2021] argue that the robustness of
DNNs needs enough parameters to be guaranteed.
Our work is motivated to investigate this apparent contradiction in theory, and to close the gap asmuch as possible.
We begin with a definition of perturbation stability of DNNs, which allows foraverage robustness , following the spirit of Wu et al.
[2021], Dohmatob and Bietti [2022].
Specifically,given a data point x ∼ D X , the ϵ -perturbation stability P ( f , ϵ ) of a deep ReLU neural network f( cf. , Fig. 1) is given by
[Equation]
where ˆ x is uniformly sampled from an ℓ 2 norm ball of x with radius ϵ , denoted as Unif ( B ( ϵ, x )) [Equation]
[Table]
Based on this definition
[Table]
we study the average robustness of neural networks under different initializations in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy 2 training settings. Generally
[Table] non-lazy training makes the analysis of neural networks intractable as DNNs in this regimecannot be simplified as a time-independent model [Chizat and Bach, 2018] [Table] and accordingly, theanalysis in this regime is mainly restricted to the two-layer setting [Mei et al., 2018, 2019].
Overall, our results suggest that the width ( good ) helps robustness in the over-parameterized regimebut the depth ( bad ) can help only under certain initializations ( ugly ).
To be specific, we make thefollowing contributions and findings under the lazy/non-lazy training regimes, see Table 1.
In the lazy training regime, we derive upper-bounds, suggesting that
• along with the increase in width, the average robustness P ( f , ϵ ) first becomes worse in the
under-parameterized setting and then gets better, and finally tends to be a constant in highly
over-parameterized regions, which implies the existence of phase transition.
• the depth has more complex tendency on average robustness , which largely depends on the
initialization and the training mode.
It can be grouped into two main classes ( cf. , Table 1) :depth helps robustness in an exponential order under LeCun initialization [LeCun et al.
,2012], whereas it exacerbates robustness in a polynomial order under He-initialization
[He et al., 2015] and under Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al. 2019a
Surprisingly, standard tools on training dynamics of neural networks [Allen-Zhu et al., 2019a, Duet al., 2018a] are sufficient to obtain our bounds, which explain the relationship between averageperturbation robustness and the structural/architectural parameters of neural network.
Our theoreticaldevelopments improve the results by Huang et al.
[2021], Wu et al.
[2021], and are supported byempirical evidence.
In the non-lazy training regime, we derive upper-bounds for two-layer networks, suggesting that
• the width improves average robustness P ( f , ϵ ) under different initializations.
We also derive a sufficient condition to identify when DNNs enter in this regime, as an initial but firstattempt on understanding DNNs in this regime.
Our technical contribution lies in connecting averagerobustness to changes of neural network parameters during the early stages of training, which couldexpand the application scope of deep learning theory beyond lazy training analysis [Jacot et al., 2018,
Allen-Zhu et al., 2019b]
Notations:
We use the shorthand [ n ] := { 1 , 2 , . . . , n } for some positive integer n .
We denote by a ( n ) ≲ b ( n ) :there exists a positive constant c independent of n such that a ( n ) ⩽ cb ( n ) .
The standard Gaussiandistribution is N ( 0 , 1) with the zero-mean and the identity variance.
Uniform distribution inside thesphere is Unif ( B ( ϵ, x )) with the center x and radius ϵ .
We follow the standard Bachmann–Landaunotation in complexity theory e.g., O , o , Ω , and Θ for order notation.
Related work
DNNs are demonstrated to be fragile, sensitive to adversarially chosen but undetectable noise bothempiricallySzegedy et al.
[2014] and theoretically Huang et al.
[2021], Bubeck and Sellke [2021].
Adversarial training [Athalye et al., 2018, Croce and Hein, 2020, Zhang et al., 2020b] is a reliableway to obtain adversarially robust neural network.
Nevertheless, improving the overall robustnessof neural networks is still an unsolved problem in machine learning, especially when coupling withinitializations and parameters.
Over-parameterized neural networks under lazy/non-lazy training regimes: Modern DNNs inpractice
[He et al., 2016] work under the setting where the number of parameters is (much) largerthan
the number of training data.
Analysis of DNNs in terms of optimization [Safran et al., 2021,
Zhou et al., 2021] and generalization [Cao and Gu, 2019] has received great attention in deep learningtheory [Zhang et al., 2021], and further brings in new insights, e.g., double descent [Hassani and
Javanmard, 2022], implicit bias [You et al., 2020].
In deep learning theory, neural tangent kernel (NTK) Jacot et al.
[2018] and mean field analysis aretwo powerful tools for neural network analysis.
To be specific, NTK builds an equivalence betweentraining dynamics by gradient-based algorithms of DNNs and kernel regression under a specificinitialization, and thus allows for deep networks analysis [Allen-Zhu et al., 2019a, Du et al., 2019,
Chen et al., 2020].
However, this way actually requires neural networks falling in a lazy trainingregime
[Chizat et al., 2019], where neural networks are able to achieve zero training loss but theparameters change little, or even remain unchanged during training.
In contrast, mean-field theoryestablishes global convergence by casting network weights during training as an evolution in thespace of probability distributions under some certain initialization to results [Mei et al., 2018, Chizatand Bach, 2018].
This strategy goes beyond lazy training regime, which allows for neural networksparameters changing in a constant order after training.
If neural networks parameters changes a lot after training, or even tend to infinity, then neuralnetworks work in non-lazy training regime.
Analysis of DNNs under this setting appears intractableand challenging, so current work mainly focus on two-layer neural networks [Maennel et al., 2018,
Luo et al., 2021].
Robustness and over-parameterization Goodfellow et al.
[2015] demonstrate that adversariallearning helps robustness and reduces overfitting, and in the following, many works focus on the tracethe origin and influencing factors of adversarial examples and robustness for neural network [Schmidtet al., 2018, Zhang et al., 2020a, Allen-Zhu and Li, 2022].
The relation between model capacityand robustness is empirically investigated by Madry et al.
[2017], i.e., neural network with insufficient capacity can seriously exacerbate the robustness.
Bubeck et al.
[2021] theoretically studythe inherent trade-off between the size of neural networks and their robustness, and they claim thatover-parameterization is necessary for the robustness of two-layer neural networks.
However, some recent works propose the opposite view.
Under the lazy training regime, Huang et al.[2021] demonstrate that when over-parameterized neural networks get wider, the robustness willbe exacerbated in a polynomial order.
At the same time, the depth exacerbates the robustness in anexponential order.
Wu et al.
[2021] affirm the view of Huang et al.
[2021] on the width.
Howeverfor depth, they derive a stronger bound that the robustness gets worse in a polynomial decay asdepth increases.
In addition, Gao et al.
[2019] also make a similar view: more model capacity (i.e.,wider width and deeper depth) leads to the robustness of neural networks worse.
These contradictthe previous results in theoretical and experimental.
In this work, we adopt a complementary viewto these vast literature.
We provide an in-depth theoretical analysis to investigate this apparentcontradiction in theory, and to close the gap as much as possible.
Problem setting
Let X ⊆ R d and Y
⊆ R o be compact metric spaces.
We assume that the training set D tr ={ ( x i , y i ) } ni =1 with data dimension x ∈ R d and label dimension
y ∈ R o is drawn from a probabilitymeasure D on X × Y .
Its marginal data distribution is denoted by D X .
The goal of the classificationtask is to find a neural network f : X → Y such that f ( x ; W ) parameterized by W is a goodapproximation of the label y ∈ Y corresponding to a new sample x ∈ X .
In this paper, we use theempirical risk L ( W ) =
12 n (cid:80) ni =1 ∥ f ( x i ; W ) − y i ∥ 22 .
Then we make the following assumptions.
Assumption 1.
We assume that the data satisfy ∥ x ∥ 2 = 1 .
Remark:
This is a standard assumption in theory on over-parameterized neural networks and itis also commonly used in practice.
[Du et al., 2018b, 2019, Allen-Zhu et al., 2019a, Oymak and
Soltanolkotabi, 2020, Malach et al., 2020].
3.1 Network
We focus on the typical depth- L fully-connected ReLU neural networks with the width of the l -thhidden layer m l , ∀ l ∈ [ L ] ( cf. , Fig. 1):
[Equation]
where the x ∈ R d , f ( x ) ∈ R o , α is the scaling factor, weights W :=
{ W i } Li =1 ∈ { R m ×
d ×( R m × m )
L − 2 × R o × m } represent the tuple of weight matrices and ϕ = max(0 , x ) is ReLU activationfunction.
According to the property ϕ ( x ) =
xϕ ′ ( x ) of ReLU, we have h
i,l = D i,l W l h i,l − 1 , where
D i,l is a diagonal matrix under the ReLU activation function defined as below.
Definition 1 (Diagonal sign matrix) .
For each i ∈ [ n ] , l ∈ [ L − 1] and k ∈ [ m ] , the diagonal signmatrix D i,l is defined as: ( D i,l ) k,k = 1 { ( W l h i,l − 1 ) k ≥ 0 } .
Initialization: Let m 0 =
d , m L
=
o
and m 2 = · · · = m L −
= m , we make the standard randominitialization [ W l ] i,j ∼ N (0 , β 2 l ) for every ( i, j ) ∈ [ m l ] × [ m l − 1 ] and l ∈ [ L ] .
This work holdsfor three commonly used Gaussian initializations, i.e., LeCun initialization [LeCun et al., 2012],
He-initialization [He et al., 2015] and Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al.
,2019a].
The formulation of these intilization refer to 1.
3.2 Robustness metric
Here we introduce perturbation stability ( cf. , Definition 2) as a measure to describe the averagerobustness of neural networks by defining an ℓ 2 norm ball B ( ϵ, x ) = { ˆ x | ∥ ˆ x − x ∥ 2 ≤ ϵ } .
Then,assume that the perturbation is uniformly distributed in the ℓ 2 norm ball with the radius ϵ , termed as Unif( B ( ϵ, x )) , the perturbation stability is defined as the expectation of the product of perturbationand gradient of the network output. Definition 2 (perturbation stability) .
The perturbation stability of the neural network f under datadistrubution D X and perturbation radius ϵ is defined as follows: [Equation] Remark: Under the same ϵ , smaller P ( f , ϵ ) implies more robust f .
This metric can be viewedas an inner product of first-order approximation of adversarial risk [Madry et al., 2017] and theperturbations with uniform distribution, which measures the average robustness of the neural network.
Previous works [Hein and Andriushchenko, 2017, Weng et al., 2018, Wu et al., 2021, Bubeck and
Sellke, 2021] use Lipschitzness to describe the robustness of the network, suggesting that smaller
Lipschitzness leads to robust models.
However, Lipschitzness is only a worst-case measure, andcannot reasonably describe the average changes of the entire dataset.
Instead, we follow the measureof Wu et al.
[2021], Dohmatob and Bietti [2022], that aims to comprehensively considers the overalldistribution of the data, not only the extreme case.
Main results
In this section, we state the main theoretical results.
Firstly, in Section 4.1 we provide the upperbound of Perturbation Stability in lazy training regime for deep neural networks defined by Eq.
The sufficient condition that the neural network Eq.
(1) is under non-lazy training regime is givenin Section 4.2.
Finally, in Section 4.3, we give the upper bound on perturbation stability during earlytraining of two-layer network under non-lazy training regime.
The proofs of our theoretical resultsare deferred to Appendix B, C, and D, respectively.
4.1 Upper bound of perturbation stability of DNNs under the lazy training regime
We are now ready to state the main results under the lazy training regime.
The following theoremgives the upper bound of perturbation stability and connects to depth and width of network anddimension of data for a deep fully-connected neural network under standard Gaussian initialization.
Theorem 1.
Given an L -layer neural network f defined by Eq.
(1) trained by { ( x i , y i ) } ni =1 satisfying Assumption 1, for the convenience of analysis, we set α = 1 and β := β 2 = · · · = β L − 1 , definea constant γ := β/ (cid:113) 2 m , then under a small perturbation ϵ , we have the following
[Equation]
Remark: Our results cover the effect of the width and depth of neural network on average robustnessunder various common initializations depending on γ ⪌ 1 .
For the initializations used in practice, our theoretical results can be mainly divided into two classes.1) Depth helps robustness in an exponential order under LeCun initialization: our Theorem 1 implies 174 (cid:18)(cid:113) πL m d e − m/ L 3 + 1 (cid:19) ( √ 22 )
L − 2 ; 2) Depth exacerbates robustness in a polynomial order under
He-initialization (cid:18)(cid:113) πL 3 m 2 d e − m/L 3 + 1 (cid:19) and under NTK initialization (cid:18)(cid:113) πL 3 m 4 o e − m/L 3 + 1 (cid:19)derived by Theorem 1.
When employing other initializations, robustness could be exacerbated in aexponential order.
Below, we elaborate on these three initalizations:
• LeCun initialization ( γ = √ 22 ):
The order has three main parts (cid:113) πL 3 m 8 d , e − m/L 3 and
( √ 22 ) L − 2 .
The first two parts implies a phase transition phenomenon between average
robustness and over-parameterization for the width m .
Concretely, (cid:113) πL 3 m 8 d is an increasing
function with respect to m and e − m/
L 3 is a decreasing function with respect to m .
In the
under-parameterized region ( m is small)
, (cid:113) L 3 md plays a major role, so the stability will
increase as m increases.
After a critical point, e − m/
L 3 plays a major role, so the stability
will decrease as m increases.
When m tends to infinity, the first term of bound tends to 0 .
Hence the perturbation stability tends to be a constant and independent with width m as the
width m tends to infinity.
However, for depth L , it holds that γ = √ 2 2 .
So the third part has the faster increase/decrease speed than the first and second part and play a major role
in the tendency.
The perturbation stability of the neural network exponentially decreases
with respect to the depth.
That means that for LeCun initialization, the deeper the network,
the better average robustness .
Nevertheless, the energy of LeCun initialization decreases
with the increase of network depth, which means that training deep network with LeCun
initialization is very difficult.
Hence we need a trade off between robustness and training
difficulty regarding network depth in practice for LeCun initialization.
• He initialization and NTK initialization ( γ = 1 ): here the perturbation stability bounds only have the first two parts.
From this, it is easy to see that for the network width m ,
the two initializations have similar phase transition phenomena with LeCun initialization.
Regarding to the depth, when L is large, the first part √ L 3 plays a major role in the
perturbation stability.
So these two initializations exacerbate the average robustness of the neural network polynomially.
• In addition, if the initialization admits γ ≥ 1 , then the depth L of network will exponentiallyexacerbate average robustness of the neural network.
Comparison with previous work: Theorem 1 provides a new relationship between the robustnesswith width and depth of DNNs.
We compare our result with [Wu et al., 2021, Huang et al., 2021]using a basic NTK initialization Allen-Zhu et al.
[2019a] (suppose that m ≫ o and m ≫ d ).
Forbetter comparison, we derive their results under our average robustness metric, reported by Table 2.
[Table]
Metrics Our result
[Table]
[Equation]
[Table]
[Equation]
[Table]
Our results indicate a behavior transition on the width.
For the over-parameterized regime, theperturbation stability of neural network only depends on the perturbation energy, and it is almost independent of the width significantly our results give compared to Wu in a degree increasing and increasing
4.2 Sufficient condition for neural network under non-lazy training regime
Beyond the lazy training regime, we turn our attention to non-lazy training regime and present resultsabout the sufficient condition for (well-chosen) initialization of neural networks when entering intothe non-lazy training regime.
This is a first attempt to understanding training dynamics of DNNs inthis regime.
Our result requires a further assumption on the data and the empirical risk as follows.
Assumption 2.
For a single-output network defined in Eq.
(1) , we assume that max i ∈
[ n ] y i ≥ C 1 ≥ 0 .
We also assume that the neural network can be well-trained such that the empirical risk is O ( 1 n ) .
Remark:
This is a common assumption in the field of optimization [Song et al., 2021] in the underand over-parameterized regime, and we can even assume zero risk.
Here we follow the specificassumption of Luo et al.
Now we are ready to present our result, a sufficient condition to identify when deep ReLU neuralnetworks fall into non-lazy training regime, as a promising extension of Luo et al.
[2021] on two-layerneural networks.
To avoid cluttering the analysis, we consider a single-output i.e., o = 1 .
Theorem 2.
Given an L -layer neural network f defined by Eq.
(1) with one-dimensional output,trained by { ( x i , y i ) } n i =1 satisfying Assumptions 1 and 2.
Suppose that α ≫ ( m 3 / 2 (cid:80) L i =1 β i )
L andm ≫ d in Eq.
(1) , then for sufficiently large m , with probability at least 1 − ( L − 2) exp( − Θ( m 2 )) −exp
( − Θ( md )) − exp( [Equation] Θ( m )) over the initialization, we have
[Equation]
Remark:
The condition α ≫ ( m 3 / 2 (cid:80) Li =
1 β i )
L implies that, a neural network falls in a non-lazytraining regime when the variance of the Gaussian initialization is very small.
A typical case is,taking m ≫ L 2 , choosing α = 1 and ∀ l ∈
[ L ]; β l = 1 m 2 .
Commonly used initializations such as
NTK initialization, LeCun initialization, He’s initialization lead to lazy training.
4.3 Upper bound of perturbation stability for two-layer networks in non-lazy training
Unlike lazy training, weights of non-lazy training concentrate on few directions determined bythe input data in the early stages of training.
The following theorem describes the neural networkperturbation stability in the early training stage as a function of network width in the non-lazy training regime.
For ease of description, here we consider a special initialization scheme under the non-lazyregime, more cases under this theorem and proof are deferred to the Appendix D.
Theorem 3.
Given a two-layer neural network f defined by Eq.
(1) with L = 2 and trained by{ ( x i , y i ) } ni =1 satisfying Assumption 1, using gradient descent under the squared loss, consider thefollowing initialization in Eq.
L = 2 , α ∼ 1 , β 1 ∼ β 2 ∼ β ∼ 1 m c with c ≥ 1 . 5 , m ≫ n 2 andt ≤ t ⋆ ( n, m, α ) , then for a small range of perturbation ϵ , with probability at least 1 − n exp( − n 2 ) − 3 nover initialization, we have the following:
[Equation]
Remark: Under this setting of non-lazy training regime, the perturbation stability and width ofthe neural network are negatively correlated in the early stages of training.
That is, as the width mincreases in the over-parameterized regime, a Gaussian initialization with smaller variance results inthe perturbation stability decreasing in a faster decay.
Our result holds for other initialization schemesin the non-lazy training regime, e.g., c = 2 leads to P ( f t , ϵ ) /ϵ
≤ Θ (cid:18) √ n log m + n m
[Equation]
(cid:19) ; and c = 3 leadsto P ( f t , ϵ ) /ϵ
≤ Θ (cid:18) √ n log m + n m 4 .(cid:19) .
Numerical evidence
We validate our theoretical results with a series of experiments.
In Section 5.2 we first verify thatour initialization settings belong in the lazy and the non-lazy training regimes.
In Section 5.3, wethen explore the effect of varying widths from under-parameterized to over-parameterized regions onthe perturbation stability of neural networks.
In Section 5.4, we finally compare the effect of twodifferent initializations and the network depth on the perturbation stability.
Additional experimentalresults can be found in Appendix E.
5.1 Experimental settings
Here we present our experimental setting including models, hyper-parameters, the choice of widthand depth, and initialization schemes.
We use the popular datasets of MNIST [Lecun et al.
1998]and CIFAR-10 [Krizhevsky et al., 2014] for experimental validation.
Models: We report results using the following models: fully connected ReLU neural network named“FCN” in main paper and convolutional ReLU neural network named “CNN” in Appendix E.
Hyper-parameters: Unless mentioned otherwise, all models are trained for 50 epochs with a batchsize of 64 .
The initial value of the learning rate is 0 .
After the first 25 epochs, the learning rate ismultiplied by a factor of 0 .
1 every 10 epochs.
The SGD is used to optimize all the models, while thecross-entropy loss is used.
Width and depth: In order to verify our theoretical results, we conduct a series of experiments withdifferent depths and widths of the same type neural network.
Specifically, our experiments include 11different widths from 2 4 to 2 14 , and four different choices of depths, i.e., 2 , 4 , 6 , 8 .
Initialization: We report results using the following initializations: 1) He initialization where
W ij ∼ N (0 , 2 m in ), 2) LeCun initialization where W ij ∼ N (0 , 1 m in ) and 3)
An initialization allowsfor non-lazy training regime on two-layer networks, i.e., β 1 = β 2 = 1 /m 2 and α = 1 .
5.2 Validation for lazy and non-lazy training regimes
Before verifying our results, we need identify the lazy and non-lazy training regime under differentinitializations.
To this end, we define a measure lazy training ratio , i.e., κ = (cid:80)
[Table]
tomeasure whether the neural network is under the lazy training regime.
A smaller κ implies that theneural network is more close to lazy training.
According to the theory, we employ He initialization and non lazy training initialization we statein Section 5.1 then conduct the experiment under two-layer neural networks to verify that their lazy [Figure] [Figure] training ratio matches the theoretical results of lazy training and non-lazy training (i.e. the experimentis under the correct regime).
Fig. 2(a) and Fig.
2(b) show the tendency of ratio respect to time(training epochs) and relationship between width and lazy training ratio of neural networks underlazy training regime, respectively.
We can find that the ratio of lazy traing regime is almost a constantthat does not change with time, and this constant decreases with the width of network increases.
Thisis in line with what we know about lazy training [Chizat et al., 2019].
Likewise, Fig. 3 shows the ratio tendency with time and width under non-lazy training regime.
Theratio increases almost linearly over time in Fig. 3(a).
(The polyline shown in the figure is because wechanged the learning rate during training.)
At the same time Fig. 3(b) shows the similar tendencybetween width and lazy training ratio as lazy training.
However, the value of κ is much higherthan that of lazy training regime.
Combining the results about tendency with time, the ratio will beexpected to increase as time at a slow decay and tend to infinity under highly wide width setting.
5.3 Validation for width
We verify the relationship between the perturbation stability and the width of network as illustratedby Eqs.
(3) and (4).
We conduct a series of experiments on MNIST dataset using FCN with differentwidths.
Fig.
4 shows the relationship between perturbation stability and width of FCN with differentdepths and training regimes.
Here for lazy training and non-lazy training we use the same initializationas Section 5.2.
Fig. 4(a) exhibits the relationship between the perturbation stability and the width for neural networkswith different depths of L = 2 , 4 , 6 , and 8 .
All of the four curves show the phase transition withwidth, and the perturbation stability first increases and then decreases with width, which match ourtheoretical results.
Fig. 4(b) shows the difference of the effect of width on the robustness of lazy andnon-lazy training for two-layer neural networks.
First, the perturbation stability of non-lazy training [Figure] [Figure] is significantly smaller than that of lazy training, which means non-lazy training regime is morerobust.
Besides, the perturbation stability of non-lazy training decrease with the width of the neuralnetwork increases, which coincides with our theoretical result, i.e., no phase transition phenomenon.
5.4 Validation for depth and initialization
Here we explore the effect of depth on robustness under lazy training regime with different initializations in Fig.
5(a) and Fig.
5(b).
Our results show the tendency of perturbation stability fortwo/six-layers FCN with different widths under He initialization and LeCun initialization, respectively.
We observe a similar phase transition phenomenon, and find that, the perturbation stability under Heinitialization increases with depth, while the LeCun initialization shows the opposite tendency, whichverified our theory.
Conclusions
In this work, we explore the interplay of the width, the depth and the initialization of neural networks on their average robustness with new theoretical bounds in an effort to address the apparentcontradiction in the literature.
Our theoretical results hold in both under- and over-parameterizedregimes.
Intriguingly, we find a change of behavior in average robustness with respect to the depth,initially exacerbating robustness and then alleviating it.
We suspect that this could help explain thecontradictory messages in the literature.
We also characterize the average robustness in the non-lazytraining regime for two layer neural networks and find that width always help, coinciding the withthe results Bubeck and Sellke [2021], Bubeck et al.
We also provide numerical evidence tosupport the theoretical developments. Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] We clearly discuss the limitation
of this work in the Appendix F.
(c) Did you discuss any potential negative societal impacts of your work?
[Yes]
We clearly
discuss the societal impact of this work in the Appendix G.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes] We havedetailed the rationale of the applied assumptions in this paper.
(b) Did you include complete proofs of all theoretical results?
[Yes] We include the
complete proofs of our theoretical results.
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[No] The datasets weuse in this work are all in the public domain and standard for image-related tasks.
Thus,our setup can be reproduced by interested practitioners.
The code will be open-sourced
upon the acceptance of the paper.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes] Our experiments are mainly for validation our theory, all of the
settings and hyper-parameters are mentioned in the main paper.
(c) Did you report error bars (e
g., with respect to the random seed after running experi-
ments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type
of GPUs, internal cluster, or cloud provider)?
[Yes] All our experiments are conducted
on a single GPU in our internal cluster.
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes] We cite all the
corresponding papers that provide the assets we use.
(b) Did you mention the license of the assets?
[Yes] All the datasets used in this work are
publicly available datasets.
All the datasets enable their use for research purposes.
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
The datasets we utilize are publicly available and contain tens or
hudrends of thousands of images.
We refer to the authors original papers describing
the datasets.
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A] Our experiments rely on a) synthetic data, b)
public benchmarks that do not contain personally identifiable information or offensive
content.
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]