Robustness in deep learning: The good (width), the bad (depth), and the ugly (initialization)
Abstract
We study the average robustness notion in deep neural networks in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy training settings.
We prove that in the under-parameterized setting, width has a negative effect while it improves robustness in the over-parameterized setting.
The effect of depth closely depends on the initialization and the training mode.
In particular, when initialized with LeCun initialization, depth helps robustness with lazy training regime.
In contrast, when initialized with Neural Tangent Kernel (NTK) and Heinitialization, depth hurts the robustness.
Moreover, under non-lazy training regime, we demonstrate how the width of a two-layer ReLU network benefits robustness.
Our theoretical developments improve the results by Huang et al.
[2021], Wu et al. [2021] and are consistent with Bubeck and Sellke [2021], Bubeck et al.
Introduction
It is now well-known that deep neural networks (DNNs) are susceptible to adversarially chosen, albeit imperceptible, perturbations to their inputs [Goodfellow et al., 2015, Szegedy et al., 2014].
This lack of robustness is worrying as DNNs are now deployed in many real-world applications [Eykholt et al., 2018].
As a result new algorithms are more and more being developed to defend against adversarial attacks to improve the DNN robustness.
Among the current defense methods, the most commonly used and arguably the most successful method is adversarial training based minimax optimization [Athalye et al., 2018, Croce and Hein, 2020, Madry et al., 2018].
To study adversarial attacks and defenses, we need to throughout investigate the robustness of DNNs at first.
The literature focuses on several aspects of the robustness issue, from algorithms to their initialization as well as from width of neural networks to their depth (i.e., the architecture).
On the practical side,
Madry et al.
[2018] advocate that adversarial training requires more parameters (e.g., width) for better performance in minimax optimization, which would fall into the so-called {+over-parameterized regime 
+} [Zhang et al., 2017].
On the theory side, recent works suggest that over-parameterization may damage the adversarial robustness [Huang et al., 2021, Wu et al., 2021, Zhou and Schoellig, 2019, Hassani and Javanmard, 2022].
In stark contrast, Bubeck and Sellke [2021], Bubeck et al.
[2021] argue that the robustness of DNNs needs enough parameters to be guaranteed.
See a detailed discussion in Section 2.
Our work is motivated to investigate this apparent contradiction in theory, and to close the gap as much as possible.
We begin with a definition of the perturbation stability of DNNs, which can be used to describe the robustness, following the spirit of Wu et al.
[2021], Dohmatob and Bietti [2022].
Mathematically,
[Table]
Definition 1 ( perturbation stability ) .
The perturbation stability of the neural network f ( x ; W ) : R d (cid:55)→ R o parameterized by the neural network parameter W under the data distribution D X and a perturbation radius ϵ is defined as follows:
[Equation]
where ˆ x is uniformly sampled from an ℓ 2 norm ball of x with radius ϵ , denoted as Unif ( B ( ϵ, x )) [Table]
Since our definition of the perturbation stability takes the expectation to clean and adversarial data points, it is natural to describe the average robustness of a neural network.
It can be noticed that the larger value of the perturbation stability means worse robustness in average, i.e., average robustness .
Based on the perturbation stability , we study the average robustness of neural networks under different initializations in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazytraining settings.
Generally, non-lazy training makes the analysis of neural networks intractable as DNNs in this regime cannot be simplified as a time-independent model [Chizat and Bach, 2018], and accordingly, the analysis in this regime is mainly restricted to the two-layer setting [Mei et al., 2018, 2019].
Overall, our results suggest that the width ( good ) helps average robustness in the over-parameterized regime but the depth ( bad ) can help only under certain initializations ( ugly ).
To be specific, we make the following contributions and findings under the lazy/non-lazy training regimes, see Table 1.
In the lazy training regime, the derived upper-bounds for DNNs, suggest that
• along with the increase in width, the robustness first becomes worse in the underparameterized regime and then gets better, and finally tends to be a constant in highly over-parameterized regimes, which implies the existence of phase transition.
• the depth has more complex tendency on robustness, which largely depends on the initialization and the training mode.
It can be grouped into two main classes ( cf. , Table 1): depth helps robustness in an exponential order under LeCun initialization [LeCun et al., 2012], whereas it hurts robustness in a polynomial order under He-initialization
[He et al., 2015] and under Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al., 2019].
Surprisingly, standard tools on training dynamics of neural networks [Allen-Zhu et al. , 2019, Du et al., 2018] are sufficient to obtain our bounds, which explain the relationship between robustness and the structural/architectural parameters of neural network.
Our theoretical developments improve the results by Huang et al.
[2021], Wu et al.
[2021], and are supported by empirical evidence.
In the non-lazy training regime, we derive upper-bounds for two-layer networks, suggesting that
• the width improves robustness under different initializations.
• the convergence rates of the average robustness is effected by several certain initializations.
We also derive a sufficient condition to identify when DNNs enter in this regime, as an initial but first attempt on understanding DNNs in this regime.
Our technical contribution lies in connecting robustness to changes of neural network parameters during the early stages of training, which could expand the application scope of deep learning theory beyond lazy training analysis [Jacot et al., 2018,
Allen-Zhu et al., 2019].
Notations: We use the shorthand [ n ] := { 1 , 2 , . . . , n } for a positive integer n .
We denote by a ( n ) ≲ b ( n ) : there exists a positive constant c independent of n such that a ( n ) ⩽ cb ( n ) .
The standard Gaussian distribution is N (0 , 1) with the zero-mean and the identity variance.
Uniform distribution inside the sphere is Unif ( B ( ϵ, x )) with the center x and radius ϵ .
We follow the standard Bachmann–Landau notation in complexity theory e.g., O , o , Ω , and Θ for order notation.
Related work
DNNs are demonstrated to be fragile, sensitive to adversarially chosen but undetectable noise both empirically [Szegedy et al., 2014] and theoretically [Huang et al., 2021, Bubeck and Sellke, 2021].
Adversarial training [Athalye et al., 2018, Croce and Hein, 2020, Zhang et al., 2020b] is a reliable way to obtain adversarially robust neural network.
Nevertheless, improving the overall robustness of neural networks is still an unsolved problem in machine learning, especially when coupling with initializations and parameters.
Over-parameterized neural networks under lazy/non-lazy training regimes: Modern DNNs in practice [He et al., 2016] work under the setting where the number of parameters is (much) larger than the number of training data.
Analysis of DNNs in terms of optimization [Safran et al., 2021,
Zhou et al., 2021] and generalization [Cao and Gu, 2019] has received great attention in deep learning theory [Zhang et al., 2017].
In deep learning theory, neural tangent kernel (NTK)
[Jacot et al., 2018] and mean field [Mei et al., 2018] analysis are two powerful tools for neural network analysis.
To be specific, NTK builds an equivalence between training dynamics by gradient-based algorithms of DNNs and kernel regression under a specific initialization, and thus allows for deep networks analysis [Allen-Zhu et al., 2019, Du et al., 2019a, Chen et al., 2020].
However, this way actually requires neural networks falling in a lazy training regime [Chizat et al., 2019], where neural networks are able to achieve zero training loss but the parameters change little, or even remain unchanged during training.
In contrast, mean-field theory establishes global convergence by casting network weights during training as an evolution in the space of probability distributions under some certain initialization to results [Mei et al., 2018, Chizat and Bach, 2018].
This strategy goes beyond lazy training regime, which allows for neural networks parameters changing in a constant order after training.
If neural networks parameters changes a lot after training, or even tend to infinity, then neural networks work in non-lazy training regime.
Analysis of DNNs under this setting appears intractable and challenging, so current work mainly focus on two-layer neural networks [Maennel et al., 2018,
Luo et al., 2021].
Robustness and over-parameterization Goodfellow et al.
[2015] demonstrate that adversarial learning helps robustness and reduces overfitting, and in the following, many works focus on the trace the origin and influencing factors of adversarial examples and robustness for neural network [Schmidt et al., 2018, Zhang et al., 2020a, Allen-Zhu and Li, 2022].
The relation between model capacity and robustness is empirically investigated by Madry et al.
[2018], i.e., neural network with insufficient capacity can seriously hurt the robustness.
Bubeck et al.
[2021] theoretically study the inherent tradeoff between the size of neural networks and their robustness, and they claim that over-parameterization is necessary for the robustness of two-layer neural networks.
However, some recent works propose the opposite view.
Under the lazy training regime, Huang et al. [2021] demonstrate that when over-parameterized neural networks get wider, the robustness will be hurted in a polynomial order.
At the same time, the depth hurts the robustness in an exponential order.
Wu et al.
[2021] affirm the view of Huang et al.
[2021] on the width.
However for depth, they derive a stronger bound that the robustness gets worse in a polynomial decay as depth increases, as suggested by Hassani and Javanmard [2022]: over-parameterization hurts robustness.
In addition, Gao et al.
[2019] also make a similar view: more model capacity (i.e., wider width and deeper depth) leads to the robustness of neural networks worse.
Nevertheless, we remark that, the results of Hassani and Javanmard [2022] work in a slightly different setting with Bubeck et al. [2021] on data interpolation, which requires a careful comparison.
Accordingly, we adopt a complementary view to these vast literature, provide an in-depth theoretical analysis to investigate this apparent contradiction in theory, and to close the gap as much as possible.
Problem setting
Let X ⊆ R d and Y
⊆ R o be compact metric spaces.
We assume that the training set D tr = { ( x i , y i ) } ni =1 is drawn from a unknown probability measure D on X × Y .
Its marginal data distribution is denoted by D X .
The goal of the classification task is to learn a neural network f : X → Y such that f ( x ; W ) parameterized by W is a good approximation of the label y ∈ Y corresponding to a new sample x ∈ X .
In this paper, we use the empirical risk L ( W ) =
12 n (cid:80) n i =1 ∥ f ( x i ; W ) − y i ∥ 2 2 .
Then we make the following assumptions.
Assumption 1.
We assume that the data satisfy ∥ x ∥ 2 = 1 .
Remark:
This assumption is standard in theory on over-parameterized neural networks and also commonly used in practice [Du et al., 2019b,a, Allen-Zhu et al., 2019, Oymak and Soltanolkotabi, 2020, Malach et al., 2020].
3.1 Network
We focus on the typical depth- L fully-connected ReLU neural networks admitting the width m l of the l -th hidden layer, ∀ l ∈ [ L ] ( cf. , Fig. 1):
[Equation]
where x ∈ R d , f ( x ) ∈ R o , α is the scaling factor, and ϕ = max(0 , x ) is ReLU activation function.
The neural networks parameters formulate the tuple of weight matrices W :=
{ W i } Li =1 ∈ { R m ×
d × ( R m × m )
L − 2 × R o × m } .
According to the property ϕ ( x ) =
xϕ ′ ( x ) of ReLU, we have h
i,l = D i,l W l h i,l − 1 , where D i,l is a diagonal matrix under the ReLU activation function defined as below.
Definition 2 (Diagonal sign matrix) .
For each i ∈ [ n ] , l ∈ [ L − 1] and k ∈ [ m ] , the diagonal sign matrix D i,l is defined as: ( D i,l ) k,k = 1 { ( W l h i,l − 1 ) k ≥ 0 } .
In our setting, we consider the standard Gaussian initialization with different variances that includes three typical initialization schemes in practice.
Initialization: Let m 0 =
d , m L
=
o
and m 2 = · · · = m L −
= m , we make the standard random initialization [ W l ] i,j ∼ N (0 , β 2 l ) for every ( i, j ) ∈ [ m l ] × [ m l − 1 ] and l ∈ [ L ] .
Choosing different variance, our work holds for three commonly used Gaussian initializations, i.e., LeCun initialization [LeCun et al., 2012],
He-initialization [He et al., 2015] and Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al., 2019], refer to the formal definition Table 1 in details.
3.2 Discussion on various robustness metrics
In Section 1, we have proposed the our robustness metric: perturbation stability ( cf. , Definition 1).
This metric can be viewed as an expectation of inner product of first-order approximation of adversarial risk [Madry et al., 2018] and the perturbations with uniform distribution, which measures the average robustness of the neural network.
As we mentioned before, under the same perturbation radius ϵ , smaller value of P ( f , ϵ ) implies better perturbation stability , that is better average robustness .
Previous works [Hein and Andriushchenko, 2017, Weng et al., 2018, Wu et al., 2021, Bubeck and
Sellke, 2021] use Lipschitzness to describe the robustness of the network, suggesting that smaller
Lipschitzness leads to robust models.
However, Lipschitzness is only a worst-case measure, and cannot reasonably describe the average changes of the entire dataset.
Instead, we follow the measure of Wu et al.
[2021], Dohmatob and Bietti [2022], that aims to comprehensively considers the overall distribution of the data, not only the extreme case.
Besides, the worst-case robustness can be extended to a probabilistic robustness view [Robey et al., 2022], which shares a similar spirit of our average robustness concept. Schmidt et al.
[2018] presents another definition of robustness, depending on the misclassified error of an adversarial data point. Instead, our perturbation stability measures the function value changes at the clean data point via Taylor expansion which can exclude the influence of the learning capacity of the network.
Main results
In this section, we state the main theoretical results.
Firstly, in Section 4.1 we provide the upper bound of the perturbation stability in lazy training regime for deep neural networks defined by Eq.
The sufficient condition that the neural network (2) is under non-lazy training regime is given in Section 4.2.
Finally, in Section 4.3, we provide the upper bound on the perturbation stability during early training of two-layer network under non-lazy training regime.
4.1 Upper bound of the perturbation stability of DNNs under the lazy training regime
We are now ready to state the main results under the lazy training regime.
The following theorem provides the upper bound of the perturbation stability and connects to the width, and the depth of a deep fully-connected neural network under different standard Gaussian initialization. The proof of Theorem 1 is deferred to Appendix B.
Theorem 1.
Given an L -layer neural network f defined by Eq.
(2) trained by { ( x i , y i ) }
ni
=1 satisfying Assumption 1, for the convenience of analysis, we set α = 1 and β := β 2 = · · · = β L − 1 , define a constant γ := β/ (cid:113) 2 m , then under a small perturbation ϵ , we have the following:
[Equation]
Remark: Our results cover the effect of the width and depth of neural network on robustness under various common initializations depending on γ ⪌ 1 .
Comparison with three commonly used initializations: For the initializations used in practice, our theoretical results can be mainly divided into two classes. 1) Depth helps robustness in an exponential order under LeCun initialization: our Theorem 1 implies (cid:18)(cid:113) L 3 md e − m/L 3 + (cid:112) od (cid:19) ( √ 22 )
L − 2 . 2) Depth hurts robustness in a polynomial order under He-initialization (cid:18)(cid:113)
L 3 md e − m/L 3 + (cid:112) od (cid:19) and under NTK initialization (cid:18)(cid:113) L 3 mo e − m/L 3 + 1 (cid:19) derived by Theorem 1.
When employing other initializations, robustness could be hurted in a exponential order.
Below, we elaborate on these three initalizations:
1) LeCun initialization ( γ = √ 22 ):
The order has three main parts (cid:113) L 3 md , e − m/ L 3 and ( √ 22 )
L − 2 .
Regarding the width m , the first part (cid:113) L 3 md is an increasing function of m and the second part e − m/
L 3 is a decreasing function of m .
Accordingly, in the under-parameterized region (e.g., m is small)
, (cid:113) L 3 md plays a major role, so the stability will increase as m increases.
After a critical point, e − m/
L 3 plays a major role, so the stability will decrease as m increases.
When m tends to infinity, the first term of bound tends to 0 .
Hence the perturbation stability tends to be a constant and independent with width m as the width
m tends to infinity.
That means, there exists a phase transition phenomenon between the perturbation stability and over-parameterization in terms of the width m .
Regarding the depth L , the constant γ = √ 22 implies that the third part has a faster decrease speed than the first and second part and play a major role in the tendency.
The perturbation stability of the neural network exponentially decreases with respect to the depth.
That means, for LeCun initialization, the deeper the network, the better robustness.
Nevertheless, the energy of LeCun initialization decreases as the network depth increases due to the variance β = (cid:113) 1 m and the activation function ReLU that [Table] [Table] [Table]
Our result [Table] loses half of energy every layer, which means that training deep network with LeCun initialization is very difficult.
Hence we need a trade off between robustness training difficulty regarding the network practice for LeCun initialization.
He initialization and NTK initialization ( γ = 1 ): the bounds for these two initializations are almost the same, and only differ in the feature dimension.
We can see that phase transition phenomena exist under these two initializations regarding the width m , similar to LeCun initialization.
Regarding the depth, when L is large, the first part √ L 3 plays a major role in the perturbation stability .
So these two initializations hurt the robustness of the neural network at a polynomial order.
All of the three initializations admit γ ≤ 1 .
If some initialization schemes admit γ > 1 , then the depth L will hurt robustness of the neural network at an exponentially increasing rate.
Comparison with previous work: Theorem 1 provides a new relationship between the robustness with width and depth of DNNs.
We compare our result with [Wu et al., 2021, Huang et al., 2021] using a basic NTK initialization [Allen-Zhu et al., 2019]
(suppose that m ≫ o and m ≫ d ).
For better comparison, we derive their results under our robustness metric perturbation stability , reported by Table 2.
Our results indicate a behavior transition on the width.
For the over-parameterized regime, the robustness of neural network only depends on the perturbation energy, and it is almost independent of the width m .
The results on width are significantly better than the previous results increasing as the square root of m .
For depth L , our results provide a tighter and more precise estimate as compared to [Wu et al., 2021] in a two-degree polynomial increasing order and [Huang et al., 2021] in an exponential increasing order. Furthermore, compared with the results of Bubeck et al. [2021] showing that the robustness of the two-layer neural network becomes better with the increase of the number of neurons (i.e., width), we provide more detailed and refined results on the robustness of DNNs under different initializations and under-parameterized regimes.
4.2 Sufficient condition for neural network under non-lazy training regime
Beyond the lazy training regime, we turn our attention to the non-lazy training regime and provide a sufficient condition for a (well-chosen) initialization of neural networks when entering into the non-lazy training regime.
This is a first attempt to understanding training dynamics of DNNs in this regime.
Our result requires a further assumption on the data and the empirical risk as follows.
Assumption 2.
For a single-output network defined in Eq.
(2) , we assume that max i ∈
[ n ] y i ≥ C 1 >for some constant C 1 .
We also assume that the neural network can be well-trained such that the empirical risk is O ( 1 n ) .
Remark:
This is a common assumption in the field of optimization [Song et al., 2021] in the underand over-parameterized regime, and we can even assume zero risk.
Here we follow the specific assumption of Luo et al.
Now we are ready to present our result: a sufficient condition to identify when deep ReLU neural networks fall into non-lazy training regime, as a promising extension of Luo et al.
[2021] on two-layer neural networks.
To avoid cluttering the analysis, we assume a single-output i.e., o = 1 .
The proof of Theorem 2 is deferred to Appendix C.
Theorem 2.
Given an L -layer neural network f defined by Eq.
(2) with o = 1 , trained by { ( x i , y i ) } ni =1 , under Assumptions 1 and 2, suppose that α ≫ ( m 3 / 2 (cid:80) Li =
1 β i ) L and m ≫ d in Eq.
(2) , then for sufficiently large m , with probability at least 1 − ( L − 2) exp( − Θ( m 2 ))
− exp( − Θ( md )) − exp( − Θ( m )) over the initialization, we have:
[Equation]
Remark:
The condition α ≫ ( m 3 / 2 (cid:80) Li =
1 β i )
L implies that, a neural network falls in a non-lazy training regime when the variance of the Gaussian initialization is very small.
It can be achieved by a typical case: taking m ≫ L 2 , choosing α = 1 and ∀ l ∈ [ L ]; β l = 1 m 2 .
Commonly used initializations such as NTK initialization, LeCun initialization, He’s initialization lead to lazy training.
4.3 Upper bound of the perturbation stability for two-layer networks in non-lazy training
Unlike lazy training, weights of non-lazy training concentrate on few directions determined by the input data in the early stages of training [Luo et al., 2021].
The following theorem describes the neural network perturbation stability in the early training stage as a function of network width in the non-lazy training regime.
For ease of description, here we consider a special initialization scheme under the non-lazy regime, the proof of Theorem 3 is deferred to Appendix D.
Theorem 3.
Given a two-layer neural network with single output f t defined by Eq.
(2) and trained by { ( x i , y i ) } ni =1 satisfying Assumption 1, using gradient descent under the squared loss, consider the following initialization in Eq.
L = 2 , α ∼ 1 , β 1 ∼ β 2 ∼ β ∼ 1 m c with c ≥ 1 . 5 , m ≫ nand training time less than a constant that only depends on n, m and λ 0 , then for a small range of perturbation ϵ , with probability at least 1 − n exp( − n 2 ) − 3 n over initialization, we have the following:
[Equation]
Remark: Under this setting of non-lazy training regime, the robustness and width of the neural network are positively correlated in the early stages of training.
That is, as the width m increases in the over-parameterized regime, a Gaussian initialization with smaller variance leads to the robustness increasing in a faster decay.
Our result holds for other initialization schemes in the non-lazy training regime, e.g., c = 2 leads to P ( f t , ϵ ) /ϵ
≤ Θ
[Equation]
n
[Equation]
m + n m
[Equation]
[Equation]
; and c = 3 leads to P ( f t , ϵ ) /ϵ
≤ Θ
[Equation]
Numerical evidence
We validate our theoretical results with a series of experiments.
In Section 5.2 we first verify that our initialization settings belong in the lazy and the non-lazy training regimes.
In Section 5.3, we then explore the effect of varying widths from under-parameterized to over-parameterized regions on the perturbation stability of neural networks.
In Section 5.4, we finally compare the effect of two different initializations and the network depth on the perturbation stability .
Additional experimental results can be found in Appendix E.
5.1 Experimental settings
Here we present our experimental setting including models, hyper-parameters, the choice of width and depth, and initialization schemes.
We use the popular datasets of MNIST [Lecun et al., 1998] and CIFAR-10 [Krizhevsky et al., 2014] for experimental validation.
Models: We report results using the following models: fully connected ReLU neural network named “FCN” in main paper and convolutional ReLU neural network named “CNN” in Appendix E.
Hyper-parameters: Unless mentioned otherwise, all models are trained for 50 epochs with a batch size of 64 .
The initial value of the learning rate is 0 .
After the first 25 epochs, the learning rate is [Figure] L=
[Figure]
Lazy [Figure]
Width and depth: In order to verify our theoretical results, we conduct a series of experiments with different depths and widths of the same type neural network.
Specifically, our experiments includedifferent widths from 2 4 to 2 14 , and four different choices of depths, i.e., 2 , 4 , 6 , 8 , 10 .
Initialization: We report results using the following initializations: 1) He initialization where
W ij ∼ N (0 , 2 m in ), 2) LeCun initialization where W ij ∼ N (0 , 1 m in ) and 3)
An initialization allows for non-lazy training regime on two-layer networks, i.e., β 1 = β 2 = 1 /m 2 and α = 1 .
5.2 Validation for lazy and non-lazy training regimes
Before verifying our results, we need identify the lazy and non-lazy training regime under different initializations.
To this end, we define a measure lazy training ratio , i.e., κ = (cid:80)
[Equation]
to measure whether the neural network is under the lazy training regime.
A smaller κ implies that the neural network is more close to lazy training.
According to the theory, we employ the He initialization and the non lazy training initialization we state in Section 5.1 to conduct the experiment under two-layer neural networks to verify that their lazy training ratio matches the theoretical results of lazy training and non-lazy training (i.e. the experiment is under the correct regime).
Fig. 2(a) and Fig.
2(b) show the tendency of ratio with respect to time (training epochs) and relationship between width and lazy training ratio of neural networks under lazy training regime, respectively.
We can find that the ratio of lazy traing regime is almost a constant that does not change with time, and this constant decreases with the width of network increases.
This is in line with what we know about lazy training [Chizat et al., 2019].
Likewise, Fig. 3 shows the ratio tendency with time and width under non-lazy training regime.
The ratio increases almost linearly over time in Fig. 3(a).
In epoch 25 we decrease the learning rate, which results in the increase rate of κ changes.
At the same time Fig. 3(b) shows the similar tendency between width and lazy training ratio as lazy training.
However, the value of κ is much higher than that of lazy training regime.
Combining the results about tendency with time, the ratio will be expected to increase as time at a slow decay and tend to infinity under highly wide width setting.
5.3 Validation for width
We verify the relationship between the perturbation stability and the width of network as illustrated by Eqs.
(3) and (4).
We conduct a series of experiments on MNIST dataset using FCN with different widths.
Fig.
4 shows the relationship between the perturbation stability and width of FCN with different depths and training regimes.
Here for lazy training and non-lazy training we use the same initialization as Section 5.2.
Fig. 4(a) exhibits the relationship between the perturbation stability and the width for neural networks with different depths of L = 2 , 4 , 6 , 8 , and 10 .
All of the five curves show the phase transition with width, and the perturbation stability first increases and then decreases with width, which match our [Figure] [Figure]
[Figure] theoretical results. Fig. 4(b) shows the difference of the effect of width on the perturbation stability of lazy and non-lazy training for two-layer neural networks.
First, the perturbation stability of non-lazy training is significantly smaller than that of lazy training, which means non-lazy training regime is more robust.
Besides, the perturbation stability of non-lazy training decrease with the width of the neural network increases, which coincides with our theoretical result, i.e., no phase transition phenomenon.
5.4 Validation for depth and initialization
Let us explore the effect of depth on the perturbation stability under lazy training regime with different initializations in Fig.
5(a) and Fig.
5(b).
Our results show the tendency of the perturbation stability for
FCN with different widths and depths under He initialization and LeCun initialization, respectively.
We observe a similar phase transition phenomenon, and find that, the perturbation stability under He initialization increases with depth, while the LeCun initialization shows the opposite tendency, which verified our theory.
Conclusions
In this work, we explore the interplay of the width, the depth and the initialization of neural networks on their average robustness with new theoretical bounds in an effort to address the apparent contradiction in the literature.
Our theoretical results hold in both under- and over-parameterized regimes.
Intriguingly, we find a change of behavior in average robustness with respect to the depth, initially exacerbating robustness and then alleviating it.
We suspect that this could help explain the contradictory messages in the literature.
We also characterize the average robustness in the non-lazy training regime for two layer neural networks and find that width always help, coinciding the with [Figure] [Figure] [Figure]
[Figure]
S t a b ili t y [Figure] (a) [Figure]
(b) the results [Bubeck and Sellke, 2021, Bubeck et al., 2021].
We also provide numerical evidence to support the theoretical developments.
Acknowledgements
We are also thankful to the reviewers for providing constructive feedback.
Research was sponsored by the Army Research Office and was accomplished under Grant Number W911NF-19-1-0404.
This work was supported by Hasler Foundation Program: Hasler Responsible AI (project number 21043).
This work was supported by SNF project - Deep Optimisation of the Swiss National
Science Foundation (SNSF) under grant number 200021_205011.
This work was supported by Zeiss.
This project has received funding from the European Research Council (ERC) under the European
Union’s Horizon 2020 research and innovation programme (grant agreement n° 725594 - time-data).
Corresponding authors: Fanghui Liu and Zhenyu Zhu.