Robustness in deep learning: The width (good), the depth (bad), and the initialization (ugly)
Anonymous Author(s)
AffiliationAddress
Abstract
We study the average robustness notion in deep neural networks in (selected) wideand narrow, deep and shallow, as well as lazy and non-lazy training settings.
Weprove that in the under-parameterized setting, width has a negative effect whileit improves robustness in the over-parameterized setting.
The effect of depthclosely depends on the initialization and the training mode.
In particular, wheninitialized with LeCun initialization, depth helps robustness with lazy trainingregime.
In contrast, when initialized with Neural Tangent Kernel (NTK) and Heinitialization, depth hurts the robustness.
Moreover, under non-lazy training regime,we demonstrate how the width of a two-layer ReLU network benefits robustness.
Our theoretical developments improve the results by Huang et al. [2021], Wu et al.[2021] and are consistent with Bubeck and Sellke [2021], Bubeck et al.
Introduction
It is now well-known that deep neural networks (DNNs) are susceptible to adversarially chosen,albeit imperceptible perturbations to their inputs [Goodfellow et al., 2015, Szegedy et al., 2014].
Thislack of robustness is worrying as DNNs are now deployed in many real-world applications [Eykholtet al., 2018].
As a result, new algorithms are more and more being developed to defend againstadversarial attacks to improve the DNN robustness.
Among the current defense methods, the mostcommonly used and arguably the most successful method is adversarial training based minimaxoptimization [Athalye et al., 2018, Croce and Hein, 2020, Madry et al., 2018].
The literature focuses on several aspects of the robustness issue, from algorithms to their initializationas well as from width of neural networks to their depth (i.e., the architecture).
On the practical side,
Madry et al.
[2018] advocate that adversarial training requires more parameters (e.g., width) forbetter performance in minimax optimization, which would fall into the so-called over-parameterizedregime 1 [Zhang et al., 2021].
On the theory side, recent works suggest that over-parameterizationmay damage the adversarial robustness [Huang et al., 2021, Wu et al., 2021, Zhou and Schoellig,2019].
In stark contrast, Bubeck and Sellke [2021], Bubeck et al.
[2021] argue that the robustness of
DNNs needs enough parameters to be guaranteed.
Our work is motivated to investigate this apparent contradiction in theory, and to close the gap asmuch as possible.
We begin with a definition of perturbation stability of DNNs, which can be usedto describe the robustness, following the spirit of Wu et al.
[2021], Dohmatob and Bietti [2022].
Mathematically, [Table] Definition 1 ( perturbation stability ) . The perturbation stability of the neural network f under datadistrubution D X and perturbation radius ϵ is defined as follows:
[Equation]
[Equation] where ˆ x is uniformly sampled from an ℓ 2 norm ball of x with radius ϵ , denoted as Unif ( B ( ϵ, x )) .
Since our definition of perturbation stability takes the expectation to clean and adversarial data points,it is natural to describe average robustness of neural network. It can be noticed that the larger valueof perturbation stability means worse average robustness .
Based on perturbation stability
[Table]
we study the average robustness of neural networks under differentinitializations in (selected) wide and narrow, deep and shallow, as well as lazy and non-lazy 2 trainingsettings.
Generally, non-lazy training makes the analysis of neural networks intractable as DNNsin this regime cannot be simplified as a time-independent model [Chizat and Bach, 2018], andaccordingly, the analysis in this regime is mainly restricted to the two-layer setting [Mei et al., 2018,2019].
Overall, our results suggest that the width ( good ) helps robustness in the over-parameterized regimebut the depth ( bad ) can help only under certain initializations ( ugly ).
To be specific, we make thefollowing contributions and findings under the lazy/non-lazy training regimes, see Table 1.
In the lazy training regime, we derive upper-bounds, suggesting that
• along with the increase in width, the robustness first becomes worse in the under-
parameterized setting and then gets better, and finally tends to be a constant in highly
over-parameterized regions, which implies the existence of phase transition.
• the depth has more complex tendency on robustness , which largely depends on the initial-
ization and the training mode.
It can be grouped into two main classes ( cf. , Table 1): depthhelps robustness in an exponential order under LeCun initialization [LeCun et al., 2012],
whereas it hurts robustness in a polynomial order under He-initialization
[He et al., 2015] and under Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al., 2019a].
Surprisingly, standard tools on training dynamics of neural networks [Allen-Zhu et al., 2019a, Duet al., 2018a] are sufficient to obtain our bounds, which explain the relationship between robustnessand the structural/architectural parameters of neural network.
Our theoretical developments improve the results by Huang et al.
[2021], Wu et al.
[2021], and are supported by empirical evidence.
In the non-lazy training regime, we derive upper-bounds for two-layer networks, suggesting that
• the width improves robustness under different initializations
We also derive a sufficient condition to identify when DNNs enter in this regime, as an initial butfirst attempt on understanding DNNs in this regime.
Our technical contribution lies in connectingrobustness to changes of neural network parameters during the early stages of training, which couldexpand the application scope of deep learning theory beyond lazy training analysis [Jacot et al., 2018,
Allen-Zhu et al., 2019b].
Notations:
We use the shorthand [ n ] := { 1 , 2 , . . . , n } for some positive integer n .
We denote by a ( n ) ≲ b ( n ) :there exists a positive constant c independent of n such that a ( n ) ⩽ cb ( n ) .
The standard Gaussiandistribution is N ( 0 , 1) with the zero-mean and the identity variance.
Uniform distribution inside thesphere is Unif ( B ( ϵ, x )) with the center x and radius ϵ .
We follow the standard Bachmann–Landaunotation in complexity theory e.g., O , o , Ω , and Θ for order notation.
Related work
DNNs are demonstrated to be fragile, sensitive to adversarially chosen but undetectable noise bothempiricallySzegedy et al.
[2014] and theoretically Huang et al.
[2021], Bubeck and Sellke [2021].
Adversarial training [Athalye et al., 2018, Croce and Hein, 2020, Zhang et al., 2020b] is a reliableway to obtain adversarially robust neural network.
Nevertheless, improving the overall robustnessof neural networks is still an unsolved problem in machine learning, especially when coupling withinitializations and parameters.
Over-parameterized neural networks under lazy/non-lazy training regimes: Modern DNNs inpractice
[He et al., 2016] work under the setting where the number of parameters is (much) largerthan
the number of training data.
Analysis of DNNs in terms of optimization [Safran et al., 2021,
Zhou et al., 2021] and generalization [Cao and Gu, 2019] has received great attention in deep learningtheory [Zhang et al., 2021], and further brings in new insights, e.g., double descent [Hassani and
Javanmard, 2022], implicit bias [You et al., 2020].
In deep learning theory, neural tangent kernel (NTK) Jacot et al.
[2018] and mean field analysis aretwo powerful tools for neural network analysis.
To be specific, NTK builds an equivalence betweentraining dynamics by gradient-based algorithms of DNNs and kernel regression under a specificinitialization, and thus allows for deep networks analysis [Allen-Zhu et al., 2019a, Du et al., 2019,
Chen et al., 2020].
However, this way actually requires neural networks falling in a lazy trainingregime
[Chizat et al., 2019], where neural networks are able to achieve zero training loss but theparameters change little, or even remain unchanged during training.
In contrast, mean-field theoryestablishes global convergence by casting network weights during training as an evolution in thespace of probability distributions under some certain initialization to results [Mei et al., 2018, Chizatand Bach, 2018].
This strategy goes beyond lazy training regime, which allows for neural networksparameters changing in a constant order after training.
If neural networks parameters changes a lot after training, or even tend to infinity, then neuralnetworks work in non-lazy training regime.
Analysis of DNNs under this setting appears intractableand challenging, so current work mainly focus on two-layer neural networks [Maennel et al., 2018,
Luo et al., 2021].
Robustness and over-parameterization Goodfellow et al.
[2015] demonstrate that adversariallearning helps robustness and reduces overfitting, and in the following, many works focus on the tracethe origin and influencing factors of adversarial examples and robustness for neural network [Schmidtet al., 2018b, Zhang et al., 2020a, Allen-Zhu and Li, 2022].
The relation between model capacity androbustness is empirically investigated by Madry et al.
[2017], i.e., neural network with insufficientcapacity can seriously hurt the robustness.
Bubeck et al.
[2021] theoretically study the inherent tradeoff between the size of neural networks and their robustness, and they claim that over-parameterizationis necessary for the robustness of two-layer neural networks.
However, some recent works propose the opposite view.
Under the lazy training regime, Huang et al.[2021] demonstrate that when over-parameterized neural networks get wider, the robustness will behurted in a polynomial order.
At the same time, the depth hurts the robustness in an exponentialorder.
Wu et al.
[2021] affirm the view of Huang et al.
[2021] on the width.
However for depth, they derive a stronger bound that the robustness gets worse in a polynomial decay as depth increases.
Inaddition, Gao et al.
[2019] also make a similar view: more model capacity (i.e., wider width anddeeper depth) leads to the robustness of neural networks worse.
These contradict the previous resultsin theoretical and experimental.
In this work, we adopt a complementary view to these vast literature.
We provide an in-depth theoretical analysis to investigate this apparent contradiction in theory, and toclose the gap as much as possible.
Problem setting
Let X ⊆ R d and Y
⊆ R o be compact metric spaces.
We assume that the training set D tr ={ ( x i , y i ) } ni =1 with data dimension x ∈ R d and label dimension
y ∈ R o is drawn from a probabilitymeasure D on X × Y .
Its marginal data distribution is denoted by D X .
The goal of the classificationtask is to find a neural network f : X → Y such that f ( x ; W ) parameterized by W is a goodapproximation of the label y ∈ Y corresponding to a new sample x ∈ X .
In this paper, we use theempirical risk L ( W ) =
12 n (cid:80) ni =1 ∥ f ( x i ; W ) − y i ∥ 22 .
Then we make the following assumptions.
Assumption 1.
We assume that the data satisfy ∥ x ∥ 2 = 1 .
Remark:
This is a standard assumption in theory on over-parameterized neural networks and itis also commonly used in practice.
[Du et al., 2018b, 2019, Allen-Zhu et al., 2019a, Oymak and
Soltanolkotabi, 2020, Malach et al., 2020].
3.1 Network
We focus on the typical depth- L fully-connected ReLU neural networks with the width of the l -thhidden layer m l , ∀ l ∈ [ L ] ( cf. , Fig. 1):
[Equation]
n ] , (2) where the x ∈ R d , f ( x ) ∈ R o , α is the scaling factor, weights W :=
{ W i } Li =1 ∈ { R m ×
d ×( R m × m )
L − 2 × R o × m } represent the tuple of weight matrices and ϕ = max(0 , x ) is ReLU activationfunction.
According to the property ϕ ( x ) =
xϕ ′ ( x ) of ReLU, we have h
i,l = D i,l W l h i,l − 1 , where
D i,l is a diagonal matrix under the ReLU activation function defined as below.
Definition 2 (Diagonal sign matrix) .
For each i ∈ [ n ] , l ∈ [ L − 1] and k ∈ [ m ] , the diagonal signmatrix D i,l is defined as: ( D i,l ) k,k = 1 { ( W l h i,l − 1 ) k ≥ 0 } .
Initialization: Let m 0 =
d , m L
=
o
and m 2 = · · · = m L −
= m , we make the standard randominitialization [ W l ] i,j ∼ N (0 , β 2 l ) for every ( i, j ) ∈ [ m l ] × [ m l − 1 ] and l ∈ [ L ] .
This work holdsfor three commonly used Gaussian initializations, i.e., LeCun initialization [LeCun et al., 2012],
He-initialization [He et al., 2015] and Neural Tangent Kernel (NTK) initialization [Allen-Zhu et al.
,2019a].
The formulation of these intilization refer to Table 1.
3.2 Discussion on various robustness metrics
In Section 1, we have proposed the our robustness metric: perturbation stability ( cf. , Definition 1).
Thismetric can be viewed as an expectation of inner product of first-order approximation of adversarialrisk [Madry et al., 2017] and the perturbations with uniform distribution, which measures the averagerobustness of the neural network.
As we mentioned before, under the same perturbation radiusϵ , smaller value of P ( f , ϵ ) implies better perturbation stability , that is better average robustness .
Previous works [Hein and Andriushchenko, 2017, Weng et al., 2018, Wu et al., 2021, Bubeck and
Sellke, 2021] use Lipschitzness to describe the robustness of the network, suggesting that smaller
Lipschitzness leads to robust models.
However, Lipschitzness is only a worst-case measure, andcannot reasonably describe the average changes of the entire dataset.
Instead, we follow the measureof Wu et al.
[2021], Dohmatob and Bietti [2022], that aims to comprehensively considers the overalldistribution of the data, not only the extreme case.
Compared with the definition of robustnessin Schmidt et al.
[2018a] relies on the misclassified error of an adversarial data point, our perturbationstability measures the function value changes at the clean data point via Taylor expansion which canexclude the influence of the learning capacity of the network.
Main results
In this section, we state the main theoretical results.
Firstly, in Section 4.1 we provide the upperbound of perturbation stability in lazy training regime for deep neural networks defined by Eq.
The sufficient condition that the neural network Eq.
(2) is under non-lazy training regime is givenin Section 4.2.
Finally, in Section 4.3, we provide the upper bound on perturbation stability duringearly training of two-layer network under non-lazy training regime.
The proofs of our theoreticalresults are deferred to Appendix B, C, and D, respectively.
4.1 Upper bound of perturbation stability of DNNs under the lazy training regime
We are now ready to state the main results under the lazy training regime.
The following theoremprovides the upper bound of perturbation stability and connects to depth and width of network anddimension of data for a deep fully-connected neural network under standard Gaussian initialization.
Theorem 1.
Given an L -layer neural network f defined by Eq.
(2) trained by { ( x i , y i ) } ni =1 satisfying Assumption 1, for the convenience of analysis, we set α = 1 and β := β 2 = · · · = β L − 1 , definea constant γ := β/ (cid:113) 2 m , then under a small perturbation ϵ , we have the following:
[Equation]
Remark: Our results cover the effect of the width and depth of neural network on robustness undervarious common initializations depending on γ ⪌ 1 .
For the initializations used in practice, our theoretical results can be mainly divided into two classes.1) Depth helps robustness in an exponential order under LeCun initialization: our Theorem 1implies (cid:18)(cid:113) πL 3 m 8 d e − m/L 3 + 1 (cid:19) ( √ 22 )
L − 2 ; 2) Depth hurts robustness in a polynomial order under Heinitialization (cid:18)(cid:113) πL 3 m 2 d e − m/
L 3 + 1 (cid:19) and under NTK initialization (cid:18)(cid:113) πL 3 m 4 o e − m/L 3 + 1 (cid:19) derivedby Theorem 1.
When employing other initializations, robustness could be hurted in a exponentialorder.
Below, we elaborate on these three initalizations:
• LeCun initialization ( γ = √ 22 ):
The order has three main parts (cid:113) πL 3 m 8 d , e − m/L 3 and( √ 22 )
L − 2 .
The first two parts implies a phase transition phenomenon between perturbation
stability and over-parameterization for the width m .
Concretely, (cid:113) πL 3 m 8 d is an increasing
function with respect to m and e − m/
L 3 is a decreasing function with respect to m .
In the
under-parameterized region ( m is small)
, (cid:113) L 3 md plays a major role, so the stability will
increase as m increases .
After a critical point, e − m/
L 3 plays a major role, so the stability
will decrease as m increases .
When m tends to infinity, the first term of bound tends to
Hence the perturbation stability tends to be a constant and independent with width m
as the width m tends to infinity.
However, for depth L , it holds that γ = √ 22 .
So the
third part has the faster increase/decrease speed than the first and second part and play a
major role in the tendency.
The perturbation stability of the neural network exponentially
decreases with respect to the depth.
That means that for LeCun initialization, the deeper the
network, the better robustness .
Nevertheless, the energy of LeCun initialization decreases
with the increase of network depth, which means that training deep network with LeCun
initialization is very difficult.
Hence we need a trade off between robustness and training
difficulty regarding network depth in practice for LeCun initialization.
• He initialization and NTK initialization ( γ = 1 ): here the bounds only have the first two
parts.
From this, it is easy to see that for the network width m , the two initializations have
similar phase transition phenomena with LeCun initialization.
Regarding to the depth, whenL is large, the first part √ L 3 plays
a major role in the perturbation stability .
So these twoinitializations hurt the robustness of the neural network polynomially.•
In addition, if the initialization admits γ ≥ 1 , then the depth L of network will exponentiallyhurt robustness of the neural network.
Comparison with previous work: Theorem 1 provides a new relationship between the robustnesswith width and depth of DNNs.
We compare our result with [Wu et al., 2021, Huang et al., 2021] using a basic NTK initialization Allen-Zhu et al.
[2019a] (suppose that m ≫ o and m ≫ d ).
Forbetter comparison, we derive their results under our robustness metric perturbation stability , reportedby Table 2.
[Table]
[Table]
[Table]
[Equation]
[Table]
[Equation]
Our results indicate a behavior transition on the width.
For the over-parameterized regime, therobustness of neural network only depends on the perturbation energy, and it is almost independent of the width m . The results on width are significantly better than the previous as the square root of m . depth L our a
4.2 Sufficient condition for neural network under non-lazy training regime
Beyond the lazy training regime, we turn our attention to non-lazy training regime and present resultsabout the sufficient condition for (well-chosen) initialization of neural networks when entering intothe non-lazy training regime.
This is a first attempt to understanding training dynamics of DNNs inthis regime.
Our result requires a further assumption on the data and the empirical risk as follows.
Assumption 2.
For a single-output network defined in Eq.
(2) , we assume that max i ∈
[ n ] y i ≥ C 1 ≥ 0 .
We also assume that the neural network can be well-trained such that the empirical risk is O ( 1 n ) .
Remark:
This is a common assumption in the field of optimization [Song et al., 2021] in the underand over-parameterized regime, and we can even assume zero risk.
Here we follow the specificassumption of Luo et al.
Now we are ready to present our result, a sufficient condition to identify when deep ReLU neuralnetworks fall into non-lazy training regime, as a promising extension of Luo et al.
[2021] on two-layerneural networks.
To avoid cluttering the analysis, we consider a single-output i.e., o = 1 .
Theorem 2.
Given an L -layer neural network f defined by Eq.
(2) with one-dimensional output,trained by { ( x i , y i ) } ni =1 satisfy Assumptions 1 and 2.
Suppose that α ≫ ( m 3 / 2 (cid:80) Li =1 β i )
L andm ≫ d in Eq.
(2) , then for sufficiently large m , with probability at least 1 − ( L − 2) exp( − Θ( m 2 )) −exp
( − Θ( md )) − exp( − Θ( m )) over the initialization, we have:
[Equation]
Remark:
The condition α ≫ ( m 3 / 2 (cid:80) Li =
1 β i )
L implies that, a neural network falls in a non-lazytraining regime when the variance of the Gaussian initialization is very small.
A typical case is,taking m ≫ L 2 , choosing α = 1 and ∀ l ∈
[ L ]; β l = 1 m 2 .
Commonly used initializations such as
NTK initialization, LeCun initialization, He’s initialization lead to lazy training.
4.3 Upper bound of perturbation stability for two-layer networks in non-lazy training
Unlike lazy training, weights of non-lazy training concentrate on few directions determined bythe input data in the early stages of training.
The following theorem describes the neural networkperturbation stability in the early training stage as a function of network width in the non-lazy trainingregime.
For ease of description, here we consider a special initialization scheme under the non-lazyregime, more cases under this theorem and proof are deferred to the Appendix D.
Theorem 3.
Given a two-layer neural network f defined by Eq.
(2) and trained by { ( x i , y i ) } ni = 1satisfying Assumption 1, using gradient descent under the squared loss, consider the followinginitialization in Eq.
L = 2 , α ∼ 1 , β 1 ∼ β 2 ∼ β ∼ 1 m c with c ≥ 1 . 5 , m ≫ n 2 andt ≤ t ⋆ ( n, m, α ) , then for a small range of perturbation ϵ , with probability at least 1 − n exp( − n 2 ) − 3 nover initialization, we have the following:
[Equation]
Remark: Under this setting of non-lazy training regime, the robustness and width of the neuralnetwork are positively correlated in the early stages of training.
That is, as the width m increasesin the over-parameterized regime, a Gaussian initialization with smaller variance results in therobustness increasing in a faster decay.
Our result holds for other initialization schemes in thenon-lazy training regime, e.g., c = 2 leads to P ( f t , ϵ ) /ϵ
≤ Θ [Equation] m [Equation]
n m
[Equation]
; and c = 3 leads to P [Equation] f t , ϵ ) /
[Equation] ≤ Θ [Equation]
Numerical evidence
We validate our theoretical results with a series of experiments.
In Section 5.2 we first verify thatour initialization settings belong in the lazy and the non-lazy training regimes.
In Section 5.3, wethen explore the effect of varying widths from under-parameterized to over-parameterized regions onthe perturbation stability of neural networks.
In Section 5.4, we finally compare the effect of twodifferent initializations and the network depth on the perturbation stability .
Additional experimentalresults can be found in Appendix E.
5.1 Experimental settings
Here we present our experimental setting including models, hyper-parameters, the choice of widthand depth, and initialization schemes.
We use the popular datasets of MNIST [Lecun et al.
1998]and CIFAR-10 [Krizhevsky et al., 2014] for experimental validation.
Models: We report results using the following models: fully connected ReLU neural network named“FCN” in main paper and convolutional ReLU neural network named “CNN” in Appendix E.
Hyper-parameters: Unless mentioned otherwise, all models are trained for 50 epochs with a batchsize of 64 .
The initial value of the learning rate is 0 .
After the first 25 epochs, the learning rate ismultiplied by a factor of 0 .
1 every 10 epochs.
The SGD is used to optimize all the models, while thecross-entropy loss is used.
Width and depth: In order to verify our theoretical results, we conduct a series of experiments withdifferent depths and widths of the same type neural network.
Specifically, our experiments include 11different widths from 2 4 to 2 14 , and four different choices of depths, i.e., 2 , 4 , 6 , 8 , 10 .
Initialization: We report results using the following initializations: 1) He initialization where
W ij ∼ N (0 , 2 m in ), 2) LeCun initialization where W ij ∼ N (0 , 1 m in ) and 3)
An initialization allowsfor non-lazy training regime on two-layer networks, i.e., β 1 = β 2 = 1 /m 2 and α = 1 .
5.2 Validation for lazy and non-lazy training regimes
Before verifying our results, we need identify the lazy and non-lazy training regime under differentinitializations.
To this end, we define a measure lazy training ratio , i.e., κ = (cid:80) Ll =1 ∥ W l ( t ) − W l (0) ∥ F (cid:80) Ll =1 ∥ W l (0)
∥
F tomeasure whether the neural network is under the lazy training regime.
A smaller κ implies that theneural network is more close to lazy training.
According to the theory, we employ He initialization and non lazy training initialization we statein Section 5.1 then conduct the experiment under two-layer neural networks to verify that their lazytraining ratio matches the theoretical results of lazy training and non-lazy training (i.e. the experimentis under the correct regime).
Fig. 2(a) and Fig.
2(b) show the tendency of ratio with respect to time(training epochs) and relationship between width and lazy training ratio of neural networks underlazy training regime, respectively.
We can find that the ratio of lazy traing regime is almost a constant
[Figure] Fig ratio recognized [Figure] that does not change with time, and this constant decreases with the width of network increases.
Thisis in line with what we know about lazy training [Chizat et al., 2019]
Likewise, Fig. 3 shows the ratio tendency with time and width under non-lazy training regime.
Theratio increases almost linearly over time in Fig. 3(a).
In epoch 25 we decrease the learning rate,which results in the increase rate of κ changes.
At the same time Fig. 3(b) shows the similar tendencybetween width and lazy training ratio as lazy training.
However, the value of κ is much higherthan that of lazy training regime.
Combining the results about tendency with time, the ratio will beexpected to increase as time at a slow decay and tend to infinity under highly wide width setting.
5.3 Validation for width
We verify the relationship between the perturbation stability and the width of network as illustratedby Eqs.
(3) and (4).
We conduct a series of experiments on MNIST dataset using FCN with differentwidths.
Fig.
4 shows the relationship between perturbation stability and width of FCN with differentdepths and training regimes.
Here for lazy training and non-lazy training we use the same initializationas Section 5.2.
Fig. 4(a) exhibits the relationship between the perturbation stability and the width for neural networkswith different depths of L = 2 , 4 , 6 , 8 , and 10 .
All of the five curves show the phase transition withwidth, and the perturbation stability first increases and then decreases with width, which match ourtheoretical results.
Fig. 4(b) shows the difference of the effect of width on the perturbation stability oflazy and non-lazy training for two-layer neural networks.
First, the perturbation stability of non-lazytraining is significantly smaller than that of lazy training, which means non-lazy training regimeis more robust.
Besides, the perturbation stability of non-lazy training decrease with the width ofthe neural network increases, which coincides with our theoretical result, i.e., no phase transitionphenomenon. [Figure] [Figure]
5.4 Validation for depth and initialization
Here we explore the effect of depth on perturbation stability under lazy training regime with differentinitializations in Fig.
5(a) and Fig.
5(b).
Our results show the tendency of perturbation stability for FCN with different widths and depths under He initialization and LeCun initialization, respectively
[Figure]
We observe a similar phase transition phenomenon, and find that, the perturbation stability under Heinitialization increases with depth, while the LeCun initialization shows the opposite tendency, whichverified our theory.
Conclusions
In this work, we explore the interplay of the width, the depth and the initialization of neural networks on their average robustness with new theoretical bounds in an effort to address the apparentcontradiction in the literature.
Our theoretical results hold in both under- and over-parameterizedregimes.
Intriguingly, we find a change of behavior in average robustness with respect to the depth,initially exacerbating robustness and then alleviating it.
We suspect that this could help explain thecontradictory messages in the literature.
We also characterize the average robustness in the non-lazytraining regime for two layer neural networks and find that width always help, coinciding the withthe results [Bubeck and Sellke, 2021, Bubeck et al., 2021].
We also provide numerical evidence tosupport the theoretical developments.
In addition, since robustness can be linked to flatness [Petzkaet al., 2021], studying flatness under different architecture settings could be a promising direction tocomprehensively understand flatness, robustness, and generalization.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] We clearly discuss the limitation
of this work in the Appendix F.
(c) Did you discuss any potential negative societal impacts of your work?
[Yes]
We clearly
discuss the societal impact of this work in the Appendix G.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes] We havedetailed the rationale of the applied assumptions in this paper.
(b) Did you include complete proofs of all theoretical results?
[Yes] We include the
complete proofs of our theoretical results.
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[No] The datasets weuse in this work are all in the public domain and standard for image-related tasks.
Thus, our setup can be reproduced by interested practitioners.
The code will be open-sourced
upon the acceptance of the paper.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes] Our experiments are mainly for validation our theory, all of the
settings and hyper-parameters are mentioned in the main paper.
(c) Did you report error bars (e.g., with respect to the random seed after running experi-
ments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e.g., type
of GPUs, internal cluster, or cloud provider)?
[Yes] All our experiments are conducted
on a single GPU in our internal cluster.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes] We cite all the
corresponding papers that provide the assets we use.
(b) Did you mention the license of the assets?
[Yes] All the datasets used in this work are
publicly available datasets.
All the datasets enable their use for research purposes.
(c) Did you include any new assets either in the supplemental material or as a URL?
[No]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
The datasets we utilize are publicly available and contain tens or
hudrends of thousands of images.
We refer to the authors original papers describing
the datasets.
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A] Our experiments rely on a) synthetic data, b)
public benchmarks that do not contain personally identifiable information or offensive
content.
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]