The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression

TL;DR

This work analyzes how overparametrization affects robustness to norm-bounded adversarial perturbations in random features regression. In the high-dimensional regime where $N/d\to\psi_1$ and $n/d\to\psi_2$, the authors derive an asymptotically exact formula for the robust generalization error under adversarial training, expressed via a five-variable convex-concave minimax problem. The analysis combines a Gaussian Equivalence Property, a Convex Gaussian Minimax Theorem, and a reduction to a Gaussian noisy linear model, providing a precise mechanism for how overparameterization can hurt robustness. Their results reveal that, unlike standard generalization which can improve with more parameters, robust generalization can deteriorate with increasing overparametrization, offering guidance for designing robust yet scalable learning systems under adversarial settings.

Abstract

Successful deep learning models often involve training neural network architectures that contain more parameters than the number of training samples. Such overparametrized models have been extensively studied in recent years, and the virtues of overparametrization have been established from both the statistical perspective, via the double-descent phenomenon, and the computational perspective via the structural properties of the optimization landscape. Despite the remarkable success of deep learning architectures in the overparametrized regime, it is also well known that these models are highly vulnerable to small adversarial perturbations in their inputs. Even when adversarially trained, their performance on perturbed inputs (robust generalization) is considerably worse than their best attainable performance on benign inputs (standard generalization). It is thus imperative to understand how overparametrization fundamentally affects robustness. In this paper, we will provide a precise characterization of the role of overparametrization on robustness by focusing on random features regression models (two-layer neural networks with random first layer weights). We consider a regime where the sample size, the input dimension and the number of parameters grow in proportion to each other, and derive an asymptotically exact formula for the robust generalization error when the model is adversarially trained. Our developed theory reveals the nontrivial effect of overparametrization on robustness and indicates that for adversarially trained random features models, high overparametrization can hurt robust generalization.

Figures (6)

• Figure 1: Random features regression with (shifted) ReLU activation ($\sigma(x) = \max(x,0)-1/\sqrt{2\pi}$). Data $(\bm{x}_i, y_i)$ is generated with $d$-dimensional normal covariates $\bm{x}_i$ and $y_i = {\boldsymbol{\beta}}^{\sf T} \bm{x}_i + \xi_i$, where the noise variables $\xi_i \sim \mathcal{N}(0,0.5)$ and $\left\|{\boldsymbol{\beta}}\right\|_{\ell_2} = 1$. Perturbations are allowed within an Euclidean ball of radius $\varepsilon$, and the models are adversarially trained. We plot the robust generalization error (using Theorem \ref{['thm:main']}) versus the amount of overparametrization $N/n$, where $N$ is the number of parameters and $n$ is the number of training data points. The plots are obtained for different values of $\varepsilon$ and $\psi_2 = n/d$.
• Figure 2: Adversarial risk versus overparametrization $\psi_1/\psi_2 = N/n$ for different values of adversary's power $\varepsilon_0$. Solid curves are theoretical predictions and dots are results obtained based on gradient descent on the robust ERM objective. Each dot represents the average of 100 trials. The data is generated according to model \ref{['eq:linearModel']}, with $d = 100$, $n = 300$, $\tau^2 = 0.5$, and ${\boldsymbol{\beta}}\in\mathbb{R}^d$ obtained by drawing a vector with i.i.d ${\sf N}(0,1)$ entries and then normalizing it to have $\left\|{\boldsymbol{\beta}}\right\|_{\ell_2} = 1$.
• Figure 3: Theoretical prediction curves for adversarial risk of robust ERM as a function of overparametrization $\psi_1/\psi_2 = N/n$ for different values of adversary's power $\varepsilon$ and noise variance $\tau^2$, with the data model \ref{['eq:linearModel']}. Here we fix $\left\|{\boldsymbol{\beta}}\right\|_{\ell_2} = 1$ and $\psi_2 =3$.
• Figure 4: Theoretical prediction curves for adversarial risk of robust ERM as a function of overparametrization $\psi_1/\psi_2 = N/n$ for different values of $\psi_2 = n/d$. Each plot corresponds to a specific value of adversary's power $\varepsilon$ and noise variance $\tau^2$.
• Figure 5: Behavior of adversarial/standard risk as we vary $\varepsilon$, the "perceived" adversary's power used in the adversarial training. In (a), (b), $\psi_2 = 3$ is fixed and in (c), (d), we fix $\psi_1 = 3$. Also, (b), (d) correspond to $\varepsilon_{{\rm test}} = 0$, and so there is no perturbation at the test time. In these cases, adversarial risk reduces to the standard risk. In these experiments, we set $\tau^2 = 0.5$, $\left\|{\boldsymbol{\beta}}\right\|_{\ell_2} = 1$.

Theorems & Definitions (42)

• Definition 4.1
• Theorem 4.2
• Remark 4.1
• Proposition 5.1
• Proposition 6.1
• Proposition 6.2
• Proposition 6.3
• Proposition 6.4
• Corollary 6.5
• Lemma 6.6