Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Over-parameterization and Adversarial Robustness in Neural Networks: An Overview and Empirical Analysis

Srishti Gupta, Zhang Chen, Luca Demetrio, Xiaoyi Feng, Zhaoqiang Xia, Antonio Emanuele Cinà, Maura Pintor, Luca Oneto, Ambra Demontis, Battista Biggio, Fabio Roli

TL;DR

The paper investigates how over-parameterization affects adversarial robustness, addressing conflicting claims in prior work by incorporating reliability checks for attack effectiveness. By combining PGD with AutoAttack and IoAF indicators, the authors demonstrate that larger networks not only generalize better but also exhibit greater robustness to adversarial perturbations than smaller ones. The experiments on MNIST and CIFAR-10 across CNN, FC-ReLU, and ResNet architectures show that base performance remains strong or improves with size, and robustness gains are consistent across evaluation methods. The study argues that previous inconsistencies stem from unreliable attack evaluations and advocates reliability as a standard component of robustness analyses, with implications for theory and future secure ML research.

Abstract

Thanks to their extensive capacity, over-parameterized neural networks exhibit superior predictive capabilities and generalization. However, having a large parameter space is considered one of the main suspects of the neural networks' vulnerability to adversarial example -- input samples crafted ad-hoc to induce a desired misclassification. Relevant literature has claimed contradictory remarks in support of and against the robustness of over-parameterized networks. These contradictory findings might be due to the failure of the attack employed to evaluate the networks' robustness. Previous research has demonstrated that depending on the considered model, the algorithm employed to generate adversarial examples may not function properly, leading to overestimating the model's robustness. In this work, we empirically study the robustness of over-parameterized networks against adversarial examples. However, unlike the previous works, we also evaluate the considered attack's reliability to support the results' veracity. Our results show that over-parameterized networks are robust against adversarial attacks as opposed to their under-parameterized counterparts.

Over-parameterization and Adversarial Robustness in Neural Networks: An Overview and Empirical Analysis

TL;DR

The paper investigates how over-parameterization affects adversarial robustness, addressing conflicting claims in prior work by incorporating reliability checks for attack effectiveness. By combining PGD with AutoAttack and IoAF indicators, the authors demonstrate that larger networks not only generalize better but also exhibit greater robustness to adversarial perturbations than smaller ones. The experiments on MNIST and CIFAR-10 across CNN, FC-ReLU, and ResNet architectures show that base performance remains strong or improves with size, and robustness gains are consistent across evaluation methods. The study argues that previous inconsistencies stem from unreliable attack evaluations and advocates reliability as a standard component of robustness analyses, with implications for theory and future secure ML research.

Abstract

Thanks to their extensive capacity, over-parameterized neural networks exhibit superior predictive capabilities and generalization. However, having a large parameter space is considered one of the main suspects of the neural networks' vulnerability to adversarial example -- input samples crafted ad-hoc to induce a desired misclassification. Relevant literature has claimed contradictory remarks in support of and against the robustness of over-parameterized networks. These contradictory findings might be due to the failure of the attack employed to evaluate the networks' robustness. Previous research has demonstrated that depending on the considered model, the algorithm employed to generate adversarial examples may not function properly, leading to overestimating the model's robustness. In this work, we empirically study the robustness of over-parameterized networks against adversarial examples. However, unlike the previous works, we also evaluate the considered attack's reliability to support the results' veracity. Our results show that over-parameterized networks are robust against adversarial attacks as opposed to their under-parameterized counterparts.
Paper Structure (29 sections, 4 equations, 4 figures, 1 algorithm)

This paper contains 29 sections, 4 equations, 4 figures, 1 algorithm.

Table of Contents

  1. Introduction
  2. Over-parameterization and Adversarial Robustness
  3. Over-parameterization and Double-descent curve
  4. Adversarial Robustness
  5. Adversarial Robustness of Over-parameterized Network
  6. Study Design
  7. Notations
  8. Attack Approach
  9. Projected Gradient Descent (PGD)
  10. AutoAttack
  11. Evaluation Procedure
  12. Experiments
  13. Experimental setup
  14. Experimental Results
  15. Base Performance
  16. ...and 14 more sections

Figures (4)

  • Figure 1: Risk curves. The bias is represented in blue and the variance is represented in red. Left plot: Double-descent risk curve; Right plot: The risk when, as for deep neural networks, the bias dominates.
  • Figure 2: Base performance of trained classifiers against the parameter size: (a) CNN trained on MNIST, (b) linear classifier trained on MNIST, and (c) ResNet model trained on CIFAR10.
  • Figure 3: SEC plots of over-parameterized models using PGD $l_2$ attack on (a) CNN trained on MNIST, (b) FC-ReLU trained on MNIST, and (c) ResNet trained on CIFAR10. Each curve represents a network trained with the number of parameters specified in the legend.
  • Figure 4: SEC plots of over-parameterized models using AutoAttack on (a) CNN trained on MNIST, (b) FC-ReLU trained on MNIST, and (c) ResNet trained on CIFAR10. Each curve represents a network trained with the number of parameters specified in the legend.