RECORD
Convergence of Adversarial Training in Overparametrized Neural Networks
Machine Learning · Submitted 19 Jun 2019
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
Neural networks are vulnerable to adversarial examples, i.e. inputs that are imperceptibly perturbed from natural data and yet incorrectly classified by the network. Adversarial training, a heuristic form of robust optimization that alternates between minimization and maximization steps, has proven to be among the most successful methods to train networks to be robust against a pre-defined family of perturbations. This paper provides a partial answer to the success of adversarial training, by showing that it converges to a network where the surrogate loss with respect to the the attack algorithm is within $\epsilon$ of the optimal robust loss. Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier. The analysis technique leverages recent work on the analysis of neural networks via Neural Tangent Kernel (NTK), combined with motivation from online-learning when the maximization is solved by a heuristic, and the expressiveness of the NTK kernel in the $\ell_\infty$-norm. In addition, we also prove that robust interpolation requires more model capacity, supporting the evidence that adversarial training requires wider networks.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | Neural networks are vulnerable to adversarial examples, i.e. inputs that are imperceptibly perturbed from natural data and yet incorrectly classified by the network. | background 1.00 | 0.04 | 0.02 | asserted 1.00 |
| s1 | Adversarial training, a heuristic form of robust optimization that alternates between minimization and maximization steps, has proven to be among the most successful methods to train networks to be robust against a pre-defined family of perturbations. | background 1.00 | 0.05 | 0.02 | asserted 1.00 |
| s2 | This paper provides a partial answer to the success of adversarial training, by showing that it converges to a network where the surrogate loss with respect to the the attack algorithm is within $\epsilon$ of the optimal robust loss. | result 0.63 | 0.94 | 0.68 | asserted 0.99 |
| s3 | Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier. | result 0.92 | 0.93 | 0.40 | asserted 1.00 |
| s4 | The analysis technique leverages recent work on the analysis of neural networks via Neural Tangent Kernel (NTK), combined with motivation from online-learning when the maximization is solved by a heuristic, and the expressiveness of the NTK kernel in the $\ell_\infty$-norm. | method 0.98 | 0.40 | 0.03 | asserted 0.97 |
| s5 | In addition, we also prove that robust interpolation requires more model capacity, supporting the evidence that adversarial training requires wider networks. | result 0.94 | 0.90 | 0.06 | asserted 0.99 |
What was examined, and what was not
- arXiv listing abstract v2
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
Neural networks are vulnerable to adversarial examples, i.e. inputs that are imperceptibly perturbed from natural data and yet incorrectly classified by the network. Adversarial training, a heuristic form of robust optimization that alternates between minimization and maximization steps, has proven to be among the most successful methods to train networks to be robust against a pre-defined family of perturbations. This paper provides a partial answer to the success of adversarial training, by showing that it converges to a network where the surrogate loss with respect to the the attack algorithm is within $\epsilon$ of the optimal robust loss. Then we show that the optimal robust loss is also close to zero, hence adversarial training finds a robust classifier. The analysis technique leverages recent work on the analysis of neural networks via Neural Tangent Kernel (NTK), combined with motivation from online-learning when the maximization is solved by a heuristic, and the expressiveness of the NTK kernel in the $\ell_\infty$-norm. In addition, we also prove that robust interpolation requires more model capacity, supporting the evidence that adversarial training requires wider networks.
Human review
References
How the literature uses it
10 arXiv papers cite this in 18 sentences
Papers citing it · 7 sentences without a confident label
Contests it 1 paper
-
However, in both cases, adversarial examples generated by the initial NTK do not transfer at all to fully trained networks, suggesting that the initialization NTK analysis of adversarial examples in some theoretical work [ref] may not be accurately describe the behavior of adversarial examples in practical networks.
Evolution of Neural Tangent Kernels under Benign and Adversarial Training · Adversarial Transferability of Linearized Dynamics · contest 0.78
Cites it as background 8 papers
-
Based on the NTK theory, there have been works studying the presence of adversarial examples under the NTK and NNGP kernels [ref] .
Evolution of Neural Tangent Kernels under Benign and Adversarial Training · Background and Related Works · 0.96
-
To facilitate our discussion, we briefly review some basics of deep neural networks (DNNs) [ref] .
Risk-Sensitive Deep RL: Variance-Constrained Actor-Critic Provably Finds Globally Optimal Policy · Background · 1.00
-
For instance, [ref] study the statistical properties of adversarial training; [ref] study the optimization perspective; [ref] work on deep learning.
Adversarial Training with Generated Data in High-Dimensional Regression: An Asymptotic Study · Related Works · 1.00
What it cites · 30 sentences without a confident label
Uses the method or tool of 3 papers
-
To show this, we utilize the connection between neural networks and their induced Reproducing Kernel Hilbert Space (RKHS) via viewing networks near initialization as a random feature scheme [ref] .
Neural Tangent Kernel: Convergence and Generalization in Neural Networks · Adversarial Training Finds Robust Classifier · 0.89
-
To show this, we utilize the connection between neural networks and their induced Reproducing Kernel Hilbert Space (RKHS) via viewing networks near initialization as a random feature scheme [ref] .
Fine-Grained Analysis of Optimization and Generalization for Overparameterized Two-Layer Neural Networks · Adversarial Training Finds Robust Classifier · 0.89
-
For the convenience of proof, we use the same architecture as defined in [ref] .[We only consider the setting when the network output is scalar.
A Convergence Theory for Deep Learning via Over-Parameterization · Deep Neural Networks · 0.80
Cites as support 3 papers
-
In fact, empirical evidence have already shown that to reliably withstand strong adversarial attacks, networks require a significantly larger capacity than for correctly classifying benign examples only [ref] .
Towards Deep Learning Models Resistant to Adversarial Attacks · Capacity Requirement of Robustness · 1.00
-
Apart from this paper, there are other works supporting the need for capacity including the perspective of network width [ref] , depth [ref] and computational complexity [ref] .
Intriguing properties of adversarial training at scale · Discussion on Limitations and Future Directions · 0.99
-
Apart from this paper, there are other works supporting the need for capacity including the perspective of network width [ref] , depth [ref] and computational complexity [ref] .
Adversarial Robustness May Be at Odds With Simplicity · Discussion on Limitations and Future Directions · 0.99
Cites as background 12 papers
-
For the reader's convenience, we first introduce the Neural Tangent Kernel (NTK) [ref] w.r.t. our two-layer network.
Neural Tangent Kernel: Convergence and Generalization in Neural Networks · Adversarial Training Finds Robust Classifier · 0.81
-
Global convergence of Gradient Descent Recent works on the over-parametrization of neural networks prove that when the width greatly exceeds the sample size, gradient descent converges to a global minimizer from random initialization [ref] .
Gradient Descent Finds Global Minima of Deep Neural Networks · Related Work · 0.90
-
Global convergence of Gradient Descent Recent works on the over-parametrization of neural networks prove that when the width greatly exceeds the sample size, gradient descent converges to a global minimizer from random initialization [ref] .
Stochastic Gradient Descent Optimizes Over-parameterized Deep ReLU Networks · Related Work · 0.90
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.