Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data

2024-10-11

arXiv.org

AI Summary

This work investigates the root causes of adversarial examples and the mechanism by which adversarial training enhances model robustness. Standard training tends to learn dense yet non-robust features, compromising generalization under perturbations. Method: Under a structured data assumption, we propose a feature learning theoretical framework based on a two-layer smooth ReLU CNN; adversarial training (PGD-style) alternates gradient ascent to generate adversarial examples and gradient descent for optimization. Contribution/Results: We provide the first theoretical characterization of the learnability separation between robust and non-robust features, rigorously proving that PGD-based adversarial training promotes robust feature learning while suppressing non-robust feature learning—revealing an intrinsic link between feature robustness and adversarial perturbation directions. Our analysis combines feature disentanglement with generalization error bounds. Theoretically guaranteed robustness improvement is empirically validated on MNIST, CIFAR-10, and SVHN, confirming the predicted feature selection mechanism.

Technology Category

Machine Learning: Adversarial Learning & RobustnessComputer Vision: Adversarial Attacks & RobustnessGame Theory and Economic Paradigms: Adversarial Learning

Application Category

Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for rankingUser Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systemsWeb Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Adversarial training is a widely-applied approach to training deep neural networks to be robust against adversarial perturbation. However, although adversarial training has achieved empirical success in practice, it still remains unclear why adversarial examples exist and how adversarial training methods improve model robustness. In this paper, we provide a theoretical understanding of adversarial examples and adversarial training algorithms from the perspective of feature learning theory. Specifically, we focus on a multiple classification setting, where the structured data can be composed of two types of features: the robust features, which are resistant to perturbation but sparse, and the non-robust features, which are susceptible to perturbation but dense. We train a two-layer smoothed ReLU convolutional neural network to learn our structured data. First, we prove that by using standard training (gradient descent over the empirical risk), the network learner primarily learns the non-robust feature rather than the robust feature, which thereby leads to the adversarial examples that are generated by perturbations aligned with negative non-robust feature directions. Then, we consider the gradient-based adversarial training algorithm, which runs gradient ascent to find adversarial examples and runs gradient descent over the empirical risk at adversarial examples to update models. We show that the adversarial training method can provably strengthen the robust feature learning and suppress the non-robust feature learning to improve the network robustness. Finally, we also empirically validate our theoretical findings with experiments on real-image datasets, including MNIST, CIFAR10 and SVHN.

Problem

• Theoretical analysis of adversarial training robustness
• Understanding adversarial examples through feature learning
• Improving neural network robustness with structured data

Innovation

• Adversarial training enhances robust features.
• Two-layer smoothed ReLU network utilized.
• Theoretical and empirical validation conducted.