Neural networks are known to be highly sensitive to adversarial examples. These may arise due to different factors, such as random initialization, or spurious correlations in the learning problem. To better understand these factors, we provide a precise study of the adversarial robustness in different scenarios, from initialization to the end of training in different regimes, as well as intermediate scenarios, where initialization still plays a role due to "lazy" training. We consider over-parameterized networks in high dimensions with quadratic targets and infinite samples. Our analysis allows us to identify new tradeoffs between approximation (as measured via test error) and robustness, whereby robustness can only get worse when test error improves, and vice versa. We also show how linearized lazy training regimes can worsen robustness, due to improperly scaled random initialization. Our theoretical results are illustrated with numerical experiments.
翻译:已知神经网络对对抗性实例非常敏感, 这些因素可能来自不同的因素, 如随机初始化或学习问题中的虚假关联。 为了更好地了解这些因素, 我们精确地研究从初始化到不同制度培训结束的不同情景中的对抗性稳健性, 以及由于“ 懒惰” 培训, 初始化仍然起作用的中间情景。 我们考虑高维度的超分化网络, 带有四面形目标和无限样本。 我们的分析使我们能够找出近似( 测试错误衡量的)和强度之间的新的权衡, 从而只有在测试错误改善时强健性才会变得更坏, 而相反的则是强健性才会变坏。 我们还展示了线性懒惰培训制度如何会因随机初始化不当扩大而使强健性恶化。 我们的理论结果通过数字实验来说明。