On the (Non-)Robustness of Two-Layer Neural Networks in Different Learning Regimes

TL;DR

This paper investigates the robustness of two-layer neural networks across various training regimes, revealing tradeoffs between accuracy and adversarial robustness, especially in lazy training scenarios with improper initialization.

Contribution

It provides a theoretical analysis of adversarial robustness in over-parameterized two-layer networks, highlighting new tradeoffs and the impact of lazy training on robustness.

Findings

Robustness can deteriorate as test error improves.

Lazy training regimes with improper initialization worsen robustness.

Tradeoffs exist between approximation accuracy and adversarial robustness.

Abstract

Neural networks are known to be highly sensitive to adversarial examples. These may arise due to different factors, such as random initialization, or spurious correlations in the learning problem. To better understand these factors, we provide a precise study of the adversarial robustness in different scenarios, from initialization to the end of training in different regimes, as well as intermediate scenarios, where initialization still plays a role due to "lazy" training. We consider over-parameterized networks in high dimensions with quadratic targets and infinite samples. Our analysis allows us to identify new tradeoffs between approximation (as measured via test error) and robustness, whereby robustness can only get worse when test error improves, and vice versa. We also show how linearized lazy training regimes can worsen robustness, due to improperly scaled random initialization. Our theoretical results are illustrated with numerical experiments.