More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models

Abstract

Despite remarkable success in practice, modern machine learning models have been found to be susceptible to adversarial attacks that make human-imperceptible perturbations to the data, but result in serious and potentially dangerous prediction errors. To address this issue, practitioners often use adversarial training to learn models that are robust against such attacks at the cost of higher generalization error on unperturbed test sets. The conventional wisdom is that more training data should shrink the gap between the generalization error of adversarially-trained models and standard models. However, we study the training of robust classifiers for both Gaussian and Bernoulli models under ${\ell }_{\infty }$ attacks, and we prove that more data may actually increase this gap. Furthermore, our theoretical results identify if and when additional data will finally begin to shrink the gap. Lastly, we experimentally demonstrate that our results also hold for linear regression models, which may indicate that this phenomenon occurs more broadly.

Accepted to ICML'20. First two authors contributed equally

References in corpus (22)

• Theoretically Principled Trade-off between Robustness and Accuracy
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Efficient Neural Network Robustness Certification with General Activation Functions
• Semidefinite relaxations for certifying robustness to adversarial examples
• Adversarial vulnerability for any classifier
• Adversarial Training Can Hurt Generalization
• Adversarial examples from computational constraints
• Rademacher Complexity for Adversarially Robust Generalization
• Adversarial Robustness May Be at Odds With Simplicity
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Adversarial Spheres
• Lower Bounds on Adversarial Robustness from Optimal Transport
• Generalized No Free Lunch Theorem for Adversarial Robustness
• Adversarial Risk Bounds via Function Transformation
• Lower Bounds for Adversarially Robust PAC Learning
• Adversarially Robust Learning Could Leverage Computational Hardness

Cited by in corpus (7)

• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Recent advances in deep learning theory
• WeMix: How to Better Utilize Data Augmentation
• On the Generalization Properties of Adversarial Training
• Provable More Data Hurt in High Dimensional Least Squares Estimator
• Towards Deep Learning Models Resistant to Large Perturbations
• Unique properties of adversarially trained linear classifiers on Gaussian data