Robustness, Privacy, and Generalization of Adversarial Training

Abstract

Adversarial training can considerably robustify deep neural networks to resist adversarial attacks. However, some works suggested that adversarial training might comprise the privacy-preserving and generalization abilities. This paper establishes and quantifies the privacy-robustness trade-off and generalization-robustness trade-off in adversarial training from both theoretical and empirical aspects. We first define a notion, {\it robustified intensity} to measure the robustness of an adversarial training algorithm. This measure can be approximate empirically by an asymptotically consistent empirical estimator, {\it empirical robustified intensity}. Based on the robustified intensity, we prove that (1) adversarial training is $(\epsilon ,\delta )$-differentially private, where the magnitude of the differential privacy has a positive correlation with the robustified intensity; and (2) the generalization error of adversarial training can be upper bounded by an $\mathcal{O}(\sqrt{\log N}/N)$ on-average bound and an $\mathcal{O}(1/\sqrt{N})$ high-probability bound, both of which have positive correlations with the robustified intensity. Additionally, our generalization bounds do not explicitly rely on the parameter size which would be prohibitively large in deep learning. Systematic experiments on standard datasets, CIFAR-10 and CIFAR-100, are in full agreement with our theories. The source code package is available at \url{https://github.com/fshp971/RPG}.

References in corpus (19)

• Adam: A Method for Stochastic Optimization
• A Survey on Deep Learning in Medical Image Analysis
• Deep Learning with Differential Privacy
• Wide Residual Networks
• Renyi Differential Privacy
• Three Factors Influencing Minima in SGD
• Differential Privacy as a Mutual Information Constraint
• Adversarial Attack on Graph Structured Data
• Motivating the Rules of the Game for Adversarial Example Research
• Generalization in Adaptive Data Analysis and Holdout Reuse
• Adversarial Robustness May Be at Odds With Simplicity
• Data-Dependent Stability of Stochastic Gradient Descent
• Towards a Mathematical Understanding of Neural Network-Based Machine Learning: what we know and what we don't
• High probability generalization bounds for uniformly stable algorithms with nearly optimal rate
• Theoretical Analysis of Adversarial Learning: A Minimax Approach
• Adversarial Risk Bounds via Function Transformation
• Recent advances in deep learning theory
• Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors
• Tighter Generalization Bounds for Iterative Differentially Private Learning Algorithms

Cited by in corpus (1)

• Gradient Masking and the Underestimated Robustness Threats of Differential Privacy in Deep Learning