Intriguing Properties of Robust Classification

2024-12-05

arXiv.org

AI Summary

This work investigates fundamental limitations on the generalization of robust classifiers: even when an accurate robust solution exists, learning a high-accuracy robust classifier requires exponentially many samples. We establish, for the first time, a rigorous exponential lower bound on the sample complexity of robust generalization within the PAC learning and information-theoretic frameworks. Our analysis identifies the root cause as the decoupling between exploitability of non-robust and robust features—not insufficient model capacity. Through PGD-based adversarial training, feature separability analysis, and empirical evaluation on CIFAR-10, we demonstrate that robust accuracy grows extremely slowly with increasing data size, while standard architectures already possess sufficient capacity to represent robust features. The core contribution is the identification of *data inefficiency*—not architectural or optimization limitations—as the fundamental bottleneck in robust learning, thereby laying a new theoretical foundation for robustness research.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Economics, Online Markets and Human Computation: Data quality aspects of human-annotated datasets
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Despite extensive research since the community learned about adversarial examples 10 years ago, we still do not know how to train high-accuracy classifiers that are guaranteed to be robust to small perturbations of their inputs. Previous works often argued that this might be because no classifier exists that is robust and accurate at the same time. However, in computer vision this assumption does not match reality where humans are usually accurate and robust on most tasks of interest. We offer an alternative explanation and show that in certain settings robust generalization is only possible with unrealistically large amounts of data. More precisely we find a setting where a robust classifier exists, it is easy to learn an accurate classifier, yet it requires an exponential amount of data to learn a robust classifier. Based on this theoretical result, we explore how well robust classifiers generalize on datasets such as CIFAR-10. We come to the conclusion that on this datasets, the limitation of current robust models also lies in the generalization, and that they require a lot of data to do well on the test set. We also show that the problem is not in the expressiveness or generalization capabilities of current architectures, and that there are low magnitude features in the data which are useful for non-robust generalization but are not available for robust classifiers.

Problem

• Training robust and accurate classifiers is still unsolved
• Robust generalization requires unrealistically large data amounts
• Non-robust features hinder robust classifier performance

Innovation

• Examines robust generalization with large data
• Links training data volume to robust performance
• Identifies non-robust generalization data directions