Research map / Adversarial robustness and security / Certified and empirical robustness
Can Implicit Bias Imply Adversarial Robustness?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that a shallow polynomial-ReLU (pReLU) network trained by gradient flow can learn subclass centers and be robust to O(1) l2 attacks, whereas standard ReLU networks learn class-average directions and are vulnerable to O(1/sqrt(K)) attacks.
Problem
Gradient-flow-trained shallow ReLU networks generalize well on clean data with latent subclass structure but are non-robust to small l2 adversarial perturbations, due to implicit bias toward class-average neuron directions.
Approach
Replace ReLU with a polynomial ReLU activation sigma^p(<x,w>)/||w||^{p-1} (p>=3), which changes the neuron alignment dynamics under small-initialization gradient flow so neurons align with individual subclass centers rather than averaged class directions, yielding O(1)-robust classifiers.
Key results
- On synthetic data (D=1000, K=10), trained p=1 network is close to the average-direction classifier F while p=3 network is close to the subclass classifier F^(p), supporting the conjecture.
- On MNIST parity with l_inf radius 0.1, robust accuracy rises from about 4% (ReLU, p=1) to 64% (p=4) per the appendix table.
- Theory: ReLU classifier F is non-robust to O(1/sqrt(K)) l2 attacks, while pReLU classifier F^(p) with p>=2 is robust to O(1) radius (about sqrt(2)/2), though the gradient-flow convergence is only conjectured.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use p=2 instead of p=1 (ablation) | pReLU network · MNIST digits, clean | accuracy: 0.981($\pm 0.000$) -> 0.982 ($\pm 0.000$) | No clear effect |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, clean | accuracy: 0.981($\pm 0.000$) -> 0.980 ($\pm 0.000$) | No clear effect |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_\infty$ attack, radius=0.05 | robust accuracy: 0.512 ($\pm 0.006$) -> 0.913 ($\pm 0.001$) | Helped |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_\infty$ attack, radius=0.1 | robust accuracy: 0.040 ($\pm 0.002$) -> 0.637 ($\pm 0.004$) | Helped |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_2$ attack, radius=1 | robust accuracy: 0.301 ($\pm 0.004$) -> 0.775 ($\pm 0.002$) | Helped |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_2$ attack, radius=2 | robust accuracy: 0.007 ($\pm 0.001$) -> 0.239 ($\pm 0.003$) | Helped |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_1$ attack, radius=5 | robust accuracy: 0.500 ($\pm 0.007$) -> 0.807 ($\pm 0.002$) | Helped |
| Increase activation exponent from p=1 to p=4 (ablation) | pReLU network · MNIST digits, $\ell_1$ attack, radius=10 | robust accuracy: 0.098 ($\pm 0.004$) -> 0.402 ($\pm 0.003$) | Helped |
Surprising findings
- pReLU networks gain robustness on original MNIST digit classification, which does not follow the subclass data assumption.
- Robustness gain persists even though the full gradient-flow convergence result is only conjectured and validated numerically.
Limitations
- Gradient-flow convergence to the pReLU classifier is conjectured, not proven; only a preliminary alignment analysis is given.
- Theory holds in high-dimensional or low-intra-class-variance regime (D/alpha^2 >> K^2 log K) and for a simplified dataset of exact subclass centers.
- Real-data experiments are preliminary and use modified tasks (parity MNIST, relabeled Caltech256 features).
Experimental setup
Datasets: MNIST Caltech256 synthetic mixture-of-Gaussians subclass data
Benchmarks: MNIST Caltech256 (10 superclasses) synthetic subclass data
Metrics: clean test accuracy robust accuracy under APGD l_inf attack robust accuracy under l2, l1 attacks distance dist(f_p,F) to target classifier stable rank
Baselines: vanilla ReLU network (p=1)
Builds on: Frei et al. 2023 implicit bias non-robustness neuron alignment analysis of shallow networks APGD attack
Closest papers by meaning
- The Double-Edged Sword of Implicit Bias: Generalization vs. Robustness in ReLU Networks (NeurIPS 2023 · similarity 0.94)
- The Implicit Bias of Gradient Descent toward Collaboration between Layers: A Dynamic Analysis of Multilayer Perceptions (NeurIPS 2024 · similarity 0.90)
- The Price of Implicit Bias in Adversarially Robust Generalization (NeurIPS 2024 · similarity 0.89)
- Feature Averaging: An Implicit Bias of Gradient Descent Leading to Non-Robustness in Neural Networks (ICLR 2025 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
- On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.