Understanding Adversarially Robust Generalization via Weight-Curvature Index
Adversarially Robust Generalization; Weight-Curvature Index; Robust overfitting; PAC-Bayesian framework
Yes
No ethics review needed.
Please see my comments on weaknesses.
1- The paper employs PAC-Bayesian generalization bounds, which could potentially be useful for evaluating the generalization of adversarially-trained neural networks.
This paper introduces the Weight Curvature Index (WCI) as a measure for evaluating the adversarial generalization error of neural network classifiers under norm-bounded adversarial perturbations. Section 2 reviews the PAC-Bayesian framework for generalization analysis. Then, using a second-order loss approximation in Lemma 2.4, the paper derives an upper bound on generalization error in Theorem 2.5. This upper bound, referred to as the WCI score in equation (5), is subsequently assessed through numerical results presented in Section 3.
1- I have several questions about Definition 2.1 where the authors define the adversarial risk. In the definition, the perturbation $\delta$ appears a constant that is not maximized as required in standard adversarial training. The authors try to address this by defining $\ell(\theta , x+\delta ,y)$ as the adversarial loss where it is said "$\delta$ stands for the worst-case perturbation that maximizes the perturbation". This notation ignores the fact that the worst-case perturbation $\delta(x,y,\theta)$ should be a function of input $x,y$ and neural net parameter $\theta$, because the perturbation is supposed to maximize the loss at data point $(x,y)$ and for neural net $h_{\delta}$ and so varies between different samples and neural net parameters.

I think the notation $\delta$ (without specifying the input $x,y,\theta$ for the perturbation) is not only confusing in the writing, but may have caused errors in the theoretical and numerical analysis of the paper. To ensure my concern is valid, I would like to ask the following question: The authors consider the Hessian of the loss function $\ell(\theta , x+\delta ,y)$ in Lines 204-205. Can the authors clarify how they compute the Hessian of the adversarial loss function $\ell(\theta , x+\delta ,y)$ which, using the standard notation, is supposed to be $\max_{\Vert\delta\Vert\le \epsilon} \ell_{clean}(x+\delta ,y,\theta)$? Do the authors fix the perturbation $\delta$ to be the worst-case perturbation $\delta^* $ and then they take the Hessian of $\ell(\theta , x+\delta^* ,y)$ with respect to $\theta$?

2- Lemma 2.4 is based on an unspecified assumption that "the empirical loss $L_S(\theta ,x+\delta ,y)$ can be approximated using second-order Taylor expansion". Can the authors clarify the precise mathematical statement of the assumption? It seems the assumption can be questioned. First, standard ReLU activation functions are not twice-differentiable and so the Hessian analysis does not apply to them. Also, $L_S$ is supposed to be the adversarial loss, which means the authors assume that the worst-case loss $\max_{\Vert\delta\Vert\le \epsilon } \ell(\theta, x+\delta , y)$ has a bounded Hessian. Therefore, the flatness of the adversarial loss seems a very strong assumption which very likely would not work even using twice-differentiable activation functions.  Also, when I checked the proof of this lemma, I could not understand Lines 804-807. How does the "second-order Taylor series expansion around $\theta$" yield Equation (8)?

3- In the definition of WCI in Equation (5), I wonder how the authors compute $\text{Tr}(H_k)$. Do they solve the optimization problem for the adversarial perturbation $\delta(x,y,\theta)$ for the training samples and then take the Hessian of $\sum_i \ell(\theta, x+\delta^*_{x,y,\theta} , y) $? 

4- Theorem 2.5 is based on a seemingly unspecified assumption in Lemma 2.4 that "the empirical loss $L_S(\theta , x+\delta ,y)$ can be approximated using second-order Taylor expansion". It is unclear how the assumption is reflected in Equation (4) because Equation (4) is a definite inequality which is not an approximate result, while the assumption considers an approximation. The approximation error of the assumption is not reflected in Equation (4).
Yes
No ethics review needed.
No questions, beyond addressing the weaknesses raised. in particular, the seed + correlation point needs to be at least _addressed_ to give strong recommendation to accept
- Originality: the paper combination of pac bayes analysis and sharpness aware minimization is a novel connection, yielding a principled motivation to combine previously known regularizers. going beyond simply establishing a proxy and experimenting with an adaptiv regularizers is a distinguishing factor from similar works
- Quality+Clarity: overall, the paper can be called solid and well written: each section clearly motivates, presents and justifies its point and the appendix provides addtional details and studies of e.g. various regularizers interacting with WCI and robust-generalization. Exposition is clear and easy to follow.
- Significance: finding a good proxy measure for robust generalization with theoretical grounding (e.g. to study the tightness of the gap and find speedups) is a meaningful contribution to the field
The paper introduces the Weight Curvature Index (WCI) as a proxy for robust generalization of adversarially trained models.
WCI is the layerwise sum of the geometric mean of the trace of the loss-hessian w.r.t to layer-weights and the Frobenius norm of the layer-weights.
is motived with a PAC-Bayes bound on the robust generalization gap, combining results from the Sharpness Aware Optimization literature (Foret 2021) and Cantonis bound.

The paper establishes visual correlation with robust generalization gab, compare against a selection of related works and derives a learning rate scheduler from WCI to combat robust overfitting
- there are some references missing which would help the reader place the work into context, in particular https://openreview.net/forum?id=yT7-k6Q6gda which studies the connection between the trace of the hessian during trianing w.r.t generalization (albeit standard generalization). similarly releveant to the investigation of the evolution of WCI during training might be https://arxiv.org/abs/1905.13277  studying the impact of _when_ to regularize. I also found https://proceedings.mlr.press/v162/ju22a which also uses pac bayes robust generalization bounds, albeit without the frobenius norm based on a quick read. relationship to these papers should be clarified
- The correlation, while visually striking, is established (as presented) on a single seed and on a limited number datasets. Computational constraints beings what they are, I recommend at least testing this with muliple seeds, doing proper correlation analysis (i.e. regression and p value with correct multiple comparisons adjustment), and also comparing the difference in correlation (i.e. the relative qualiy of the measure) against individual components using suitable statistical significance tests (e.g., multiple pairwise Steigers Z https://personality-project.org/r/psych/help/r.test.html + holm-bonferronig or Benjamini-Yekutieli, hottelings). If computational cost is a concern, designing toy examples on subsets of data and with smaller models might be sufficient
- at the very least, multiple seeds ought to be run, a confidence interval ought to be computed. Ideally, ablation studies for the sensitivity to different ranges of hyperparameters could be run, and then the correlation analysis recommended above can be used to assess the quality of the proxy
Yes
No ethics review needed.
- The authors illustrated that the prior works have shown that reducing the classifier variability term also decreases the perturbation discrepancy term. Does it also hold when to consider an adversarial risk, not a standard risk?
- In the proof of lemma 2.4, how can you consider $\mathcal{Q}=N(\theta,\mathbf{I})$? I’m quite confusing that is it possible to fix the mean as a certain point of $\theta$?
- This paper is well-written, making it easy to read. 
- Experimental settings are described in detail, along with reasons for the choice of hyperparameters.
- Newly designed learning rate scheduler outperforms other existing competitors.
- This paper propose WCI, a new measure related with robust generalization gap. 
- Using some techniques such as hyperpriors and second-order loss approximation, the authors derive WCI from the theoretical gap. 
The authors empirically explain that learning rate adjustment using WCI can mitigate robust overfitting using real-word datasets.
- The main concern is that the theoretical results are not convincing, or underdescribed at least. All theoretical results from lemma 2.2 to theorem 2.5, think the adversarial loss $l(\theta,x+\delta,y)$ can be applied to all results using the standard loss term, regardless of the existence of $\delta$. Since the authors defined $\delta$ as the worst-case perturbation, $\delta$ is a function that depend on $l,(x,y),\epsilon,\theta$ which is not a constant. To properly consider $l(\theta,x+\delta,y)$, a supremum term on perturbations should be included. Therefore the proofs are needed to be checked whether they are correct under the supremum or considering the fact that $\delta$ depends on $l,(x,y),\epsilon,\theta$ also - e.g. PAC Bayes bound, second-order differentiability and else.  Actually, this paper’s proofs remain same when considering an adversarially robust scheme, and not. I think the main difficulty in the proofs are about the supremum term (which is inside the expectation, making it more difficult.), and the authors should describe about it in detail. 

- When to define an upper bound in theorem 2.5, $\sigma_k^2$ should be controlled to minimize the bound. If not, the upper bound does not hold since it needs an equality condition for an arithmetic–geometric mean inequality. I think the Frobenius norm of layer weights $W_k$ and the trace of Hessian $H_k$ is not controllable during training, where their control is crucial to the control of $\sigma_k^2$. Hence, I conjecture that the fluctuation of WCI rises in learning curves since the upper bound does not holds all the time. This hinder the reason that WCI works. 

- In Figure 4, the authors explained that the Frobenius norm of the weight matrix is the most critical factor during the initial training stages. However, to me, it seems that the trace term dominantly influence to WCI since they share the whole shape. This implies that considering WCI is not basically different from considering the trace of the Hessian. Combined with above weaknesses, we may conclude that considering WCI is not basically different from simply using SAM with an adversarial risk. 

- Minor) line 811: $H^{(l)}\to H_k$, $l$-th layer $\to k$-th layer.
Yes
No ethics review needed.
The method you use to generate adversarial examples in Section B.2 raises some concerns. Why did you choose not to resort to state-of-the-art techniques, such as AutoAttack? Please also comment on the validity of the assumptions.
The paper is well-written and thoroughly documented, providing clear insights into the Weight-Curvature Index (WCI) and its relevance to adversarially robust generalization. It effectively leverages the PAC-Bayesian framework to derive robust generalization bounds and makes connections with several recent concepts. However, the paper could be further strengthened by incorporating additional recent references, such as those discussed in [1] regarding PAC-Bayesian bounds, for instance. Overall, the clarity of the writing and the integration of foundational concepts contribute to its value as a significant contribution to the literature.

[1] Patracone, J., Viallard, P., Morvant, E., Gasso, G., Habrard, A., Canu, S. A Theoretically Grounded Extension of Universal Attacks from the Attacker’s Viewpoint. In ECML/PKDD 2024.
The paper introduces the Weight-Curvature Index (WCI) as a metric for assessing adversarially robust generalization in machine learning models. This metric is motivated by the derivation of a PAC-Bayesian bound on the robust generalization gap, which incorporates terms such as KL divergence, classifier variability, and perturbation discrepancy. Under certain assumptions and a second-order loss function approximation, the classifier variability is then shown to be upper bounded by the WCI.
Overall, the paper is quite dense, which may pose challenges for readers who are not familiar with the underlying concepts, making it difficult to assess the validity of the connections drawn throughout. Additionally, the proposed results rely on specific assumptions to simplify several terms and avoid an in-depth exploration of others, potentially limiting the generalizability of the findings. A discussion addressing the implications of these assumptions is essential and should ideally be introduced early in the paper. Moreover, clarifying the trade-offs associated with these assumptions would enhance the reader's understanding of the model's applicability in diverse contexts.
We introduce the Weight-Curvature Index (WCI), a novel metric that captures the interplay between model parameters and loss landscape curvature to better understand and improve adversarially robust generalization in deep learning.
@inproceedings{
anonymous2024understanding,
title={Understanding Adversarially Robust Generalization via Weight-Curvature Index},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=q9T51gF0fr},
note={under review}
}
Despite extensive research on adversarial examples, the underlying mechanisms of adversarially robust generalization, a critical yet challenging task for deep learning, remain largely unknown. In this work, we propose a novel perspective to decipher adversarially robust generalization through the lens of the Weight-Curvature Index (WCI). The proposed WCI quantifies the vulnerability of models to adversarial perturbations using the Frobenius norm of weight matrices and the trace of Hessian matrices. We prove generalization bounds based on PAC-Bayesian theory and second-order loss function approximations to elucidate the interplay between robust generalization gap, model parameters, and loss landscape curvature. Our theory and experiments show that WCI effectively captures the robust generalization performance of adversarially trained models. By offering a nuanced understanding of adversarial robustness based on the scale of model parameters and the curvature of the loss landscape, our work provides crucial insights for designing more resilient deep learning models, enhancing their reliability and security.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Adversarially Robust Generalization; Weight-Curvature Index; Robust overfitting; PAC-Bayesian framework
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/bd27e92504f85d8457fc236804b725dfcd37610d.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Understanding Adversarially Robust Generalization via Weight-Curvature Index
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission