Gradient descent with large steps changes adversarial training behaviors
Adversarial Training with Large Step Sizes: Implicit Bias, Optimization, and Sharpness
Machine Learning
Summary
Training computer models to be robust against tricky mistakes is important. The authors looked at how a common training method called gradient descent acts when taking big steps instead of very small ones, during a special kind of training called adversarial training. They found that certain behaviors, like where the model ends up and how the training speed changes, are different from usual training. Their work helps explain how big training steps affect model robustness in practice.
What this means in practice
- •For machine learning engineers: Improve adversarial training methods by adjusting step sizes based on understanding of training dynamics and convergence differences.
- •For ai system performance teams: Use insights about loss sharpness evolution during adversarial training to better monitor and tune model robustness in production.
Authors
Yi Feng, Andrea Paudice
Abstract
Adversarial Training (AT) is an important method for improving model robustness. We study the dynamics of deterministic Gradient Descent (GD) in AT. Most existing works in this direction focus on the small or vanishing step sizes regime, where GD resembles a continuous-time flow. However, such step sizes can make training inefficient and are rarely used in practice. In this paper, we study the AT dynamics of GD with large constant step sizes. We first study GD in adversarial linear logistic regression, focusing on two aspects: where the model parameters converge (implicit bias) and how quickly the losses decrease (optimization). We then turn to neural networks training and study how the sharpness of losses evolve during AT. Our results advance the understanding of the behaviors of GD with large step sizes in AT and highlight three key differences from its behavior in Standard Training (ST): (i) the implicit bias gap between AT and ST, previously established only for small step sizes, persists for arbitrarily large constant step sizes, (ii) different from ST, there is no uniform rate of convergence for the optimization error in AT, and (iii) sharpness can exhibit two-stage dynamics that differ from the Edge-of-Stability behavior observed in ST.