Abstract
Modern neural networks are expected to simultaneously satisfy a host of desirable properties: accurate fitting to training data, generalization to unseen inputs, parameter and computational efficiency, and robustness to adversarial perturbations. While compressibility and robustness have each been studied extensively, a unified understanding of their interaction still remains elusive. In this work, we develop a principled framework to analyze how different forms of compressibility - such as neuron-level sparsity and spectral compressibility - affect adversarial robustness. We show that these forms of compression can induce a small number of highly sensitive directions in the representation space, which adversaries can exploit to construct effective perturbations. Our analysis yields a simple yet instructive robustness bound, revealing how neuron and spectral compressibility impact $L_\infty$ and $L_2$ robustness via their effects on the learned representations. Crucially, the vulnerabilities we identify arise irrespective of how compression is achieved - whether via regularization, architectural bias, or implicit learning dynamics. Through empirical evaluations across synthetic and realistic tasks, we confirm our theoretical predictions, and further demonstrate that these vulnerabilities persist under adversarial training and transfer learning, and contribute to the emergence of universal adversarial perturbations. Our findings show a fundamental tension between structured compressibility and robustness, and suggest new pathways for designing models that are both efficient and secure.
Abstract (translated)
现代神经网络被期望同时满足一系列理想的特性，包括对训练数据的准确拟合、对未见输入的一般化能力、参数和计算效率以及对抗扰动的鲁棒性。尽管可压缩性和鲁棒性各自已经得到了广泛的研究，但它们相互作用的统一理解仍然难以捉摸。在本工作中，我们开发了一个原则性的框架来分析不同形式的可压缩性（如神经元级稀疏性和谱可压缩性）如何影响对抗鲁棒性。我们发现这些形式的压缩可以在表示空间中诱导出少量高度敏感的方向，这些方向可以被对手利用以构建有效的扰动。我们的分析得出了一种简单而有教育意义的鲁棒性界限，揭示了神经元和谱可压缩性是如何通过其对学习表示的影响来影响$L_\infty$ 和 $L_2$ 鲁棒性的。 尤为重要的是，我们所识别的脆弱性无论通过何种方式实现压缩都会出现——无论是通过正则化、架构偏置还是隐式学习动态。通过在合成和现实任务上的经验评估，我们确认了我们的理论预测，并进一步证明这些漏洞在对抗训练和迁移学习中仍然存在，而且有助于普遍对抗扰动的产生。 我们的发现表明，在结构化的可压缩性和鲁棒性之间存在着根本性的矛盾，并提出了设计既高效又安全模型的新路径。
URL
https://arxiv.org/abs/2507.17725
