If You Want to Be Robust, Be Wary of Initialization

Summary

This paper provides a theoretical study on the impact of number of epoch and initialisation to adversarial attack for GNN, potentially generalise to DNN. The theoretical evidence is supported by some empirical results.

Strengths

The study of how number of training epoch and initialisation affect GNN robustness is novel and interesting. The presentation is clear. Both theoretical and empirical evidence are provided.

Weaknesses

The study presents novel insights into Graph Neural Networks (GNNs), however, it is somewhat discussed in Deep Neural Networks (DNNs) regarding the number of training epochs [1, 2, 5] and initialisation methods [3, 4]. While the study is interesting, its contribution is somewhat limited due to the lack of proposed methods based on the findings. From my understanding, the empirical validation is based on a single architecture, which may introduce limitations and bias. Given that the findings focus on initialisation, the empirical validation should cover a wider range of architectures. The additional study on DNN and GIN is appreciated. However, the empirical evidence primarily focuses on outdated adversarial setups. The evidence would be more convincing if the authors provided empirical results using current and more practical adversarial setups, such as large-scale datasets (e.g., ImageNet-1K), modern architectures (e.g., ResNet, ConvNeXt, ViT), and recent adversarial attacks (e.g., AutoAttack, APGD) [5]. I believe that without the proposed method, validating the theoretical findings on a wider range of adversarial setups, as suggested, would help improve the contribution of this paper. [1] Mo, Yichuan, et al. "When adversarial training meets vision transformers: Recipes from training to architecture." NeurIPS 2022. [2] Pang, Tianyu, et al. "Bag of tricks for adversarial training." ICLR 2021. [3] Hua, Andong, et al. "Initialization matters for adversarial transfer learning." CVPR 2024. [4] Vaishnavi, Pratik, Kevin Eykholt, and Amir Rahmati. "A Study of the Effects of Transfer Learning on Adversarial Robustness." Transactions on Machine Learning Research. [5] Singh, Naman Deep, Francesco Croce, and Matthias Hein. "Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models." NeurIPS 2023.

Questions

Please see the weakness.

Rating

5

Confidence

3

Soundness

3

Presentation

3

Contribution

2

Limitations

N/A

Summary

This paper studies the impact of weight initialization (and training epochs) on adversarial robustness of a GNN model, both theoretically and empirically. The analysis is also extended to DNNs in general, although this is not the focus of this paper. The theoretical and empirical analysis both suggest that increase to norm of weights of initialization and increase in training epoch both have negative influence on adversarial robustness. The paper later compares different initialization strategies and show they lead to difference in robustness in their experiments.

Strengths

This paper studies the influence of model initialization and training epochs to the adversarial robustness of the model, with both theoretical and empirical analysis. This paper also studies both GNN and DNN in general, with a great balance between staying focused, and comprehensiveness of the paper. The presentation of the paper is great and easy to follow.

Weaknesses

Although there are many theories and claims presented in the first half of the paper, they can all simply be interpreted as "smaller norm of weights lead to more tightly bounded distance in output space given a same perturbation and thus better robustness", which is not that interesting. Especially, it seems that it did not consider the softmax function, or other type of normalization that may be applied. Given these theories give very loose bound anyways, I am more interested to see how different initialization make a difference in practice. One big question of Fig.2 is that if they all trained to convergence and how their test accuracy look like. I hope to see more details about the experiment setting as well. Section 6.4 is the most interesting and important section in my view, where it compares different initialization strategies and their influence on robustness. It is unfortunately too short and it could be made great if authors could expand the experiments, draw some conclusions, or reveal more deep insights on the choice of initialization. To prove that different initialization do lead to different robustness, I think it need to cover more models and attacks. And importantly, as there is randomness in the initialization and training (if using dropout for example), I don't know if the results shown in Fig.4 is a single run of experiment or average among multiple runs. It should be average of multiple runs to avoid randomness which can lead to different conclusions. I am happy to be convinced to the value of this paper if these major concerns are addressed.

Questions

1. Regarding to Fig.2 , do they all trained to convergence and how their test accuracy look like? 2. Regarding to Fig.4, is it a single run of experiment or average of multiple runs?

Rating

6

Confidence

5

Soundness

3

Presentation

4

Contribution

3

Limitations

Presentation of limitations of this paper is decent.

Summary

This work investigates the relationship between weight initialization and adversarial robustness, specifically in Graph Neural Networks (GNNs). In this setting, a defender wants to train a GNN for which, given an input graph X, and adversary cannot find a similar graph which induces a different output from the GNN than X. The authors prove an upper bound on the adversarial risk of a given GNN that corresponds to the norm of the initial weights of the model. Bounds of this type are proved for both node feature robustness and structural robustness, with initialization shown to be more important in the structural case. Similar bounds are derived for other GNN architectures, like the GIN, and for DNNs more generally. Through experiments, it is shown that, as indicated by the theory, training models for more epochs can lead to higher robustness and lower variance parameters in weight initialization leads to higher robustness. These trends are shown to hold for different architectures, datasets, and weight initialization techniques.

Strengths

This paper seemingly has high originality, being the first to study the impact of weight initialization on model robustness. It may have significant implications for the field of adversarial robustness, and may lead to improved adversarial training techniques. Clarity is one of this paper's main strengths. It is clear how the claims made in the introduction relate to the theoretical results, and the proofs provided in the appendix are easy to follow. Overall, I think this is a well-written paper with interesting results.

Weaknesses

While the experimental section does validate many of the main results of the paper, there are other experiments that I would have liked to see to back up some claims made in earlier sections. Specifically, it would have been nice to see empirical results mirroring figure 2 but showing how different initializations impacted clean accuracy to show what the trade-off between accuracy and robustness looks like in a realistic setting. Also, I think the framing and ordering of this paper may limit its reach. Based on the abstract, this paper seems to be targeted towards those who are interested in graph neural networks, despite the fact that the generalized results would be compelling even absent the discussion of GNNs. I feel this paper would be more effective if it put the generalized results (section 5) first, and then followed that up with a case study in GNNs to give an example of how this theory can be applied in specific settings. Figures 1-3 are difficult to parse without closely reading their descriptions in the text. I would appreciate if the legends were made more descriptive and the captions were more detailed as to what is being shown.

Questions

- How tight are the bounds presented in sections 4 and 5? Do you think future work might be able to tighten these bounds? - In section G.1, it looks like the definition of adversarial risk is average-case (taking the expectation over all perturbations in a neighborhood), rather than worst-case. Was this intentional? It seems in conflict with the definition offered in equation 2. - It seems like these results may also suggest that regularization (to target final weights with a smaller norm) is good for robustness. There have been recent papers that study the relationship between regularization and robustness [1,2], do you think your paper relates to this line of research? - What are the implications of this for fine-tuning? Is this framework still useful when starting from a pretrained model? [1] Nern, Laura F., et al. "On transfer of adversarial robustness from pretraining to downstream tasks." Advances in Neural Information Processing Systems 36 (2024). [2] Dai, Sihui, Saeed Mahloujifar, and Prateek Mittal. "Formulating robustness against unforeseen attacks." Advances in Neural Information Processing Systems 35 (2022): 8647-8661.

Rating

7

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

Limitations are addressed in the problem setup and conclusion.

Summary

The paper investigates the under-explored impact of weight initialization on the robustness of Graph Neural Networks (GNNs) against adversarial perturbations. The authors present a theoretical framework linking weight initialization strategies and training epochs to the model's resilience to adversarial attacks. They derive an upper bound that connects the model's robustness to initial weight norms and training epochs, showing that appropriate initialization strategies enhance robustness without degrading performance on clean datasets. The findings are validated through extensive experiments on various GNN models and real-world datasets subjected to different adversarial attacks, extending the theoretical insights to Deep Neural Networks (DNNs).

Strengths

1. Originality: * The paper addresses a novel dimension of adversarial robustness in GNNs by focusing on weight initialization strategies, an area largely unexplored in existing literature. * Extends the theoretical framework to apply broadly to DNNs, showcasing its versatility and broader applicability. 2. Quality: * The theoretical analysis is rigorous, providing a clear connection between initialization strategies, training epochs, and model robustness. * Extensive experiments with diverse models and real-world datasets validate the theoretical findings, demonstrating the practical significance of the proposed framework. 3. Clarity: * The paper is well-structured, with a logical flow from theoretical analysis to experimental validation. 4. Significance: * The insights on the impact of weight initialization on adversarial robustness can influence future research directions and the development of more robust GNNs and DNNs.

Weaknesses

1. Hyperparameter Tuning: * The paper does not discuss the sensitivity of the proposed initialization strategies to other hyperparameters, such as learning rate, batch size, or the number of layers. This omission could lead to challenges in replicating and generalizing the findings, as the effectiveness of the initialization strategies might vary with different hyperparameter settings. 2. Practical Implementation: * The practical implementation details of the proposed initialization strategies in real-world scenarios are not deeply explored. Practitioners might struggle to adopt these strategies without clear guidance on integrating them into existing workflows. Including a discussion on how to balance the trade-off between choosing the right number of epochs to achieve optimal clean accuracy and the most robust model would strengthen the paper.

Questions

1. Interaction with Other Defense Mechanisms: how do the proposed initialization strategies interact with existing adversarial defense mechanisms, such as adversarial training or regularization techniques? For example, does combining your initialization methods with adversarial training lead to improved robustness, or are there any diminishing returns?

Rating

6

Confidence

3

Soundness

3

Presentation

3

Contribution

3

Limitations

The theoretical framework is primarily validated on GNNs, leaving uncertainty about its applicability to other types of neural networks, such as recurrent neural networks (RNNs) or transformer models. This limitation reduces the perceived impact and versatility of the findings. Extending the theoretical analysis and experimental validation to include these other neural network architectures would enhance the generalizability of the results.

Official Comment by Reviewer A9tB

I thank authors for the rebuttal that address my major concerns. This is not further questions but rather a few suggestions that might improve the paper. - I understand the results for ImageNet-1K is not feasible for the rebuttal, but I strongly encourage the authors to include them in the future. - If the authors could compare the impact of initialisation on adversarial attacks with other defence mechanisms, it would underscore the significance of exploring initialisation for adversarial robustness. For example, varying the initialisations could result in a ~5% difference in attacked accuracy, while other defences might similarly reduce attacked accuracy by ~5%. This comparison would highlight the potential and importance of further investigating initialisation strategies for improving adversarial robustness in the future. Consequently, I increase my score to 5 borderline accept as my concern on contribution remains.