Robustness of neural networks to random noise perturbations of their inputs

Technical Summary: Robustness of Neural Networks to Random Noise Perturbations of Their Inputs

Problem Statement
The paper addresses the evaluation of neural network (NN) robustness, specifically concerning the stability of predictions when input values are perturbed by random noise. While accuracy (measured via Mean Squared Error, MSE, or Multi-class Brier Score, MBS) is a standard metric for model quality, it does not account for stability under conditions such as random Gaussian noise. The authors note a known trade-off where increasing accuracy may decrease robustness. Existing research often focuses on modifying network weights or is limited to classification problems; this work treats the trained NN as a "black box" and focuses on input perturbations for both regression and classification tasks.

Methodology
The proposed approach involves a three-stage methodology:

1. Perturbation and Robustness Measure ($\theta$-robustness):
   The authors define a robustness measure, $\theta$, for a trained NN given a standard deviation $\sigma$ and a significance level $\alpha$. The measure $\rho(\sigma, \alpha, NN)$ represents the upper bound on the MSE (or MBS) of the network under input perturbation $\epsilon \sim N(0, \sigma^2)$ with probability $1-\alpha$.

   • Computation: This is approximated using a Monte Carlo method (Algorithm 1). The algorithm generates $m$ random noise vectors, computes the resulting MSE for each, sorts them, and selects the value at the $(1-\alpha)m$-th percentile as the robustness bound $\theta$.
   • Input Handling: For real-world datasets with mixed feature types, the method perturbs only numeric features. The noise variance for a specific numeric feature is scaled by its empirical standard deviation. A probability $p$ determines whether a specific numeric feature in a data item is perturbed.

2. Robustness Curves:
   To visualize the relationship between perturbation magnitude and error, the authors introduce "robustness curves." These plot the normalized robustness ratio $\rho(\sigma, \alpha, NN) / \text{MSE}_0$ (where $\text{MSE}_0$ is the baseline error) against the noise standard deviation $\sigma$. This normalization allows for scale-free comparison across different datasets.

3. Modeling with the Gompertz Function:
   The robustness curves are fitted to a four-parameter Gompertz function, a sigmoidal curve used for growth and saturation phenomena. The fit is evaluated using the coefficient of determination ($R^2$). Key points on the curve are identified:

   • Knee Point: The maximum curvature point before the inflection, marking the end of the linear regime where error grows slowly.
   • Inflection Point: The point of maximum growth rate.
   • Half-Maximum Slope: An intermediate threshold.

   Based on these fits, the authors define a Robustness Index ($G_i$). By normalizing the Gompertz curves to remove vertical asymptotes, they compare the "growth rate" ($b$) and "inflection point" ($c$) of different datasets. A relative robustness index ($R_{ij}$) is calculated to determine the fraction of the interval $[0, 1]$ where one curve lies below another (indicating lower error and higher robustness).

Experimental Setup and Results
The method was validated on five real-world datasets:

• Regression: "Deaths from Cancer" and "Flu vaccination rates" (small datasets, $n=31$).
• Classification: "Heart disease," "Wisconsin diagnostic Breast Cancer," and "MNIST" (handwritten digits).

Feedforward Neural Networks (FNNs) were trained on these datasets. The authors verified that their baseline performance (MSE, RMSE, F1 scores) was comparable to literature standards.

• Curve Fitting: The Gompertz function provided excellent fits for all datasets ($R^2 > 0.99$), confirming the S-shaped degradation of performance as noise increases.
• Threshold Analysis: For regression tasks, the authors found that a user-defined threshold of twice the baseline MSE ($y=2$) was a sensible metric for robustness. For classification tasks, the "knee point" of the curve was more appropriate.
• Robustness Hierarchy: Using the calculated Robustness Index ($G_i$), the datasets were ranked by robustness. The "Deaths from Cancer" dataset yielded the most robust model ($G_1 = 0.9866$), followed by "Flu vaccination rates," "Breast Cancer," "Heart disease," and finally "MNIST" ($G_5 = 0.1708$). The resulting hierarchy is:
  $$\text{Deaths from Cancer} > \text{Flu vaccination rates} > \text{Breast Cancer} > \text{Heart disease} > \text{MNIST}$$

Significance and Claims
The paper claims to provide a simple, efficient, and black-box method for quantifying neural network robustness without requiring access to internal weights or architecture modifications. Key contributions include:

1. A Probabilistic Upper Bound: A method to estimate an upper bound on MSE/MBS under Gaussian noise with a specified confidence level.
2. Robustness Curves: A visualization tool to analyze the degradation of model performance as noise increases, revealing linear regimes and saturation points.
3. Comparative Metric: The introduction of a robustness index based on Gompertz curve parameters, allowing for the quantitative comparison of robustness across different datasets and models.

The authors conclude that while their method is effective for the tested datasets, future work should validate it on additional datasets and extend the concept of robustness to generative models like Variational Autoencoders (VAEs). They explicitly state that the method is valid for other ML algorithms as well, provided they can be treated as deterministic black boxes once trained.