Autonomous systems (AS) increasingly use neural networks (NNs) due to their ability to process high-dimensional data such as camera images [1], LiDAR scans [2] and textual prompts [3]. At the same time, NNs are known to suffer from robustness vulnerabilities: a slightly perturbed or outof-distribution input [4], [5] may lead to very different and unexpected outputs. In turn, such vulnerabilities may severely compromise the safety and predictability of NN-based AS.
Since the discovery of NN robustness issues [4], there has been an impressive amount of research on this topic. Researchers have developed a number of robust training methods, including adversarial training [6], certified robustness [7], [8], knowledge distillation [9], and semi-infinite constrained learning [10]. Although significant progress has been made, training robust NNs remains largely an unsolved and very challenging problem (e.g., the current leader on the CIFAR-10 robustness leaderboard [11] can only achieve high robust accuracy for perturbations of at most 8/255).
We note that the vast majority of existing methods approach the problem from an optimization point of view: e.g., in adversarial training the goal is to train a NN that minimizes the loss not only on training data but also on the worst-case bounded perturbations of that data. This bilevel non-convex optimization problem is challenging to solve and leads to suboptimal solutions, especially if gradient descent is used.
This material is based upon work supported by the National Science Foundation (NSF) under Award No. 2403616, as part of the NSF Cyber-Physical Systems Program. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.
We take a fresh look at NN robustness through the lens of graph theory and network science analysis, in particular graph curvature (GC). GC (e.g., Ricci curvature [12]) has been effectively applied in numerous domains that can be modeled as graphs, including road traffic analysis [13], [14], internet routing [15], machine learning [16], [17], and biological networks [16], [18], due to its ability to capture intrinsic geometric and local structure of the space, such as connectivity and robustness in networks. GC can quantify the importance of specific edges; for example, an edge with negative curvature can be considered a bottleneck and is greatly important for the overall graph functionality, e.g., such an edge may connect different communities within the graph [19], [20].
In this paper, we employ GC in order to analyze the robustness of NN classifiers. We introduce the notion of neural Ricci curvature (NRC) that captures the bottleneck intuition of standard Ricci curvature -if an edge has a negative NRC, then it is heavily used by the NN and is thus likely a source of robustness vulnerability. To calculate the NRC, we construct a neural data graph, i.e., a graph in the shape of the NN architecture, where edges are weighted by a combination of the NN weights and the magnitude of data that goes through each edge when an example is provided as input.
We evaluate the significance of the NRC using NNs trained on MNIST. We show that neural data graphs corresponding to more robust examples (i.e., examples which are correctly classified even for an adversarial perturbation) indeed have fewer negative-NRC edges. The results are consistent across architectures, including adversarially trained ones. This result will serve as the basis for an alternative, graph-based, method for robust training, that minimizes the number of negative-NRC edges and promotes balanced usage of all NN edges. In summary, this paper makes two contributions: 1) we define the concepts of neural data graphs and neural Ricci curvature that can be used to identify bottleneck NN edges that contribute to robustness issues; 2) we provide an evaluation on MNIST that demonstrates that bottleneck edges indeed occur more frequently in examples where NNs are less robust.
The concept of Ricci curvature [21] is used in Riemannian geometry to quantify the degree to which the geometry of a space deviates from being flat, as is the case for Euclidean space. In continuous manifolds, positive curvature is seen in spherical surfaces where geodesics converge, negative curvature is found in hyperbolic surfaces where geodesics diverge, and zero curvature characterizes flat Euclidean surfaces with parallel geodesics. The Ollivier-Ricci curvature (ORC) [12] serves as a discrete analogue, e.g., in the case of graphs, to curvature measurements in continuous spaces, and it is computed using transport theory via the Wasserstein distance.
Definition 1 (Ollivier-Ricci Curvature [12]). Given a graph G(V, E) with vertex set V and edge set E, the ORC κ(u, v) between two adjacent vertices u and v is given by
where d(u, v) is the shortest-path distance between u and v, m u and m v are the probability distributions over the neighbors of u and v, respectively; W 1 (m u , m v ) is the Wasserstein distance between distributions m u and m v and is given by
where Π u,v is the set of probability measures µ u,v that capture all possible ways of transferring mass from m u to m v , i.e.,
For unweighted nodes, the probability distribution is typically distributed uniformly to all the neighbors of u and v. Otherwise, the probability distribution is adjusted based on the edge weights, e.g., using an exponential function [22].
A positive curvature indicates that nodes within a particular region are tightly connected (due to a smaller W 1 ), suggesting a robust community structure. A negative curvature points to areas with more dispersed connections, often signifying edges that act as bridges between different communities. For example, if an edge e between u and v is a bottleneck, then all paths from u's neighbors to v's neighbors have to go through e; in this case, κ(u, v) < 0 since W 1 > d(u, v). This makes ORC particularly effective at identifying bottleneck edges that may introduce robustness issues, i.e., the graph functionality is not robust to removing such negative-curvature edges.
III. PROBLEM STATEMENT Consider a trained NN classifier f θ : X → {1, . . . , N }, where X ⊆ R n is the set of all input examples, and each example is assigned a label from 1 to N . We assume f θ is an L-layer feedforward NN (possibly including convolutional layer), parameterized by θ = {(W 1 , b 1 ), . . . , (W L , b L )}, where W i and b i are the weights and biases of layer i. Thus, each layer i can be written as a function
where σ is the ReLU activation: σ(x) = max{0, x}.
An example (x, y) is ε-robust if there exists no ε-bounded perturbation of x that changes the label predicted by f , i.e.,
where y is the true (unknown) label of x. An example is called ε-nonrobust if there exists a δ that satisfies ∥δ∥ ∞ ≤ ε for
test accuracy is the fraction of ε-robust examples in the test set. Although NN robustness is distinct from graph robustness, we hypothesize that non-robust NNs correspond to non-robust graphs.
The problem considered in this paper is to define the notions of a neural data graph G f θ ,x and a corresponding neural Ricci curvature. In particular, the NRC definition must capture the notion of a bottleneck edge such that a NN with more negative-NRC edges is less robust to input perturbations.
Notation. We use n l,i to denote neuron i in layer l in the NN; n l,i (x) denotes the neuron's activation given NN input x. Similarly, w l,jk denotes the NN weight on the edge between n l,j and n l+1,k , i.e., matrix entry [W l ] kj . Given graph nodes u and v, we use w(u, v) to denote the weight of edge (u, v).
Our approach is motivated by prior work on analyzing the robustness of road and transit traffic networks to individual segments [13], [14], [16]. To model the problem as a graph, one can map each intersection to a node and each segment to an edge; the edge weight is determined by historical data, e.g., travel time per passenger. Thus, if an edge has a negative ORC, i.e., its cost is lower than the costs of paths through the node's neighbors, then this edge is likely a bottleneck.
The above example has obvious analogues and differences with respect to NNs. The main similarities are: 1) a NN has a natural graph structure; 2) NN edges can be considered as roads that carry data; 3) NN weights can be thought of as edge weights such that a larger NN weight means more data gets through (i.e., less travel time). However, two NN characteristics distinguish it from the traffic network case: i) the NN has non-linear activations which break the traffic analogy (different levels of traffic "get through" depending on the input); ii) the NN has positive and negative weights, which makes it impossible to apply the vanilla ORC analysis.
In what follows, we define the concepts of a neural data graph and neural Ricci curvature, through iteratively addressing the challenges above: 1) we start with a neural graph; 2) we address the non-linearity challenge through calculating each ReLU's phase (0 or linear) for the current input x; 3) we address the mixed-sign challenge through normalizing the NN weights for the current input x. Definition 2 (Neural Graph). Given a NN f θ , we define a neural graph G f θ as follows:
• each NN neuron becomes a node in G f θ and each NN edge becomes an edge in
Definition 2 is based purely on the NN and thus cannot address the challenges mentioned above. The following construction provides an approach that alleviates those challenges. Definition 3 (Neural Data Graph). Given a NN f θ and an example x, we define a neural data graph G f θ ,x as follows:
• construct neural graph G f θ according to Definition 2;
• an edge (n l,i , n l+1,j ) is removed from G f θ if n l,i (x) = 0, i.e., the ReLU is in its zero phase;
Algorithm 1 Mixed-Sign Weights Normalization Input: Mixed-sign NN weights w l,1j , . . . , w l,Kj , neuron activations n l,1 (x), . . . , n l,K (x) //Assuming layer l has K neurons Output: Graph weights w(n l,1 , n l+1,j ), . . . , w(n l,K , n l+1,j )
1: sum = K i=1 w l,ij n l,i (x) 2: //it must be the case that sum ≥ 0; otherwise ReLU would be in 0 phase 3: for i = 1 to K do end if 11: end for
• if weights w l,1j , . . . , w l,Kj (where K is the number of neurons in layer l) going into node n l+1,j (x) > 0 have mixed signs, normalize weights using Algorithm 1.
The last two parts of Definition 3 modify the original neural graph G f θ based on the contribution of the input example x. Algorithm 1 only applies when n l1,j (x) > 0 since otherwise the ReLU would be its zero phase and all outgoing edges would be removed. Algorithm 1 normalizes the weights such that negative weights are reset to 0 and positive weights are normalized so that overall sum remains the same. Given Definition 3, we are ready to define the neural Ricci curvature, which is essentially the ORC applied to the neural data graph. Definition 4 (Neural Ricci Curvature). Consider a NN f θ , an input example x and a corresponding neural data graph G f θ ,x , as defined in Definition 3. The NRC of a NN edge (n l,i , n l+1,j ) is defined as the ORC of the corresponding edge in G f θ ,x .
The evaluation aims to demonstrate the following: given a NN, ε-robust examples with higher ε tend to result in neural data graphs with fewer negative-NRC edges. Note that this result is orthogonal to the overall NN robustness -even nonrobust NNs exhibit some ε-robust examples with large ε. This finding implies that training NNs with fewer negative-NRC edges would be an effective method for robust training.
We evaluate the NRC concept on the MNIST dataset [23]. MNIST consists of 28 × 28 grayscale images of handwritten digits; there are 60,000 training images and 10,000 test images. We use two fully-connected NN architectures, [15,20] and [15,25,20,15], where notation [K 1 , . . . , K L ] means the NN has L layers, with K i neurons in layer i. Each architecture is trained in three ways: 1) using cross-entropy loss; 2) using cross-entropy with weight decay regularization; 3) using adversarial training [6]. For further evaluation, we also include a convolutional NN (CNN), trained with cross-entropy, with two convolutional layers (first layer has six 6 × 6 kernels, NN setup ε = 0.03 ε = 0.07 ε = 0.1 ε = 0.2 [15,20], CE 0.517 0.044 0.005 0.000 [15,20], WD 0.851 0.421 0.175 0.014 [15,20], AT 0.845 0.766 0.685 0.270 [15,25,20,15], CE 0.471 0.054 0.007 0.000 [15,25,20,15], WD 0.801 0.311 0.109 0.001 [15,25,20,15], AT 0.862 0.780 0.692 0.253 CNN, CE 0.939 0.725 0.409 0.017
TABLE I: Robust test accuracy (evaluated using the projected gradient descent attack [6]) for all setups: cross-entropy (CE), cross-entropy + weight decay (WD), adversarial training (AT). NN setup ε = 0.03 ε = 0.07 ε = 0.1 ε = 0.2 [15,20], CE 1.48 1.30 1.28 N/A [15,20], WD 1.47 1.45 1.37 1.24 [15,20], AT 1.15 1.15 1.14 1.12 [15,25,20,15], CE 2.04 1.81 1.66 N/A [15,25,20,15], WD 1.93 1.92 1.86 N/A [15,25,20,15], AT 2.10 2.09 2.10 2.08 CNN, CE 3.43 3.42 3.44 3.31
TABLE II: Average AUC over all labels for all considered setups: cross-entropy (CE), cross-entropy + weight decay (WD), adversarial training (AT). stride of two; second layer has 16 6 × 6 kernels, stride of two) and two fully-connected layers, [120,84]. The models' robust accuracies are reported in Table I. All experiments were run on a 95-core machine with an NVIDIA A40 unit; calculating curvatures per example took on average 1.2s, 1.4s and 3.2s for the two-layer NN, four-layer NN and CNN, respectively.
To perform the evaluation, we use the test set to identify ε-robust and ε-nonrobust images for each setup, where ε is incremented from 0.03 to 0.2. We calculate the NRCs for each resulting neural data graph and plot them using a cumulative distribution function (CDF). As shown in Fig. 1, the CDF grows faster for examples which are less ε-robust, i.e., those examples have more negatve-NRC edges, on average, than the graphs corresponding to more ε-robust examples.
For further evaluation, we also present the average area under the CDF curve (AUC) per label (averaged over 70 test examples). Fig. 2 provides the average results for the two-layer fully-connected (FC) NN. Fig. 2a very clearly demonstrates that the AUC decreases with larger ε, i.e., more ε-robust examples result in fewer negative-NRC edges on average. Although the benefit is less pronounced for the other setups, there is still a clear downwards trend as ε is increased. Finally, Table II presents the AUC results for all setups. Once again, we emphasize that the same trend can be observed across all considered setups. Finally, we note that the CNN trends are less emphasized, which is likely due to the fact that convolutional layers have very few edges per node; we will explore this phenomenon at greater depth in future work.
This paper introduced neural data graphs and neural Ricci curvature, which provide an alternative way of analyzing NN robustness. We presented an evaluation on the MNIST dataset to demonstrate that more robust NNs (as well as more εrobust examples) result in fewer negative-NRC edges. In future work, we will perform an evaluation over multiple datasets
-50 -40 -30 -20 -10 0 Neural Ricci Curvature 0.0 0.2 0.4 0.6 0.8 1.0 Cumulative Distribution Function Two-layer FC network: Cross-entropy eps = 0.03 eps = 0.1 -2.00 -1.75 -1.50 -1.25 -1.00 -0.75 -0.50 -0.25 0.00 0.05 0.10 0.15 (a) Cross-entropy, label 2. -50 -40 -30 -20 -10 0 Neural Ricci Curvature 0.0 0.2 0.4 0.6 0.8 1.0 Cu ulative Distribution Function Two-layer FC network: Cross-entropy + weight decay eps = 0.03 eps = 0.1 -2.00 -1.75 -1.50 -1.25 -1.00 -0.75 -0.50 -0.25 0.00 0.05 0.10 0.15 0.20 (b) Cross-entropy + weight decay, label 4. -50 -40 -30 -20 -10 0 Neural Ricci Curvature 0.0 0.2 0.4 0.6 0.8 1.0 Cumulative Distributio Fu ctio Two-layer FC etwork: Adversarial trai i g eps = 0.03 eps = 0.1 -2.00-1.75-1.50-1.25-1.00-0.75-0.50-0.25 0.00 0.05 0.10 0.15 0.20 (c) Adversarial training, label 3. 0 1 2 3 4 5 6 7 8 9 Image label 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 Area under the CDF curve Two-layer FC network: Cross-entropy eps = 0.03 eps = 0.05 eps = 0.07 eps = 0.1 (a) Cross-entropy. 0 1 2 3 4 5 6 7 8 9 Image label 0.9 1.0 1.1 1.2 1.3 1.4 1.5 Area under the CDF curve Two-layer FC network: Adversarial training eps = 0.03 eps = 0.05 eps = 0.07 eps = 0.1 eps = 0.2 (c) Adversarial training. and robust training methods [24]- [26], and will explore an approach for robust training, e.g., by regularizing training through a term that penalizes low-curvature edges.