PaperlayerView exact revision on arXiv

Source-linked AI summary

Are All Layers Created Equal?

Chiyuan Zhang, Samy Bengio, Yoram Singer

arXiv:1902.01996v4stat.MLcs.AIcs.LG

TL;DR

Overparameterized networks are difficult to understand using coarse capacity measures, so the paper probes their layer-wise functional structure through post-training parameter modifications. It finds heterogeneous layers that are either robust or critical, with robust-layer resets usually preserving performance, while noting limitations of the robustness defense and its qualitative threshold.

  • Problem

    Excessively overparameterized networks challenge capacity-based explanations of generalization, motivating finer analysis of how individual layers coordinate learned computations.

  • Method

    The paper empirically studies re-initialization and re-randomization robustness by modifying individual layers after training and evaluating the resulting networks.

  • Results

    Experiments provide evidence that layers are heterogeneous, with robust layers tolerating resets with negligible performance effects while critical-layer re-initialization can reduce test performance to random guesses.

  • Takeaways & Limitations

    Parameter counting and norm accounting are too coarse for studying generalization, so robustness and optimization-landscape analyses should respect heterogeneous network architectures.

  • Takeaways & Limitations

    Layer robustness does not sufficiently defend against strong attacks that explicitly handle non-deterministic classifiers, and “negligible” performance decline has no universal threshold.

Abstract

from arXiv · show

Understanding deep neural networks is a major research objective with notable experimental and theoretical attention in recent years. The practical success of excessively large networks underscores the need for better theoretical analyses and justifications. In this paper we focus on layer-wise functional structure and behavior in overparameterized deep models. To do so, we study empirically the layers' robustness to post-training re-initialization and re-randomization of the parameters. We provide experimental results which give evidence for the heterogeneity of layers. Morally, layers of large deep neural networks can be categorized as either "robust" or "critical". Resetting the robust layers to their initial values does not result in adverse decline in performance. In many cases, robust layers hardly change throughout training. In contrast, re-initializing critical layers vastly degrades the performance of the network with test error essentially dropping to random guesses. Our study provides further evidence that mere parameter counting or norm calculations are too coarse in studying generalization of deep models, and "flatness" and robustness analysis of trained models need to be examined while taking into account the respective network architectures.

1. Introduction

The paper studies how individual layers contribute to learned functions in overparameterized networks, motivated by limits of classical capacity-based explanations and the need for interpretable robustness analysis.

  • The paper examines post-training layer roles in functions learned by gradient-based neural networks.
  • Classical uniform-convergence arguments struggle to explain generalization in excessively large networks that can fit random labels.
  • Prior analyses emphasize post-training complexity measures such as norms, margins, robustness, and flatness rather than total hypothesis-space capacity.
  • The paper relates layer-wise behavior to generalization and robustness properties in conventional deterministic networks.
  • The identified layer-robustness properties can transform a conventionally trained deterministic model into a stochastic model.

2. Setting

The study defines layer-wise robustness by modifying parameters after training and measuring test performance, while tracking training checkpoints and parameter distances.

  • A network is represented as a composition of D parametric layers, with each layer transforming inputs from the preceding layer.
  • The analysis evaluates performance along the training trajectory using saved epoch checkpoints, including random initialization and the final trained model.
  • Re-initialization replaces one trained layer with its value from initialization or an earlier checkpoint while keeping the other parameters fixed.
  • Figure 1 measures MNIST test error by modified layer and checkpoint, alongside normalized 2-norm and ∞-norm distances from initialization.
  • Re-randomization replaces one layer with newly sampled parameters from the same initialization distribution.
  • A layer is robust when modification causes negligible performance decline and critical otherwise, without retraining or fine-tuning afterward.

3. Robustness of Individual Layers

The study finds that layer robustness is heterogeneous across architectures and tasks: some layers tolerate post-training re-initialization, while critical layers remain sensitive. Robustness patterns vary with network capacity, task difficulty, and architecture, and individual robustness does not guarantee joint robustness.

  • Fully Connected Networks: Re-initializing any layer in an FCN trained on MNIST can reduce representations to random-guessing accuracy, whereas all but the first layer remain robust to re-initialization.The study distinguishes re-initialization from re-randomization: the first layer is especially sensitive to re-initialization, while re-randomization disrupts classification more broadly.
  • Fully Connected Networks: Wider FCNs on MNIST make top layers increasingly robust, consistent with larger capacity allowing lower layers to form predictors while upper layers act as random nonlinear projections.When capacity is small, all layers participate more actively in representing the prediction function.
  • Fully Connected Networks: On CIFAR-10, increasing task difficulty produces less pronounced robustness patterns, suggesting that more layers participate in forming accurate predictors.The comparison uses FCNs with varying hidden dimensions and contrasts CIFAR-10 with MNIST.
  • Large Convolutional Networks: VGG networks show more re-initialization-sensitive layers than FCNs, but lower layers remain more sensitive than upper layers.The VGG results are reported on CIFAR-10 using transposed heatmaps to display the deeper architecture.
  • Large Convolutional Networks: ResNets distribute critical layers throughout their depth rather than concentrating them at the bottom, and residual blocks robust to re-initialization are also robust to re-randomization.The residual-block result contrasts with the final linear layer, which does not share this re-randomization robustness.
  • Large Convolutional Networks: Although individual ResNet layers can be robust, jointly resetting grouped layers can fail; alternative grouping can significantly improve joint robustness.For ResNet152, jointly resetting about half of the layers produced better robustness than resetting all but the first residual blocks together.

4. Joint Robustness

The paper tests whether layers that are individually robust remain robust when reset together. Joint behavior depends on the grouping: some individually robust layers fail collectively, while alternative groupings preserve robustness better.

  • Joint re-initialization and re-randomization are evaluated by dividing layers into groups and resetting each group simultaneously.
  • For ResNets, jointly resetting all but the first residual blocks is not robust despite each layer being individually robust.
  • A different grouping can substantially improve robustness when approximately half of the ResNet layers are reset together.
  • Freezing selected layers produces higher error than average individual-layer robustness, but the gap is smaller than under direct joint resetting.
  • On CIFAR-10, removing the selected layers can preserve similar performance, whereas removal on ImageNet causes a significant performance drop.

5. Other Architectures and Domains

The layer-robustness phenomenon extends beyond conventional image classifiers to language models, Vision Transformers, and MLP-Mixers. Across these settings, robustness varies by layer type, depth, architecture, and training regime.

  • The study extends layer-robustness evaluation to language modeling and convolution-free vision architectures, finding results that corroborate earlier observations.
  • Transformer-Based Neural Language Models: The language-model experiment uses a 12-layer decoder-only T5-Base variant with 112,242,480 parameters trained on LM1B.
  • Transformer-Based Neural Language Models: Language-model robustness is measured by average per-token validation accuracy after layer re-randomization or re-initialization to checkpoints from epochs 0, 1, 2, 5, 10, 15, and 20.
  • Transformer-Based Neural Language Models: Higher layers are generally more robust, while layer-normalization layers and first MLP dense layers are sensitive; attention components and second MLP dense layers are generally robust.
  • Transformer-Based Neural Language Models: Many language-model layers become robust after one training epoch, which the authors suggest may relate to the larger text-domain training sets.
  • Convolution-Free Architectures for Computer Vision: Vision Transformers show patterns similar to text Transformers, with attention layers and higher-block second MLP dense layers generally robust.
  • Convolution-Free Architectures for Computer Vision: The larger ViT-L/16 is generally more robust than ViT-B/16, while SAM optimization improves robustness for ViT-B/16 but can reduce it for some higher layer-normalization layers in ViT-L/16.
  • Convolution-Free Architectures for Computer Vision: MLP-Mixers exhibit overall robustness patterns similar to those of Vision Transformers.

6. Connections to Other Notions of Robustness

Layer re-initialization and re-randomization provide a layer-specific robustness notion related to, but distinct from, flatness and adversarial robustness. The experiments connect robust layers to randomized defenses while showing that strong adaptive attacks remain a limitation.

  • Flatness studies local parameter perturbations near a converged model, while this paper’s layer robustness can involve non-local trajectory-based perturbations.
  • Layer re-initialization robustness concerns perturbations along the training trajectory, whereas re-randomization permits larger perturbations of trained parameters.
  • Because robustness is layer-dependent, analyzing layers individually can provide more refined insights than treating the network as a whole.
  • Output randomization significantly improves robustness to weak FGSM attacks and remains an order of magnitude better than baseline under strong PGD attacks, despite a sharp performance drop.
  • More sophisticated attacks that explicitly account for non-deterministic classifiers could completely undermine randomized defenses based on robust layers.

7. Discussion

The paper connects layer robustness to generalization analysis and argues that overparameterized networks contain heterogeneous robust and critical layers. It also motivates architecture-aware complexity measures and future study of mixed learned-random networks.

  • Generalization and criticality: Robust layers can control complexity terms in PAC-Bayes bounds and yield more faithful generalization rankings than several previous complexity measures.The cited theoretical work formalizes module criticality and derives bounds for perturbed networks.
  • Layer heterogeneity: The empirical results show that layers split into robust and critical categories, with robust-layer resets causing negligible performance changes.This heterogeneity also suggests structural symmetry breaking related to initialization.
  • Architecture-aware analysis: Parameter counting and norm accounting are too coarse for studying generalization because network parameters do not form a monolithic set.The paper argues that optimization-landscape analysis should respect network architecture and layer heterogeneity.
  • Architecture-aware analysis: The study motivates composite divergences that measure learning progression across heterogeneous parameter groups rather than across the entire parameter set.This direction is contrasted with using Bregman divergences over the full parameter set.
  • Future directions: The paper proposes hybrid learned-random networks as a potential direction, extending beyond fully random feature representations.The proposed direction follows from the observed distinction between learned critical layers and robust layers.

A. Details of Experimental Setup

The experiments evaluate fully connected, VGG, and ResNet architectures on MNIST, CIFAR-10, and ImageNet using standardized SGD training and dataset-specific preprocessing. Architectural and implementation choices vary with dataset scale and experimental purpose.

  • Training protocol: The study uses MNIST, CIFAR-10, and ImageNet, training models with SGD, momentum 0.9, 100 epochs, and scheduled learning-rate reductions.The learning rate is multiplied by 0.2 at epochs 30, 60, and 90.
  • Architectures: The analyzed architectures are fully connected networks, VGG networks, and ResNets.FCNs use equal-width ReLU layers before a final classifier; VGGs combine convolutional and fully connected layers.
  • Architectures: ResNet configurations differ by image size: ImageNet uses an initial 7 × 7 convolution and pooling, whereas CIFAR-10 uses a 3 × 3 stride-1 convolution.The CIFAR-10 choice avoids reducing spatial resolution at the input.
  • Implementation choices: The adversarial-robustness experiments use a modified ResNet with explicit downsampling layers between stages and identity skip connections in all residual blocks.This modification is specific to the experiments described in the cited passage.
  • Implementation choices: The main-text ResNets omit batch normalization, with full comparisons of architectures with and without batch normalization provided in Appendix C.This is an explicit scope condition for the main experiments.
  • Data preprocessing: Training preprocessing includes padding, random flips, and random crops for CIFAR-10, random crops for ImageNet training, and dataset-level pixel normalization.ImageNet testing uses center crops.

B. Further Details on Joint Robustness

Joint robustness is generally weaker than individual layer robustness, but selected grouping schemes can make substantial subsets jointly robust. The appendix evaluates these effects on FCNs and ResNets.

  • FCNs on MNIST: On MNIST, FCN 5 × 256 groups layer1 separately from higher layers because layers above layer1 are individually robust to re-initialization.The resulting joint analysis is shown in Figure 11(a).
  • FCNs on MNIST: Grouping two of every three layers slightly improves joint robustness, while an every-other-layer scheme makes about half the layers jointly robust.These alternative schemes are reported in Figure 11(b) and Figure 11(c).
  • ResNets on CIFAR-10: For ResNets on CIFAR-10, bundling residual blocks across stages produces results similar to FCNs: ResNet-18 is relatively robust, whereas deeper ResNets are not jointly robust.The grouping follows individual layer-robustness results and is illustrated in Figure 12.
  • Overall finding: Individually robust layers are generally not jointly robust, but carefully selected subsets can achieve joint robustness for up to half of the layers.Finding the best grouping involves trading off robustness against the number of included layers.
  • Residual-block context: Figure 10 distinguishes residual blocks with and without a downsampling skip branch and identifies convolution, normalization, and ReLU components.Bottleneck blocks add a three-convolution residual body with a 4× middle-channel reduction.

C. Batch Normalization and Weight Decay

Weight decay and batch normalization change performance and robustness patterns, but pronounced layer-robustness structure remains across VGG and ResNet settings. Early-training checkpoints can be less robust than initialization checkpoints for many layers.

  • Performance effects: On CIFAR-10, training with or without weight decay and batch normalization changes performance by 3% to 5%, while the ImageNet gap can reach 10%.Table 3 reports classification error rates for the compared configurations.
  • Robustness patterns: Layer-robustness patterns remain pronounced across VGG-16 and ResNet-50 under varied weight-decay and batch-normalization configurations.The comparisons are shown for CIFAR-10 and ImageNet.
  • Experimental comparisons: The robustness comparisons explicitly examine how weight decay and batch normalization affect VGG16 and ResNet-50 layer patterns.The figure captions identify these training conditions as the comparison axes.
  • Measurement comparison: Figure 17 compares test-error robustness with normalized parameter distances under ℓ2 and ℓ∞ metrics for VGG-16 on CIFAR-10.Figure 18 applies the same layout to ResNet-50 and separates configurations with and without weight decay and batch normalization.
  • Checkpoint effects: For many layers, re-initialization from checkpoint-1 is less robust than re-initialization from checkpoint-0.The paper suggests that aggressive early learning may produce larger parameter or statistic changes than later training.

D. Robustness and Distances

Layer robustness does not consistently track parameter movement from initialization. Across examined models, normalized ℓ2 distances show some correspondence with robustness, while ℓ∞ distances and training settings produce weaker or unclear relationships.

  • Distance–robustness comparisons: For FCNs on MNIST, neither normalized 2-norm nor ∞-norm parameter distance showed an obvious correlation with re-initialization robustness.The comparison measured layer-wise distances from checkpoint-0 values.
  • Distance–robustness comparisons: The appendix compares layer-robustness patterns with layer-wise distances across additional models and datasets studied in the paper.These comparisons extend the initial FCN-on-MNIST analysis.
  • Distance–robustness comparisons: VGG-16 upper layers remained robust despite large ℓ∞ distances from initialization.By contrast, normalized ℓ2 distance appeared correlated: more robust upper layers moved smaller distances during training.
  • Distance–robustness comparisons: For ResNet-50 without weight decay and batch normalization, critical layers had slightly larger distances from random initialization, indicating a weak correlation.With weight decay and batch normalization, the relationship between distance and robustness was less clear.

E. Alternative Visualizations

The paper supplements heatmaps with line plots to make close numerical robustness values easier to distinguish. These alternative visualizations cover VGG-16 and ResNet-50 results across CIFAR-10 and ImageNet.

  • Visualization design: Line plots provide an alternative to heatmaps because color coding makes closely spaced numerical values difficult to distinguish.Heatmaps remain useful for uncluttered comparisons across layers and training epochs.
  • Model and dataset coverage: Figure 21 presents alternative layer-robustness visualizations for ResNet-50 on CIFAR-10 and ImageNet.The figure organizes CIFAR-10 in the first row and ImageNet in the second row.
Loading 1902.01996v4…