Revisiting the Relation Between Robustness and Universality
This work clarifies the limitations of universality in robust neural networks, addressing a theoretical problem for researchers in adversarial machine learning.
The paper revisits the modified universality hypothesis, which suggests adversarially robust models are highly similar, and finds that while representational similarity holds in specific settings, predictive behavior does not converge with increasing robustness and varies across datasets.
The modified universality hypothesis proposed by Jones et al. (2022) suggests that adversarially robust models trained for a given task are highly similar. We revisit the hypothesis and test its generality. While we verify Jones' main claim of high representational similarity in specific settings, results are not consistent across different datasets. We also discover that predictive behavior does not converge with increasing robustness and thus is not universal. We find that differing predictions originate in the classification layer, but show that more universal predictive behavior can be achieved with simple retraining of the classifiers. Overall, our work points towards partial universality of neural networks in specific settings and away from notions of strict universality.