In this paper, we explore the properties of loss curvature with respect to
input data in deep neural networks. Curvature of loss with respect to input
(termed input loss curvature) is the trace of the Hessian of the loss with
respect to the input. We investigate how input loss curvature varies between
train and test sets, and its implications for train-test distinguishability. We
develop a theoretical framework that derives an upper bound on the train-test
distinguishability based on privacy and the size of the training set. This
novel insight fuels the development of a new black box membership inference
attack utilizing input loss curvature. We validate our theoretical findings
through experiments in computer vision classification tasks, demonstrating that
input loss curvature surpasses existing methods in membership inference
effectiveness. Our analysis highlights how the performance of membership
inference attack (MIA) methods varies with the size of the training set,
showing that curvature-based MIA outperforms other methods on sufficiently
large datasets. This condition is often met by real datasets, as demonstrated
by our results on CIFAR10, CIFAR100, and ImageNet. These findings not only
advance our understanding of deep neural network behavior but also improve the
ability to test privacy-preserving techniques in machine learning.

本文研究深度神经网络中相对于输入数据的损失曲率的特性，并探讨了训练集和测试集之间的输入损失曲率变化及其对测试集辨别性的影响。通过构建理论框架，我们得出了基于隐私和训练集大小的对训练集和测试集辨别性的上界。这一新颖的发现促进了一种利用输入损失曲率的黑盒成员隶属推断攻击的开发。通过在计算机视觉分类任务中进行实验验证，我们证实了我们的理论发现，并展示了输入损失曲率在成员隶属推断效果上超过现有方法。我们的分析突出了成员隶属推断攻击方法在训练集大小变化时的性能差异，表明基于曲率的成员隶属推断攻击在足够大的数据集上胜过其他方法。我们的结果在 CIFAR10、CIFAR100 和 ImageNet 上证明了这种情况往往适用于真实数据集。这些发现不仅推进了对深度神经网络行为的理解，而且改进了在机器学习中测试隐私保护技术的能力。

曲率线索：用输入失真曲率解码深度学习隐私

Curvature Clues: Decoding Deep Learning Privacy with Input Loss  Curvature

We present a new approach to understanding the relationship between loss
curvature and generalisation in deep learning. Specifically, we use existing
empirical analyses of the spectrum of deep network loss Hessians to ground an
ansatz tying together the loss Hessian and the input-output Jacobian of a deep
neural network. We then prove a series of theoretical results which quantify
the degree to which the input-output Jacobian of a model approximates its
Lipschitz norm over a data distribution, and deduce a novel generalisation
bound in terms of the empirical Jacobian. We use our ansatz, together with our
theoretical results, to give a new account of the recently observed progressive
sharpening phenomenon, as well as the generalisation properties of flat minima.
Experimental evidence is provided to validate our claims.

我们提出了一种新的方法来理解深度学习中损失曲率和泛化之间的关系，特别地，我们使用深度网络损失 Hessian 频谱的现有经验分析来基于一个猜想将深度神经网络的损失 Hessian 和输入输出 Jacobian 联系在一起。我们证明了一系列理论结果，这些结果量化了模型的输入输出 Jacobian 在数据分布上近似其 Lipschitz 范数的程度，并在经验 Jacobian 的术语中推导出一个新的泛化界限。我们使用我们的猜想以及我们的理论结果来提供一个关于最近观察到的渐进锐化现象以及平坦极小值的泛化特性的新解释。我们提供了实验证据来验证我们的论点。

渐进锐化、平坦最小值和泛化

On progressive sharpening, flat minima and generalisation

This paper establishes minimax rates for online regression with arbitrary
classes of functions and general losses. We show that below a certain threshold
for the complexity of the function class, the minimax rates depend on both the
curvature of the loss function and the sequential complexities of the class.
Above this threshold, the curvature of the loss does not affect the rates.
Furthermore, for the case of square loss, our results point to the interesting
phenomenon: whenever sequential and i.i.d. empirical entropies match, the rates
for statistical and online learning are the same.
In addition to the study of minimax regret, we derive a generic forecaster
that enjoys the established optimal rates. We also provide a recipe for
designing online prediction algorithms that can be computationally efficient
for certain problems. We illustrate the techniques by deriving existing and new
forecasters for the case of finite experts and for online linear regression.

本文研究任意函数类和一般损失的在线回归问题，并确定了最小极大率。结果表明，当函数类的复杂度低于某一阈值时，最小极大率取决于损失函数的曲率和序列复杂度。而当复杂度高于该阈值时，损失的曲率不再影响率。此外，对于平方损失，当顺序和独立同分布的经验熵匹配时，统计和在线学习的速率相同。我们还提供了一种通用的预测器，它具有确定的最优率，并提供了一种设计在线预测算法的方法，用于某些问题可以是计算量有效的。