Learning to Perturb Hidden Representations for Generalizable Deep Learning

Abstract: Deep neural networks process data through a cascade of representations: input features, hidden activations, logits, and loss. While perturbations at the input, logit, and label levels have been systematically studied, the intermediate hidden activations, which constitute the bulk of the network's computation, have received no unified perturbation analysis. In this paper, we establish a unified framework for hidden activation perturbation, revealing that Dropout, Manifold Mixup, adversarial feature perturbation, and related methods all impose specific forms of activation perturbation but with class-agnostic or random strategies. We conjecture that expansive perturbation (increasing activation norm) acts as positive augmentation, while contractive perturbation (decreasing activation norm) acts as negative augmentation, and that the perturbation layer determines whether the effect resembles input-level augmentation (shallow layers) or logit-level manipulation (deep layers). We propose Learning to Perturb Activations (LPA), which adaptively perturbs activations at a selected hidden layer with class-level perturbations learned via PGD. We further provide theoretical analysis connecting activation perturbation to flat minima and perturbation amplification through layers. Experiments on balanced classification, long-tail classification, and domain generalization demonstrate that LPA consistently outperforms existing methods and provides complementary benefits to logit perturbation methods such as LPL.

• The paper introduces a unified hidden activation perturbation framework as both positive and negative augmentation to improve model generalization.
• LPA employs adaptive, class-aware perturbations using projected gradient descent on intermediate layers, outperforming methods like Dropout and LPL on various benchmarks.
• Empirical results show improved tail-class accuracy and domain generalization, underpinned by theoretical analyses linking perturbations to flat minima.

Learning to Perturb Hidden Representations for Generalizable Deep Learning

Introduction

This paper introduces a unified perturbation framework for hidden activations in deep neural networks and develops Learning to Perturb Activations (LPA), an adaptive, class-aware perturbation approach for intermediate network layers. The central hypothesis is that learned, class-level perturbations in high-dimensional hidden spaces can provide both positive and negative augmentation, generalizing and extending beyond prior methods such as Dropout, Manifold Mixup, and Logit Perturbation Learning (LPL). LPA is shown to enhance generalization, robustness, and handle imbalanced and shifting data distributions more effectively than previous approaches.

Unified Perturbation Framework: Theoretical Foundations

Historically, perturbation strategies have targeted input (adversarial or augmentation), logit (label smoothing, logit adjustment), or label spaces. This work demonstrates that a vast set of techniques—including Dropout, Manifold Mixup, adversarial feature perturbation—can be formulated as specific cases of hidden activation perturbation, typically with random, class-agnostic patterns.

The authors articulate three conjectures:

1. Expansive Perturbation as Positive Augmentation: Increasing the activation norm within a class disperses its representations, pushing decision boundaries outward (positive augmentation).
2. Contractive Perturbation as Negative Augmentation: Decreasing the activation norm has the effect of compressing class representations, reducing influence on the boundary (negative augmentation).
3. Layer-Dependent Perturbation Effects: The perturbed layer's depth modulates augmentation: shallow layers influence low-level feature diversity, whereas deep layers target semantic/class-space relations.

Central to this thesis is the insight that hidden activation perturbation operates in $\mathbb{R}^{d_l}$ ($d_l \gg C$), giving finer control over intra-class variance than logit perturbation, which is restricted to $\mathbb{R}^C$.

Relative activation variation analyses reveal that standard perturbation approaches apply uniform or geometric-structure-driven magnitude but fail to adjust on a per-class basis. LPA learns these perturbations adaptively, targeting classes needing expansion (e.g., tails in a long-tail distribution) or contraction.

Figure 1: Relative activation variation $$\mathbb{E}[\|\delta_i^{(l)}\|] / \mathbb{E}[\|a_i^{(l)}\|]$$; LPA adaptively distributes perturbation magnitude according to class accuracy and tail/head status.

Learning to Perturb Activations (LPA): Methodology

LPA operates by learning class-level perturbations at a chosen hidden layer, parameterized and updated via projected gradient descent (PGD) under constraints that reflect each class's augmentation requirements. For classes in need of positive augmentation (e.g., low-accuracy, underrepresented), LPA maximizes the loss over a ball in activation space. Conversely, classes needing contraction minimize the loss in the same ball. The PGD procedure is performed on class-averaged activation gradients with further computational reductions via low-rank approximation (retaining the top-$k$ singular vectors in $g_c^{(l)}$).

The layer where perturbation is applied is crucial. Intermediate to deeper layers (e.g., penultimate, or post-stage 3 in ResNets) are empirically and theoretically most effective, as early-layer perturbations are over-amplified or "washed out" and logit-layer perturbations reduce to LPL.

Optimal perturbation bounds are adaptive: class-dependent, shaped by a splitting statistic (accuracy/imbalance), and layer-scaled via a geometric attenuation ($\gamma_l = \beta^{L-l}$) to prevent excessive distortion in shallow layers.

LPA generalizes LPL: when the perturbation layer is the logits, it is equivalent to LPL; for earlier layers, LPA can induce a richer set of logit perturbations due to the typically larger hidden dimensionality.

Theoretical Analysis

Three key theoretical analyses undergird LPA's justification:

• Connection to Flat Minima: LPA perturbation at layer $l$ is equivalent to a structured parameter perturbation at that layer, thus enforcing minimization over neighborhoods in parameter space akin to SAM, contributing to flatness-based generalization.
• Perturbation Amplification: The effect on the output is bounded by the Lipschitz constant of the network segments beyond the perturbed layer, informing choice and scaling of perturbation locus.
• Expressivity: The logit perturbations achievable via LPA at deep but pre-logit layers form a strict superset of those achievable by LPL, due to larger hidden spaces.

Experimental Results

Balanced Classification

On CIFAR-10 and CIFAR-100 with standard architectures (WRN-28-10, ResNet-110), LPA outperforms Cross-Entropy (CE), Dropout, Manifold Mixup, and LPL. On CIFAR-100, the LPA (mean + varied bound) yields a 0.73% error reduction over LPL and achieves further computational efficiency with low-rank approximate perturbation.

Long-Tail Classification

LPA demonstrates superior accuracy, especially in tail classes, compared to LPL, ISDA, and classic augmentation methods. The targeted expansive perturbation for tail classes provides a significant relative improvement, validating the underlying conjectures.

Figure 2: Tail-class accuracy for long-tail CIFAR benchmarks—LPA best augments rare class representations.

Domain Generalization

Evaluations on PACS, VLCS, OfficeHome, and TerraIncognita (DomainBed benchmark, ResNet-50 backbone) show consistent, strong results, surpassing competitive methods such as SWAD and Manifold Mixup. LPA's learned diversity in representation space is beneficial under domain shifts.

Additive Effects with Existing Methods

LPA can be effectively combined with techniques such as ISDA and LPL, yielding further accuracy improvements. The performance increase is additive, confirming complementarity between activation-space and logit-space perturbations.

Figure 3: (a) Combination with existing methods; (b) Additive improvement of LPA and LPL on long-tail benchmarks.

Analysis & Visualizations

Ablation studies on perturbation layer placement indicate the output of the final convolution block (stage 3 for ResNets) provides optimal trade-off for cost and accuracy.

Figure 4: (a) Classification error as a function of perturbation layer; (b) Performance and efficiency of single- vs. multi-layer perturbation.

t-SNE visualizations depict LPA's effect on intra-class compactness and inter-class separation, most notably for tail classes.

Figure 5: t-SNE of penultimate-layer features demonstrates enhanced tail class structure under LPA.

Grad-CAM heatmaps confirm LPA encourages models to attend to broad and discriminative spatial regions, consistent with a more robust, diverse representation.

Figure 6: LPA increases attention to diverse, semantically coherent input regions.

Hyperparameter sensitivity experiments show LPA's robustness to a range of $\epsilon$, $\beta$, and low-rank $d_l \gg C$0 parameters.

Figure 7: LPA generalization is robust to perturbation magnitude, scaling, and rank constraints.

Training overhead due to LPA is moderate (12–18% increase for $d_l \gg C$1 PGD steps), significantly lower than other perturbation-based regularizers like SAM.

Implications and Future Directions

LPA completes the hierarchy of perturbation strategies (input, activation, logit, label), offering highly expressive and adaptive augmentation mechanisms. Its theoretical connection to flat minima, and empirical generalization gains—especially for long-tail and domain shifts—point to broad utility in robust and fair deep learning.

Sample-level adaptive perturbations, richer criteria for category split and bound choice, and architectural automation of perturbation loci remain open for exploration. Combining multi-level perturbation with joint optimization holds promise for further improvement. Investigating the interplay with calibration, uncertainty, and causally invariant representations is a provocative next step.

Conclusion

This work formalizes and generalizes activation-space perturbation, showing that established techniques are special cases within this unifying framework. The proposed LPA algorithm, through adaptive, class-aware and theoretically justified hidden layer perturbation, yields consistently superior empirical results while being computationally efficient and composable with other regularization techniques. LPA thus advances both the practical and theoretical understanding of representation-level augmentation in deep learning.