Skip to content
AI.info

Mathematical foundations

Capacity, VC Dimension, Rademacher Complexity, and Stability

Learn classical and algorithm-dependent capacity measures, uniform convergence, sample-complexity logic, and the limits of generalization bounds.

By the end you can

Example

What it means to shatter points

Consider a class of linear separators in a plane. The two observations below are not an illustration invented for this lesson. They are the standard proof sketch on the way to VCdim(hyperplanes in R^d) = d+1, the one Mehryar Mohri gives in his Foundations of Machine Learning lecture on infinite hypothesis sets at NYU Courant.

  • Three non-collinear points: Every binary labeling can be separated by some line. Mohri's phrasing is “Any three non-collinear points can be shattered”.
  • Four points: There exists a configuration and labeling that no line can realize — four points admit unrealizable dichotomies. That is the half of the argument that caps the number rather than raising it.
  • VC conclusion: The class has VC dimension three under the standard affine-separator setup. That is the d=2 case of a numbered theorem. Shalev-Shwartz and Ben-David prove in Understanding Machine Learning, 2014, that homogenous halfspaces in R^d have VC dimension d (Theorem 9.2), and that nonhomogenous, that is affine, halfspaces in R^d have VC dimension d+1 (Theorem 9.3).
  • Meaning: The measure concerns possible labelings, not the accuracy on one dataset. Theorem 9.3 counts what the family of affine halfspaces could label. It never mentions data you have actually collected.
  • Caution: A finite VC dimension does not tell which separator a training algorithm will choose. Nothing in the shattering argument, and nothing in either theorem, refers to an optimizer.

A rich class can fit more patterns, including accidental ones

Statistical learning theory asks when empirical performance can justify a claim about population performance across a class of candidate predictors. The difficulty grows when the algorithm may choose among many functions after seeing the data. Capacity measures describe how flexibly a class can fit different labelings or losses. Parameter count is one clue, but geometry, norms, margins, sparsity, and the learning algorithm can matter as much or more.

How weak a clue parameter count is has been measured. Standard architectures were trained on CIFAR-10 after every label had been replaced with a uniformly random one. A small Inception with 1,649,402 parameters reached 100.0% training accuracy and 9.78% test accuracy. AlexNet, with 1,387,786 parameters, reached 99.82% training and 9.86% test. An MLP 1x512 with 1,209,866 parameters reached 99.34% training and 10.61% test — chance on ten classes. Same architectures, same parameter counts; only the labels changed. Zhang and four colleagues put the finding in five words at ICLR 2017: “Deep neural networks easily fit random labels.” Effective capacity sufficed to memorise the whole 50,000-image training set while generalisation collapsed. Arpit and colleagues reproduced the memorisation of noise independently at ICML 2017, and argued that dataset-independent notions of effective capacity cannot explain how these networks generalize.

Capacity is not even monotone in the direction the textbook curve suggests. The double-descent risk curve was documented in the Proceedings of the National Academy of Sciences in 2019: test risk falls, rises to a peak at the interpolation threshold, then falls again as capacity grows past it. Belkin and three colleagues state it directly in the abstract — “This “double-descent” curve subsumes the textbook U-shaped bias–variance trade-off curve by showing how increasing model capacity beyond the point of interpolation results in improved performance.” Nakkiran and five colleagues reproduced the effect independently in modern deep networks at ICLR 2020. They added an epoch-wise version, and identified regimes where quadrupling the number of training samples makes test performance worse. More capacity can mean less risk. More data can mean more error. Raw class size is plainly not the quantity being controlled.

The classical result underneath all of this is older than any of it. Vapnik and Chervonenkis published the uniform convergence theorem in 1971.

Capacity measures control families of possible predictors, not the merit of one fitted model in isolation.

Analogy

More keys on the ring, more accidental fits

A large ring of keys, with one key chosen after inspecting a collection of locks, raises the chance of fitting the observed locks by accident. A uniform guarantee accounts for every key that could have been selected, not only the one finally chosen. Capacity measures describe the size or flexibility of that choice set.

The random-label result is that ring at full size. A class able to reach the training accuracies just quoted on uniformly random CIFAR-10 labels holds a key for every labeling of the sample. So the fact that one of its keys fits the labeling you happened to observe carries no information on its own.

Real rings are stranger than this one: a function class can be continuous, and an algorithm reaches for some of its members far more readily than others.

Selection among many candidates requires evidence that controls the whole selection process.

Key idea

A bound is not a prediction of the exact test error

Generalization bounds are often worst-case and may be numerically loose. Their value can be conceptual: they identify how sample size, confidence, loss range, and complexity enter a guarantee. A vacuous numerical bound does not prove that the model fails to generalize. A small observed test error does not prove that the assumptions behind a theorem hold.

The looseness has a documented shape, and it is not the shape intuition predicts. Nagarajan and Kolter open their 2019 abstract with the measurement: “While it is well-known that many of these existing bounds are numerically large, through numerous experiments, we bring to light a more concerning aspect of these bounds: in practice, these bounds can increase with the training dataset size.” A guarantee that gets worse as you collect more data is not merely conservative. It is tracking something other than the quantity it gets quoted for. They then constructed overparameterized linear classifiers and gradient-descent-trained networks with test error below ε. For those, two-sided uniform convergence yields only a vacuous guarantee larger than 1-ε — even when it is applied to the restricted set of classifiers gradient descent actually outputs. Bartlett and Long restate the same scenario from outside in 2021, as one where “an algorithm generalizes well, but two-sided uniform convergence fails for any hypothesis space that is likely to contain the algorithm's output”, and prove a companion impossibility for least-norm interpolation.

Use bounds as conditional statements that help you design, not as decorative certificates.

A theorem explains what follows from assumptions; it does not verify that the assumptions match the system.

Case

A nonvacuous bound for a network with millions of parameters, 2017

The vacuous case was taken seriously in 2017. Dziugaite and Roy asked how little it takes to lose the classical guarantee, and their introduction answers in one line: “To put this in concrete terms, on MNIST, having even 72 hidden units in a fully connected first layer yields vacuous PAC bounds.”

The numbers from their experiments are the lesson. They worked on a binary variant of MNIST with 55,000 training images. Their T-600 network had 471,000 parameters and a best-known ReLU VC-dimension upper bound of 26 million. Set that 26 million against 55,000 examples and the classical guarantee constrains nothing whatsoever. By optimizing a PAC-Bayes bound directly, they obtained a bound on test error of 0.161, holding with probability 0.965, against a stochastic-network test error of 0.034. Across every true-label architecture they report — up to 2,384,000 parameters, with a VC-dimension bound of 187 million — the PAC-Bayes bounds stayed at or below 0.223. The same network trained on random labels instead produced 1.352. That is a number above 1 offered as a bound on an error rate, which is to say no constraint at all. The method does not hand out small numbers indiscriminately.

So the same networks carry both a vacuous bound and a nonvacuous one. The difference lies in which theorem is applied, not in which model was trained. Pérez-Ortiz and three colleagues confirmed the result independently in 2021, describing the 2017 work as having delivered “non-vacuous risk bound values” for randomised neural network classifiers, and reported tighter certificates of their own.

Comparison

VC dimension, Rademacher complexity, and norm-based control

These measures capture different aspects of flexibility, and each of the four has a dated primary result you can go and check.

VC dimension is the distribution-free combinatorial one. The classical route from it to a guarantee is the 1971 Vapnik–Chervonenkis uniform convergence theorem, and Theorem 9.3 of Shalev-Shwartz and Ben-David fixes the number for nonhomogenous halfspaces in R^d at d+1. It supports sample-complexity bounds, and it can be loose for trained deep models — for the reason the random-label experiment makes concrete.

Rademacher complexity has a datable primary result of its own. Bartlett and Mendelson open their 2002 paper in the Journal of Machine Learning Research with the plan: “We investigate the use of certain data-dependent estimates of the complexity of a function class, called Rademacher and Gaussian complexities.” Their Theorem 5(b) states that with probability at least 1-δ, every f in F satisfies P(Y ≠ f(X)) ≤ P̂_n(Y ≠ f(X)) + R_n(F)/2 + sqrt(ln(1/δ)/(2n)). Put that beside their Theorem 1, the VC-based bound, which scales as c·sqrt(VCdim(F)/n). The data-dependence is visible as a single substitution. R_n(F)/2, computed on the observed sample, stands where a complexity fixed in advance stood. Theorem 6 shows the exchange costs little: the Rademacher bound is never much worse than the VC one. Koltchinskii and Panchenko developed Rademacher-process bounds for combined classifiers independently that same year, in the Annals of Statistics.

Norm or margin control uses scale-sensitive properties of predictors, and it too has a theorem and an experiment. Bartlett and two colleagues proved at NIPS 2017 a margin-based multiclass generalization bound scaling with margin-normalized spectral complexity — the product of the spectral norms of the weight matrices, times a correction factor. They then trained AlexNet on MNIST and on CIFAR-10, with true labels and with random ones, and showed that the bound, the Lipschitz constants and the excess risk move together. That is a capacity measure that separates the true-label run from the random-label run. Counting labelings cannot do that. Golowich and two colleagues then gave norm-based Rademacher complexity bounds for neural networks at COLT 2018 that, under additional assumptions, are “fully independent of the network size (both depth and width)”.

Algorithmic stability is the column that is not a property of the class at all. Bousquet and Elisseeff state the programme in their 2002 abstract: “We define notions of stability for learning algorithms and show how to use these notions to derive generalization error bounds based on the empirical error and the leave-one-out error.” Their Definition 6 gives uniform stability β. Their Theorem 12 gives the bound: for a loss bounded by M, with probability at least 1-δ, R ≤ R_emp + 2β + (4mβ + M)·sqrt(ln(1/δ)/(2m)). Regularization in a Hilbert space (RKHS) with parameter λ has uniform stability β ≤ σ²κ²/(2λm), that is stability of order 1/m, which is exactly the regime in which the theorem is tight. So the regularization parameter is what buys the guarantee, and the sentence "useful for regularized algorithms" has an inequality behind it. Hardt and two colleagues later proved at ICML 2016 that stochastic gradient descent is itself “algorithmically stable in the sense of Bousquet and Elisseeff”, in the convex and non-convex cases.

FigureComparison · 4 columns

VC dimension

Measures binary-label shattering capacity.

  • Distribution-free combinatorial notion
  • Natural for classification classes
  • Supports sample-complexity bounds
  • Can be loose for trained deep models

Rademacher complexity

Measures correlation with random signs on observed inputs.

  • Data-dependent
  • Extends to real-valued functions
  • Connects to Lipschitz losses
  • Varies with the sample

Norm or margin control

Uses scale-sensitive properties of predictors.

  • Can distinguish parameter magnitudes
  • Relevant to linear and neural models
  • Depends on representation and normalization
  • May better reflect algorithmic bias

Algorithmic stability

Measures sensitivity to replacing one training example.

  • Property of the learning procedure
  • Useful for regularized algorithms
  • Can support expectation or high-probability results
  • Not a class-only measure

Regularization can reduce effective capacity without shrinking the class syntactically

A neural architecture may represent many functions, while an optimizer, initialization, early stopping rule, or norm penalty makes only a subset easy to reach. Telling those two apart motivates algorithm-dependent and norm-based analyses. The formal hypothesis class alone can overstate the flexibility exercised in practice. The Dziugaite and Roy table shows by how much: a VC-dimension bound of 26 million sitting over 55,000 examples, while the trained stochastic network makes 0.034 test error.

The two anchored routes out of the gap are the ones already named. Bousquet and Elisseeff's β ≤ σ²κ²/(2λm) is an explicit statement of how much an explicit penalty buys, and the ICML 2016 stability result carries the same treatment over to stochastic gradient descent itself. The spectral-norm quantity is the norm-based route: a number computed from the trained weights that moved with the excess risk in the AlexNet experiments.

However, “implicit regularization” should not become an explanation nobody has measured. The induced bias must be characterized for the actual training procedure. Nagarajan and Kolter show how far that characterization may have to go. Restricting attention to the set of classifiers gradient descent actually outputs was not enough to rescue two-sided uniform convergence in their construction. It still left a guarantee larger than 1-ε on networks whose test error was below ε.

Steps

Read a sample-complexity statement

Use these checks when a paper or report cites a learning-theory guarantee: identify the random sample, the class, and the loss; read the probability statement; inspect constants and scaling; and compare with shift.

Two of the six steps have worked examples in this lesson. Inspecting constants and scaling is what separates 26 million from 55,000 in the Dziugaite and Roy setting, and separates both from an optimized PAC-Bayes value of 0.161 holding with probability 0.965. The same trained network, three numbers, and only one of them informative at that sample size. Reading the probability statement is what keeps 0.161 in its place: it bounds test error with probability 0.965, not with certainty, and it is not a forecast of the 0.034 actually observed.

The scaling check also has a failure mode worth naming, since it is the one nobody looks for. Nagarajan and Kolter found bounds that increase with the training dataset size. A guarantee can degrade under the one intervention practitioners assume always helps.

FigureProcess · 6 steps
  1. 1. Identify the random sample

    State distribution, independence, and sample unit.

  2. 2. Identify the class

    Clarify functions, norms, margins, or algorithm restrictions.

  3. 3. Identify the loss

    Check boundedness, Lipschitz properties, and target meaning.

  4. 4. Read the probability statement

    Separate expectation, high probability, and asymptotic claims.

  5. 5. Inspect constants and scaling

    Evaluate whether the bound is informative at realistic n.

  6. 6. Compare with shift

    Confirm the theorem’s population matches deployment.

Visual

The uniform-convergence argument

A classical proof separates approximation, estimation, and optimization components. A hypothesis class H is fixed, empirical risk is computed for each candidate on the sample, a uniform bound controls sample-to-population deviation for all candidates at once, the empirical minimizer is chosen after observing the data, and the selected predictor is finally compared with the best member of H.

The uniform bound in the middle of that chain is where a capacity measure enters, and which measure enters is a choice: c·sqrt(VCdim(F)/n) in Bartlett and Mendelson's Theorem 1, or R_n(F)/2 computed on the observed sample in their Theorem 5(b). It is also the step Nagarajan and Kolter attack. In their construction two-sided uniform convergence is precisely what fails while the learned classifier still generalizes. That is why algorithm-dependent measures such as uniform stability, defined on the procedure rather than on H, are a different argument and not a refinement of this one.

FigureProcess · 5 steps
  1. 1

    Hypothesis class H

    The candidate predictors considered by the learner.

  2. 2

    Empirical risk

    Observed average loss for each candidate on the sample.

  3. 3

    Uniform bound

    Controls sample-to-population deviation for all candidates at once.

  4. 4

    Empirical minimizer

    Chooses a low-risk candidate after observing the data.

  5. 5

    Population comparison

    Relates the selected predictor to the best member of H.

Position

Citing a bound is not a safety argument, and a vacuous bound is not a verdict

Citing a theorem tends to end the argument about whether a model will generalize, so it is worth being exact about what has been cited. A generalization bound is a conditional statement. Given a sample drawn independently from a stated distribution, given a hypothesis class, given a loss with the stated range, population performance departs from observed performance by no more than some quantity, with a stated probability. Each of those givens is a fact about the setup rather than a consequence of it. The theorem says what follows from its assumptions. Whether the assumptions describe the system in front of you is the last question in this lesson's reading routine, and it is asked of deployment, not of the proof.

Two further things survive being cited and get lost in the quoting. Bounds are often worst-case, so the number can sit far above any error the model will actually make. And finite capacity says nothing about which member of the class the training procedure will select. Linear separators in the plane shatter three non-collinear points, giving VC dimension three under the standard affine-separator setup — the d=2 case of Shalev-Shwartz and Ben-David's Theorem 9.3, which fixes affine halfspaces in R^d at d+1. That is an answer about what the class can label. It is no answer at all about which line was fitted. Offering finite VC dimension as a safety property answers a question about the family and leaves the question about the model untouched.

For a deep network the objection is stronger than "leaves it untouched". The NIPS 2017 spectral-norm paper opens its overview with it: “A first observation is that any analysis based solely on the number of possible labellings on a finite training set — as is the case with VC dimension — is doomed: if the function class can fit all possible labels (as is the case with neural networks in standard configurations (Zhang et al., 2017)), then this analysis can not distinguish it from the collection of all possible functions!” The parenthetical is the CIFAR-10 experiment from the opening of this lesson: 100.0% training accuracy on uniformly random labels, 9.78% test. A measure that assigns a network the same value whether it was trained on true labels or on noise cannot be the measure that certifies it.

The opposite shortcut is more tempting than it looks. A bound that comes out vacuous does not show that the model fails to generalize. It shows the bound is uninformative at that sample size, with those constants. Dziugaite and Roy took the vacuous case seriously in 2017, and the arithmetic is on one line of their table: a VC-dimension upper bound of 26 million against 55,000 training images, and a directly optimized PAC-Bayes bound of 0.161, holding with probability 0.965, against a stochastic-network test error of 0.034. Nothing about the network changed between those two numbers. That the method still returns 1.352 on random labels is what makes 0.161 worth quoting.

And the failure runs in the third direction too, the one that flatters neither shortcut. Nagarajan and Kolter's bounds increased with the training dataset size. Their construction produced a guarantee larger than 1-ε for gradient-descent-trained networks whose test error was below ε — with uniform convergence applied to exactly the classifiers gradient descent returns. Bartlett and Long prove a companion impossibility for least-norm interpolation, so this is not one group's pathological example. A small test error does not establish that a theorem's assumptions hold. A loose bound does not establish that a model is unsafe. And a bound that improves is not automatically the one whose assumptions you checked. Bounds earn their place by guiding design, showing how sample size, confidence, loss range and complexity enter a guarantee. They lose it the moment they are handed over as certificates.

Finite capacity describes the family the learner could have chosen from, not the model it chose.

Key takeaways