Abstract:Adversarial training is a widely used method to improve the robustness of deep neural networks (DNNs) over adversarial perturbations. However, it is empirically observed that adversarial training on over-parameterized networks often suffers from the \textit{robust overfitting}: it can achieve almost zero adversarial training error while the robust generalization performance is not promising. In this paper, we provide a theoretical understanding of the question of whether overfitted DNNs in adversarial training can generalize from an approximation viewpoint. Specifically, our main results are summarized into three folds: i) For classification, we prove by construction the existence of infinitely many adversarial training classifiers on over-parameterized DNNs that obtain arbitrarily small adversarial training error (overfitting), whereas achieving good robust generalization error under certain conditions concerning the data quality, well separated, and perturbation level. ii) Linear over-parameterization (meaning that the number of parameters is only slightly larger than the sample size) is enough to ensure such existence if the target function is smooth enough. iii) For regression, our results demonstrate that there also exist infinitely many overfitted DNNs with linear over-parameterization in adversarial training that can achieve almost optimal rates of convergence for the standard generalization error. Overall, our analysis points out that robust overfitting can be avoided but the required model capacity will depend on the smoothness of the target function, while a robust generalization gap is inevitable. We hope our analysis will give a better understanding of the mathematical foundations of robustness in DNNs from an approximation view.

Understanding Robust Overfitting from the Feature Generalization Perspective

Feature Augmentation for Adversarial Robustness

Understanding Robust Overfitting of Adversarial Training and Beyond

Understanding and Mitigating Robust Overfitting through the Lens of Feature Dynamics

Towards Understanding Clean Generalization and Robust Overfitting in Adversarial Training

Adversarial Masking: Towards Understanding Robustness Trade-off for Generalization

Over-parameterization and Adversarial Robustness in Neural Networks: An Overview and Empirical Analysis

Can overfitted deep neural networks in adversarial training generalize? -- An approximation viewpoint

Enhancing Robust Representation in Adversarial Training: Alignment and Exclusion Criteria

Robustness, Privacy, and Generalization of Adversarial Training

The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression

ROBY: Evaluating the adversarial robustness of a deep model by its decision boundaries

Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data

Improving Generalization of Adversarial Training via Robust Critical Fine-Tuning

Overfitting in adversarially robust deep learning

Exploring Robust Features for Improving Adversarial Robustness

Inter-feature Relationship Certifies Robust Generalization of Adversarial Training

The Surprising Harmfulness of Benign Overfitting for Adversarial Robustness

Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization

Exploring the Relationship Between Architectural Design and Adversarially Robust Generalization

Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement