Research map / Adversarial robustness and security / Certified and empirical robustness
Theoretical Analysis of Robust Overfitting for Wide DNNs: An NTK Approach
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Extends NTK theory to adversarial training of infinitely wide MLPs, proves wide AT networks are approximated by linearized networks with closed-form dynamics, identifies "AT degeneration" as the cause of robust overfitting, and proposes Adv-NTK, an AT-free algorithm for infinite-width DNNs.
Problem
Robust overfitting in adversarial training: why a DNN gradually loses robustness gained early in AT under continued training, which existing theory (converged-model analyses, or two-layer feature-learning analyses) does not explain for deep networks.
Approach
Introduces per-example learning-rate terms into the gradient-flow adversarial search so NTK analysis applies; shows the AT dynamics of wide MLPs match a linearized network with a time-dependent regularization matrix that decays in long AT (AT degeneration); then optimizes that regularization matrix directly as Adv-NTK on infinite-width kernels.
Key results
- Adv-NTK on MLP-3 CIFAR-10 (12K subset, rho=4/255) reaches 27.35% robust accuracy versus 9.93% for NTK and 30.64% for AT.
- At depth 10 with rho=4/255, Adv-NTK attains 30.91% robust accuracy on MLP while AT collapses to 10.00%, showing AT degradation for deep models.
- On CNN-3 with rho=4/255, Adv-NTK achieves 29.31% robust accuracy versus 18.29% for AT and 5.01% for NTK.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Optimize the infinite-width model's adversarial regularization parameter with Adv-NTK instead of using NTK without adversarial training | infinite-width DNNs · CIFAR-10 (Subset 12K), MLP-8, ℓ∞ ρ=4/255 | robust test accuracy (%): 22.44$\pm$0.27 -> 30.56$\pm$0.48 | Helped |
| Optimize the infinite-width model's adversarial regularization parameter with Adv-NTK instead of using NTK without adversarial training | infinite-width DNNs · CIFAR-10 (Subset 12K), CNN-3, ℓ∞ ρ=8/255 | robust test accuracy (%): 1.31$\pm$0.03 -> 26.79$\pm$2.25 | Helped |
| Use Adv-NTK instead of finite-width adversarial training | DNNs · CIFAR-10 (Subset 12K), MLP-5, ℓ∞ ρ=4/255 | robust test accuracy (%): 28.70$\pm$0.45 -> 29.04$\pm$0.38 | Helped |
| Use Adv-NTK instead of finite-width adversarial training | DNNs · CIFAR-10 (Subset 12K), MLP-3, ℓ∞ ρ=4/255 | robust test accuracy (%): 30.64$\pm$0.42 -> 27.35$\pm$0.66 | Hurt |
| Continue adversarial training for a long time, allowing the AT regularization effect to fade | wide DNNs · adversarial training | robustness | Hurt |
Surprising findings
- Standard AT collapses to chance (10.00%) at depth 8-10 for MLPs, while Adv-NTK remains around 30%.
- Adv-NTK does not beat the best checkpoint during AT, only the final AT model.
Limitations
- Theory assumes small adversarial perturbation so the limiting matrix stays positive definite; large perturbation discussed only in appendix.
- Closed-form dynamics derived only for squared loss and MLPs; CNN generalization is empirical.
- Adv-NTK does not exceed the best checkpoint obtained during AT.
Experimental setup
Datasets: CIFAR-10 SVHN
Benchmarks: CIFAR-10
Metrics: robust test accuracy under l_inf PGD attack (rho=4/255, 8/25
Baselines: AT NTK
Builds on: neural tangent kernel Neural tangent kernel linearization (Lee et al.) projected gradient descent adversarial training early stopping for robust overfitting
Closest papers by meaning
- Evolution of Neural Tangent Kernels under Benign and Adversarial Training (NeurIPS 2022 · similarity 0.90)
- Interpreting Robustness Proofs of Deep Neural Networks (ICLR 2024 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
- Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.88)
- Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependency (ICML 2024 · similarity 0.88)
- Benign Overfitting in Adversarial Training of Neural Networks (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.