Research map / Adversarial robustness and security / Certified and empirical robustness

Benign Overfitting in Adversarial Training of Neural Networks

ICML 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Robust overfitting and regularization

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that adversarial training (gradient descent with PGD-style inner maximization) of two-layer networks on a noisy Gaussian-mixture distribution reaches zero robust training error and near-optimal clean and robust test error, i.e., benign overfitting under adversarial training.

Problem

Whether benign overfitting (interpolating noisy training data while generalizing well) can occur in adversarially trained neural networks, an open question raised by Chen et al. (2023) for linear models.

Approach

Analyzes gradient-descent adversarial training of two-layer networks with symmetric small initialization on a noisy mixture data model, giving convergence to zero robust training loss and generalization bounds for clean and l2-bounded robust error, for both smooth and non-smooth (ReLU-type) activations, without assuming robust realizability.

Key results

• Adversarial training reaches 100% robust training accuracy and robust training loss goes to zero, while robust test error converges to the label noise rate of 0.1 on synthetic data.
• Phase transition in clean and robust accuracy at dimension d around O(||mu||^4) for clean and O(||mu||^2) for robust accuracy, consistent with theory.
• Same trends observed on MNIST (0 vs 1) even though the generative assumptions do not hold.

Measured effects reported in the paper

Surprising findings

• Robust overfitting observed empirically is not contradicted here because the analysis uses small perturbation budgets; the robust training loss still converges to zero.

Limitations

• Analysis restricted to a structured log-concave Gaussian-mixture data model and two-layer networks.
• Generalization guarantee only covers small attack strength (alpha/||mu|| bounded); moderate attack strength is open.
• Requires high-dimensional regime d much larger than n and small initialization.

Experimental setup

Datasets: MNIST

Benchmarks: MNIST

Metrics: robust training loss clean test accuracy robust test accuracy robust test error

Baselines: Chen et al. 2023 Gao et al. 2019 Zhang et al. 2020 Mianjy & Arora 2023 Li & Telgarsky 2023

Builds on: Frei et al. 2022 benign overfitting in two-layer networks Chatterji & Long 2021 Xu & Gu 2023 Madry et al. 2018 adversarial training Chen et al. 2023

Closest papers by meaning

• Rethinking Benign Overfitting in Two-Layer Neural Networks (ICML 2025 · similarity 0.91)
• Noisy Interpolation Learning with Shallow Univariate ReLU Networks (ICLR 2024 · similarity 0.91)
• Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.89)
• Benign overfitting in leaky ReLU networks with moderate input dimension (NeurIPS 2024 · similarity 0.89)
• On the Clean Generalization and Robust Overfitting in Adversarial Training from Two Theoretical Views: Representation Complexity and Training Dynamics (ICML 2025 · similarity 0.89)
• Benign Overfitting in Single-Head Attention (NeurIPS 2025 · similarity 0.88)