Research map / Adversarial robustness and security / Certified and empirical robustness

On the Clean Generalization and Robust Overfitting in Adversarial Training from Two Theoretical Views: Representation Complexity and Training Dynamics

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Robust overfitting and regularization · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Theoretically explains clean generalization with robust overfitting in adversarial training via ReLU representation complexity (poly(D)+Õ(ND) vs exponential for robust classifiers) and a three-stage training-dynamics analysis of a two-layer CNN on patch-structured data, with supporting MNIST/CIFAR10 experiments.

Problem

Why adversarially trained deep nets achieve good clean test accuracy yet exhibit a large robust generalization gap (robust overfitting), i.e., the CGRO phenomenon.

Approach

Combines a representation-complexity argument (CGRO classifiers need only mildly more parameters than clean classifiers via robust memorization, while robust classifiers need exponential size) with a feature-learning analysis showing adversarial training provably learns partial true features and memorizes noise, yielding CGRO.

Key results

• On CIFAR10 with WideResNet-34 under PGD adversarial training (8/255), clean test accuracy rises from 82.56% to 86.05% across widen factors 1 to 10, while robust test accuracy is only 43.39% to 50.08%.
• On synthetic patch data (d=100, N=20), adversarial training reaches 100% clean and robust train accuracy, 98.5% clean test accuracy but only 17.5% robust test accuracy.
• On MNIST, small LeNet variants collapse to trivial constant predictions (11.35% accuracy), while larger models reach about 95% clean and 78-83% robust test accuracy.

Measured effects reported in the paper

Surprising findings

• Small models under adversarial training converge to a trivial fixed-class predictor even though they can learn an accurate clean classifier by standard training.
• The robust generalization gap is non-monotone in model size: it first persists as robust training error drops, then gradually shrinks for larger models.

Limitations

• Theory relies on a patch-structured data distribution with a single meaningful signal patch and a two-layer CNN with fixed second layer and ReLU^q activation.
• Assumes perturbations aligned with the signal vector and polynomial-size clean classifier existence, which are idealized.
• Experiments are small-scale (MNIST, CIFAR10) and only loosely tied to theoretical quantities.

Experimental setup

Datasets: MNIST CIFAR10 synthetic patch-structured data

Benchmarks: MNIST CIFAR10 synthetic patch data

Metrics: clean test accuracy robust test accuracy robust train accuracy

Builds on: PGD adversarial training feature learning theory (Allen-Zhu and Li) tensor power method

Closest papers by meaning

• Benign Overfitting in Adversarial Training of Neural Networks (ICML 2024 · similarity 0.89)
• The Effectiveness of Random Forgetting for Robust Generalization (ICLR 2024 · similarity 0.88)
• To Grok or not to Grok: Disentangling Generalization and Memorization on Corrupted Algorithmic Datasets (ICLR 2024 · similarity 0.88)
• Benign Overfitting and Grokking in ReLU Networks for XOR Cluster Data (ICLR 2024 · similarity 0.87)
• Feature Contamination: Neural Networks Learn Uncorrelated Features and Fail to Generalize (ICML 2024 · similarity 0.87)
• Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.87)