# Adversarial Training is a Form of Data-dependent Operator Norm Regularization

arXiv: https://arxiv.org/abs/1906.01527 · HTML: https://mlsanity.com/paper/1906.01527/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Jun 2019.

## Built on by (most cited first, 4 of 4)

- [Noise Stability Regularization for Improving BERT Fine-tuning](https://mlsanity.com/paper/2107.04835/) (2021)
- [Clustering Effect of (Linearized) Adversarial Robust Models](https://mlsanity.com/paper/2111.12922/) (2021)
- [Data Interpolants -- That's What Discriminators in Higher-order Gradient-regularized GANs Are](https://mlsanity.com/paper/2306.00785/) (2023)
- [Measuring the False Sense of Security](https://mlsanity.com/paper/2204.04778/) (2022)

## Abstract (arXiv)

We establish a theoretical link between adversarial training and operator norm regularization for deep neural networks. Specifically, we prove that ℓp-norm constrained projected gradient ascent based adversarial training with an ℓq-norm loss on the logits of clean and perturbed inputs is equivalent to data-dependent (p, q) operator norm regularization. This fundamental connection confirms the long-standing argument that a network's sensitivity to adversarial examples is tied to its spectral properties and hints at novel ways to robustify and defend against adversarial attacks. We provide extensive empirical evidence on state-of-the-art network architectures to support our theoretical results.