mlsanityData to 7 Oct 2026

Adversarial Training Can Hurt Generalization

arXiv 1906.06032 ↗First posted 14 Jun 2019cs.LG stat.MLcited by 131

Not on the map. Why?

Abstract (arXiv)

While adversarial training can improve robust accuracy (against an adversary), it sometimes hurts standard accuracy (when there is no adversary). Previous work has studied this tradeoff between standard and robust accuracy, but only in the setting where no predictor performs well on both objectives in the infinite data limit. In this paper, we show that even when the optimal predictor with infinite data performs well on both objectives, a tradeoff can still manifest itself with finite data. Furthermore, since our construction is based on a convex learning problem, we rule out optimization concerns, thus laying bare a fundamental tension between robustness and generalization. Finally, we show that robust self-training mostly eliminates this tradeoff by leveraging unlabeled data.

Key facts. Cited by 131 papers in the map (data through 7 Oct 2026). First posted on arXiv 14 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 27; 2022: 36; 2023: 28; 2024: 27; 2025: 9; 2026: 4.

131 papers.

Sort:

By area:

  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  2. 2021Trustworthy AI: From Principles to Practicescited by 206
  3. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  4. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 70
  5. 2021Improved OOD Generalization via Adversarial Training and Pre-trainingcited by 66
  6. 2022Probable Domain Generalization via Quantile Risk Minimizationcited by 66
  7. 2022MaskTune: Mitigating Spurious Correlations by Forcing to Explorecited by 66
  8. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  9. 2022Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentationscited by 46
  10. 2021Distributionally Robust Learningcited by 44
  11. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  12. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
38 more
  1. 2022Probabilistically Robust Recourse: Navigating the Trade-offs between Costs and Robustness in Algorithmic Recoursecited by 40
  2. 2022Probabilistically Robust Learning: Balancing Average- and Worst-case Performancecited by 36
  3. 2021Neural Network Robustness as a Verification Property: A Principled Case Studycited by 35
  4. 2024A review on data-driven constitutive laws for solidscited by 35
  5. 2021Analysis and Applications of Class-wise Robustness in Adversarial Trainingcited by 33
  6. 2023Prompt Optimization via Adversarial In-Context Learningcited by 33
  7. 2022Stability Analysis and Generalization Bounds of Adversarial Trainingcited by 30
  8. 2022A Survey of Mix-based Data Augmentation: Taxonomy, Methods, Applications, and Explainabilitycited by 30
  9. 2021Detecting Adversarial Examples from Sensitivity Inconsistency of Spatial-Transform Domaincited by 29
  10. 2021Defending Against Image Corruptions Through Adversarial Augmentationscited by 28
  11. 2021Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspectivecited by 25
  12. 2021On the Effect of Pruning on Adversarial Robustnesscited by 23
  13. 2022Why Robust Generalization in Deep Learning is Difficult: Perspective of Expressive Powercited by 23
  14. 2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
  15. 2021Reweighting Augmented Samples by Minimizing the Maximal Expected Losscited by 21
  16. 2022A Theory of PAC Learnability under Transformation Invariancescited by 21
  17. 2024H-Consistency Guarantees for Regressioncited by 21
  18. 2021Adversarial Training is Not Ready for Robot Learningcited by 20
  19. 2024Can Biases in ImageNet Models Explain Generalization?cited by 20
  20. 2022Adversarial Rademacher Complexity of Deep Neural Networkscited by 18
  21. 2021CAP: Co-Adversarial Perturbation on Weights and Features for Improving Generalization of Graph Neural Networkscited by 15
  22. 2022Adversarial Unlearning: Reducing Confidence Along Adversarial Directionscited by 14
  23. 2023Beyond the Universal Law of Robustness: Sharper Laws for Random Features and Neural Tangent Kernelscited by 13
  24. 2021Fundamental Tradeoffs in Distributionally Adversarial Trainingcited by 12
  25. 2022Robust and Accurate -- Compositional Architectures for Randomized Smoothingcited by 12
  26. 2023MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustnesscited by 12
  27. 2025E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Modelscited by 12
  28. 2021Adversarial Feature Augmentation and Normalization for Visual Recognitioncited by 11
  29. 2023Improving the Robustness of Transformer-based Large Language Models with Dynamic Attentioncited by 10
  30. 2026GPTZero: Robust Detection of LLM-Generated Textscited by 10
  31. 2021Training a Resilient Q-Network against Observational Interferencecited by 9
  32. 2022On the Role of Generalization in Transferability of Adversarial Examplescited by 9
  33. 2022Adaptive Smoothness-weighted Adversarial Training for Multiple Perturbations with Its Stability Analysiscited by 9
  34. 2022Understanding the Impact of Adversarial Robustness on Accuracy Disparitycited by 9
  35. 2023ACAT: Adversarial Counterfactual Attention for Classification and Detection in Medical Imagingcited by 9
  36. 2023Targeted Adversarial Attacks on Wind Power Forecastscited by 9
  37. 2023Hierarchical Randomized Smoothingcited by 9
  38. 2021Adversarial robustness for latent models: Revisiting the robust-standard accuracies tradeoffcited by 8

50 most cited of 131 All 131 (JSON)