# Boundary thickness and robustness in learning models

arXiv: https://arxiv.org/abs/2007.05086 · HTML: https://mlsanity.com/paper/2007.05086/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Jul 2020.

## Built on by (most cited first, 26 of 26)

- [Noisy Feature Mixup](https://mlsanity.com/paper/2110.02180/) (2021)
- [Removing Batch Normalization Boosts Adversarial Training](https://mlsanity.com/paper/2207.01156/) (2022)
- [Evaluating natural language processing models with generalization metrics that do not need access to any training or testing data](https://mlsanity.com/paper/2202.02842/) (2022)
- [A Unified Understanding of Deep NLP Models for Text Classification](https://mlsanity.com/paper/2206.09355/) (2022)
- [Graph Mixup with Soft Alignments](https://mlsanity.com/paper/2306.06788/) (2023)
- [Exact Count of Boundary Pieces of ReLU Classifiers: Towards the Proper Complexity Measure for Classification](https://mlsanity.com/paper/2306.08805/) (2023)
- [Curved Representation Space of Vision Transformers](https://mlsanity.com/paper/2210.05742/) (2022)
- [Adversarial for Good? How the Adversarial ML Community's Values Impede Socially Beneficial Uses of Attacks](https://mlsanity.com/paper/2107.10302/) (2021)
- [Reverse engineering adversarial attacks with fingerprints from adversarial examples](https://mlsanity.com/paper/2301.13869/) (2023)
- [Input margins can predict generalization too](https://mlsanity.com/paper/2308.15466/) (2023)
- [Bridged Adversarial Training](https://mlsanity.com/paper/2108.11135/) (2021)
- [CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense](https://mlsanity.com/paper/2602.20418/) (2026)
- [Attack Transferability Characterization for Adversarially Robust Multi-label Classification](https://mlsanity.com/paper/2106.15360/) (2021)
- [Scalable Attribution of Adversarial Attacks via Multi-Task Learning](https://mlsanity.com/paper/2302.14059/) (2023)
- [On the Relationship Between Adversarial Robustness and Decision Region in Deep Neural Networks](https://mlsanity.com/paper/2207.03400/) (2022)
- [Provable Robust Saliency-based Explanations](https://mlsanity.com/paper/2212.14106/) (2022)
- [Improving classifier decision boundaries using nearest neighbors](https://mlsanity.com/paper/2310.03927/) (2023)
- [Complexity Matters: Effective Dimensionality as a Measure for Adversarial Robustness](https://mlsanity.com/paper/2410.18556/) (2024)
- [RDI: An adversarial robustness evaluation metric for deep neural networks based on model statistical features](https://mlsanity.com/paper/2504.18556/) (2025)
- [A Flat Minima Perspective on Understanding Augmentations and Model Robustness](https://mlsanity.com/paper/2505.24592/) (2025)
- [On the Importance of Regularisation & Auxiliary Information in OOD Detection](https://mlsanity.com/paper/2107.07564/) (2021)
- [Enhancing Adversarial Training with Feature Separability](https://mlsanity.com/paper/2205.00637/) (2022)
- [Robust Ranking Explanations](https://mlsanity.com/paper/2307.04024/) (2023)
- [Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networks](https://mlsanity.com/paper/2601.14505/) (2026)
- [Understanding the geometry of deep learning with decision boundary volume](https://mlsanity.com/paper/2603.14768/) (2026)
- [Suppress and Diversify: Refining Robust Pathways for Corruption Robustness](https://mlsanity.com/paper/2608.06712/) (2026)

## Abstract (arXiv)

Robustness of machine learning models to various adversarial and non-adversarial corruptions continues to be of interest. In this paper, we introduce the notion of the boundary thickness of a classifier, and we describe its connection with and usefulness for model robustness. Thick decision boundaries lead to improved performance, while thin decision boundaries lead to overfitting (e.g., measured by the robust generalization gap between training and testing) and lower robustness. We show that a thicker boundary helps improve robustness against adversarial examples (e.g., improving the robust test accuracy of adversarial training) as well as so-called out-of-distribution (OOD) transforms, and we show that many commonly-used regularization and data augmentation procedures can increase boundary thickness. On the theoretical side, we establish that maximizing boundary thickness during training is akin to the so-called mixup training. Using these observations, we show that noise-augmentation on mixup training further increases boundary thickness, thereby combating vulnerability to various forms of adversarial attacks and OOD transforms. We can also show that the performance improvement in several lines of recent work happens in conjunction with a thicker boundary.