mlsanityData to 14 Oct 2026

Benign Overfitting in Adversarially Robust Linear Classification

arXiv 2112.15250 ↗First posted 31 Dec 2021cs.LG math.OC stat.MLcited by 11

Not on the map. Why?

Abstract (arXiv)

"Benign overfitting", where classifiers memorize noisy training data yet still achieve a good generalization performance, has drawn great attention in the machine learning community. To explain this surprising phenomenon, a series of works have provided theoretical justification in over-parameterized linear regression, classification, and kernel methods. However, it is not clear if benign overfitting still occurs in the presence of adversarial examples, i.e., examples with tiny and intentional perturbations to fool the classifiers. In this paper, we show that benign overfitting indeed occurs in adversarial training, a principled approach to defend against adversarial examples. In detail, we prove the risk bounds of the adversarially trained linear classifier on the mixture of sub-Gaussian data under ℓp adversarial perturbations. Our result suggests that under moderate perturbations, adversarially trained linear classifiers can achieve the near-optimal standard and adversarial risks, despite overfitting the noisy training data. Numerical experiments validate our theoretical findings.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 53 of its 68 references that are in the map. First posted on arXiv 31 Dec 2021.

Builds on

53 of 68 references.

References · 53

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  6. 2016Adversarial examples in the physical worldcited by 1,769
  7. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  9. 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 927
  10. 2018Robustness May Be at Odds with Accuracycited by 880
  11. 2017The Implicit Bias of Gradient Descent on Separable Datacited by 655
  12. 2019Benign Overfitting in Linear Regressioncited by 549
38 more
  1. 2019Surprises in High-Dimensional Ridgeless Least Squares Interpolationcited by 513
  2. 2020Overfitting in adversarially robust deep learningcited by 506
  3. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  4. 2019Implicit Regularization in Deep Matrix Factorizationcited by 405
  5. 2017Implicit Regularization in Matrix Factorizationcited by 322
  6. 2019Gradient Descent Maximizes the Margin of Homogeneous Neural Networkscited by 320
  7. 2018Adversarially Robust Generalization Requires More Datacited by 318
  8. 2018Characterizing Implicit Bias in Terms of Optimization Geometrycited by 266
  9. 2019Two models of double descent for weak featurescited by 195
  10. 2018To understand deep learning we need to understand kernel learningcited by 187
  11. 2018Gradient descent aligns the layers of deep linear networkscited by 182
  12. 2020Benign overfitting in ridge regressioncited by 153
  13. 2020Understanding and Mitigating the Tradeoff Between Robustness and Accuracycited by 149
  14. 2018Rademacher Complexity for Adversarially Robust Generalizationcited by 132
  15. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  16. 2020Feature Purification: How Adversarial Training Performs Robust Deep Learningcited by 107
  17. 2020On the Optimal Weighted ℓ2 Regularization in Overparameterized Linear Regressioncited by 98
  18. 2017Implicit Regularization in Deep Learningcited by 90
  19. 2020Finite-sample Analysis of Interpolating Linear Classifiers in the Overparameterized Regimecited by 81
  20. 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
  21. 2018Adversarial vulnerability for any classifiercited by 78
  22. 2021Benign Overfitting of Constant-Stepsize SGD for Linear Regressioncited by 71
  23. 2018Stochastic Gradient Descent on Separable Data: Exact Convergence with a Fixed Learning Ratecited by 64
  24. 2019Convergence of Adversarial Training in Overparametrized Neural Networkscited by 58
  25. 2021Exploring Memorization in Adversarial Trainingcited by 55
  26. 2020Precise Statistical Analysis of Classification Accuracies for Adversarial Trainingcited by 50
  27. 2021Risk Bounds for Over-parameterized Maximum Margin Classification on Sub-Gaussian Mixturescited by 49
  28. 2020Provable tradeoffs in adversarially robust classificationcited by 40
  29. 2020How benign is benign overfitting?cited by 40
  30. 2020Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionalitycited by 36
  31. 2020Sharp Statistical Guarantees for Adversarially Robust Gaussian Classificationcited by 28
  32. 2020More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Modelscited by 27
  33. 2021Foolish Crowds Support Benign Overfittingcited by 24
  34. 2018PAC-learning in the presence of evasion adversariescited by 23
  35. 2020Efficiently Learning Adversarially Robust Halfspaces with Noisecited by 22
  36. 2020The Complexity of Adversarially Robust Proper Learning of Halfspaces with Agnostic Noisecited by 15
  37. 2020Asymptotic Behavior of Adversarial Training in Binary Classificationcited by 15
  38. 2021On the Impact of Hard Adversarial Instances on Overfitting in Adversarial Trainingcited by 11

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 2; 2023: 1; 2024: 5; 2025: 2; 2026: 1.

11 papers.

  1. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
  2. 2024Implicit Optimization Bias of Next-Token Prediction in Linear Modelscited by 14
  3. 2024Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Datacited by 12
  4. 2022Understanding Benign Overfitting in Gradient-Based Meta Learningcited by 11
  5. 2024On the Benefits of Over-parameterization for Out-of-Distribution Generalizationcited by 7
  6. 2023On the Clean Generalization and Robust Overfitting in Adversarial Training from Two Theoretical Views: Representation Complexity and Training Dynamicscited by 5
  7. 2024Provably Neural Active Learning Succeeds via Prioritizing Perplexing Samplescited by 5
  8. 2025Scanning Trojaned Models Using Out-of-Distribution Samplescited by 3
  9. 2024Can overfitted deep neural networks in adversarial training generalize? -- An approximation viewpointcited by 1
  10. 2025Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillationcited by 0
  11. 2026Tail-Weight Control and Localized Generalization in Nearly Low-Rank Adversarial Classificationcited by 0