mlsanityData to 7 Oct 2026

On the (Non-)Robustness of Two-Layer Neural Networks in Different Learning Regimes

arXiv 2203.11864 ↗First posted 22 Mar 2022stat.ML cs.LGcited by 10

Not on the map. Why?

Abstract (arXiv)

Neural networks are known to be highly sensitive to adversarial examples. These may arise due to different factors, such as random initialization, or spurious correlations in the learning problem. To better understand these factors, we provide a precise study of the adversarial robustness in different scenarios, from initialization to the end of training in different regimes, as well as intermediate scenarios, where initialization still plays a role due to "lazy" training. We consider over-parameterized networks in high dimensions with quadratic targets and infinite samples. Our analysis allows us to identify new tradeoffs between approximation (as measured via test error) and robustness, whereby robustness can only get worse when test error improves, and vice versa. We also show how linearized lazy training regimes can worsen robustness, due to improperly scaled random initialization. Our theoretical results are illustrated with numerical experiments.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Builds on 37 of its 54 references that are in the map. First posted on arXiv 22 Mar 2022.

Builds on

37 of 54 references.

References · 37

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  4. 2018Robustness May Be at Odds with Accuracycited by 873
  5. 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 784
  6. 2018On Lazy Training in Differentiable Programmingcited by 671
  7. 2018Gradient Descent Provably Optimizes Over-parameterized Neural Networkscited by 655
  8. 2017Deep Neural Networks as Gaussian Processescited by 617
  9. 2018Gradient Descent Finds Global Minima of Deep Neural Networkscited by 572
  10. 2018A Mean Field View of the Landscape of Two-Layers Neural Networkscited by 463
  11. 2018On the Global Convergence of Gradient Descent for Over-parameterized Models using Optimal Transportcited by 422
  12. 2019The generalization error of random features regression: Precise asymptotics and double descent curvecited by 410
25 more
  1. 2018Adversarially Robust Generalization Requires More Datacited by 318
  2. 2018Gaussian Process Behaviour in Wide Deep Neural Networkscited by 314
  3. 2021A Universal Law of Robustness via Isoperimetrycited by 150
  4. 2015High-Dimensional Asymptotics of Prediction: Ridge Regression and Classificationcited by 146
  5. 2016Toward Deeper Understanding of Neural Networks: The Power of Initialization and a Dual View on Expressivitycited by 138
  6. 2018Rademacher Complexity for Adversarially Robust Generalizationcited by 132
  7. 2017Theoretical insights into the optimization landscape of over-parameterized shallow neural networkscited by 128
  8. 2018Are adversarial examples inevitable?cited by 113
  9. 2019Limitations of Lazy Training of Two-layers Neural Networkscited by 87
  10. 2020The Interpolation Phase Transition in Neural Networks: Memorization and Generalization under Lazy Trainingcited by 84
  11. 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
  12. 2019Convergence of Adversarial Training in Overparametrized Neural Networkscited by 58
  13. 2020The Implicit Regularization of Stochastic Gradient Flow for Least Squarescited by 58
  14. 2020A law of robustness for two-layers neural networkscited by 54
  15. 2018The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measurecited by 44
  16. 2020How benign is benign overfitting?cited by 40
  17. 2022The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regressioncited by 40
  18. 2020The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalizationcited by 39
  19. 2020Provable tradeoffs in adversarially robust classificationcited by 39
  20. 2021A single gradient step finds adversarial examples on random two-layers neural networkscited by 26
  21. 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
  22. 2017Robustness of classifiers to universal perturbations: a geometric perspectivecited by 14
  23. 2020Most ReLU Networks Suffer from ℓ2 Adversarial Perturbationscited by 12
  24. 2021Fundamental tradeoffs between memorization and robustness in random features and neural tangent regimescited by 9
  25. 2020Sample Complexity of Adversarially Robust Linear Classification on Separated Datacited by 3

Built on by

Cited by year

Citing papers per year: 2022: 2; 2023: 4; 2024: 1; 2025: 3.

10 papers.

  1. 2023The Double-Edged Sword of Implicit Bias: Generalization vs. Robustness in ReLU Networkscited by 23
  2. 2022Robustness in deep learning: The good (width), the bad (depth), and the ugly (initialization)cited by 18
  3. 2023Beyond the Universal Law of Robustness: Sharper Laws for Random Features and Neural Tangent Kernelscited by 13
  4. 2023How Spurious Features Are Memorized: Precise Analysis for Random and NTK Featurescited by 11
  5. 2025Spurious Correlations in High Dimensional Regression: The Roles of Regularization, Simplicity Bias and Over-Parameterizationcited by 9
  6. 2023Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspacescited by 8
  7. 2024Towards Understanding the Word Sensitivity of Attention Layers: A Study via Random Featurescited by 5
  8. 2025A Law of Data Reconstruction for Random Features (and Beyond)cited by 3
  9. 2022Salient Skin Lesion Segmentation via Dilated Scale-Wise Feature Fusion Networkcited by 1
  10. 2025Non-Parametric Probabilistic Robustness: A Conservative Risk Estimator under Unknown Perturbation Distributionscited by 1