mlsanityData to 7 Oct 2026

Adversarial Examples Exist in Two-Layer ReLU Networks for Low Dimensional Linear Subspaces

arXiv 2303.00783 ↗First posted 1 Mar 2023cs.LG cs.CR cs.NEcited by 8

Not on the map. Why?

Abstract (arXiv)

Despite a great deal of research, it is still not well-understood why trained neural networks are highly vulnerable to adversarial examples. In this work we focus on two-layer neural networks trained using data which lie on a low dimensional linear subspace. We show that standard gradient methods lead to non-robust neural networks, namely, networks which have large gradients in directions orthogonal to the data subspace, and are susceptible to small adversarial L2-perturbations in these directions. Moreover, we show that decreasing the initialization scale of the training algorithm, or adding L2 regularization, can make the trained network more robust to adversarial perturbations orthogonal to the data.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 36 of its 39 references that are in the map. First posted on arXiv 1 Mar 2023.

Builds on

36 of 39 references.

References · 36

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2013Auto-Encoding Variational Bayescited by 3,980
  6. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  9. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  10. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  11. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  12. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
24 more
  1. 2020The Pitfalls of Simplicity Bias in Neural Networkscited by 349
  2. 2018Adversarially Robust Generalization Requires More Datacited by 318
  3. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  4. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  5. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  6. 2021A Universal Law of Robustness via Isoperimetrycited by 150
  7. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  8. 2018Are adversarial examples inevitable?cited by 113
  9. 2020Feature Purification: How Adversarial Training Performs Robust Deep Learningcited by 107
  10. 2018Adversarial examples from computational constraintscited by 79
  11. 2018Adversarial vulnerability for any classifiercited by 78
  12. 2016A Boundary Tilting Persepective on the Phenomenon of Adversarial Examplescited by 70
  13. 2020A law of robustness for two-layers neural networkscited by 54
  14. 2018On the Geometry of Adversarial Examplescited by 43
  15. 2021The Dimpled Manifold Model of Adversarial Examples in Machine Learningcited by 41
  16. 2017The Robust Manifold Defense: Adversarial Training using Generative Modelscited by 35
  17. 2019A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distancecited by 32
  18. 2022Gradient Methods Provably Converge to Non-Robust Networkscited by 27
  19. 2021A single gradient step finds adversarial examples on random two-layers neural networkscited by 26
  20. 2021Adversarial Examples in Multi-Layer Random ReLU Networkscited by 26
  21. 2021Shift Invariance Can Reduce Adversarial Robustnesscited by 16
  22. 2022Adversarial Examples in Random Neural Networks with General Activationscited by 13
  23. 2022On the (Non-)Robustness of Two-Layer Neural Networks in Different Learning Regimescited by 10
  24. 2022Adversarial Robustness is at Odds with Lazy Trainingcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 3; 2026: 3.

8 papers.

  1. 2025When Flatness Does (Not) Guarantee Adversarial Robustnesscited by 3
  2. 2025H-SPLID: HSIC-based Saliency Preserving Latent Information Decompositioncited by 2
  3. 2026From Curiosity to Caution: Mitigating Reward Hacking for Best-of-N with Pessimismcited by 2
  4. 2024Feature compression is the root cause of adversarial fragility in neural network classifierscited by 1
  5. 2024Adversarial Vulnerability as a Consequence of On-Manifold Inseparibilitycited by 0
  6. 2025Existence of Adversarial Examples for Random Convolutional Networks via Isoperimetric Inequalities on mathbbso(d)cited by 0
  7. 2026On the Rate of Convergence of GD in Non-linear Neural Networks: An Adversarial Robustness Perspectivecited by 0
  8. 2026Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guaranteescited by 0