mlsanityData to 7 Oct 2026

Theoretical Analysis of Robust Overfitting for Wide DNNs: An NTK Approach

arXiv 2310.06112 ↗First posted 9 Oct 2023cs.LG stat.MLcited by 8

Not on the map. Why?

Abstract (arXiv)

Adversarial training (AT) is a canonical method for enhancing the robustness of deep neural networks (DNNs). However, recent studies empirically demonstrated that it suffers from robust overfitting, i.e., a long time AT can be detrimental to the robustness of DNNs. This paper presents a theoretical explanation of robust overfitting for DNNs. Specifically, we non-trivially extend the neural tangent kernel (NTK) theory to AT and prove that an adversarially trained wide DNN can be well approximated by a linearized DNN. Moreover, for squared loss, closed-form AT dynamics for the linearized DNN can be derived, which reveals a new AT degeneration phenomenon: a long-term AT will result in a wide DNN degenerates to that obtained without AT and thus cause robust overfitting. Based on our theoretical results, we further design a method namely Adv-NTK, the first AT algorithm for infinite-width DNNs. Experiments on real-world datasets show that Adv-NTK can help infinite-width DNNs enhance comparable robustness to that of their finite-width counterparts, which in turn justifies our theoretical findings. The code is available at https://github.com/fshp971/adv-ntk.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 44 of its 67 references that are in the map. First posted on arXiv 9 Oct 2023.

Builds on

44 of 67 references.

References · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  8. 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 784
  9. 2019Wide Neural Networks of Any Depth Evolve as Linear Models Under Gradient Descentcited by 732
  10. 2018Gradient Descent Provably Optimizes Over-parameterized Neural Networkscited by 655
  11. 2019On Exact Computation with an Infinitely Wide Neural Netcited by 572
  12. 2020Overfitting in adversarially robust deep learningcited by 504
32 more
  1. 2020Towards Understanding Ensemble, Knowledge Distillation and Self-Distillation in Deep Learningcited by 292
  2. 2018Learning Overparameterized Neural Networks via Stochastic Gradient Descent on Structured Datacited by 260
  3. 2019Generalization Bounds of Stochastic Gradient Descent for Wide and Deep Neural Networkscited by 221
  4. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  5. 2018Bayesian Deep Convolutional Networks with Many Channels are Gaussian Processescited by 164
  6. 2019Graph Neural Tangent Kernel: Fusing Graph Neural Networks with Graph Kernelscited by 160
  7. 2019Neural Tangents: Fast and Easy Infinite Neural Networks in Pythoncited by 149
  8. 2020Infinite attention: NNGP and NTK for deep attention networkscited by 117
  9. 2020Tight Bounds on the Smallest Eigenvalue of the Neural Tangent Kernel for Deep ReLU Networkscited by 87
  10. 2020Why Do Deep Residual Networks Generalize Better than Deep Feedforward Networks? -- A Neural Tangent Kernel Perspectivecited by 60
  11. 2019Convergence of Adversarial Training in Overparametrized Neural Networkscited by 58
  12. 2020A law of robustness for two-layers neural networkscited by 54
  13. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
  14. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  15. 2022The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regressioncited by 40
  16. 2020The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalizationcited by 39
  17. 2020Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionalitycited by 36
  18. 2022Memorization and Optimization in Deep Neural Networks with Minimum Over-parameterizationcited by 36
  19. 2022What Can the Neural Tangent Kernel Tell Us About Adversarial Robustness?cited by 21
  20. 2020Backward Feature Correction: How Deep Learning Performs Deep (Hierarchical) Learningcited by 18
  21. 2022Fast Neural Kernel Embeddings for General Activationscited by 18
  22. 2022Robustness in deep learning: The good (width), the bad (depth), and the ugly (initialization)cited by 18
  23. 2021Interpolation can hurt robust generalization even when there is no noisecited by 15
  24. 2022Evolution of Neural Tangent Kernels under Benign and Adversarial Trainingcited by 14
  25. 2023Beyond the Universal Law of Robustness: Sharper Laws for Random Features and Neural Tangent Kernelscited by 13
  26. 2022Why adversarial training can hurt robust accuracycited by 12
  27. 2022A Kernel Perspective of Skip Connections in Convolutional Networkscited by 12
  28. 2022Neural Tangent Kernel Analysis of Deep Narrow Neural Networkscited by 11
  29. 2023How Spurious Features Are Memorized: Precise Analysis for Random and NTK Featurescited by 11
  30. 2022Adversarial Robustness is at Odds with Lazy Trainingcited by 6
  31. 2023Generalization Ability of Wide Residual Networkscited by 5
  32. 2023Understanding Overfitting in Adversarial Training via Kernel Regressioncited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 5.

8 papers.

  1. 2025Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidencecited by 13
  2. 2026Concept-Based Dictionary Learning for Inference-Time Safety in Vision Language Action Modelscited by 3
  3. 2025Attributing Data for Sharpness-Aware Minimizationcited by 2
  4. 2026Word Recovery in Large Language Models Enables Character-Level Tokenization Robustnesscited by 2
  5. 2026Differentially Private Non-convex Distributionally Robust Optimizationcited by 1
  6. 2026Understanding and Improving Continuous Adversarial Training for LLMs via In-context Learning Theorycited by 1
  7. 2024How Learning Dynamics Drive Adversarially Robust Generalization?cited by 0
  8. 2026Adversarial Robustness of NTK Neural Networkscited by 0