# Asymptotic Behavior of Adversarial Training Estimator under ℓ_∞-Perturbation

arXiv: https://arxiv.org/abs/2401.15262 · HTML: https://mlsanity.com/paper/2401.15262/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 40 references that are in the map.
- First posted on arXiv 27 Jan 2024.

## Builds on (most cited first, 20 of 20)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Adversarially Robust Generalization Requires More Data](https://mlsanity.com/paper/1804.11285/) (2018)
- [Distributionally Robust Stochastic Optimization with Wasserstein Distance](https://mlsanity.com/paper/1604.02199/) (2016)
- [Rademacher Complexity for Adversarially Robust Generalization](https://mlsanity.com/paper/1810.11914/) (2018)
- [A modern maximum-likelihood theory for high-dimensional logistic regression](https://mlsanity.com/paper/1803.06964/) (2018)
- [Precise Statistical Analysis of Classification Accuracies for Adversarial Training](https://mlsanity.com/paper/2010.11213/) (2020)
- [The curse of overparametrization in adversarial training: Precise analysis of robust generalization for random features regression](https://mlsanity.com/paper/2201.05149/) (2022)
- [Provable tradeoffs in adversarially robust classification](https://mlsanity.com/paper/2006.05161/) (2020)
- [More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models](https://mlsanity.com/paper/2002.04725/) (2020)
- [Confidence Regions in Wasserstein Distributionally Robust Estimation](https://mlsanity.com/paper/1906.01614/) (2019)
- [On the Generalization Properties of Adversarial Training](https://mlsanity.com/paper/2008.06631/) (2020)
- [Overparameterized Linear Regression under Adversarial Attacks](https://mlsanity.com/paper/2204.06274/) (2022)
- [The Multimarginal Optimal Transport Formulation of Adversarial Multiclass Classification](https://mlsanity.com/paper/2204.12676/) (2022)
- [Regularization properties of adversarially-trained linear regression](https://mlsanity.com/paper/2310.10807/) (2023)
- [The Asymptotic Distribution of the MLE in High-dimensional Logistic Models: Arbitrary Covariance](https://mlsanity.com/paper/2001.09351/) (2020)
- [Statistical Limit Theorems in Distributionally Robust Optimization](https://mlsanity.com/paper/2303.14867/) (2023)
- [On Connections between Regularizations for Improving DNN Robustness](https://mlsanity.com/paper/2007.02209/) (2020)
- [On model selection consistency of regularized M-estimators](https://mlsanity.com/paper/1305.7477/) (2013)
- [Surprises in adversarially-trained linear regression](https://mlsanity.com/paper/2205.12695/) (2022)
- [Adjusted Wasserstein Distributionally Robust Estimator in Statistical Learning](https://mlsanity.com/paper/2303.15579/) (2023)

## Built on by (most cited first, 1 of 1)

- [Utility-Aware Multimodal Contrastive Learning for Product Image Generation](https://mlsanity.com/paper/2605.28733/) (2026)

## Abstract (arXiv)

Adversarial training has been proposed to protect machine learning models against adversarial attacks. This paper focuses on adversarial training under ℓ_∞-perturbation, which has recently attracted much research attention. The asymptotic behavior of the adversarial training estimator is investigated in the generalized linear model. The results imply that the asymptotic distribution of the adversarial training estimator under ℓ_∞-perturbation could put a positive probability mass at 0 when the true parameter is 0, providing a theoretical guarantee of the associated sparsity-recovery ability. Alternatively, a two-step procedure is proposed -- adaptive adversarial training, which could further improve the performance of adversarial training under ℓ_∞-perturbation. Specifically, the proposed procedure could achieve asymptotic variable-selection consistency and unbiasedness. Numerical experiments are conducted to show the sparsity-recovery ability of adversarial training under ℓ_∞-perturbation and to compare the empirical performance between classic adversarial training and adaptive adversarial training.