mlsanityData to 7 Oct 2026

Can Implicit Bias Imply Adversarial Robustness?

arXiv 2405.15942 ↗First posted 24 May 2024cs.LG stat.MLcited by 5

Not on the map. Why?

Abstract (arXiv)

The implicit bias of gradient-based training algorithms has been considered mostly beneficial as it leads to trained networks that often generalize well. However, Frei et al. (2023) show that such implicit bias can harm adversarial robustness. Specifically, they show that if the data consists of clusters with small inter-cluster correlation, a shallow (two-layer) ReLU network trained by gradient flow generalizes well, but it is not robust to adversarial attacks of small radius. Moreover, this phenomenon occurs despite the existence of a much more robust classifier that can be explicitly constructed from a shallow network. In this paper, we extend recent analyses of neuron alignment to show that a shallow network with a polynomial ReLU activation (pReLU) trained by gradient flow not only generalizes well but is also robust to adversarial attacks. Our results highlight the importance of the interplay between data structure and architecture design in the implicit bias and robustness of trained networks.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 43 of its 48 references that are in the map. First posted on arXiv 24 May 2024.

Builds on

43 of 48 references.

References · 43

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  6. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  7. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  8. 2019Adversarial Training for Free!cited by 638
  9. 2016Weight Normalization: A Simple Reparameterization to Accelerate Training of Deep Neural Networkscited by 541
  10. 2017Countering Adversarial Images using Input Transformationscited by 517
  11. 2019On Evaluating Adversarial Robustnesscited by 442
  12. 2017Implicit Regularization in Matrix Factorizationcited by 318
31 more
  1. 2019Gradient Descent Maximizes the Margin of Homogeneous Neural Networkscited by 308
  2. 2020Kernel and Rich Regimes in Overparametrized Modelscited by 302
  3. 2020Implicit Bias of Gradient Descent for Wide Two-layer Neural Networks Trained with the Logistic Losscited by 267
  4. 2018Gradient descent aligns the layers of deep linear networkscited by 182
  5. 2018Algorithmic Regularization in Learning Deep Homogeneous Models: Layers are Automatically Balancedcited by 172
  6. 2020Directional convergence and alignment in deep learningcited by 172
  7. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  8. 2018Are adversarial examples inevitable?cited by 113
  9. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
  10. 2022B-cos Networks: Alignment is All We Need for Interpretabilitycited by 88
  11. 2021Saddle-to-Saddle Dynamics in Deep Linear Networks: Small Initialization Training, Symmetry, and Sparsitycited by 83
  12. 2021Gradient Descent on Two-layer Nets: Margin Maximization and Simplicity Biascited by 82
  13. 2018Adversarial vulnerability for any classifiercited by 78
  14. 2021Small random initialization is akin to spectral learning: Optimization and generalization guarantees for overparameterized low-rank matrix reconstructioncited by 77
  15. 2022Gradient flow dynamics of shallow ReLU networks for square loss and orthogonal inputscited by 74
  16. 2018Gradient Descent Quantizes ReLU Network Featurescited by 57
  17. 2023Max-Margin Token Selection in Attention Mechanismcited by 57
  18. 2023Transformers learn through gradual rank increasecited by 52
  19. 2022Implicit Bias in Leaky ReLU Networks Trained on High-Dimensional Datacited by 46
  20. 2021On Margin Maximization in Linear and ReLU Networkscited by 34
  21. 2023Implicit bias of SGD in L2-regularized linear DNNs: One-way jumps from high to low rankcited by 28
  22. 2023Early Neuron Alignment in Two-layer ReLU Networks with Small Initializationcited by 28
  23. 2023The Double-Edged Sword of Implicit Bias: Generalization vs. Robustness in ReLU Networkscited by 23
  24. 2020Adversarial Robustness of Supervised Sparse Codingcited by 22
  25. 2024Early alignment in two-layer networks training is a two-edged swordcited by 17
  26. 2023Learning a Neuron by a Shallow ReLU Network: Dynamics and Implicit Bias for Correlated Inputscited by 16
  27. 2023Understanding Multi-phase Optimization Dynamics and Rich Nonlinear Behaviors of ReLU Networkscited by 15
  28. 2022Analysis and Extensions of Adversarial Training for Video Classificationcited by 11
  29. 2023Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustnesscited by 11
  30. 2024Directional Convergence Near Small Initializations and Saddles in Two-Homogeneous Neural Networkscited by 10
  31. 2021Bridging the Gap Between Adversarial Robustness and Optimization Biascited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 3.

5 papers.

  1. 2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 14
  2. 2026The Implicit Bias of Adam and Muon on Smooth Homogeneous Neural Networkscited by 6
  3. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  4. 2024Adversarial Vulnerability as a Consequence of On-Manifold Inseparibilitycited by 0
  5. 2026Noise Stability of Transformer Modelscited by 0