# Adversarial generalization of unfolding (model-based) networks

arXiv: https://arxiv.org/abs/2509.15370 · HTML: https://mlsanity.com/paper/2509.15370/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 27 of its 52 references that are in the map.
- First posted on arXiv 18 Sep 2025.

## Builds on (most cited first, 27 of 27)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks](https://mlsanity.com/paper/1908.06281/) (2019)
- [A vector-contraction inequality for Rademacher complexities](https://mlsanity.com/paper/1605.00251/) (2016)
- [Model-Based Deep Learning](https://mlsanity.com/paper/2012.08405/) (2020)
- [Rademacher Complexity for Adversarially Robust Generalization](https://mlsanity.com/paper/1810.11914/) (2018)
- [Generalizable Adversarial Training via Spectral Normalization](https://mlsanity.com/paper/1811.07457/) (2018)
- [Solving Inverse Problems With Deep Neural Networks -- Robustness Included?](https://mlsanity.com/paper/2011.04268/) (2020)
- [Robustness to Adversarial Perturbations in Learning from Incomplete Data](https://mlsanity.com/paper/1905.13021/) (2019)
- [Adversarial Learning Guarantees for Linear Hypotheses and Neural Networks](https://mlsanity.com/paper/2004.13617/) (2020)
- [Memory-Augmented Deep Unfolding Network for Compressive Sensing](https://mlsanity.com/paper/2110.09766/) (2021)
- [Theoretical Analysis of Adversarial Learning: A Minimax Approach](https://mlsanity.com/paper/1811.05232/) (2018)
- [Optimism in the Face of Adversity: Understanding and Improving Deep Learning through Adversarial Robustness](https://mlsanity.com/paper/2010.09624/) (2020)
- [Revisiting Residual Networks for Adversarial Robustness: An Architectural Perspective](https://mlsanity.com/paper/2212.11005/) (2022)
- [Improving Robustness of Deep-Learning-Based Image Reconstruction](https://mlsanity.com/paper/2002.11821/) (2020)
- [Theoretical Perspectives on Deep Learning Methods in Inverse Problems](https://mlsanity.com/paper/2206.14373/) (2022)
- [Overparameterized Linear Regression under Adversarial Attacks](https://mlsanity.com/paper/2204.06274/) (2022)
- [Regularization properties of adversarially-trained linear regression](https://mlsanity.com/paper/2310.10807/) (2023)
- [Compressive Sensing and Neural Networks from a Statistical Learning Perspective](https://mlsanity.com/paper/2010.15658/) (2020)
- [Dynamic Path-Controllable Deep Unfolding Network for Compressive Sensing](https://mlsanity.com/paper/2306.16060/) (2023)
- [ADMM-DAD net: a deep unfolding network for analysis compressed sensing](https://mlsanity.com/paper/2110.06986/) (2021)
- [Compressed sensing of low-rank plus sparse matrices](https://mlsanity.com/paper/2007.09457/) (2020)
- [Adversarial Risk Bounds for Neural Networks through Sparsity based Compression](https://mlsanity.com/paper/1906.00698/) (2019)
- [DECONET: an Unfolding Network for Analysis-based Compressed Sensing with Generalization Error Bounds](https://mlsanity.com/paper/2205.07050/) (2022)
- [Data-Dependent Stability Analysis of Adversarial Training](https://mlsanity.com/paper/2401.03156/) (2024)
- [PAC-Bayesian Adversarially Robust Generalization Bounds for Graph Neural Network](https://mlsanity.com/paper/2402.04038/) (2024)
- [Generalization analysis of an unfolding network for analysis-based Compressed Sensing](https://mlsanity.com/paper/2303.05582/) (2023)

## Abstract (arXiv)

Unfolding networks are interpretable networks emerging from iterative algorithms, incorporate prior knowledge of data structure, and are designed to solve inverse problems like compressed sensing, which deals with recovering data from noisy, missing observations. Compressed sensing finds applications in critical domains, from medical imaging to cryptography, where adversarial robustness is crucial to prevent catastrophic failures. However, a solid theoretical understanding of the performance of unfolding networks in the presence of adversarial attacks is still in its infancy. In this paper, we study the adversarial generalization of unfolding networks when perturbed with l2-norm constrained attacks, generated by the fast gradient sign method. Particularly, we choose a family of state-of-the-art overaparameterized unfolding networks and deploy a new framework to estimate their adversarial Rademacher complexity. Given this estimate, we provide adversarial generalization error bounds for the networks under study, which are tight with respect to the attack level. To our knowledge, this is the first theoretical analysis on the adversarial generalization of unfolding networks. We further present a series of experiments on real-world data, with results corroborating our derived theory, consistently for all data. Finally, we observe that the family's overparameterization can be exploited to promote adversarial robustness, shedding light on how to efficiently robustify neural networks.