SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Antônio H. Ribeiro
antonio.horta.ribeiro@it.uu.se
PSL Research University, INRIA
Dave Zachariah
dave.zachariah@it.uu.se
Thomas B. Schön
thomas.schon@it.uu.se
State-of-the-art machine learning models can be vulnerable to very small input perturbations that are adversarially constructed. Adversarial training is an effective approach to defend against it. Formulated as a min-max problem, it searches for the best solution when the training data were corrupted by the worst-case attacks. Linear models are among the simple models where vulnerabilities can be observed and are the focus of our study. In this case, adversarial training leads to a convex optimization problem which can be formulated as the minimization of a finite sum. We provide a comparative analysis between the solution of adversarial training in linear regression and other regularization methods. Our main findings are that: (A) Adversarial training yields the minimum-norm interpolating solution in the overparameterized regime (more parameters than data), as long as the maximum disturbance radius is smaller than a threshold. And, conversely, the minimum-norm interpolator is the solution to adversarial training with a given radius. (B) Adversarial training can be equivalent to parameter shrinking methods (ridge regression and Lasso). This happens in the underparametrized region, for an appropriate choice of adversarial radius and zero-mean symmetrically distributed covariates. (C) For  $\ell_{\infty}$ -adversarial training—as in square-root Lasso—the choice of adversarial radius for optimal bounds does not depend on the additive noise variance. We confirm our theoretical findings with numerical examples.
Adversarial attacks generated striking examples of the brittleness of modern machine learning. The framework considers inputs contaminated with disturbances deliberately chosen to maximize the model error and, even for small disturbances, can cause a substantial performance drop in otherwise state-of-the-art models [1]–[6]. Adversarial training [7] is one of the most effective approaches for deep learning models to defend against adversarial attacks [7]–[9]. It considers training models on samples that have been modified by an adversary, with the goal of obtaining a model that will be more robust when faced with new adversially perturbed samples. The training procedure is formulated as a min-max problem, searching for the best solution to the worst-case attacks.
Despite its success in producing state-of-the-art results in adversarial defense benchmarks [10], there are still major challenges in using adversarial training. The min-max problem is a hard optimization problem to solve and it is still an open question how to solve it efficiently. Moreover, these methods still produce large errors in new adversially disturbed test points, often much larger than the adversarial error obtained during training.
(a) Lasso regression
(b)  $\ell_{\infty}$ -adversarial training
Figure 1: Regularization paths estimated in the Diabetes dataset [18]. Regularization paths are plots showing the coefficient estimates for varying regularization parameter  $\lambda$  or, in adversarial training, perturbation radius  $\delta$ . This type of plot is commonly used in analysing Lasso and variants, i.e. [18], [19]. On the horizontal axis, we give the  $\ell_1$ -norm of the estimated parameter. On the vertical axis, the coefficients obtained for each method. The dataset has  $p = 10$  baseline variables (age, sex, body mass index, average blood pressure, and six blood serum measurements), which were obtained for  $n = 442$  diabetes patients. The model output is a quantitative measure of the disease progression. See Appendix B.5 for the relationship between  $\|\widehat{\beta}\|_1$  and  $\delta$  and  $\lambda$ .
To get insight into adversarial training and try to tackle these challenges, a growing body of work [11]–[15] studies fundamental properties of adversarial attacks and adversarial training in linear models. Linear models allow for analytical analysis while still reproducing phenomena observed in state-of-the-art models. Consider a training dataset  $\{(x_i,y_i)\}_{i = 1}^n$  consisting of  $n$  data points of dimension  $\mathbb{R}^p\times \mathbb{R}$ , adversarial training in linear regression corresponds to minimizing (in  $\beta \in \mathbb{R}^p$ )
$$
R ^ {\mathrm {a d v}} (\boldsymbol {\beta}; \delta , \| \cdot \|) = \frac {1}{n} \sum_ {i = 1} ^ {n} \max  _ {\| \boldsymbol {\Delta x} _ {i} \| \leq \delta} | y _ {i} - \left(\boldsymbol {x} _ {i} + \boldsymbol {\Delta x} _ {i}\right) ^ {\top} \boldsymbol {\beta} | ^ {2}. \tag {1}
$$
Restricting the analysis to linear models allows for a simplified analysis: the problem is convex and the next proposition allows us to express  $R^{\mathrm{adv}}$  in terms of the dual norm,  $\| \boldsymbol{\beta} \|_* = \sup_{\| \boldsymbol{x} \| \leq 1} |\boldsymbol{\beta}^\top \boldsymbol{x}|$ .
Proposition 1 (Dual formulation). Let  $\| \cdot \|_*$  be the dual norm of  $\| \cdot \|$ , then
$$
R ^ {\mathrm {a d v}} (\boldsymbol {\beta}; \delta , \| \cdot \|) = \frac {1}{n} \sum_ {i = 1} ^ {n} \left(| y _ {i} - \boldsymbol {x} _ {i} ^ {\top} \boldsymbol {\beta} | + \delta \| \boldsymbol {\beta} \| _ {*}\right) ^ {2}. \tag {2}
$$
This simple reformulation removes one of the major challenges: it removes the inner optimization problem and yields a model that is more amenable to analysis. Similar reformulations can be obtained for classification. This simplification made the analysis of adversarial attacks in linear models fruitful to get insights into the properties of adversarial training and examples. From giving a counterexample to the idea that deep neural networks' vulnerabilities to adversarial attacks were caused by their nonlinearity [2], [5], [16], to help explaining how implicitly regularized overparametrized models can be robust, see [17].
In this paper, we further explore this reformulation and provide a thorough characterization of adversarial training in linear regression problems. We do this in a comparative fashion, establishing when the solution of adversially-trained linear models coincides with the solution of traditional regularization methods. For instance, a simple inspection of (2) hints at the similarities with other parameter shrinking methods. This similarity is confirmed in Figure 1, $^{1}$  which illustrates how the solutions of  $\ell_{\infty}$ -adversarial training can be almost indistinguishable from Lasso. We explain the similarities and differences with other methods. Our contributions are:
A. In the overparametrized region, we prove that the minimum-norm interpolator is the solution to adversarial training for  $\delta$  smaller than a certain threshold (Section 4).
B. We establish conditions under which the solution coincides with Lasso and ridge regression, respectively (Section 5).
C. We show that adversarial training can be framed in the robust regression framework, and use it to establish connections with the square-root Lasso. We show that adversarial training (like the square-root Lasso) can obtain bounds on the prediction error that do not require the noise variance to be known (Section 6).
D. We prove a more general version of Proposition 1, valid for general lower-semicontinuous and convex loss functions (Section 8).
$^{1}$ Code for reproducing the figures is available in: https://github.com/antonior92/advtrain-linreg
Generalization of minimum-norm interpolators. The study of minimum-norm interpolators played a key role in explaining why overparametrized models generalize—an important open question for which traditional theory failed to explain empirical results [20]—and for which significant progress has been made over the past few years [21]. These estimates provide a simple scenario where we can interpolate noisy data and still generalize well. Minimum-norm interpolators have indeed been quite a fruitful setting to study the phenomenon of benign overfitting, i.e., when the model interpolates the training data but still generalizes well to new samples. In [22] the authors use these estimates to prove consistency, a development that later had several extensions [23]. From another angle, in a series of insightful papers, Belkin et al. [24], [25] explore the phenomena of double-descent: where a double-descent curve subsumes the textbook U-shaped bias-variance trade-off curve, with a second decrease in the error occurring beyond the point where the model has reached the capacity of interpolating the training data. Interestingly, minimum-norm interpolators are also basic scenarios for observing this phenomena [24]-[26]. Our research connects the research on robustness to adversarial attacks to the study of generalization of minimum-norm interpolators.
Adversarial training in linear models. The generalization of adversarial attacks in linear models is well-studied. Tsipras et al. [16] and Ilyas et al. [5] use linear models to explain the conflict between robustness and high-performance models observed in neural networks; Ribeiro et al. [17] use these models to show how overparameterization affects robustness to perturbations; Taheri et al. [11] derive asymptotics for adversarial training in binary classification. Dan et al. [27] and Dobriban et al. [28] study adversarial robustness in Gaussian classification problems. Javanmard et al. [12] provide asymptotics for adversarial training in linear regression, Javanmard et al. [29] in classification settings and Hassani et al. [13] for random feature regressions. Min et al. [14] investigate how the dataset size affects adversarial performance. Yin et al. [15] provide an analysis of  $\ell_{\infty}$ -attack on linear classifiers based on Rademacher complexity. These works, however, focus on the generalization properties. We provide a fresh perspective on the problem by clarifying the connection of adversarial training to other regularization methods.
Robust regression and square-root Lasso. The properties of Lasso [30] for recovering sparse parameters in noisy settings have been extensively studied, and bounds on the parameter estimation error are well-known [31]. However, these results rely on choices of regularization parameters that depend on the variance of additive noise. Square-root Lasso [32] was proposed to circumvent this difficulty. We show that for  $\ell_{\infty}$ -adversarial, similarly to the square-root Lasso, bounds can be obtained with the adversarial radius set without knowledge about the variance of the additive noise. We also show that both methods fit into the robust regression framework [33]. The work on robust classification [34] is also connected to our work, there they show that certain robust support vector machines are equivalent to SVM. Our results for classification in Section 8 can be viewed as a generalization of their Theorem 3.
Dual formulation. Variations of Proposition 1 are presented in [12], [17], [35]. Equivalent results in the context of classification are presented in [2], [15]. We use the reformulation extensively in our developments and also present a generalized statement for it.
Different estimators will be relevant to our developments and will be compared in this paper.
Adversarially-trained linear regression. Our main object of study is the minimization of
$$
R ^ {\mathrm {a d v}} (\pmb {\beta}; \delta , \| \cdot \|) = \frac {1}{n} \sum_ {i = 1} ^ {n} \max _ {\| \pmb {\Delta x} _ {i} \| \leq \delta} | y _ {i} - (\pmb {x} _ {i} + \pmb {\Delta x} _ {i}) ^ {\top} \pmb {\beta} | ^ {2} \overset {\mathrm {(a)}} {=} \frac {1}{n} \sum_ {i = 1} ^ {n} \left(| y _ {i} - \pmb {x} _ {i} ^ {\top} \pmb {\beta} | + \delta \| \pmb {\beta} \| _ {*} \right) ^ {2},
$$
where equality (a) follows from Proposition 1. We use  $\| \boldsymbol{\beta}\|_{*} = \sup_{\|\boldsymbol{x}\| \leq 1} |\boldsymbol{\beta}^{\top} \boldsymbol{x}|$  to denote the dual norm of  $\|\cdot\|$ . We highlight that the  $\ell_2$ -norm,  $\|\boldsymbol{\beta}\|_2 = \sum_i |\beta_i|^2$  is dual to itself. The  $\ell_1$ -norm,  $\|\boldsymbol{\beta}\|_1 = \sum_i |\beta_i|$ , is the dual norm of the  $\ell_\infty$ -norm,  $\|\boldsymbol{\beta}\|_\infty = \max_i |\beta_i|$ . When the adversarial disturbances are constrained to the  $\ell_p$  ball:  $\{\Delta \boldsymbol{x} : \|\Delta \boldsymbol{x}\|_p \leq \delta\}$  we will call it  $\ell_p$ -adversarial training. Our focus will be on  $\ell_\infty$  and  $\ell_2$ -adversarial training.
Parameter-shrinking methods. Parameter-shrinking methods explicitly penalize large values of  $\beta$ . Regression methods that involve shrinkage include Lasso [30] and ridge regression, which minimize,
$$
R ^ {\mathrm {l a s s o}} (\boldsymbol {\beta}; \lambda) = \frac {1}{n} \sum_ {i = 1} ^ {n} | y _ {i} - \boldsymbol {x} _ {i} ^ {\top} \boldsymbol {\beta} | ^ {2} + \lambda \| \boldsymbol {\beta} \| _ {1} \quad \text {a n d} \quad R ^ {\mathrm {r i d g e}} (\boldsymbol {\beta}; \lambda) = \frac {1}{n} \sum_ {i = 1} ^ {n} | y _ {i} - \boldsymbol {x} _ {i} ^ {\top} \boldsymbol {\beta} | ^ {2} + \lambda \| \boldsymbol {\beta} \| _ {2} ^ {2}.
$$
Square-root Lasso: Setting (with guarantees) the Lasso regularization parameters requires knowledge about the variance of the noise. Square-root Lasso [32] circumvent this difficulty by minimizing:
$$
R ^ {\sqrt {\text {l a s s o}}} (\boldsymbol {\beta}, \lambda) = \sqrt {\frac {1}{n} \sum_ {i = 1} ^ {n} | y _ {i} - \boldsymbol {x} _ {i} ^ {\top} \boldsymbol {\beta} | ^ {2}} + \lambda \| \boldsymbol {\beta} \| _ {1}. \tag {3}
$$
Minimum-norm interpolator: Let  $\mathbf{X} \in \mathbb{R}^{n \times p}$  denote the matrix of stacked vectors  $\mathbf{x}_i$  and  $\mathbf{y} \in \mathbb{R}^n$  is the vector of stacked outputs. When matrix  $\mathbf{X}$  has full row rank, the linear system  $\mathbf{X}\beta = \mathbf{y}$  has multiple solutions. In this case the minimum  $\| \cdot \|_*$ -norm interpolator is the solution of
$$
\min  _ {\boldsymbol {\beta}} \| \boldsymbol {\beta} \| _ {*} \quad \text {s u b j e c t t o} \quad \boldsymbol {X} \boldsymbol {\beta} = \boldsymbol {y}. \tag {4}
$$
4 Adversarial training in the overparametrized regime
Our first contribution is to provide conditions for when the minimum-norm interpolator is equivalent to adversarial training in the overparametrized case (we will assume that  $\mathrm{rank}(\mathbf{X}) = n$  and  $n < p$ ). On the one hand, our result gives further insight into adversarial training. On the other hand, it allows us to see minimum-norm interpolators as a solution of the adversarial training problem.
Theorem 1. Assume the matrix  $\mathbf{X} \in \mathbb{R}^{n \times p}$  to have full row rank, let  $\widehat{\alpha}$  denote the solution of the dual problem  $\max_{\| \alpha^{\top} \mathbf{X} \| \leq 1} \alpha^{\top} \mathbf{y}$ , and  $\bar{\delta}$  denote the threshold
$$
\bar {\delta} = \left(n \| \hat {\boldsymbol {\alpha}} \| _ {\infty}\right) ^ {- 1}. \tag {5}
$$
The minimum  $\| \cdot \|_{*}$ -norm interpolator minimizes the adversarial risk  $R^{\mathrm{adv}}(\beta, \delta, \| \cdot \|)$  if and only if  $\delta \in (0, \bar{\delta}]$ .
Remark 1 (Bounds on  $\bar{\delta}$ ). The theorem allows us to directly compute  $\bar{\delta}$ , but it does require solving the dual problem to the minimum-norm solution. In Appendix A.3, we provide bounds on  $\bar{\delta}$  that avoid solving the optimization problem. For instance, for  $\ell_{\infty}$ -adversarial attacks, we have the following bounds depending on the singular values of  $X$ :  $\frac{1}{\sqrt{p}} \sigma_n(X) \leq n \bar{\delta} \leq \sqrt{p} \sigma_1(X)$ . Where  $\sigma_1$  and  $\sigma_n$  denote the largest and smallest positive singular values of  $X$ , respectively.
Proof of Theorem 1. Let  $\widehat{\beta}$  and  $\widehat{\alpha}$  be the minimum  $\| \cdot \|_{*}$ -norm solution and the solution of the associated dual problem. Throughout the proof we denote  $R^{\mathrm{adv}}(\beta) = R^{\mathrm{adv}}(\beta ;\delta ,\| \cdot \|)$ , dropping the last two arguments. The subgradient of  $R^{\mathrm{adv}}(\beta)$  evaluated at  $\widehat{\beta}$  is given by
$$
\partial R ^ {\mathrm {a d v}} (\widehat {\boldsymbol {\beta}}) = \frac {2 \delta}{n} \sum_ {i = 1} ^ {n} \| \widehat {\boldsymbol {\beta}} \| _ {*} \left(\rho_ {i} \boldsymbol {x} _ {i} + \delta \partial \| \widehat {\boldsymbol {\beta}} \| _ {*}\right), \tag {6}
$$
for any  $\pmb{\rho} = (\rho_1, \dots, \rho_n) \in \mathbb{R}^n$  that satisfies  $\| \pmb{\rho} \|_{\infty} \leq 1$ . We have that any element of  $\partial \| \widehat{\beta} \|_*$  can be written as  $X^\top \widehat{\alpha}$  (we prove that in Lemma 1 in the Appendix). Hence, we can rewrite
$$
\partial R ^ {\mathrm {a d v}} (\widehat {\boldsymbol {\beta}}) = \frac {2 \delta}{n} \sum_ {i = 1} ^ {n} \| \widehat {\boldsymbol {\beta}} \| _ {*} (\rho_ {i} \boldsymbol {x} _ {i} + \delta \boldsymbol {X} ^ {T} \widehat {\boldsymbol {\alpha}}) = 2 \delta \| \widehat {\boldsymbol {\beta}} \| _ {*} \left(\frac {\boldsymbol {X} ^ {\top} \boldsymbol {\rho}}{n} + \delta \boldsymbol {X} ^ {\top} \widehat {\boldsymbol {\alpha}}\right).
$$
If  $\delta \leq \bar{\delta} = 1 / (n\|\widehat{\boldsymbol{\alpha}}\|_{\infty})$ , we can take  $\pmb{\rho} = -n\delta \widehat{\pmb{\alpha}}$  and the subderivative contains zero. On the other hand, if  $\delta > 1 / (n\|\widehat{\boldsymbol{\alpha}}\|_{\infty})$  then  $\left(\frac{\pmb{X}^{\top}\pmb{\rho}}{n} + \delta \pmb{X}^{\top}\widehat{\pmb{\alpha}}\right)$  is not zero for  $\|\pmb{\rho}\|_{\infty} \leq 1$ .
The minimum  $\ell_1$ -norm interpolator is well studied in the context of 'basis pursuit' and allows the recovery of low-dimensional representations in sparse signals [39]. The interest in the minimum  $\ell_2$ -norm is more recent. It played an important role in studying the interplay between interpolation and generalization, being used in many recent papers where the double-descent [24], [26] and the benign overfitting phenomena [22] were observed.
2The subgradient of a function  $\omega :\mathbb{R}^p\to \mathbb{R}$  is the set:
$\partial \omega (\pmb {\beta}_0) = \{\pmb {v}\in \mathbb{R}^p:\omega (\pmb {\beta}) - \omega (\pmb {\beta}_0)\geq \pmb {v}(\pmb {\beta} - \pmb {\beta}_0),\forall \pmb {\beta}\in \mathbb{R}^p\} .$
See [36]–[38] for properties. We use  $\partial \| \widehat{\beta} \|_*$  to denote the subgradient of  $\omega(\beta) = \| \beta \|_*$  evaluated at  $\widehat{\beta}$ .
Theorem 1 gives a new perspective on the robustness of the minimum-norm interpolator, allowing us to see it as a solution to adversarial training with adversarial radius  $\bar{\delta}$ . Figure 2 shows that the radius  $\bar{\delta}$  of the adversarial training problem corresponding to the minimum-norm interpolator increases with the ratio  $p / n$ . It is natural to expect that training with a larger radius would yield more adversially robust models on new test points. The next result formalizes this intuition by establishing an upper bound on the robustness gap: the difference between the square-root of the expected adversarial squared error
$\mathcal{R}_{*}^{\mathrm{adv}}(\beta ;\delta_{\mathrm{test}},\| \cdot \|) = \mathbb{E}_{y_0,\pmb {x}_0}\left[\max_{\| \pmb {\Delta}\pmb {x}_i\| \leq \delta_{\mathrm{test}}}(\boldsymbol {y}_0 - (\pmb {x}_0 + \pmb {\Delta}\pmb {x}_0)^\top \pmb {\beta})^2\right]$  and the expected squared error  $\mathcal{R}_{*}(\beta) = \mathbb{E}_{y_{0},\pmb{x}_{0}}\left[(y_{0} - \pmb{x}_{0}^{\top}\beta)^{2}\right]$ . The upper bound depends on the in-training adversarial error and on the ratio  $\frac{\delta_{\mathrm{test}}}{\delta}$  which are quantities that you can directly compute.
Figure 2: Threshold  $\bar{\delta}$  vs. number of features. We fix  $n = 60$  and show the value of  $\bar{\delta}$  (defined in (5)) as a function of the number of features  $p$ . The dotted lines give the reference  $\delta_{\mathrm{test}} = 0.01\mathbb{E}\left[\| \boldsymbol{x}\|\right]$  for comparison.
Proposition 2. Assume  $X$  to have full row rank and let  $\widehat{\beta}$  be the minimum  $\| \cdot \|_{*}$ -norm interpolator, then
$$
\sqrt {\mathcal {R} _ {*} ^ {\mathrm {a d v}} (\widehat {\beta} ; \delta_ {\text {t e s t}} , \| \cdot \|)} - \sqrt {\mathcal {R} _ {*} (\widehat {\beta})} \leq \frac {\delta_ {\text {t e s t}}}{\bar {\delta}} \sqrt {R ^ {\mathrm {a d v}} (\widehat {\beta} ; \bar {\delta} , \| \cdot \|)}. \tag {7}
$$
Remark 2. The example in Figure 2 is one case where adding more features makes the minimum-norm interpolator more robust. Examples showing the opposite and illustrating that adding more features to linear models can make them less adversarially robust are abound in the literature [16], [17]. Indeed, examples that consider the minimum  $\ell_2$ -interpolator subject to  $\ell_{\infty}$ -adversarial attacks during test-time result in this scenario, as discussed in [17]. Proposition 7 in the Appendix is the equivalent of Proposition 2 for this case (mismatched norms in train and test). There, the upper bound grows with  $\sqrt{p}$ , which explains the vulnerability in this scenario.
Remark 3. A pitfall of analyzing the minimum-norm solution properties in linear models is that it requires the analysis of nested problems: different choices of  $p$  require different covariates  $x$ . The random projection model proposed by Bach [40] avoids this pitfall by considering the input  $x$  is fixed, but only a projected version of it  $Sx$  is observed, with the number of parameters being estimated changing with the number of projections observed. Adversarily training this model consists in finding a parameter  $\widehat{\beta}$  that minimizes:  $\frac{1}{n}\sum_{i = 1}^{n}\max_{\| \pmb {\Delta}\pmb {x}_i\| \leq \delta}|y_i - (\pmb {x}_i + \pmb {\Delta}\pmb {x}_i)^\top \pmb {S}^\top \pmb {\beta}|^2$ . We generalize our results so that we can also study this case (See Appendix A.4).
5 Adversarial training and parameter-shrinking methods
Theorem 1 stated an equivalence with the minimum-norm solution when  $\delta$  is small. The next result applies to the other extreme of the spectrum, characterizing the case when  $\delta$  is large.
Proposition 3 (Zero solution of adversarial training). The zero solution  $\widehat{\beta} = 0$  minimizes the adversarial training if and only if  $\delta \geq \frac{\|\pmb{X}^\top\pmb{y}\|}{\|\pmb{y}\|_1}$ .
In the remaining of this section, we will characterize the solution between these two extremes. We compare adversarial training to Lasso and ridge regression.
5.1 Relation to Lasso and ridge regression
Proposition 1 makes it clear by inspection that adversarial training is similar to other well-known parameter-shrinking regularization methods. Indeed, for  $\ell_{\infty}$ -adversarial attacks, the cost function  $R^{\mathrm{adv}}(\beta; \delta, \| \cdot \|_{\infty})$  in its dual form is remarkably similar to Lasso [30] and  $R^{\mathrm{adv}}(\beta; \delta, \| \cdot \|_2)$ , to ridge regression (the cost functions were presented in Section 3). In Figures 1 and 3, we show the regularization paths of these methods (the dataset is described in [18]). We observe that  $\ell_{\infty}$ -adversarial training produces sparse solutions and that Lasso and  $\ell_{\infty}$ -adversarial training have extremely similar regularization paths. There are also striking similarities between ridge regression and  $\ell_{2}$ -adversarial training, with the notable difference that for large  $\delta$  the solution of  $\ell_{2}$ -adversarial
(a) Ridge regression
(b)  $\ell_2$ -adversarial training
Figure 3: Regularization paths in the Diabetes dataset [18] (see dataset description in Figure 1). On the horizontal axis, we give the inverse of the regularization parameter (in log scale). On the vertical axis, the coefficients.
training is zero (which is explained by Proposition 3). The next proposition justifies why we can observe such similarities in part of the regularization path. It applies to data that has been normalized and for positive responses  $y$  (as it is the case in our example).
Proposition 4. Assume the output is positive and the data is normalized:  $\pmb{y} \geq 0$  and  $\pmb{X}^{\top}\pmb{1} = \mathbf{0}$ . The solution of adversarial training  $\widehat{\beta}$ , for  $\| \widehat{\beta} \|_* \leq \min_i \frac{|y_i|}{\|x_i\|}$  is also the solution of