SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Robustness Guarantees for Adversarily Trained Neural Networks
Poorya Mianjy
We study robust adversarial training of two-layer neural networks as a bi-level optimization problem. In particular, for the inner loop that implements the adversarial attack during training using projected gradient descent (PGD), we propose maximizing a lower bound on the  $0/1$ -loss by reflecting a surrogate loss about the origin. This allows us to give a convergence guarantee for the inner-loop PGD attack. Furthermore, assuming the data is linearly separable, we provide precise iteration complexity results for end-to-end adversarial training, which holds for any width and initialization. We provide empirical evidence to support our theoretical results.
Despite the tremendous success of deep learning, neural network-based models are highly susceptible to small, imperceptible, adversarial perturbations of data at test time [Szegedy et al., 2014]. Such vulnerability to adversarial examples imposes severe limitations on the deployment of neural networks-based systems, especially in critical high-stakes applications such as autonomous driving, where safe and reliable operation is paramount.
An abundance of studies demonstrating adversarial examples across different tasks and application domains [Goodfellow et al., 2014, Moosavi-Dezfooli et al., 2016, Carlini and Wagner, 2017] has led to a renewed focus on robust learning as an active area of research within machine learning. The goal of robust learning is to find models that yield reliable predictions on test data notwithstanding adversarial perturbations. A principled approach to training models that are robust to adversarial examples that has emerged in recent years is that of adversarial training [Madry et al., 2018]. Adversarial training formulates learning as a min-max optimization problem wherein the 0-1 classification loss is replaced by a convex surrogate such as the cross-entropy loss, and alternating optimization techniques are used to solve the resulting saddle point problem.
Despite empirical success of adversarial training, our understanding of its theoretical underpinnings remain limited. From a practical standpoint, it is remarkable that gradient based techniques can efficiently solve both inner maximization problems to find adversarial examples and outer minimization problem to impart robust generalization. On the other hand, a theoretical analysis is challenging because (1) both the inner- and outer-level optimization problems are non-convex, and (2) it is unclear a-priori if solving the min-max optimization problem would even guarantee robust generalization.
In this work, we seek to understand adversarial training better. In particular, under a margin separability assumption, we provide robust generalization guarantees for two-layer neural networks with Leaky ReLU activation trained using adversarial training. Our key contributions are as follows.
1. We identify a disconnect between the robust learning objective and the min-max formulation of adversarial training. This observation inspires a simple modification of adversarial training -
we propose reflecting the surrogate loss about the origin in the inner maximization phase when searching for an "optimal" perturbation vector to attack the current model.
2. We provide convergence guarantees for PGD attacks on two-layer neural networks with leaky ReLU activation. This is the first of its kind result to the best of our knowledge.
3. We give global convergence guarantees and establish learning rates for adversarial training for two-layer neural networks with Leaky ReLU activation function. Notably, our guarantees hold for any bounded initialization and any width - a property that is not present in the previous works in the neural tangent kernel (NTK) regime [Gao et al., 2019, Zhang et al., 2020].
4. We provide extensive empirical evidence showing that reflecting the surrogate loss in the inner loop does not have a significant impact on the test time performance of the adversarially trained models.
Notation. We denote matrices, vectors, scalar variables, and sets by Roman capital letters, Roman lowercase letters, lowercase letters, and uppercase script letters, respectively (e.g. X, x,  $x$ , and  $\mathcal{X}$ ). For any integer  $d$ , we represent the set  $\{1,\ldots ,d\}$  by  $[d]$ . The  $\ell_2$ -norm of a vector  $\mathbf{x}$  and the Frobenius norm of a matrix  $\mathrm{X}$  are denoted as  $\| \mathbf{x}\|$  and  $\| \mathbf{X}\| _F$ , respectively. Given a set  $\mathcal{C}$ , the operator  $\Pi_{\mathcal{C}}(\mathrm{x}) = \min_{\mathrm{x}^{\prime}\in \mathcal{C}}\| \mathrm{x} - \mathrm{x}^{\prime}\|$  projects onto the set  $\mathcal{C}$  with respect to the  $\ell_2$ -norm.
Linear models. Adversarial training of linear models was recently studied by Charles et al. [2019], Li et al. [2020], Zou et al. [2021]. In particular, Charles et al. [2019], Li et al. [2020] give robust generalization error guarantees for adversarially trained linear models under a margin separability assumption. The hard margin assumption was relaxed by Zou et al. [2021] who give robust generalization guarantees for distributions with agnostic label noise. We note that the optimal attack for linear models has a simple closed-form expression, which mitigates the challenge of analyzing the inner loop PGD attack. In contrast, one of our main contributions is to give convergence guarantees for the PGD attack. Nonetheless, as the Leaky ReLU activation function can also realize the identity map for  $\alpha = 1$ , our results also provide robust generalization error guarantees for training linear models.
Non-linear models. Wang et al. [2019] propose a first order stationary condition to evaluate the convergence quality of adversarial attacks found in the inner loop. Zhang et al. [2021] study adversarial training as a bi-level optimization problem and propose a principled approach towards the design of fast adversarial training algorithms. Most related to our results are the works of Gao et al. [2019] and Zhang et al. [2020], which study the convergence of adversarial training in non-linear neural networks. Under specific initialization and width requirements, these works guarantee small robust training error with respect to the attack that is used in the inner-loop, without explicitly analyzing the convergence of the attack. Gao et al. [2019] assume that the activation function is smooth and require that the width of the network, as well as the overall computational cost, is exponential in the input dimension. The work of Zhang et al. [2020] partially addresses these issues. In particular, their results hold for ReLU neural networks, and they only require the width and the computational cost to be polynomial in the input parameters.
Our work is different from that of Gao et al. [2019] and Zhang et al. [2020] in several ways. Here we highlight three key differences.
- First, while the prior work analyzes the convergence in the NTK setting with specific initialization and width requirements, our results hold for any initialization and width.
- Second, none of the prior works studies computational aspects of finding an optimal attack vector in the inner loop. Instead, the prior work assumes oracle access to optimal attack vectors. We provide precise iteration complexity results for the projected gradient method (i.e., for the PGD attack) for finding near-optimal attack vectors.
- Third, the prior works focus on minimizing the robust training loss, whereas we provide computational learning guarantees on the robust generalization error.
The rest of the paper is organized as follows. In Section 2, we give the problem setup and introduce the adversarial training procedure with the reflected surrogate loss in the inner loop. In Section 3, we present our main results, discuss the implications and give a proof sketch. We support our theory with empirical results in Section 4 and conclude with a discussion in Section 5.
Algorithm 1 Atk PGD Attack
Input: Sample  $(\mathbf{x},y)$  ,Weights W, Stepsize  $\eta_{\mathrm{atk}}$  # Iters  $T_{\mathrm{atk}}$
1: Initialize  $\delta_{1}\gets \mathrm{x}$
2: for  $t = 1$  to  $T$  do
3:  $\delta_{t + 1}\gets \Pi_{\Delta (\mathbf{x})}(\delta_t + \eta_{\mathrm{atk}}\nabla_\delta \ell_-(yf_{\mathrm{W}}(\delta_t)))$
4: end for
Output:  $\delta_{\tau}$ , where  $\tau \in \arg \max_{t\in [T]}\ell_{-}(yf_{\mathrm{W}}(\delta_t))$
We focus on two-layer networks with  $m$  hidden nodes computing  $f(\mathrm{x};\mathrm{a},\mathrm{W}) = \mathrm{a}^{\top}\sigma (\mathrm{Wx})$ , where  $\mathrm{W}\in \mathbb{R}^{m\times d}$  and  $\mathrm{a}\in \mathbb{R}^m$  are the weights of the first and the second layers, respectively, and  $\sigma (z) = \max \{\alpha z,z\}$  is the Leaky ReLU activation function. We randomly initialize the weights  $a_{r}\sim \mathrm{Unif}(\{-\kappa , + \kappa \})$  for all hidden nodes  $r\in [m]$ , and randomly initialize W such that  $\| \mathrm{W}\| _F\leq \omega$  for some positive real numbers  $\kappa$  and  $\omega$ . The top linear layer (i.e., weights a) is kept fixed, and the hidden layer (i.e., W) is trained using stochastic gradient descent (SGD).
For simplicity of notation, we represent the network as  $f(\mathrm{x};\mathrm{W})$ , suppressing the dependence on the top layer weights. Further, with a slight abuse of notation, we denote the function by  $f_{\mathrm{W}}(\mathrm{x})$  when optimizing over the input adversarial perturbations, and by  $f_{\mathrm{x}}(\mathrm{W})$  when training the network weights.
Formally, adversarial learning is described as follows. Let  $\mathcal{X} \subseteq \mathbb{R}^d$  and  $\mathcal{Y} = \{\pm 1\}$  denote the input feature space and the output label space, respectively. Let  $\mathcal{D}$  be an unknown joint distribution on  $\mathcal{X} \times \mathcal{Y}$ . For any fixed  $\mathrm{x} \in \mathcal{X}$ , we consider norm-bounded adversarial perturbations in the set  $\Delta(\mathrm{x}) := \{\delta : \| \delta - \mathrm{x} \| \leq \nu\}$ , for some fixed noise budget  $\nu$ .
Given a training sample  $\mathcal{S} \coloneqq \{(x_i, y_i)\}_{i=1}^n \sim \mathcal{D}^n$  drawn independently and identically from the underlying distribution  $\mathcal{D}$ , the goal is to find a network with small robust misclassification error
$$
\varepsilon_ {\mathrm {r o b}} (\mathrm {W}) = \mathbb {E} _ {\mathcal {D}} \max  _ {\delta \in \Delta (\mathrm {x})} \mathbb {I} [ y f _ {\bar {\mathrm {W}}} (\delta) <   0 ], \tag {1}
$$
where  $\bar{\mathrm{W}}\coloneqq \mathrm{W} / \| \mathrm{W}\|_{F}$  is the weight matrix normalized to have unit Frobenius norm. Note that, due to the homogeneity of Leaky ReLU, such normalization has no effects on the robust error whatsoever.
In adversarial training, the  $0 - 1$  loss inside the expectation is replaced with a convex surrogate such as cross entropy loss  $\ell(z) = \log(1 + e^{-z})$ , and the expected value is estimated using a sample average:
$$
\widehat {\varepsilon} _ {\mathrm {r o b}} (\mathrm {W}) := \frac {1}{n} \sum_ {i = 1} ^ {n} \max  _ {\delta_ {i} \in \Delta \left(\mathrm {x} _ {i}\right)} \ell \left(y _ {i} f _ {\bar {\mathrm {W}}} \left(\delta_ {i}\right)\right) \tag {2}
$$
Notwithstanding the conventional wisdom, adversarial training entails maximizing an upper bound as opposed to a lower bound on the  $0 - 1$  loss. In contrast, we propose using a concave lowerbound on the  $0 - 1$  loss to solve the inner maximization problem. Let  $\ell_{-}(z) = -\ell (-z) = -\log (1 + e^{z})$  denote the reflected loss. In Figure 1, we plot the 0-1 loss, the cross-entropy loss, and the reflected cross-entropy loss. Starting from  $\delta_1 = \mathbf{x}$ , the PGD attack updates iterates via
$$
\delta_ {t + 1} = \Pi_ {\Delta (\mathrm {x})} \left(\delta_ {t} + \eta_ {\mathrm {a t k}} \ell_ {-} \left(y f _ {\mathrm {W}} \left(\delta_ {t}\right)\right)\right),
$$
as described in Algorithm 1. We emphasize that the only difference between standard adversarial training and what we propose in Algorithm 2 and Algorithm 1 is that we reflect the loss (about the origin) in Algorithm 1.
Figure 1: The 0-1 loss (red), its convex surrogate, the cross-entropy loss (blue), and the reflected cross-entropy loss (green).
Algorithm 2 AdvTr Adversarial Training
Input:Stepsize  $\eta_{\mathrm{tr}},\#$  Iters  $T_{\mathrm{tr}}$  1: Initialize a  $\sim$  Unif  $\{-\kappa , + \kappa \} ^m$  and  $\mathrm{W}_1$  such that  $\| \mathrm{W}_1\| _F\leq \omega$  2: for  $t = 1$  to  $T$  do 3: Draw  $(x_{t},y_{t})\sim \mathcal{D}$  4:  $\delta_t\gets \mathsf{Atk}(W_t,x_t,y_t)$  5:  $\mathrm{W}_{t + 1}\leftarrow \mathrm{W}_t - \eta_{\mathrm{tr}}\nabla_{\mathrm{W}}\ell (y_tf_{\delta_t}(\mathrm{W}_t))$  6: end for
We consider a slightly weaker version of the robust error. In particular, we are interested in adversarial attacks that can fool the learner with a margin - for some small, non-negative constant  $\beta$ , we define the  $\beta$ -robust misclassification error as:  $\varepsilon_{\beta}(\mathrm{W}) = \mathbb{P}\left\{\min_{\delta \in \Delta (\mathrm{x})}yf_{\bar{\mathrm{W}}}(\delta) < -\beta \right\}$ . In particular, as  $\beta$  tends to zero,  $\varepsilon_{\beta}(\mathrm{W})\rightarrow \varepsilon_{\mathrm{rob}}(\mathrm{W})$ . When  $\beta$  is a small positive constant bounded away from zero,  $(\mathrm{x},y)$  contributes to  $\varepsilon_{\beta}(\mathrm{W})$  only if there exists an attack  $\delta \in \Delta (\mathrm{x})$  such that  $f_{\bar{\mathrm{W}}}$  confidently makes a wrong prediction on  $\delta$ . In other words,  $\beta$ -robust misclassification error is the probability that for  $(\mathrm{x},y)\sim \mathcal{D}$ , a  $\beta$ -effective attack exists.
Definition 3.1 (Effective Attacks). Given a neural networks with parameters (a, W) and a data point  $(\mathrm{x}, y)$  and some constant  $\beta > 0$ , we say that  $\delta_{*} \in \Delta(\mathrm{x})$  is a  $\beta$ -effective attack if  $y f_{\bar{\mathrm{W}}}(\delta_{*}) \leq -\beta$ , where  $\bar{\mathrm{W}} = \mathrm{W} / \| \mathrm{W}\|_{F}$ .
Our bounds depend on several important problem parameters. Before stating the main results of the paper, we remind the reader of these important quantities.  $\nu$  denotes the attack size.  $\kappa$  and  $\omega$  are the bounds on the norm of the parameters a and W at the initialization. Finally,  $\alpha$  is the Leaky-ReLU parameter. Our first result stated in the following theorem<sup>1</sup> gives convergence rates for Algorithm 1 in terms of the and the negated loss derivative  $-\ell'(\cdot)$  under the assumption that an effective attack exists. The negative derivative,  $-\ell'(\cdot)$ , of the loss function has been used in several previous works to give an upper bound on the error Cao and Gu [2019]; here, we borrow similar ideas from Frei et al. [2021]. In particular, as it will become clear later, we will use positivity and monotonicity of  $-\ell'(\cdot)$  to give an upper bound on the  $\beta$ -robust loss using Markov's inequality.
Theorem 3.2. Let  $\delta_{*}$  be a  $\beta$ -effective attack for a given network with weights (a, W) and a given example  $(x, y)$ , with  $\beta \geq 2\nu(1 - \alpha)\kappa \sqrt{m}$ . Then, after  $T_{atk}$  iterations, PGD with step size  $\eta_{atk} \leq \frac{1}{\kappa^2 m \|W\|_F^2}$  generates an attack  $\delta_{atk}$  such that  $-\ell'(yf_W(\delta_*)) \leq -2\ell'(yf_W(\delta_{atk})) + \frac{4\nu^2}{\eta_{atk} T_{atk}}$ .
Theorem 3.2 establishes that under proper initialization  $(\kappa = 1 / \sqrt{m})$ , when a  $\beta$ -effective attack exists, Algorithm 1 finds a  $\epsilon$ -suboptimal attack vector in  $O(\beta^2 /\epsilon)$  iteration. We next study convergence of Algorithm 2 under the following distributional assumption.
Assumption 3.3. Samples  $(\mathbf{x},y)$  are drawn i.i.d. from an unknown joint distribution  $\mathcal{D}$  that satisfies:
-  $\| \mathbf{x}\| \leq R$  with probability 1.
- There exists a unit norm vector  $\mathbf{v}_* \in \mathbb{R}^d$ ,  $\|\mathbf{v}_*\| = 1$ , such that for  $(x,y) \sim \mathcal{D}$ , we have with probability 1 that  $y(\mathbf{v}_* \cdot \mathbf{x}) \geq \gamma > 0$ .
The first assumption requires that the inputs are bounded, which is standard in the literature and is satisfied for most practical applications. The second assumption implies that  $\mathcal{D}$  is linearly separable with margin  $\gamma > 0$ . Of course, we do not need a non-linear neural network to robustly learn a predictor under such a distributional assumption. But can we even guarantee robust learnability of neural networks for such simple settings? Nothing is known as far as we know. We note that even for standard (non-robust) training of two-layer neural networks using SGD, the convergence guarantees in the hard margin setting were unknown until recently [Brutzkus et al., 2018]. The following theorem establishes that adversarial training can efficiently find a network with small  $\beta$ -robust error.
<sup>1</sup>Proofs are deferred to the appendix.
Theorem 3.4 (Convergence of Algorithm 2). For any  $\epsilon >0$ , in at most  $T_{tr}\leq \frac{64(R + \nu)^2(1 + \omega\gamma\alpha\kappa\sqrt{m\epsilon})}{(\gamma - \nu)^2\alpha^2\epsilon^2}$  iterations, Algorithm 2 with step-size  $\eta_{tr}\leq \frac{1}{m\kappa^2(R + \nu)^2}$  finds an iterate  $\tau$  that, in expectation over  $\{(x_t,y_t)\}_{t = 1}^{T_{tr}}$ , satisfies  $\varepsilon_{\beta}(\mathrm{W}_{\tau})\leq 2\epsilon$  for any  $\beta \geq 2\nu (1 - \alpha)\kappa \sqrt{m}$ , provided that for all  $t\in [T]$ ,  $\eta_{atk}\leq \frac{1}{\kappa^2m\|W_t\|_F^2}$  and  $T_{atk}\geq \frac{8\nu^2}{\eta_{atk}\epsilon}$ .
Some remarks are in order.
Beyond Neural Tangent Kernel. As opposed to the convergence results in the previous work [Gao et al., 2019, Zhang et al., 2020] which requires certain initialization and width requirements specific to the NTK regime, our results hold for any bounded initialization and any width  $m$ .
Role of the Robustness Parameter  $\nu$ . Our guarantee holds only when the desired robustness parameter  $\nu$  is smaller than the distribution margin  $\gamma$ . Furthermore, the iteration complexity increases gracefully as  $O(\nu^2 / (\gamma - \nu)^2)$  as the attacks become stronger, i.e., as the size of adversarial perturbations tends to the margin. Intuitively, as  $\nu \to 0$ , the attack becomes trivial, and the adversarial training reduces to the standard non-adversarial training. This is fully captured by our results — as  $\nu \to 0$ , the number of attack iterates  $T_{\mathrm{atk}}$  goes to zero, and we recover the overall runtime of  $O(\gamma^{-2}\epsilon^{-2})$  as in the previous work [Brutzkus et al., 2018, Frei et al., 2021].
Computational Complexity. To guarantee  $\epsilon$ -suboptimality in the  $\beta$ -robust misclassification error, we require  $T_{\mathrm{tr}} = O((\gamma - \nu)^{-2}\epsilon^{-2})$  iterations of Algorithm 2. Each iteration invokes the PGD attack in Algorithm 1, which itself requires  $T_{\mathrm{atk}} = O(\nu^2/\epsilon)$  gradient updates. Therefore, the overall computational cost of adversarial training to achieve  $\epsilon$ -suboptimality is  $O\left(\frac{\nu^2}{(\gamma - \nu)^2\epsilon^3}\right)$ . Note that  $T_{\mathrm{atk}}$  is a purely computational requirement, and the statistical complexity of adversarial training is fully captured by  $T_{\mathrm{tr}}$ . Remarkably, there is only a mild  $O(\gamma^2 / (\gamma - \nu)^2)$  statistical overhead for  $\beta$ -robustness, and the computational cost increases gracefully by a multiplicative factor of  $O\left(\frac{\nu^2\gamma^2}{(\gamma - \nu)^2\epsilon}\right)$ .
Learning Robust Linear Halfspaces. When  $\alpha = 1$ , the Leaky ReLU activation equals the identity map, and the network reduces to a linear predictor. In this case, we retrieve strong robust generalization guarantees for learning halfspaces, as the lower bound required for  $\beta$  in Theorem 3.4 vanishes. The following corollary instantiates such a robust generalization guarantee.
Corollary 3.5. Let  $\kappa = 1 / \sqrt{m}$ ,  $\omega = 1 / \gamma$ , and  $\eta_{tr} = (R + \nu)^{-2}$ . For any  $\epsilon > 0$ , in at most  $T_{tr} \leq \frac{128(R + \nu)^2}{(\gamma - \nu)^2\epsilon^2}$  iterations, Algorithm 2 finds an iterate  $\tau$ , that in expectation over  $\{(x_t, y_t)\}_{t=1}^{T_{tr}}$  satisfies  $\varepsilon_{rob}(W_\tau) \leq 2\epsilon$ , provided that for all  $t \in [T]$ ,  $\eta_{atk} \leq \|W_t\|_F^{-2}$  and  $T_{atk} \geq \frac{8\nu^2}{\eta_{atk}\epsilon}$ .
Dependence on the Norm of Iterates. The iteration complexity of Algorithm 1 is inversely proportional to the learning rate  $\eta_{\mathrm{atk}}$ , and therefore increases with  $\| \mathbf{W}_t\| _F^2$ . Thus, when calculating the overall computational complexity, one needs to compute an upper bound on the norm of the iterates. As we show in Equation (5) in the appendix, it holds for all iterates that  $\| \mathbf{W}_{t + 1}\| _F^2\leq \| \mathbf{W}_1\| _F^2 +3\eta_{\mathrm{tr}}t$ . Therefore, if we set  $\kappa = 1 / \sqrt{m}$  and  $\omega^2 = 3 / (R + \nu)^2$ , we have the following worst-case weight-independent bound on the overall computational cost:
$$
\begin{array}{l} T \leq \sum_ {t = 1} ^ {T _ {\mathrm {t r}}} \frac {8 \nu^ {2}}{\eta_ {\mathrm {a t k}} \epsilon} \leq \sum_ {t = 1} ^ {T _ {\mathrm {t r}}} \frac {8 \nu^ {2} \| \mathrm {W} _ {t} \| _ {F} ^ {2}}{\epsilon} \leq \sum_ {t = 1} ^ {T _ {\mathrm {t r}}} \frac {8 \nu^ {2} (\omega^ {2} + 3 \eta_ {\mathrm {t r}} (t - 1))}{\epsilon} \\ \leq \sum_ {t = 1} ^ {T _ {\mathrm {t r}}} \frac {2 4 \nu^ {2} t}{(R + \nu) ^ {2} \epsilon} \leq \frac {1 2 \nu^ {2} T _ {\mathrm {t r}} ^ {2}}{(R + \nu) ^ {2} \epsilon} \leq \frac {1 9 6 6 0 8 \nu^ {2} (R + \nu) ^ {2}}{(\gamma - \nu) ^ {4} \alpha^ {4} \epsilon^ {5}}. \\ \end{array}
$$
Therefore, the worst-case overall computational cost is of order  $O((\gamma - \nu)^{-4}\epsilon^{-5})$ . We note again that this cost is purely computational – the statistical complexity is still in the order of  $O\left((\gamma - \nu)^{-2}\epsilon^{-2}\right)$ .
Adversarial Robustness for any  $\beta$ . As we discussed earlier, as  $\beta \to 0$ , the  $\beta$ -robust error tends to the robust error, i.e.,  $\varepsilon_{\beta}(\mathrm{W}) \to \varepsilon_{\mathrm{rob}}(\mathrm{W})$ . Although Theorem 3.4 does not hold for  $\beta = 0$  (except
for the linear case discussed above), it is possible to guarantee robust generalization with arbitrarily small  $\beta$ , as stated in the following corollary.
Corollary 3.6. For any desirable  $\beta >0$ , let  $\kappa = \frac{\beta}{2\nu(1 - \alpha)\sqrt{m}}$ . For any  $\epsilon >0$ , in at most  $T_{tr}\leq$ $\frac{64(R + \nu)^2(1 + \omega\gamma\alpha\beta\epsilon / (2\nu(1 - \alpha)))}{(\gamma - \nu)^2\alpha^2\epsilon^2}$  iterations, Algorithm 2 with step-size  $\eta_{tr}\leq \frac{4\nu^2(1 - \alpha)^2}{\beta^2(R + \nu)^2}$  finds an iterate  $\tau$  that, in expectation over  $\{(x_t,y_t)\}_{t = 1}^{T_{tr}}$ , satisfies  $\varepsilon_{\beta}(\mathrm{W}_{\tau})\leq 2\epsilon$  provided that for all  $t\in [T]$ ,  $\eta_{atk}\leq \frac{4\nu^2(1 - \alpha)^2}{\beta^2\|W_t\|_F^2}$  and  $T_{atk}\geq \frac{2(1 - \alpha)^2}{\beta^2\|W_t\|_F^2\epsilon}$ .
In this section, we highlight the key ideas and insights based on our analysis, and give a sketch of the proof of the main result. Using Definition 3.1, the proof of Theorem 3.4 crucially depends on the following two facts. First, whenever there exists a  $\beta$ -effective attack, we show that Algorithm 1 will efficiently find a sufficiently good attack (in the sense of Theorem 3.2). Second, leveraging the Perceptron analysis from the prior works of Frei et al. [2021], Brutzkus et al. [2018], we show that as long as the attack size  $\nu$  is smaller than the margin  $\gamma$ , robust training is not much harder than standard training. In particular, the following Lemma establishes that the expected value of the negative loss derivative eventually becomes arbitrarily small.