SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Lemma 3.7. For any  $\epsilon >0$ , Algorithm 2 with stepsize  $\eta_{tr}\leq m^{-1}\kappa^{-2}(R + \nu)^{-2}$  finds an iterate  $\tau$  that, in expectation over  $\{(x_t,y_t)\}_{t = 1}^{T_{tr}}$ , satisfies  $\mathbb{E}_{\mathcal{D}}[-\ell^{\prime}(yf_{\mathrm{W}_{\tau}}(\delta_{\mathbf{atk}}(\mathrm{x})))]\leq \epsilon$  in at most  $T_{tr}\leq$ $\frac{4(1 + \|W_1\|_F\gamma\alpha\kappa\sqrt{m\epsilon})}{\eta_{tr}(\gamma - \nu)^2\alpha^2\kappa^2m\epsilon^2}$  iterations.
We remark that the result in Lemma 3.7 holds for any attack algorithm Atk, as long as it respects the condition  $\delta_{\mathrm{atk}}(\mathbf{x}) \in \Delta(\mathbf{x})$  for all  $\mathbf{x}$ . We are now ready to present the proof of the main result.
Proof of Theorem 3.4. Recall, that  $\beta$ -robust misclassification error is defined as:
$$
\varepsilon_ {\beta} (\mathrm {W}) = \mathbb {P} \left\{\min  _ {\delta \in \Delta (\mathrm {x})} y f _ {\bar {\mathrm {W}}} (\delta) <   - \beta \right\} = \mathbb {P} \left\{\min  _ {\delta \in \Delta (\mathrm {x})} y f _ {\mathrm {W}} (\delta) <   - \beta \| \mathrm {W} \| _ {F} \right\} \quad (\text {H o m o g e n e i t y o f} f)
$$
A key step in the proof is to give an upper bound on  $\epsilon_{\beta}$  in terms of the attack returned by PGD, i.e.,  $\delta_{\mathrm{atk}(\mathbf{x})}$ , rather than the optimal attack  $\min_{\delta \in \Delta (\mathbf{x})}yf_{\mathrm{W}}(\delta)$ . Theorem 3.2 does provide us with such an upper bound; however, (1) it only holds in expectation, and 2) it is conditioned on existence of an effective attack at the given example  $(\mathbf{x},y)$  and the weights W. Naturally, we can use Markov's inequality to bound the probability above. In order to address the conditional nature of the result in Theorem 3.2, we introduce a truncated version of the negative loss derivative. In particular, for any  $c$ , let  $\ell_c^\prime (z) = \ell^\prime (z)\mathbb{I}[z\leq c]$  be the loss derivative thresholded at  $c$ . Note that  $z\leq c$  implies that  $-\ell_c^\prime (z)\geq -\ell_c^\prime (c)$  - therefore,  $\mathbb{P}\{z\leq c\} \leq \mathbb{P}\{-\ell_c^\prime (z)\geq -\ell_c^\prime (c)\}$ . Let  $\beta_{\tau}\coloneqq \beta \| \mathrm{W}_{\tau}\| _F$ , where  $\mathrm{W}_{\tau}$  is the iterate guaranteed by Lemma 3.7. We have
$$
\begin{array}{l} \varepsilon_ {\beta} \left(\mathrm {W} _ {\tau}\right) = \mathbb {P} \left\{\underset {\delta \in \Delta (\mathrm {x})} {\min } y f _ {\mathrm {W} _ {\tau}} (\delta) \leq - \beta_ {\tau} \right\} \leq \mathbb {P} \left\{- \ell_ {- \beta_ {\tau}} ^ {\prime} \left(\underset {\delta \in \Delta (\mathrm {x})} {\min } y f _ {\mathrm {W} _ {\tau}} (\delta)\right) \geq - \ell_ {- \beta_ {\tau}} ^ {\prime} (- \beta_ {\tau}) \right\} \\ \leq \frac {\mathbb {E} _ {\mathcal {D}} \left[ - \ell_ {- \beta_ {\tau}} ^ {\prime} \left(\min  _ {\delta \in \Delta (\mathrm {x})} y f _ {\mathrm {W} _ {\tau}} (\delta)\right) \right]}{- \ell_ {- \beta_ {\tau}} ^ {\prime} (- \beta_ {\tau})} \quad (\text {M a r k o v ' s i n e q u a l i t y}) \\ \leq 2 \mathbb {E} _ {\mathcal {D}} \left[ - \ell_ {- \beta_ {\tau}} ^ {\prime} \left(\min  _ {\delta \in \Delta (\mathrm {x})} y f _ {\mathrm {W} _ {\tau}} (\delta)\right) \right] (- \ell_ {- \beta_ {\tau}} ^ {\prime} (z) \geq 1 / 2 \text {f o r} z \leq 0) \\ \end{array}
$$
Given  $\mathrm{W}_{\tau}$ , for any  $(x,y)\sim \mathcal{D}$ , one of the two following cases can happen:
1. There exists a  $\beta$ -effective attack. In this case, by Definition 3.1, it holds that  $\min_{\delta \in \Delta(\mathbf{x})} yf_{\mathrm{W}_{\tau}}(\delta) \leq -\beta \| \mathrm{W}_{\tau}\|_F = -\beta_{\tau}$ . Therefore, by definition of the truncated negative loss derivative, it also holds that  $-\ell'_{\beta_{\tau}}(\min_{\delta \in \Delta(\mathbf{x})} yf_{\mathrm{W}_{\tau}}(\delta)) = -\ell'(\min_{\delta \in \Delta(\mathbf{x})} yf_{\mathrm{W}_{\tau}}(\delta))$ . Now, using Theorem 3.2, we get that
$$
- \ell_ {- \beta_ {\tau}} ^ {\prime} (\min _ {\delta \in \Delta (\mathrm {x})} y f _ {\mathrm {W} _ {\tau}} (\delta)) \leq - 2 \ell^ {\prime} (y f _ {\mathrm {W} _ {\tau}} (\delta_ {\mathrm {a t k}} (\mathrm {x}))) + \frac {4 \nu^ {2}}{\eta_ {\mathrm {a t k}} T _ {\mathrm {a t k}}}
$$
Figure 2: Number of the top-k attack vectors that are optimal, i.e., can induce a label flip, for the cross entropy loss (blue) and the reflected version (red), for different values of  $k$ : Left:  $k = 10$ , Middle:  $k = 100$ , and Right:  $k = 1000$ .
2. There does not exist a  $\beta$ -effective attack. In this case, by Definition 3.1, it holds that  $\min_{\delta \in \Delta(\mathbf{x})} yf_{\mathrm{W}_{\tau}}(\delta) > -\beta \| \mathrm{W}_{\tau}\|_F = -\beta_{\tau}$ . Therefore, by definition of the truncated negative loss derivative, it also holds that  $-\ell_{\beta_{\tau}}'(\min_{\delta \in \Delta(\mathbf{x})} yf_{\mathrm{W}_{\tau}}(\delta)) = 0$ , which is trivially bounded by the upper bound in the first case above, given by Equation (3).
Putting back the above cases in the upper bound on the  $\beta$ -robust error, we arrive at:
$$
\frac {1}{2} \varepsilon_ {\beta} (\mathrm {W} _ {\tau}) \leq 2 \mathbb {E} _ {\mathcal {D}} [ - \ell^ {\prime} (y f _ {\mathrm {W} _ {\tau}} (\delta_ {\mathrm {a t k}} (\mathrm {x}))) ] + \frac {4 \nu^ {2}}{\eta_ {\mathrm {a t k}} T _ {\mathrm {a t k}}} \leq \frac {\epsilon}{2} + \frac {4 \nu^ {2}}{\eta_ {\mathrm {a t k}} T _ {\mathrm {a t k}}} \leq \frac {\epsilon}{2} + \frac {\epsilon}{2}
$$
where the first inequality follows from Theorem 3.2, the second inequality follows from Lemma 3.7
given the proper choice of  $T_{\mathrm{Tr}}$ , and the final inequality holds by setting  $T_{\mathrm{atk}} \geq \frac{8\nu^2}{\eta_{\mathrm{atk}}\epsilon}$ .
Adversarial training is widely used in training robust models and has been shown to be fairly effective in practice. The goal of this section is not to attest or reproduce previous empirical findings. Instead, since the focus in this paper is on the theoretical analysis of adversarial training in non-linear networks, the goal of this section is merely to empirically study the effect of using reflected loss in Algorithm 1.
The experimental results are organized as follows. First, in Sec. 4.1, we compare the optimal attacks found by a grid search on the surrogate loss and its reflected version. In Sec. 4.2, we empirically study adversarial training with reflected loss in the binary classification setting. Finally, in Sec. 4.3, we generalize the reflected loss, which is key to our theoretical analysis, to multi-class classification setting. We then report the results on the CIFAR-10 dataset using a deep residual network.
4.1 Grid Search Optimization
We look at the following simple 3-dimensional 3-class classification problem. Consider the point  $(\mathrm{x},y)$  where  $\mathrm{x} = [3,2,1]$  and  $y = 1$ . We focus on the simplest non-trivial function, i.e., the identity mapping, given by  $f(\mathrm{x}) = \mathrm{x}$ . Obviously,  $f$  correctly assigns  $\mathbf{x}$  to the first class because the first dimension is larger than the others. Also, a perturbation of the form  $\delta = [-0.501,0.5,0]$  with  $\| \delta \| = 0.7078$  can flip the label, since  $f(\mathrm{x} + \delta) = [2.499,2.5,1]$  incorrectly predicts the second class.
We restrict the attack to the set  $\{\delta \in (-0.51, + 0.51)^3 ||\delta ||\leq 0.7078\}$ . We look at every possible attack vector on a grid of size  $800\times 800\times 800$ . We then sort these vectors in a descending order of the corresponding loss function, i.e., the cross entropy loss and its reflected version, and simply count how many of the top- $k$  attack vectors actually induce a label flip. We take this as a measure of how effective is the corresponding loss maximization problem at finding a good attack vector. As we can see in Figure 2, the proposed method of maximizing the reflected cross entropy loss is a far more effective way of generating the attacks than maximizing the cross entropy loss.
4.2 Binary Classification
Experimental Setup. We extract digits 0 and 1 from the MNIST dataset [LeCun et al., 1998], which provides a (almost) separable distribution, consistent with our theoretical setup. The dataset contains
Atk.
Trg.	FGSM	R-FGSM	PGD-∞	R-PGD-∞	BIM	R-BIM	PGD-2	R-PGD-2
Standard	0.236	0.236	0.033	0.286	0.286	0.286	0.003	0.256
PGD-∞	0.004	0.004	0.005	0.005	0.005	0.005	0.003	0.05
R-PGD-∞	0.003	0.003	0.004	0.004	0.004	0.004	0.002	0.042
PGD-2	0.013	0.013	0.022	0.024	0.024	0.024	0.002	0.034
R-PGD-2	0.004	0.004	0.005	0.006	0.006	0.006	0.0	0.008
Table 1: Robust test error of several adversarially trained models with and without reflecting the loss (Standard training, PGD-∞, R-PGD-∞, PGD-2, R-PGD-2), for different attack benchmarks (FGSM, R-FGSM, PGD-∞, R-PGD-∞, BIM, R-BIM, PGD-2, and R-PGD-2).
12665 training samples and 2115 test samples. We evaluate the generalization error as well as the robust generalization error of fully-connected two-layer neural networks which are adversarially trained with and without reflecting the loss. The network has 100 hidden nodes with ReLU activations.
The outer loop consists of 20 epochs over the training data with batch size equal to 64, randomly shuffled at the beginning of each epoch. The initial learning rate is set to 1, and is decayed by a multiplicative factor of 0.2 every 5 epochs. We use several benchmark attacks with and without reflecting the loss. The benchmarks include the Fast Gradient Sign Method (FGSM) Goodfellow et al. [2015], the Basic Iterative Method (BIM) Kurakin et al. [2017], and the PGD attack with  $\ell_2$  constraint (PGD-2) and  $\ell_{\infty}$  constraint (PGD- $\infty$ ). For each of these attack strategies, we have a corresponding approach that involves reflecting the surrogate loss – we denote the resulting methods as R-FGSM, R-BIM, R-PGD-2, and R-PGD- $\infty$ , respectively. The perturbation size for FGSM, PGD- $\infty$ , and BIM (and their corresponding reflected version) is set to  $\nu = 0.1$ . For PGD-2 and R-PGD-2, we let a larger perturbation size of  $\nu = 2$  as recommended in the Adversarial ML Tutorial.
In the inner-loop, if the attack is iterative, we use a step-decay scheduler with initial step-size of 10, which decreases the step-size every 10 steps by a multiplicative factor of 0.2. In Table 1, we report the standard test accuracy as well as the adversarial test accuracy of the trained models over 10 independent random runs of the experiment. Different rows and columns correspond to different training algorithms and different attack models, respectively.
Analysis. We make the following observations in Table 1. First, reflecting the loss has a minimal effect on FGSM and BIM attacks, in terms of robust test accuracy of the trained models. In particular, the columns 1 and 2 (similarly columns 5 and 6) are identical up to the third decimal point.
Second, in PGD-2 attacks, reflecting the loss generally yields a stronger attack – note the striking differences in the last two columns between PGD-2 and R-PGD-2. We observe a milder trend for PGD- $\infty$  attacks, where R-PGD- $\infty$  attacks turns out to be only slightly stronger, except for the standard training setting where reflecting the loss has a huge impact on the robust error.
Third, we would like to remark on the performance of adversarially trained models. We can see that reflecting the loss in general helps robustness. In particular, second and fourth rows (PGD-∞ and PGD-2) are completely dominated by the third and fifth rows (R-PGD-∞ and R-PGD-2), respectively.
Finally, it is notable that even though PGD-2 and PGD- $\infty$  are much weaker than their reflected counterparts, they are still competitive in terms of the robustness when used in adversarial training. This suggests that finding a "strong" attack is not a necessity for adversarial training to succeed.
4.3 Extension to multi-label setting
In binary classification using the logistic loss, in essence, adversarial training finds an attack that minimizes the log-likelihood of the correct class. Using the reflected loss, instead, we aim at maximizing the log-likelihood of the wrong class. In a multiclass classification scenario, there are multiple such wrong classes. Therefore, an important design question is which wrong class should be targeted in the attack phase? Here, we focus on the most natural choice: we target the wrong class with the highest log-likelihood. This greedy approach is easy to implement, and has minimal computational overhead over standard adversarial training.
We emphasize though that the greedy approach (described above) is sub-optimal, even in a simple linear setting. Intuitively, when the parameters are such that the logits for the true class correlate
with the logits for the most likely wrong class, the greedy approach fails. In particular, consider the following 3-class classification problem in  $\mathbb{R}^2$ . Let  $f_{\mathrm{W}}(\mathrm{x}) = \mathrm{Wx}$ , where  $\mathrm{W} = [2\mathrm{e}_1,\mathrm{e}_1,10\mathrm{e}_2]\in$ $\mathbb{R}^{3\times 2}$ . Here,  $\mathrm{e}_i$  denotes the  $i$ -th standard basis. Consider the point  $\mathrm{x} = [1,0]$ . Clearly, class 1 and 3 have the highest and the smallest likelihoods, respectively. Given a perturbation size  $\| \mathbf{x}' - \mathbf{x}\| \leq 0.3$ , the likelihood of the second class will never dominate that of the first class:
$$
\mathrm {w} _ {1} ^ {\top} (\mathrm {x} + \delta) = 2 \mathrm {e} _ {1} ^ {\top} (\mathrm {x} + \delta) = 2 (x _ {1} + \delta_ {1}) > (x _ {1} + \delta_ {1}) = \mathrm {e} _ {1} ^ {\top} (\mathrm {x} + \delta) = \mathrm {w} _ {2} ^ {\top} (\mathrm {x} + \delta),
$$
where the inequality follows by using the fact that  $x_{1} = 1$  and  $|\delta_1| \leq 0.3$ . Therefore, the greedy approach fails here. Whereas, within the specified perturbation budget, maximizing the likelihood of the third class can indeed find a label-flipping attack. For example, with  $\delta = [0,0.3]$ , the point  $\mathbf{x}' = [1,0.3]$  will be assigned to the third class, because  $\mathrm{w}_3^\top \mathrm{x}' = 3 > \mathrm{w}_1^\top \mathrm{x} = 2 > \mathrm{w}_2^\top \mathrm{x} = 1$ .
Attack Sizeν = 2/255
Steps = 2	Steps = 4	Steps = 16	Steps = 32
PGD R-PGD	RA	SA	RA	SA	RA	SA	RA	SA
14.182	91.254	20.702	90.424	21.014	90.132	20.848	90.09
14.338	91.208	20.726	90.384	20.958	90.06	20.746	89.992
Attack Size ν = 4/255
PGD R-PGD	17.764	90.748	30.344	88.736	37.564	86.65	37.304	86.572
17.162	90.114	30.34	88.826	37.4	86.734	37.374	86.522
Attack Size ν = 8/255
PGD R-PGD	20.064	90.478	34.21	87.746	48.916	78.402	48.936	77.926
20.1	90.564	34.19	87.852	48.792	78.382	48.828	77.982
Attack Size ν = 16/255
PGD R-PGD	16.19	85.908	21.524	86.816	48.722	68.37	45.292	58.526
15.986	89.708	21.362	86.83	48.742	68.456	44.778	58.486
Table 2: Robust test accuracy (RA) of adversarially trained models with and without reflecting the loss, for different values of the attack size  $\nu \in \{2,4,8,16\} /255$  and number of steps in the attack Steps  $\in \{2,4,16,32\}$ . We report the results for test-time attack size  $\nu = 8 / 255$ ; the better performance is highlighted in gray, where the intensity corresponds to difference in performance.
We use adversarial training with and without reflected loss (denoted by R-PGD and PGD, respectively) to train a PreActResNet (PARN) He et al. [2016] on the CIFAR-10 dataset Krizhevsky et al. [2009]. In the training phase, we conduct experiments for attack size  $\nu \in \{2,4,8,16\} /255$ . We build on the PyTorch implementation in Zhang et al. [2021], and we follow their experimental setup, which is described next. We use a SGD optimizer with a momentum parameter of 0.9 and weight decay parameter of  $5\times 10^{-4}$ . We set the batch size to 128 and train each model for 20 epochs. We use a cyclic scheduler which increases the learning rate linearly from 0 to 0.2 within the first 10 epochs and then reduces it back to 0 in the remaining 10 epochs. We report robust test accuracy (RA) of an adversarially-trained model against PGD attacks Madry et al. [2018] (RA-PGD), where we take 50-step PGD with 10 restarts. We report the results for test-time attack size  $\nu = 8 / 255$ . Based on our empirical results, using the (greedy) reflected loss in adversarial training does not significantly impact the standard/robust generalization performance of the learned models.
We study robust adversarial training of two-layer neural networks as a bi-level optimization problem. We propose reflecting the surrogate loss about the origin in the inner maximization phase when searching for an "optimal" perturbation vector to attack the current model. We give convergence guarantee for the inner-loop PGD attack and precise iteration complexity results for end-to-end adversarial training, which hold for any width and initialization under a margin assumption. We also provide an empirical study on the effect of reflecting the surrogate loss in real datasets. Next, we list few natural research directions for future work.
Extension to multiclass setting. In binary classification, which is the focus of this paper, reflecting the loss about the origin provides a concave lower-bound for the zero one loss (see Figure 1). Maximizing the reflected loss then corresponds to maximizing the likelihood of the wrong class. This simple modification enables us to guarantee the convergence of PGD-2 attacks, and yield stronger
attacks in our experiments. However, extending this idea to the multiclass setting is not trivial. In particular, the idea of maximizing the likelihood of the wrong class does not trivially generalize to the multiclass setting due to plurality of wrong classes. Nonetheless, as we show in the experimental section, a naive greedy approach to choose a wrong class seems to provide competitive performance in terms of standard/adversarial test error. Is there a simple, principled approach to obtain a lower-bound for the misclassification error in the multiclass setting? It would be interesting to explore theoretical and empirical aspects of such possible extensions.
Beyond  $\beta$ -robustness. The notion of  $\beta$ -robustness is crucial in our analysis. Although we provide robustness guarantees for arbitrarily small positive  $\beta$  (see Corollary 3.6), our current analysis does not allow for standard robustness guarantees ( $\beta = 0$ ) except for the linear setting ( $\alpha = 1$ ). At a high level, the main challenge here is to guarantee that the attack can always find an adversarial example - if there exists one - regardless of whether the attack is  $\beta$ -effective or not. This is, in particular, challenging to establish for iterative attacks such as PGD, because they can only guarantee getting sufficiently close to an optimal attack in finite time. Therefore, if the optimal attack can just barely flip the sign, the computational time for finding it can grow unboundedly. Therefore, providing robust generalization guarantees ( $\beta = 0$ ) is an interesting research direction for future work.
**Optimization geometry.** In our theoretical results, we focus on PGD-2 attacks, which are based on steepest descent with respect to the  $\ell_2$  geometry. In our experiments, we also provide empirical results for steepest descent attacks with respect to  $\ell_{\infty}$  geometry (including FGSM and BIM) on the reflected loss. We leave the theoretical analysis of such attacks to future work.
Alon Brutzkus, Amir Globerson, Eran Malach, and Shai Shalev-Shwartz. SGD learns overparameterized networks that provably generalize on linearly separable data. In International Conference on Learning Representations, 2018.
Yuan Cao and Quanquan Gu. Generalization bounds of stochastic gradient descent for wide and deep neural networks. Advances in Neural Information Processing Systems, 32:10836-10846, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE symposium on security and privacy, pages 39-57. IEEE, 2017.
Zachary Charles, Shashank Rajput, Stephen Wright, and Dimitris Papailiopoulos. Convergence and margin of adversarial training on separable data. arXiv preprint arXiv:1905.09209, 2019.
Spencer Frei, Yuan Cao, and Quanquan Gu. Provable generalization of SGD-trained neural networks of any width in the presence of adversarial label noise. arXiv preprint arXiv:2101.01152, 2021.
Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D Lee. Convergence of adversarial training in overparametrized neural networks. Advances in Neural Information Processing Systems, 32:13029-13040, 2019.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015. URL http://arxiv.org/abs/1412.6572.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pages 630-645. Springer, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world, 2017.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2324, 1998.
Yan Li, Ethan X.Fang, Huan Xu, and Tuo Zhao. Implicit bias of gradient descent based adversarial training on separable data. In International Conference on Learning Representations, 2020. URL https://openreview.net/forum?id=HkgTTh4FDH.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582, 2016.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, 2014.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 6586-6595. PMLR, 09-15 Jun 2019. URL https://proceedings.mlr.press/v97/wang19i.html.
Yi Zhang, Orestis Plevrakis, Simon S Du, Xingguo Li, Zhao Song, and Sanjeev Arora. Overparameterized adversarial training: An analysis overcoming the curse of dimensionality. In NeurIPS, 2020.
Yihua Zhang, Guanhuan Zhang, Prashant Khanduri, Mingyi Hong, Shiyu Chang, and Sijia Liu. Revisiting and advancing fast adversarial training through the lens of bi-level optimization. arXiv preprint arXiv:2112.12376, 2021.
Difan Zou, Spencer Frei, and Quanquan Gu. Provable robustness of adversarial training for learning halfspaces with noise. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pages 13002-13011. PMLR, 18-24 Jul 2021. URL https://proceedings.mlr.press/v139/zou21a.html.
Table 3: Key terms, corresponding symbols, and descriptions.
Term	Symbol	Description
Net Function	f(x; W), fW(x), fx(W)	∑r=1m arσ(wr·x)
Leaky ReLU	σ(z)	max{αz, z}
Binary Xent	l(z)	log(1 + e-z)
Mirrored Xent	l_-(z)	- log(1 + ez)
Robust Error	εrob(W)	P[maxδ∈Δ(x) yfW(δ) < 0]
β-Robust Error	εβ(W)	P[maxδ∈Δ(x) yfW(δ) < -β]
Net Grad wrt Weights	∂/∂w_r f_x(W)	arσ'(w_r·x)x
Net Grad wrt Input	∇_xfW(x)	∑r=1m arσ'(w_r·x)wr
Homogeneity in Input	-	f_x(W) = ⟨∇_xfW(x), x⟩
Homogeneity in Weights	-	f_w(x) = ⟨∇_w f_x(W), W⟩