[BS21] Sébastien Bubeck and Mark Sellke. “A universal law of robustness via isoperimetry”. In: Advances in Neural Information Processing Systems (NeurIPS) (2021) (Cited on pages 3, 8).
[Cao+22] Yuan Cao, Zixiang Chen, Mikhail Belkin, and Quanquan Gu. “Benign Overfitting in Two-layer Convolutional Neural Networks”. In: Preprint, arXiv:2202.06526 (2022) (Cited on page 6).
[Nicholas Carlini and David Wagner. "Adversarial examples are not easily detected: Bypassing ten detection methods". In: Proceedings of the 10th ACM workshop on artificial intelligence and security. 2017 (Cited on page 1).]
[Nicholas Carlini and David Wagner. "Audio adversarial examples: Targeted attacks on speech-to-text". In: IEEE Security and Privacy Workshops (SPW). 2018 (Cited on page 1).]
[CL21] Niladri S. Chatterji and Philip M. Long. "Finite-sample analysis of interpolating linear classifiers in the overparameterized regime". In: Journal of Machine Learning Research 22.129 (2021), pp. 1-30 (Cited on page 5).
[CB20] Lenaic Chizat and Francis Bach. "Implicit bias of gradient descent for wide two-layer neural networks trained with the logistic loss". In: Conference on Learning Theory (COLT). 2020 (Cited on page 3).
[Cla+08] Francis H Clarke, Yuri S Ledyaev, Ronald J Stern, and Peter R Wolenski. Nonsmooth analysis and control theory. Vol. 178. Springer Science & Business Media, 2008 (Cited on page 4).
[CH20] Francesco Croce and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks". In: International conference on machine learning (ICML). 2020 (Cited on page 1).
[DS20] Amit Daniely and Hadas Shacham. "Most ReLU Networks Suffer from  $\ell_2$  Adversarial Perturbations". In: Advances in Neural Information Processing Systems (NeurIPS) (2020) (Cited on page 3).
[DB22] Elvis Dohmatob and Alberto Bietti. "On the (non-) robustness of two-layer neural networks in different learning regimes". In: arXiv preprint arXiv:2203.11864 (2022) (Cited on page 3).
[Dut+13] Joydeep Dutta, Kalyanmoy Deb, Rupesh Tulshyan, and Ramnik Arora. "Approximate KKT points and a proximity measure for termination". In: Journal of Global Optimization 56.4 (2013), pp. 1463-1499 (Cited on page 4).
[FFF18] Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. "Adversarial vulnerability for any classifier". In: Advances in neural information processing systems (NeurIPS) (2018) (Cited on page 3).
[FCB22] Spencer Frei, Niladri S. Chatterji, and Peter L. Bartlett. "Benign Overfitting without Linearity: Neural Network Classifiers Trained by Gradient Descent for Noisy Linear Data". In: Conference on Learning Theory (COLT). 2022 (Cited on page 6).
[Fre+23a] Spencer Frei, Gal Vardi, Peter L. Bartlett, and Nathan Srebro. "Benign Overfitting in Linear Classifiers and Leaky ReLU Networks from KKT Conditions for Margin Maximization". In: Preprint, arXiv:2303.01462 (2023) (Cited on pages 5, 6).
[Fre+23b] Spencer Frei, Gal Vardi, Peter L. Bartlett, Nathan Srebro, and Wei Hu. "Implicit Bias in Leaky ReLU Networks Trained on High-Dimensional Data". In: International Conference on Learning Representations (ICLR). 2023 (Cited on pages 3, 5).
[GSS15] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. "Explaining and harnessing adversarial examples". In: International Conference on Learning Representations (ICLR). 2015 (Cited on pages 1, 3).
[Hai+22] Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. "Reconstructing training data from trained neural networks". In: Advances in Neural Information Processing Systems (NeurIPS) (2022) (Cited on page 3).
[Hu+20] Wei Hu, Lechao Xiao, Ben Adlam, and Jeffrey Pennington. "The surprising simplicity of the early-time learning dynamics of neural networks". In: Advances in Neural Information Processing Systems (NeurIPS). 2020 (Cited on page 5).
[JT20] Ziwei Ji and Matus Telgarsky. "Directional convergence and alignment in deep learning". In: Advances in Neural Information Processing Systems (NeurIPS). 2020 (Cited on pages 2-4).