[Sch+18] Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. "Adversarily robust generalization requires more data". In: Advances in neural information processing systems (NeurIPS) (2018) (Cited on page 3).
[Sha+19] Ali Shafahi, W Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. "Are adversarial examples inevitable?" In: International Conference on Learning Representations (ICLR). 2019 (Cited on page 3).
[Sha+20] Harshay Shah, Kaustav Tamuly, Aditi Raghunathan, Prateek Jain, and Praneeth Netrapalli. "The pitfalls of simplicity bias in neural networks". In: Advances in Neural Information Processing Systems (NeurIPS) (2020) (Cited on page 3).
[SMB21] Adi Shamir, Odelia Melamed, and Oriel BenShmuel. "The dimpled manifold model of adversarial examples in machine learning". In: Preprint, arXiv:2106.10151 (2021) (Cited on page 3).
[Sin+21] Vasu Singla, Songwei Ge, Basri Ronen, and David Jacobs. "Shift invariance can reduce adversarial robustness". In: Advances in Neural Information Processing Systems (NeurIPS) (2021) (Cited on page 3).
[Sze+14] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. "Intriguing properties of neural networks". In: International Conference on Learning Representations (ICLR). 2014 (Cited on page 1).
[Var22] Gal Vardi. "On the Implicit Bias in Deep-Learning Algorithms". In: Preprint, arXiv:2208.12591 (2022) (Cited on page 2).
[VSS22] Gal Vardi, Ohad Shamir, and Nathan Srebro. "On Margin Maximization in Linear and ReLU Networks". In: Advances in Neural Information Processing Systems (NeurIPS). 2022 (Cited on pages 3, 5).
[VYS22] Gal Vardi, Gilad Yehudai, and Ohad Shamir. "Gradient Methods Provably Converge to Non-Robust Networks". In: Advances in Neural Information Processing Systems (NeurIPS). 2022 (Cited on pages 3, 5, 9).
[Wan+20] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. "High-frequency component helps explain the generalization of convolutional neural networks". In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). 2020 (Cited on page 3).
[Wan+22] Yunjuan Wang, Enayat Ullah, Poorya Mianjy, and Raman Arora. "Adversarial Robustness is at Odds with Lazy Training". In: Advances in Neural Information Processing Systems (NeurIPS) (2022) (Cited on page 3).
[WK18] Eric Wong and Zico Kolter. "Provable defenses against adversarial examples via the convex outer adversarial polytope". In: International Conference on Machine Learning (ICML). 2018 (Cited on page 1).
[WRK20] Eric Wong, Leslie Rice, and J Zico Kolter. "Fast is better than free: Revisiting adversarial training". In: International Conference on Learning Representations (ICLR). 2020 (Cited on page 1).
[Wu+20] Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. "Making an invisibility cloak: Real world adversarial attacks on object detectors". In: European Conference on Computer Vision (ECCV). 2020 (Cited on page 1).
[XG23] Xingyu Xu and Yuantao Gu. “Benign overfitting of non-smooth neural networks beyond lazy training”. In: International Conference on Artificial Intelligence and Statistics (AISTATS). Ed. by Francisco Ruiz, Jennifer Dy, and Jan-Willem van de Meent. 2023 (Cited on page 6).
[Zha+21] Chaoning Zhang, Philipp Benz, Chenguo Lin, Adil Karjauv, Jing Wu, and In So Kweon. "A survey on universal adversarial attack". In: International Joint Conference on Artificial Intelligence (IJCAI) (2021) (Cited on pages 2, 9).
[Zha+17] Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. "Delving into transferable adversarial examples and black-box attacks". In: International Conference on Learning Representations (ICLR). 2017 (Cited on page 1).