[16] Z. Ji and M. Telgarsky. Directional convergence and alignment in deep learning. Advances in Neural Information Processing Systems, 33:17176-17186, 2020. 5, D
[17] E. Kazemi, T. Kerdreux, and L. Wang. Trace-norm adversarial examples. arXiv preprint arXiv:2007.01855, 2020. 3.2
[18] E. Kernfeld, M. Kilmer, and S. Aeron. Tensor-tensor products with invertible linear transforms. Linear Algebra and its Applications, 485:545-570, 2015. 1, 2.1, 2.1, 1, 2.1, 3, 6, 7, 8
[19] M. E. Kilmer, K. Braman, et al. Third-order tensors as operators on matrices: A theoretical and computational framework with applications in imaging. SIAM J MATRIX ANAL A, 34(1):148-172, 2013. 1, 2, 9
[20] M. E. Kilmer, L. Horesh, H. Avron, and E. Newman. Tensor-tensor algebra for optimal representation and compression of multiway data. Proceedings of the National Academy of Sciences, 118(28):e2015851118, 2021. 4.3, 4.3, E.2, E.2, F.1, F.1
[21] T. G. Kolda and B. W. Bader. Tensor decompositions and applications. SIAM Review, 51(3):455-500, 2009. 2
[22] J. Li, Y. Sun, J. Su, T. Suzuki, and F. Huang. Understanding generalization in deep learning via tensor methods. In International Conference on Artificial Intelligence and Statistics, pages 504-515. PMLR, 2020. 5
[23] N. Liao, S. Wang, L. Xiang, N. Ye, S. Shao, and P. Chu. Achieving adversarial robustness via sparsity. Machine Learning, pages 1-27, 2022. 6
[24] X. Liu, S. Aeron, V. Aggarwal, and X. Wang. Low-tubal-rank tensor completion using alternating minimization. IEEE TIT, 66(3):1714-1737, 2020. 1, 5
[25] S. Lotfi, M. Finzi, S. Kapoor, A. Potapczynski, M. Goldblum, and A. G. Wilson. PAC-Bayes compression bounds so tight that they can explain generalization. Advances in Neural Information Processing Systems, 35:31459-31473, 2022. 6
[26] C. Lu. Transforms based tensor robust pca: Corrupted low-rank tensors recovery via convex optimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1145-1152, 2021. 2.1, 2.1
[27] C. Lu, J. Feng, W. Liu, Z. Lin, S. Yan, et al. Tensor robust principal component analysis with a new tensor nuclear norm. IEEE TPAMI, 2019. 5
[28] C. Lu, X. Peng, and Y. Wei. Low-rank tensor completion with a new tensor nuclear norm induced by invertible linear transforms. In CVPR, pages 5996-6004, 2019. 10
[29] B. Lv and Z. Zhu. Implicit bias of adversarial training for deep neural networks. In International Conference on Learning Representations, 2022. 1, 4.2, 4, 4.2, 5, 6, A.2, D, D, D.1
[30] K. Lyu and J. Li. Gradient descent maximizes the margin of homogeneous neural networks. In International Conference on Learning Representations, 2020. 3.1, 3.1, 4.2, 4.2, 5, A.2, D, D, 19, D.1, 20, 10, D.1, 21, D.2, 11, D.2, 23, 24
[31] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 7, D, D, D
[32] O. A. Malik, S. Ubaru, L. Horesh, M. E. Kilmer, and H. Avron. Dynamic graph convolutional networks using the tensor  $M$ -product. In Proceedings of the 2021 SIAM international conference on data mining (SDM), pages 729-737. SIAM, 2021. 1, 2.2, 5
[33] O. L. Mangasarian and S. Fromovitz. The fritz john necessary optimality conditions in the presence of equality and inequality constraints. Journal of Mathematical Analysis and applications, 17(1):37-47, 1967. D.1
[34] T. Miyato, A. M. Dai, and I. Goodfellow. Adversarial training methods for semi-supervised text classification. In International Conference on Learning Representations, 2017. 7, D