Title: Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation
Venue: NeurIPS 2024
Accepted: yes
Keywords: Stability

adversarial training

neural networks

optimization and generalization guarantees

Moreau envelope

convexity

smoothness
Abstract: Adversarial training has emerged as a popular approach for training models that are robust to inference-time adversarial attacks. However, our theoretical understanding of why and when it works remains limited. Prior work has offered generalization analysis of adversarial training, but they are either restricted to the Neural Tangent Kernel (NTK) regime or they make restrictive assumptions about data such as (noisy) linear separability or robust realizability. In this work, we study the stability and generalization of adversarial training for two-layer networks **without any data distribution assumptions** and **beyond the NTK regime**. Our findings suggest that for networks with *any given initialization* and *sufficiently large width*, the generalization bound can be effectively controlled via early stopping. We further improve the generalization bound by leveraging smoothing using Moreau’s envelope.

Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation

Abstract

Adversarial training has emerged as a popular approach for training models that are robust to inference-time adversarial attacks. However, our theoretical understanding of why and when it works remains limited. Prior work has offered generalization analysis of adversarial training, but they are either restricted to the Neural Tangent Kernel (NTK) regime or they make restrictive assumptions about data such as (noisy) linear separability or robust realizability. In this work, we study the stability and generalization of adversarial training for two-layer networks without any data distribution assumptions and beyond the NTK regime . Our findings suggest that for networks with any given initialization and sufficiently large width , the generalization bound can be effectively controlled via early stopping. We further improve the generalization bound by leveraging smoothing using Moreau's envelope.

1 Introduction

Despite the remarkable performance of over-parameterized deep networks in real-world applications, recent studies have revealed that they are highly vulnerable to adversarial attacks. These attacks use maliciously crafted imperceptible perturbations designed to deceive trained neural networks during inference [Szegedy et al., 2013, Biggio et al., 2013]. The lack of adversarial robustness has raised significant concerns for deploying neural network-based models in safety-critical applications. Therefore, it is crucial to design algorithms to learn robust models that can make reliable predictions on test data even in the presence of adversarial perturbations.

One principal approach to robust learning, adversarial training [Madry et al., 2018] (along with its variants [Zhang et al., 2019, Wang et al., 2020]), has proven to be an effective empirical defense mechanism against adversarial attacks. Naturally, this puts an emphasis on also developing a theoretical understanding of robust learning. To study the generalization performance of robust learning, one traditional approach is via uniform convergence [Khim and Loh, 2018, Yin et al., 2019, Awasthi et al., 2020, Mustafa et al., 2022], which provides the worst-case type uniform bounds for a given hypothesis class and are algorithm independent. Another line of work focuses on analyzing the convergence and generalization guarantees of adversarial training, yet they either focus on linear classifiers [Charles et al., 2019, Li et al., 2020, Zou et al., 2021, Chen et al., 2023], or introduce restrictive distribution assumptions such as (noisy) linear separability [Wang et al., 2024b] or robust realizability [Mianjy and Arora, 2024]. Therefore, it remains unclear whether we can derive theoretical results for adversarial training that extend beyond these simplifying assumptions.

In this work, we leverage a different machinery by analyzing adversarial training algorithm through the lens of uniform stability. Stability is a classical tool in learning theory that has been extensively studied in the literature [Bousquet and Elisseeff, 2002, Hardt et al., 2016]. Uniform argument stability measures the difference in output parameters when an algorithm is run on two training sets that

differ by only one sample. In the standard (non-robust) setting, Hardt et al. [2016] show a uniform stability bound of O ( ηT n ) after T iterations of gradient descent with step size η on convex and smooth losses using a training dataset of size n . They further provide a uniform stability bound of O ( T q n ) for smooth and non-convex losses with decaying step size η = O ( 1 t ) , where q ∈ (0 , 1) is a constant. The choice of decaying step size is common in the non-convex setting, as maintaining a constant step size leads to an exponentially increasing bound on uniform stability.

When it comes to the robust setting, the primary challenge lies in the non-smoothness of the robust (adversarial) loss. The robust loss is generally non-smooth even if the standard counterpart is smooth [Xing et al., 2021a, Xiao et al., 2022a]. Previous work by Xing et al. [2021a] studied the convex non-smooth adversarial losses and provide an additional term of O ( η √ T ) compared to the convex and smooth losses. Later Xiao et al. [2022a] studied the general non-smooth adversarial losses by leveraging the approximate co-coercivity of the gradient and provide the bound with an additional term of O ( ηTα ) that grows linearly in T , where α is the size of adversarial perturbation in ℓ p threat models. These works, while partially addressing the issue, only focus on general convex / non-convex functions. However, neural networks, which are a specific instance of non-convex functions and are widely used in practice, require further investigation.

In this work, we study the stability and generalization guarantees of variants of adversarial training algorithms. We focus on solving the binary classification problem using two-layer over-parameterized neural networks with smooth activation functions and logistic loss. Our key contributions are as follows:

We present a bound of O ( √ ηT + ηT n + √ βηT ) on the uniform argument stability of the gradient descent-based adversarial training of over-parameterized network after T iterations with step size η , where β represents the precision of generating adversarial examples at each iteration.

We provide robust generalization guarantees that depend on the Adversarial Regularized Empirical Risk Minimization (ARERM) Oracle. Our results hold for any given initialization and any data distribution. Specifically, if the learner is provided with a good initialization such that there exist robust networks around this initialization, then a small robust test loss is achieved via early stopping. Furthermore, our results can be extended to stochastic gradient descent-based adversarial training.

We leverage Moreau's envelope to construct a smooth loss that approximates robust empirical loss. We present bounds on the stability and generalization error of gradient descent with Moreau's smoothing, and demonstrate its superiority compared with gradient descent-based adversarial training algorithm.

1.1 Related Work

Stability Analysis. The notion of stability was initially introduced in Bousquet and Elisseeff [2002] to study the generalization of statistical learning problems. More recently, a fine-grained analysis has been presented by Feldman and Vondrak [2019] and Bousquet et al. [2020]. For smooth loss functions, Hardt et al. [2016] explored the stability of SGD in both convex and non-convex settings, which was later extended to convex non-smooth loss functions by Bassily et al. [2020] and the bound incorporated an additional term of O ( η √ T ) due to non-smoothness. Lei and Ying [2020] tackled the non-smoothness differently by assuming the gradient of the loss to be Hölder continuous. For non-convex and non-smooth loss, Lei [2023] introduced the stability of sub-gradient, as convergence to local minimizers is observed in this setting.

Robust Generalization Guarantee. The standard method of giving a generalization guarantee is through uniform convergence. These theories typically yield an upper bound of O ( 1 √ n ) and require a large number of training samples in order to get a small generalization gap. Techniques in this category include analyzing the Rademacher complexity [Yin et al., 2019, Khim and Loh, 2018, Awasthi et al., 2020], VC dimension [Cullina et al., 2018, Montasser et al., 2020], covering number [Balda et al., 2019, Mustafa et al., 2022, Li and Telgarsky, 2023], PAC Bayesian analysis [Farnia et al., 2018, Viallard et al., 2021, Xiao et al., 2023] and margin-based analysis [Farnia et al., 2018].

Generalization Guarantee of Adversarial Training. Providing generalization guarantees for adversarial training of neural networks is challenging due to its non-convex nature. A series of

works [Charles et al., 2019, Li et al., 2020, Zou et al., 2021, Chen et al., 2023] have focused on a simpler problem - adversarial training of linear models with a convex loss wherein generating adversarial examples admits a closed-form solution. Several works bypass this challenge by considering a lazy training regime [Gao et al., 2019, Zhang et al., 2020, Li and Telgarsky, 2023] in which the landscape of the neural network can be studied near certain random initialization, and the generalization guarantee is usually obtained via uniform convergence. Unfortunately, Wang et al. [2022] proved that adversarial robustness is at odds with lazy regime. Recently, Mianjy and Arora [2024], Wang et al. [2024b] provide convergence and generalization guarantees for adversarial training of neural networks, yet they make restrictive assumptions on the data distribution such as (noisy) linear separability and robust realizability.

Another line of research investigates the generalization of adversarial training through algorithmic stability analysis. Despite the smoothness of the standard loss, the adversarial loss remains nonsmooth [Liu et al., 2020, Xing et al., 2021a, Xiao et al., 2022b]. To resolve this issue, Farnia and Ozdaglar [2021] make a strong assumption that the loss is concave in input x. Xing et al. [2021a] provide adversarial training of convex and non-smooth losses, yielding an additional term of O ( √ η 2 T ) compared to the standard non-robust counterpart. Xiao et al. [2022a] and Wang et al. [2024a] leverage the idea of approximate smoothness and provide bounds that scale linearly with ηT and the perturbation size. Cheng et al. [2024] consider generating adversarial examples via a single step of gradient descent and demonstrate that such variant of adversarial training algorithm achieves better stability. Farnia et al. [2018] also consider specific attack algorithms - these attacks while being more practical and designed with continuity and Lipschitzness property, may differ significantly from the worst-case attack, and do not yield a good bound on the robust generalization gap.

2 Problem Setup

Notation. Throughout the paper, we denote scalars, vectors, and matrices with lowercase italics, lowercase bold, and uppercase bold Roman letters, respectively; e.g., u , u, and U. We use [ m ] to denote the set { 1 , 2 , . . . , m } and use both ∥ · ∥ and ∥ · ∥ 2 for ℓ 2 -norm. Given a matrix U = [ u 1 , . . . , u m ] ∈ R d × m , we use ∥ U ∥ F and ∥ U ∥ 2 to represent the Frobenius norm and spectral norm, respectively. We use the standard O-notation ( O , Θ and Ω ).

We consider a binary classification problem with a bounded input space X inside a Euclidean ball of radius C x , and label space Y = {± 1 } . We assume that data are drawn according to an unknown probability distribution D on X × Y . The learner has access to n training data drawn i.i.d. from D ; i.e., S = { z i = ( x i , y i ) } n i =1 ∼ D n . We do not make any restrictive distributional assumptions such as realizability [Mianjy and Arora, 2024] or (noisy) linearly separability [Wang et al., 2024b].

We focus on learning two-layer neural networks, parameterized by a pair of weight matrices ( a , W ) :

Here, m is a positive integer representing the number of hidden units, i.e., the width of the networks. ϕ : R → R is a 1-Lipschitz, H -smooth activation function. Formally, ∀ z, z ′ ∈ R , | ϕ ′ ( z ) | ≤ 1 , | ϕ ′ ( z ) -ϕ ′ ( z ′ ) | ≤ H | z -z ′ | . The smoothness property of activation functions is commonly assumed in algorithmic stability literature and in theory of deep learning and covers a wide range of activation functions such as smoothed ReLU and smoothed leaky ReLU [Frei et al., 2022]. The weight matrices at the top and bottom layer are denoted as a = [ a 1 , . . . , a m ] ∈ R m and W = [ w 1 , . . . , w m ] ∈ R d × m , respectively. The top layer weights are initialized such that | a i | = 1 √ m , ∀ i ∈ [ m ] , and are kept fixed throughout the training process. Prior works [Du et al., 2018, Arora et al., 2019, Ji and Telgarsky, 2019] often initialize a i to be uniformly sampled from {± 1 √ m } , which can be seen as a special instance of ours. We do not make any assumption on the initialization of the bottom layer matrix, i.e., W 0 can be either a standard Gaussian [Du et al., 2018, Ji and Telgarsky, 2019], or a vanishing initialization [Ba et al., 2019, Xing et al., 2021b], or a pre-trained model.

Adversarial Attacks. We consider a general threat model where the adversary's perturbation set is defined as B : X → 2 X . Given an input x, B ( x ) represents the set of all possible perturbations of x that an adversary can choose from. This broader definition of attack includes both the standard ℓ p threat models with perturbation size of α , i.e., B ( x ) = { ˜ x : ∥ ˜ x -x ∥ p ≤ α } , as well as a discrete set of large-norm transformations. Unlike prior works [Mianjy and Arora, 2024, Wang et al., 2024b], we do not make any assumptions on the perturbation size.

In this work, we focus on logistic loss, ℓ ( z ) = ln(1 + e -z ) , which serves as a smooth and convex surrogate loss for the 0-1 loss. With a slight abuse of notation, for a fixed sample z = ( x , y ) , we define ℓ ( z , W ) := ℓ ( yf ( x ; W )) . The population and empirical loss w.r.t. ℓ ( · ) are denoted, respectively, as

Given B , for a fixed sample z = ( x , y ) , we define the robust loss as ℓ rob ( z , W ) := max ˜ x ∈B ( x ) ℓ ( yf (˜ x ; W )) .

The robust population and empirical loss w.r.t. ℓ ( · ) are defined as

Adversarial Training. During training, the network bottom layer weight W are updated using gradient descent-based adversarial training (or its stochastic version). We denote the weight matrix at the t -th iterate of adversarial training as W t . For each training example ( x i , y i ) , at iteration t , we generate a β 1 -optimal adversarial example (˜ x i ( W t ) , y i ) , which satisfies the following condition:

Setting β 1 = 0 recovers the scenario where we have access to the worst-case adversarial attack. As this may not be feasible in practice due to computational reason, the parameter β 1 allows us to capture the precision of the attack algorithm, which includes common attacks such as projected gradient descent (PGD) [Madry et al., 2018]. We should regard β 1 as a parameter we can choose. Our results in Section 3 suggest that we can achieve better generalization by adding more computation and making β 1 smaller.

Algorithm 1 Variants of Adversarial Training Algorithms

Input: Step size η . Number of iterations T . Initial weight W 0 . β ≥ 0 . µ > 0 .

GD: ∀ i ∈ [ n ] , compute a β 1 -optimal adversarial example ˜ x i ( W t ) that satisfies Equation (1).

SGD: Compute a β 1 -optimal adversarial example ˜ x t +1 ( W t ) that satisfies Equation (1). Update W t +1 = W t -η ∇ W ℓ ( y t +1 f (˜ x t +1 ( W t ); W t )) .

Moreau Envelope: Compute a β 2 -optimal minimizer ˜ U µ ( W t ; S ) that satisfies Equation (2).

end for

Optimizing the Moreau Envelope. Since the robust loss is non-smooth [Xiao et al., 2022a], we utilize Moreau's envelope to construct a smooth function that approximates the empirical robust loss. Such an idea has previously been explored in Xiao et al. [2024]. Given training data S and µ > 0 , we redefine the robust surrogate loss as follows:

Selecting µ appropriately ensures that ̂ L rob ( U ; S ) + 1 2 µ ∥ U -W ∥ 2 F is a strongly convex function w.r.t. U. Given W and S , we define U µ ( W ; S ) = argmin U ∈ R d × m ̂ L rob ( U ; S ) + 1 2 µ ∥ U -W ∥ 2 F , which can be obtained via subgradient-based method (solve a min-max optimization). The gradient of the Moreau envelope can be simply calculated as ∇ W M µ ( W ; S ) = 1 µ ( W -U µ ( W ; S )) . Given training data S , at each iteration t , we generate a β 2 -optimal minimizer ˜ U µ ( W t ; S ) that satisfies

We remark that β 2 -optimal minimizer defined in Equation (2) and β 1 -optimal adversarial example defined in Equation (1) are approximating different quantities, which are not comparable. All the algorithms described above are summarized in Algorithm 1.

Uniform Argument Stability. Given a training set S = { z i } n i =1 drawn i.i.d. from D , let S ′ denote the training set obtained by replacing one example in S with an independently drawn example z ′ ∼ D . We refer to S, S ′ as neighboring samples and write S ≃ S ′ . Given an algorithm A : ( X ×Y ) n →H , where the hypothesis class H is parameterized using a parameter matrix W ∈ R d × m , we define the uniform argument stability as

For any L -Lipschitz loss function g , | g ( A ( S ) , z ) -g ( A ( S ′ ) , z ) | ≤ Lδ A ( S, S ′ ) . The standard stability argument [Mohri et al., 2018] relates the expected generalization gap to the uniform argument stability.

In this paper, we consider robust generalization using logistic loss, so function g ( W , z ) = ℓ rob ( z , W ) , and ε gen ( W ) = E z ∼D [ ℓ rob ( z , W )] -1 n ∑ n i =1 ℓ rob ( z i , W ) . We also remark that a high probability bound for stabile algorithms can be given based on Feldman and Vondrak [2019]. For simplicity, our generalization bounds in this paper are only in expectation.

3 Main Result

In this section, we present our main results, providing theoretical guarantees for adversarial training of two-layer neural networks with smooth activation functions. We discuss (stochastic) adversarial training in Section 3.1 and gradient descent-based Moreau's smoothing in Section 3.2. Our generalization bounds rely on a key quantity, the Adversarial Regularized Empirical Risk Minimization (ARERM) Oracle defined as

Given a sample, ∆ oracle S returns the minimal empirical risk in the vicinity of an initialization W 0 .

3.1 Generalization Guarantees for Adversarial Training

We begin by presenting a bound on the uniform argument stability (UAS) of Algorithm 1 with GD. Theorem 3.1. Assume that the network width satisfies m ≥ H 2 C 4 x η 2 ( T + 1) 2 . Then, after T iterations of Algorithm 1 with GD, for any neighboring datasets S, S ′ , we have

Remarkably, setting β 1 = 0 yields a bound of O ( η √ T + ηT n ) on the UAS of Algorithm 1, thereby recovering the result in prior work of Xing et al. [2021a]. However, note that Xing et al. [2021a] show the result only for convex learning problems, whereas we consider training two-layer neural networks using logistic loss, which is non-convex and non-smooth. Further note that we assume that the networks are sufficiently over-parameterized, i.e., m ≥ Ω( η 2 T 2 ) , a condition that is commonly assumed in deep learning theory. We can also regard this condition as early stopping, wherein T ≤ O ( √ m HC 2 x η ) . This view is also consistent with several empirical studies [Caruana et al., 2000, Rice et al., 2020, Pang et al., 2021].

Next, we show that stable robust learning rules do not overfit.

Theorem 3.2. Define α 1 ( η, T ) := O ( C 2 x η √ T + C 2 x ηT n + C x √ β 1 ηT ) . Assume that the width of the networks satisfies m ≥ H 2 C 4 x η 2 ( T +1) 2 , and α 1 ( η, T ) < 1 . Then, after T iterations of Algorithm 1 with GD, we have

and

The result above bounds the robust generalization gap and the robust loss in terms of the ARERM oracle, a step size-dependent term O ( η ) , and the precision of the adversarial examples β 1 . Note though that the bound holds for the minimum over the last few iterates (past iterates), rather than for the last iteration. This distinction arises because, unlike standard gradient descent for neural networks, we cannot guarantee a decreasing robust training loss without additional assumptions on the data distributions owing to the non-smooth nature of the robust loss. The step size-dependent term arises for the same reason. A direct corollary gives us a bound on the expected robust loss.

Corollary 3.3. After T ≤ O (min { n 2 , 1 β 2 1 } ) iterations of Algorithm 1 with GD using a step size of η = Θ( 1 C 2 x √ T ) on a network with width m ≥ Ω( T ) , for any weight matrix W

Since corollary 3.3 holds for any W 0 , it underscores the importance of initialization for robust learning. Given a good initialization, such as a pre-trained model, and assuming that there exists a robust network W ∗ in the vicinity of the initialization (i.e., ∥ W ∗ -W 0 ∥ F = O (1) ) that achieves a small robust loss L rob ( W ∗ ) ≈ 0 , we have that the minimum expected robust loss over all iterates approaches O ( 1 √ T ) . Further, if β 1 is small enough and m ≳ n 2 , then T can be of the order Θ( n 2 ) , leading to a O (1 /n ) upper bound on the robust test loss.

We remark that by a similar analysis, our result can be reduced to the standard (non-robust) setting for gradient descent training of two-layer networks by setting the perturbation set B ( x ) = { x } , ∀ x ∈ X , β 1 = 0 , and redefining α 1 ( η, T ) = O ( C 2 x ηT n ) . In this context, we can show that gradient descent for the binary classification problem can achieve excess risk bound of O (1 / √ n ) by taking ηT = Θ( √ n ) if m ≳ n and assuming ∥ W ∗ -W 0 ∥ F = O (1) , where W ∗ ∈ argmin W L rob ( W ) .

Next, we extend our result to the stochastic adversarial training.

Theorem 3.4. After T iterations of Algorithm 1 with SGD on a network of width m ≥ H 2 C 4 x η 2 ( T + 1) 2 we have that for any weight matrix W,

Similar to the discussion following Corollary 3.3, we assert that if we assume that there exists an over-parameterized robust network with small robust loss, then using a step size of η = 1 / √ T , stochastic adversarial training yields an excess risk bound of O (1 / √ T ) .

3.2 Generalization Guarantees for Gradient Descent on Moreau's Envelope

We now present a bound on the uniform argument stability of gradient descent with smoothing based on Moreau's envelope.

Theorem 3.5. After T iterations of Algorithm 1 with Moreau Envelope with step-size η ≤ min { µ, √ m 8 HC 2 x } ≤ √ m 2 HC 2 x , on a network of width m ≥ H 2 C 4 x η 2 T 2 , for any neighboring datasets S, S ′ , we have

Setting β 2 = 0 yields a bound of O ( ηT n ) on the UAS of Algorithm 1, thereby recovering the result in prior work of [Hardt et al., 2016, Xiao et al., 2024] for convex and smooth functions. Note that by using Moreau's envolope, we are able to shave off the O ( η √ T ) term that appears in Theorem 3.1.

Although inspired by Xiao et al. [2024], Theorem 3.5 differs from the non-convex setting of Xiao et al. [2024]. Our result utilizes the specific structure of over-parameterized neural networks that exhibit weakly convex properties, a special instance of non-convex functions, and allows for a constant step size. In contrast, [Xiao et al., 2024, Theorem 4.7] follows the traditional stability argument for non-convex and smooth functions in Hardt et al. [2016], considering a decaying step size η t ≤ µ t .

Such a condition might be impractical if µ is chosen to be sufficiently small. In fact, our results indicate that it is necessary to select a sufficiently small µ so that the robust training loss is well approximated by the Moreau envelope (see Lemma C.1 in the Appendix).

Even though the gradient descent-based algorithm with Moreau's smoothing achieves better stability guarantees compared to gradient descent-based adversarial training when β 1 = β 2 = 0 , it requires more computational resources. Specifically, for the calculation of the gradient at each step, we need to solve a min-max optimization problem with a strongly convex and non-smooth objective to obtain a β -optimal minimizer. Additionally, for every step of this min-max optimization, we need to generate adversarial examples and apply sub-gradient descent.

Theorem 3.6. Define α 2 ( η, T ) := O ( C 2 x ηT n + C x ηT √ β 2 µ ) . Assume α 2 ( η, T ) < 1 . Then, after T ≥ 8 iterations of Algorithm Moreau Envelope with step-size η ≤ µ on a network of width m ≥ H 2 C 4 x η 2 T 2 , we have

Similar to Theorem 3.2, the result above shows that both the robust generalization gap as well as the robust loss can be bounded in terms of the ARERM oracle, parameter µ in Moreau's envelope, and a term of O ( ηTβ 2 /µ ) dependent on the precision of generating the minimizer of Moreau envelope. While the bound above is on the minimum expected generalization gap (and expected robust test loss) over the last few iterates (past iterates), we can give a bound for the the last iterate for the case when β 2 = 0 . We conclude the section by presenting the following direct corollary.

Corollary 3.7. After T ≤ O (min { n 2 , 1 β 2 / 3 2 } ) iterations of Algorithm 1 with Moreau Envelope with step-size η = µ = Θ( 1 C 2 x √ T ) on a network of width m ≥ Ω( T ) , we have for any weight matrix W,

4 Proof Sketch

We begin by providing a high level intuition behind our analysis technique, and then we highlight the key ideas in the proofs of the main theorems. For simplicity, we assume that the learner can generate optimal attacks during adversarial training, i.e., we consider β 1 = 0 , β 2 = 0 in this section. We refer the reader to the Appendix for proofs of the more general case.

Our analysis relies on a key lemma demonstrating that the objective function (i.e., the robust empirical risk) being minimized in adversarial training of two-layer neural networks with smooth activation functions using the logistic loss function is 'almost' convex.

Definition 4.1. Let l > 0 . Afunction f ( x ) is said to be -l -weakly convex if f ( x ) + l 2 ∥ x ∥ 2 2 is convex in x .

Lemma 4.2. (Restatement of Lemma A.4) For any weight matrices W 1 and W 2 ,

Equivalently, ̂ L rob ( W ; S ) is -HC 2 x √ m -weakly convex.

We borrow many ideas from Xiao et al. [2024] and Xing et al. [2021a] in our proofs. These papers primarily focus on the convex setting, while only giving a general result for non-convex functions. We extend their results to a special case of learning neural networks. We argue that by specializing our analysis to neural networks would lead to sharper results than a general non-convex function class, as we will be able to leverage the 'almost' convexity of neural network training [Richards

and Rabbat, 2021, Richards and Kuzborskij, 2021]. This allows us to get stability and optimization guarantees that are similar to the convex setting when we consider an over-parameterized network m ≥ poly( ηT ) . An additional challenge we face is that the robust loss is non-smooth even if its standard counterpart (logistic loss) is smooth, making the analysis more complicated than the standard (non-robust) scenario. Nevertheless, we can still leverage the 'almost' convex nature of the loss to establish the stability of adversarial training.

The following lemma gives a relationship between stability and generalization which is useful in both standard adversarial training as well as gradient descent with Moreau's envelope. When the robust training loss ̂ L rob ( W T ; S ) is small, Lemma 4.3 provides a tighter bound than directly applying Equation (3). See Proposition A.3 for both results.

Lemma 4.3. (Restatement of Proposition A.3) The robust test loss satisfies the following:

This result gives a way to bound the expected robust loss. Say you want to bound the expected robust test loss by (1 + ϵ ) times the expected training loss. Then, to ensure 1 1 -α 1 ( η,T ) ≤ 1 + ϵ , we need α 1 ( η, T ) ≤ ϵ 1+ ϵ = O ( ϵ ) .Since α 1 ( η, T ) = O ( η √ T + ηT n + √ β 1 ηT ) , we can set different parameters in more than one way to ensure that α 1 ( η, T ) = O ( ϵ ) . We can set β 1 = O ( ϵ 2 ) , n = Θ(1 /ϵ ) , T = Θ(1 /ϵ 2 ) , η = O ( 1 T ) ; or set β 1 = O ( ϵ 3 ) , n = Θ(1 /ϵ 2 ) , T = Θ(1 /ϵ 4 ) , η = O ( ϵ √ T ) .

4.1 Generalization Guarantees for Gradient-Based Adversarial Training

The stability guarantee we give in the following Theorem 4.4 is similar to the result in the convex case [Xing et al., 2021a]. While [Xing et al., 2021a] use the monotone subgradient condition of the convex functions, we show that the subgradients of an 'almost' convex loss function are 'almost' monotone. We do incur an additional term of exp ( 2 HC 2 x ηT/ √ m ) , which is small for over-parameterized neural networks ( m ≥ ploy( ηT ) ).

Theorem 4.4. (Restatement of Theorem 3.1) Let S and S ′ be any two neighboring data sets, i.e., they differ only in one example. Let W T and W ′ T denote the weight matrices returned after T iterations of Algorithm 1 with GD on S and S ′ , respectively. Then, we have

We next provide an intermediate lemma that lead us to Theorem 3.2.

Lemma 4.5. (Restatement of Theorem B.2) Set k = ( 1 + HC 2 x η √ m ) -1 . Then after T ≤ √ m HC 2 x η -1 iterations of Algorithm 1 with GD,

Richards and Kuzborskij [2021] (see Lemma 2 in their paper) give an optimization guarantee by providing an upper bound on the averaged training loss 1 T ∑ T t =1 ̂ L ( W t ; S ) of all iterates. In Lemma 4.5 we use a more refined analysis by considering the weighted average of the training loss. Specifically, for any weight matrix W, we follow the standard technique in the convex case and upper bound the following:

The second term on the right hand side is bounded by the Lipschitzness of the logistic loss. The inner product in the third term is bounded by ̂ L rob ( W ; S ) -̂ L rob ( W t ; S ) + HC 2 x 2 √ m ∥ W -W t ∥ 2 F using Lemma A.4. We finish the proof by telescoping. The weighted telescoping technique removes all of the ∥ W -W t ∥ 2 F terms ( t > 0 ) in the upper bound, thereby giving a simpler result. The term C 2 x η/ 2 in the upper bound stems from the non-smoothness of the robust loss, and is unavoidable even if the robust loss is convex. Finally, Theorem 3.2 follows from Theorem 4.4 and Lemmas 4.3 and 4.5.

4.2 Generalization Guarantees for Gradient-Descent on Moreau's Envelope

Below we give the key lemmas for bounding the generalization error of GD with Moreau's envelope. The proof technique here is similar to that for standard adversarial training (in the previous section), except that we get to utilize the smoothness of Moreau's envelope. Specifically, Lemma 4.6 leverages the fact that the gradient is 'almost' co-coercive to control the uniform argument stability.

Theorem 4.6. (Restatement of Theorem C.4) Let S ≃ S ′ be any two neighboring data sets, i.e., S and S ′ differ only in one example. For any η ≤ min { µ, √ m 8 HC 2 x } ≤ √ m 2 HC 2 x , let W T and W ′ T be the weight matrices obtained by T iterations of gradient descent with Moreau's envelopes on datasets S and S ′ , respectively. Then, we have that

Lemma 4.7 also leverages smoothness due to Moreau's envelope and yields a bound that does not involve the additional term C 2 x η/ 2 compared with Lemma 4.5.

Lemma 4.7. (Restatement of Theorem C.6) Set k = ( 1 + 2 HC 2 x η √ m ) -1 . After T iterations of Algorithm 1 with Moreau Envelope with η ≤ µ ≤ √ m 2 HC 2 x and T ≤ √ m HC 2 x η , we have

Theorem 3.6 is naturally derived via Theorem 4.6, Lemma 4.3 and 4.7.

5 Conclusion

In this work, we establish the generalization guarantees for variants of adversarial training applied to two-layer networks with smooth activation functions. For over-parameterized neural networks, we present robust generalization bound that are controlled by the Adversarial Regularized Empirical Risk Minimization (ARERM) oracle, applicable to any given initialization and any data distributions. One future direction is to extend our analysis to deep neural networks and beyond neural networks with smooth activation functions.

Acknowledgments and Disclosure of Funding

This research was supported, in part, by the DARPA GARD award HR00112020004, NSF CAREER award IIS-1943251, funding from the Institute for Assured Autonomy (IAA) at JHU, and the Spring'22 workshop on 'Learning and Games' at the Simons Institute for the Theory of Computing.

References

Sanjeev Arora, Simon Du, Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. In International Conference on Machine Learning , pages 322-332. PMLR, 2019.

Pranjal Awasthi, Natalie Frank, and Mehryar Mohri. Adversarial learning guarantees for linear hypotheses and neural networks. In International Conference on Machine Learning , pages 431441. PMLR, 2020.

Jimmy Ba, Murat Erdogdu, Taiji Suzuki, Denny Wu, and Tianzong Zhang. Generalization of two-layer neural networks: An asymptotic viewpoint. In International conference on learning representations , 2019.

Emilio Rafael Balda, Arash Behboodi, Niklas Koep, and Rudolf Mathar. Adversarial risk bounds for neural networks through sparsity based compression. arXiv preprint arXiv:1906.00698 , 2019.

Raef Bassily, Vitaly Feldman, Cristóbal Guzmán, and Kunal Talwar. Stability of stochastic gradient descent on nonsmooth convex losses. Advances in Neural Information Processing Systems , 33: 4381-4391, 2020.

Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim vSrndi´ c, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13 , pages 387-402. Springer, 2013.

Olivier Bousquet and André Elisseeff. Stability and generalization. The Journal of Machine Learning Research , 2:499-526, 2002.

Olivier Bousquet, Yegor Klochkov, and Nikita Zhivotovskiy. Sharper bounds for uniformly stable algorithms. In Conference on Learning Theory , pages 610-626. PMLR, 2020.

Rich Caruana, Steve Lawrence, and C. Giles. Overfitting in neural nets: Backpropagation, conjugate gradient, and early stopping. In Advances in Neural Information Processing Systems , volume 13. MIT Press, 2000.

Zachary Charles, Shashank Rajput, Stephen Wright, and Dimitris Papailiopoulos. Convergence and margin of adversarial training on separable data. arXiv preprint arXiv:1905.09209 , 2019.

Jinghui Chen, Yuan Cao, and Quanquan Gu. Benign overfitting in adversarially robust linear classification. In Conference on Uncertainty in Artificial Intelligence , 2023.

Xiwei Cheng, Kexin Fu, and Farzan Farnia. Stability and generalization in free adversarial training. arXiv preprint arXiv:2404.08980 , 2024.

Daniel Cullina, Arjun Nitin Bhagoji, and Prateek Mittal. PAC-learning in the presence of adversaries. Advances in Neural Information Processing Systems , 31, 2018.

Simon S Du, Xiyu Zhai, Barnabas Poczos, and Aarti Singh. Gradient descent provably optimizes over-parameterized neural networks. arXiv preprint arXiv:1810.02054 , 2018.

Farzan Farnia and Asuman Ozdaglar. Train simultaneously, generalize better: Stability of gradientbased minimax learners. In International Conference on Machine Learning , pages 3174-3185. PMLR, 2021.

Farzan Farnia, Jesse M Zhang, and David Tse. Generalizable adversarial training via spectral normalization. arXiv preprint arXiv:1811.07457 , 2018.

Vitaly Feldman and Jan Vondrak. High probability generalization bounds for uniformly stable algorithms with nearly optimal rate. In Conference on Learning Theory , pages 1270-1279. PMLR, 2019.

Spencer Frei, Niladri S Chatterji, and Peter Bartlett. Benign overfitting without linearity: Neural network classifiers trained by gradient descent for noisy linear data. In Conference on Learning Theory , pages 2668-2703. PMLR, 2022.

Ruiqi Gao, Tianle Cai, Haochuan Li, Cho-Jui Hsieh, Liwei Wang, and Jason D Lee. Convergence of adversarial training in overparametrized neural networks. Advances in Neural Information Processing Systems , 32, 2019.

Moritz Hardt, Ben Recht, and Yoram Singer. Train faster, generalize better: Stability of stochastic gradient descent. In International conference on machine learning , pages 1225-1234. PMLR, 2016.

Ziwei Ji and Matus Telgarsky. Polylogarithmic width suffices for gradient descent to achieve arbitrarily small test error with shallow ReLU networks. arXiv preprint arXiv:1909.12292 , 2019.

Justin Khim and Po-Ling Loh. Adversarial risk bounds via function transformation. arXiv preprint arXiv:1810.09519 , 2018.

Yunwen Lei. Stability and generalization of stochastic optimization with nonconvex and nonsmooth problems. In The Thirty Sixth Annual Conference on Learning Theory , pages 191-227. PMLR, 2023.

Yunwen Lei and Yiming Ying. Fine-grained analysis of stability and generalization for stochastic gradient descent. In International Conference on Machine Learning , pages 5809-5819. PMLR, 2020.

Justin D Li and Matus Telgarsky. On achieving optimal adversarial test error. In International Conference on Learning Representations , 2023.

Yan Li, Ethan Fang, Huan Xu, and Tuo Zhao. Implicit bias of gradient descent based adversarial training on separable data. In International Conference on Learning Representations , 2020.

Chen Liu, Mathieu Salzmann, Tao Lin, Ryota Tomioka, and Sabine Süsstrunk. On the loss landscape of adversarial training: Identifying challenges and how to overcome them. Advances in Neural Information Processing Systems , 33:21476-21487, 2020.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Poorya Mianjy and Raman Arora. Robustness guarantees for adversarially trained neural networks. Advances in Neural Information Processing Systems , 36, 2024.

Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of machine learning . MIT press, 2018.

Omar Montasser, Steve Hanneke, and Nati Srebro. Reducing adversarially robust learning to nonrobust PAC learning. Advances in Neural Information Processing Systems , 33:14626-14637, 2020.

Waleed Mustafa, Yunwen Lei, and Marius Kloft. On the generalization analysis of adversarial learning. In International Conference on Machine Learning , pages 16174-16196. PMLR, 2022.

Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations , 2021.

Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In Proceedings of the 37th International Conference on Machine Learning , pages 8093-8104. PMLR, 2020.

Dominic Richards and Ilja Kuzborskij. Stability & generalisation of gradient descent for shallow neural networks without the neural tangent kernel. Advances in neural information processing systems , 34:8609-8621, 2021.

Dominic Richards and Mike Rabbat. Learning with gradient descent and weakly convex losses. In International Conference on Artificial Intelligence and Statistics , pages 1990-1998. PMLR, 2021.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Paul Viallard, Eric Guillaume VIDOT, Amaury Habrard, and Emilie Morvant. A PAC-Bayes analysis of adversarial robustness. Advances in Neural Information Processing Systems , 34:14421-14433, 2021.

Yihan Wang, Shuang Liu, and Xiao-Shan Gao. Data-dependent stability analysis of adversarial training. arXiv preprint arXiv:2401.03156 , 2024a.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations , 2020.

Yunjuan Wang, Enayat Ullah, Poorya Mianjy, and Raman Arora. Adversarial robustness is at odds with lazy training. Advances in Neural Information Processing Systems , 35:6505-6516, 2022.

Yunjuan Wang, Kaibo Zhang, and Raman Arora. Benign overfitting in adversarially trained neural networks. In International Conference on Machine Learning , 2024b.

Jiancong Xiao, Yanbo Fan, Ruoyu Sun, and Zhi-Quan Luo. Adversarial rademacher complexity of deep neural networks. arXiv preprint arXiv:2211.14966 , 2022a.

Jiancong Xiao, Yanbo Fan, Ruoyu Sun, Jue Wang, and Zhi-Quan Luo. Stability analysis and generalization bounds of adversarial training. Advances in Neural Information Processing Systems , 35:15446-15459, 2022b.

Jiancong Xiao, Ruoyu Sun, and Zhi-Quan Luo. PAC-Bayesian adversarially robust generalization bounds for deep neural networks. In The Second Workshop on New Frontiers in Adversarial Machine Learning , 2023.

Jiancong Xiao, Jiawei Zhang, Zhi-Quan Luo, and Asuman Ozdaglar. Uniformly stable algorithms for adversarial training and beyond. arXiv preprint arXiv:2405.01817 , 2024.

Yue Xing, Qifan Song, and Guang Cheng. On the algorithmic stability of adversarial training. Advances in neural information processing systems , 34:26523-26535, 2021a.

Yue Xing, Qifan Song, and Guang Cheng. On the generalization properties of adversarial training. In International Conference on Artificial Intelligence and Statistics , pages 505-513. PMLR, 2021b.

Dong Yin, Ramchandran Kannan, and Peter Bartlett. Rademacher complexity for adversarially robust generalization. In International conference on machine learning , pages 7085-7094. PMLR, 2019.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Yi Zhang, Orestis Plevrakis, Simon S Du, Xingguo Li, Zhao Song, and Sanjeev Arora. Overparameterized adversarial training: An analysis overcoming the curse of dimensionality. Advances in Neural Information Processing Systems , 33:679-688, 2020.

Difan Zou, Spencer Frei, and Quanquan Gu. Provable robustness of adversarial training for learning halfspaces with noise. In International Conference on Machine Learning , pages 13002-13011. PMLR, 2021.

Supplementary Material

A Technical Theorems and Lemmas

Lemma A.1. Let ℓ ( z ) = ln(1 + e -z ) be the logistic loss function. We have | ℓ ′ ( z ) | ≤ min { 1 , ℓ ( z ) } .

Proof of Lemma A.1.

Lemma A.2. For any sample z = ( x , y ) , and any weight matrices W and W ′ , we have

Proof of Lemma A.2.

In the following proposition, we build the relationship between the generalization gap and uniform stability.

Proposition A.3. Let S and S ′ be any two neighboring data sets that differ only in one example. Let W t = A ( S ) , W ′ t = A ( S ′ ) be the weight returned after running algorithm A for t steps using S and S ′ , respectively. δ A ( S, S ′ ) = ∥A ( S ) -A ( S ′ ) ∥ F . Then if sup S ≃ S ′ δ A ( S, S ′ ) < 1 C x , we have

and

Proof of Proposition A.3. Let S and S ′ differ in one example, and z ′ = S ′ \ S .

E S ∼D n ( L rob ( W t ) -̂ L rob ( W t ; S ) ) = E S ∪{ z ′ }∼D n +1 [( ℓ rob ( z ′ , W t ) -ℓ rob ( z ′ , W ′ t ))] . (6) Combining Lemma A.2 and Equation (6) we get

Based on the definition of δ A ,

Simplifying this inequality, we get

and

The following lemma gives the weakly convex property of the robust loss (by considering the special case of β 1 = 0 ).

Lemma A.4. Given any data ( x , y ) , for model with weight W, let ˜ x ( W ) ∈ B ( x ) be an β 1 -optimal adversarial examples such that ℓ ( yf (˜ x ( W ) , W )) ≥ max ˜ x ∈B ( x ) ℓ ( yf (˜ x , W )) -β 1 . Then for any two weight matrices W 1 , W 2 ∈ R d × m , we have

Proof of Lemma A.4.

The following lemma tells us the gradient has a universal upper bound.

Lemma A.5. For any data ( x , y ) and any weight matrix W,

Proof of Lemma A.5. Since ∇ W ℓ ( yf ( x ; W )) = [ ℓ ′ ( yf ( x ; W )) ya s ϕ ′ ( ⟨ w s , x ⟩ ) x ] m ,

B Missing Proofs in Section 3.1

Now we give the uniform argument stability upper bound.

Theorem B.1. (Restatement of Theorem 3.1) Let S and S ( i ) only differ in the i -th data. W T and W ( i ) T denote the weight matrices returned after after running Algorithm GD for T iterations on S and S ( i ) , respectively. Then we have

̸

̸

Proof of Theorem B.1. For any weight matrix W and any perturbation of the j -th data ˜ x j ∈ B ( x j ) ( j = i ), define L S \ i (W; { ˜ x j } j = i ) = 1 n ∑ j = i ℓ ( y j f (˜ x j ; W)) to be the loss of the (perturbed) data set

̸

without including the i -th data. Let ˜ x j ( W t ) denote the β 1 -optimal adversarial example of x j given W t , and ˜ x j ( W ( i ) t ) denote the β 1 -optimal adversarial example of x j given W ( i ) t . We first show that the gradient is an 'almost' monotone operator, which is derived from the weakly convex property of the robust loss (see Lemma A.4).

̸

̸

̸

Similarly, we get

̸

Adding these two inequalities together, we get

̸

̸

̸

̸

̸

̸

Now we start upper bounding ∥ W t -W ( i ) t ∥ F .

̸

̸

Define γ = T +2 T +1 (1 + 2 HC 2 x √ m η ) , then the inequality above can be written as

Dividing both sides by γ t +1 ,

Summing up this inequality for t = 0 , 1 , . . . , T -1 , we obtain

̸

̸

̸

̸

̸

̸

̸

̸

The proof of Theorem 3.1 is immediately obtained from Theorem B.1 by observing e 1+ 2 HC 2 x ηT √ m ≤ e 3 .

Next we give an optimization guarantee. We show that when T is sufficiently large, the robust training loss can approach the adversarial regularized empirical risk minimization oracle. We do not need early stopping in the Theorem below.

Theorem B.2. After running Algorithm GD for T iterations, we have

Proof of Theorem B.2. For any given W, we have

Dividing both sides by (1 + HC 2 x η √ m ) t +1 we get

Taking the sum for t = 0 , 1 , . . . , T we get

Simplifying the above inequality, we have

Theorem 3.2. Define α 1 ( η, T ) := O ( C 2 x η √ T + C 2 x ηT n + C x √ β 1 ηT ) . Assume that the width of the networks satisfies m ≥ H 2 C 4 x η 2 ( T +1) 2 , and α 1 ( η, T ) < 1 . Then, after T iterations of Algorithm 1 with GD, we have and

Proof of Theorem 3.2. Define t 0 := [ 9 T 10 ] and k := 1 1+ HC 2 x η √ m . From equation (9), we have

Taking minimum over all weight matrices W,

Taking the expectation on both sides, we get

Simplifying the equation above, we get

Equation (4) gives us for any t ≤ T , E S ∼D n ε gen ( W t ) ≤ α 1 ( η,T ) 1 -α 1 ( η,T ) E S ∼D n ̂ L rob ( W t ; S ) . Therefore,

The proof of the second statement takes a similar approach. Following the same procedure, we can replace t 0 by 0 in equation (10), and get

Combining with equation (4),

Corollary 3.3. After T ≤ O (min { n 2 , 1 β 2 1 } ) iterations of Algorithm 1 with GD using a step size of η = Θ( 1 C 2 x √ T ) on a network with width m ≥ Ω( T ) , for any weight matrix W

Proof of Corollary 3.3. Under the conditions of the corollary, we have m ≥ H 2 C 4 x η 2 ( T +1) 2 , and α 1 ( η, T ) = O ( C 2 x η √ T + C 2 x ηT n + C x √ β 1 ηT ) can be small enough so that 1 1 -α 1 ( η,T ) ≤ 1 . 1 . Then it is clear that this corollary is a special case of Theorem 3.2.

We now extend the previous ideas to stochastic adversarial training.

Lemma B.3. After T iterations of Algorithm 1 with SGD, for any weight matrix W,

Proof of Lemma B.3. The proof proceeds similarly as Theorem B.2.

Dividing both sides by (1 + HC 2 x η √ m ) t +1 , we get

Taking the sum of the above equation for t = 0 , 1 , . . . , T :

Simplifying the above inequality we have

Theorem 3.4. After T iterations of Algorithm 1 with SGD on a network of width m ≥ H 2 C 4 x η 2 ( T + 1) 2 we have that for any weight matrix W,

Proof of Theorem 3.4. Taking the expectation over S ∼ D n on both sides of Equation (11), we obtain

Simplifying the above inequality, we get

C Missing Proofs in Section 3.2

From Lemma A.4, for any µ < √ m HC 2 x , L rob ( U ) + 1 2 µ ∥ U -W ∥ 2 F is strongly convex in U. Recall that the Moreau envelope is defined as

The minimizer of the optimization problem above is denoted as

We borrow a few properties of the Moreau envelope from Xiao et al. [2024]. Lemma C.1. For any µ < √ m HC 2 x ,

1.

2.

min

µ

W

M

(

W

;

S

)

has the same global solution set as

The gradient of

M

µ

(

W

;

S

)

is

∇

W

M

(

W

U µ ( W ; S ) is √ m HC 2 x √ m HC 2 x -µ -Lipschitz in W w.r.t the Frobenius norm.

7.

∥∇

W

M

µ

(

W

;

S

)

∥

F

C

x

.

Proof of Lemma C.1. The first 5 statements are covered in the proof of [Xiao et al., 2024, Lemma A.1]. For the statement 6,

Now we prove statement 7. For any γ ∈ (0 , 1) , from the definition of the Moreau envelope,

µ

1

µ

;

S

) =

min

(

W

W

̂

L

-

U

µ

(

(

W

;

;

S

S

)

.

))

.

W

Simplifying the inequality above, we get

Next we show a result similar as [Xiao et al., 2024, Lemma A.2]. They use the first-order optimal condition to prove the result, which only holds for the smooth loss functions. Here we give a different proof that doesn't depend on the subgradient, so it can be applied to the robust loss.

Lemma C.2. Let ˜ U µ ( W ; S ) be any β 2 -optimal minimizer of min U ( ̂ L rob ( U ; S ) + 1 2 µ ∥ U -W ∥ 2 F ) . For two data sets S and S ( i ) that differ in only one example and any weight matrix W, we have

Proof of Lemma C.2. From strong convexity of the regularized robust loss, we have

and similarly,

Adding these two inequalities,

Therefore,

Let γ → 1 , we get and

From the strong convexity of the regularized robust loss, we also have

Now we show an upper bound that is key to bounding the stability of the weight matrix.

√

Lemma C.3. For any η ≤ µ ≤ m 2 HC 2 x and any weight matrices W 1 and W 2 ,

Proof of Lemma C.3. Define ψ 1 ( W ) = M µ ( W ; S ) -M µ ( W 1 ; S ) -〈 ∇ W M µ ( W 1 ; S ) , W -W 1 〉 . From Lemma C.1, ψ 1 ( W ) is 1 µ -smooth. From the standard descent lemma of smooth functions, for any η ≤ µ ,

Since ψ 1 ( W ) + ∥ W ∥ 2 F 2 ( √ m HC 2 x -µ ) is convex from Lemma C.1,

Combining the two inequalities above,

Similarly, we can get the counterpart of this equation:

We get the desired result by simplifying the above inequality.

Theorem C.4. (Restatement of Theorem 3.5) For any η ≤ min { µ, √ m 8 HC 2 x } ≤ √ m 2 HC 2 x , let W T and W ( i ) T be the weight matrices returned after running Algorithm 1 with Moreau Envelope using S and S ( i ) respectively for T iterations. Here S and S ( i ) only differ in the i -th data. We have

Proof of Theorem C.4.

Define γ = T +2 T +1 · 1 1 -4 HC 2 x η √ m , then the inequality above can be written as

Dividing both sides by γ t +1 and summing up the inequality, we get

The proof of Theorem 3.5 is obvious from Theorem C.4 by observing e 1+ 8 HC 2 x ηT √ m ≤ e 9 .

We have the following corollary by combining Theorem C.4, Lemma C.1-6 and Proposition A.3. Corollary C.5. Assume the width of the networks satisfies m ≥ H 2 C 4 x η 2 T 2 . After T iterations of Algorithm 1 with Moreau Envelope with η ≤ min { µ, √ m 8 HC 2 x } ≤ √ m 2 HC 2 x , we have

and

Now we derive an optimization guarantee of optimizing the Moreau envelope.

Theorem C.6. Assume the width of the networks satisfies m ≥ H 2 C 4 x η 2 T 2 . After running Algorithm 1 with Moreau Envelope for T iterations with η ≤ µ ≤ √ m 2 HC 2 x , we have

Proof of Theorem C.6. From Lemma C.1, M µ ( W ; S ) is 1 µ smooth, so

From the weakly convex property Lemma C.1-3, M µ ( W ; S )

From the inequality above, for any weight matrix W,

Simplifying the above inequality and combining with Lemma C.1-6 gives us

Thus,

Dividing both sides by ( 1 + 1 T ) t +1 ( 1 + 2 HC 2 x η √ m ) t +1 and summing up the inequality for t = 0 , 1 , . . . , T -1 , we get

Theorem 3.6. Define α 2 ( η, T ) := O ( C 2 x ηT n + C x ηT √ β 2 µ ) . Assume α 2 ( η, T ) < 1 . Then, after T ≥ 8 iterations of Algorithm Moreau Envelope with step-size η ≤ µ on a network of width m ≥ H 2 C 4 x η 2 T 2 , we have and

Proof of Theorem 3.6. Define t 0 := [ 9 T 10 ] and k := 1 ( 1+ 1 T ) ( 1+ 2 HC 2 x η √ m ) . Dividing both sides of equation (14) by ( 1 + 1 T ) t +1 ( 1 + 2 HC 2 x η √ m ) t +1 and summing up, we have

Taking minimum over all weight matrices W,

Taking the expectation on both sides, we get

Simplifying the equation above, we get

Equation (4) gives us for any t ≤ T , E S ∼D n ε gen ( W t ) ≤ α 2 ( η,T ) 1 -α 2 ( η,T ) E S ∼D n ̂ L rob ( W t ; S ) . Therefore,

The proof of the second statement takes a similar approach. Following the same procedure, we can replace t 0 by 0 in equation (15), and get

Combining with equation (4),

Corollary 3.7. After T ≤ O (min { n 2 , 1 β 2 / 3 2 } ) iterations of Algorithm 1 with Moreau Envelope with step-size η = µ = Θ( 1 C 2 x √ T ) on a network of width m ≥ Ω( T ) , we have for any weight matrix W,

Proof of Corollary 3.7. Under the conditions of the corollary, we have m ≥ H 2 C 4 x η 2 T 2 , and α 2 ( η, T ) = O ( C 2 x ηT n + C x ηT √ β 2 µ ) can be small enough so that 1 1 -α 2 ( η,T ) ≤ 1 . 1 . Then it is clear that this corollary is a special case of Theorem 3.6.

NeurIPS Paper Checklist

A. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We further expand on the claims made in Abstract and Introduction in Section 3.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

B. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The paper discussed the limitations in the Conclusion section.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

C. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The paper provide the full set of assumptions and a complete and correct proof for each theoretical result. Please see Appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

D. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [NA]

Justification: The paper does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

E. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [NA]

Justification: The paper does not include experiments requiring code.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

F. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [NA]

Justification: The paper does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

G. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [NA]

Justification: The paper does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

H. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [NA]

Justification: The paper does not include experiments.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

I. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The research conducted in the paper conform with the NeurIPS Code of Ethics in every respect. The theoretical nature of the results means there are minimal ethical concerns.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

J. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: The societal impacts of the paper is overall positive.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

K. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

L. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [NA]

Justification: The paper does not use existing assets.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

M. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

N. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

O. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies generalization bounds for two-layer networks trained using several variants of adversarial training. The main results are a bound on the stability of the algorithm, which in turn provides a bound on the generalization and the robust accuracy.\n\nSTRENGTHS:\n- As far as I know, the results presented in this paper are novel. The approach of studying the generalization capabilities of adversarial training through the lens of stability seems like a promising direction with interesting results.\n\n- The paper studies 2-layer networks (where the weights of the second layer are fixed) which go beyond current research in this field, and potentially beyond the NTK/kernel regime.\n\n- The results of the Moreau Envelope are also novel in this context AFAIK, and provide tighter bounds than GD or SGD analysis (although they are computationally less efficient)\n\nWEAKNESSES:\nAlthough the results of this paper are interesting, there are some issues with the proofs and with some of the setting of the problem, specifically the amount of over-parameterization. In more detail:\n\n1) The assumption on m I think is a bit misleading. If I understand correctly, the authors assume that $m \\geq T^2 \\eta^2$ which means that the change of the weights when doing GD is very small compared to the number of neurons. This in turn means that slightly changing the loss (by a single sample), and beginning from the same starting point will lead to almost the same weights, hence the stability result. However, I don’t think this assumption makes sense in more practical settings. It basically means that the number of iterations is so small (or the learning rate is so small) that most weights barely move from their initialization. \nThis is also emphasized in Theorem B.1, where the change depends on $\\exp(T\\eta /\\sqrt(m))$. This means that even if m is slightly smaller than $T^2\\eta^2$, (e.g. $m = (T\\eta)^{1.5}$) then the difference changes exponentially, and the algorithm is very non-stable. This issue is not addressed in the paper and is only briefly mentioned in the proof intuition.\n\n2) The bounds in Theorem 3.2 don’t make sense. If $\\alpha_1(\\eta,T) > 1$ then the r.h.s of the bounds is negative. Do the bounds only work when $\\alpha_1(\\eta,T) < 1$? If so, this means that $T<1/\\eta\\cdot\\beta_1$ so the number of iterations might be very small compared to the learning rate. \nThis also seems relevant to Theorem 3.6 with $\\alpha_2$\n\n3) There is an issue with the value of T in Corollary 3.3. Which value of T gives that $1/(1/\\alpha_1) < 1.1$? Suppose $\\beta_1$ is a constant, then we need $T<1/\\eta$ to get a constant term rather than $T< 1/\\eta^2$, no?\n\n4) Line 509 - I don’t understand this, how is Eq (4) related to \\epsilon_gen?\n\nI will be happy to see the author’s response to these issues and will consider raising my score accordingly.\n\nQUESTIONS:\n1) Given $\\epsilon > 0$, how should we set the parameters of the problem (i.e. $T, \\beta_1, \\eta, ||W-W_0||, m$ etc.) to get generalization error and robust accuracy smaller than $\\epsilon$? \n\n2) What happens when m is chosen independently of T - although we allow it to depend on n, i.e. the overparameterized regime compared to the number of samples.\n\nLIMITATIONS:\nThe authors discuss the limitations of their results.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nAdversarial Training is a popular method to train models that enhance robutness to adversarial examples. In recent years, a lot of papers study the generalization of adversarial training in various models. In this paper, the authors study the generalization of adversarial training for a special shallow neural networks with uniform stability, they show the theoretical reults for three different algorithms.\n\nSTRENGTHS:\n1. The authors show theoretical results for a special shallow neural networks with logistic loss, which is non-convex and non-smooth.\n2. The authors discuss stability and generalization guarantees of three variants of adversarial training.\n3. The proof of this work is clear to read.\n\nWEAKNESSES:\n1. The model studied in this work is a special neural network. By fixing the weights of last layer, it has only one layer of trainable parameters, it is unclear if the results shown in this special neural network can be generalized to regular neural netowrk.\n2. The authors claim that they use a over-parameterized neural network, while they explian \"over-parameterized\" as $m \\geq O(\\eta T)$. It is confused that $m$ depends on $\\eta$ and $T$ but not depends on the number and dimention of inputs. \n3. In section 4, the bound shown in theoretical results depend on $m$ with a same order. I check the proof of this work, and find that these bounds depend on $m$ since the weights of last layer is initilized from $\\\\{ \\frac{1}{\\sqrt{m}}, -\\frac{1}{\\sqrt{m}} \\\\}$, which means that the bounds depends on the initilization of weights of last layer. If the last layer is initilized from other parameters, especially, initilized from $\\\\{ \\sqrt{m}, -\\sqrt{m} \\\\}$, does the reult still hold for over-parameterized neural network?\n4. The main techniques used in proofs depend on the weakly convex property of function, and uniform stability of algorithm. It is suggested to show the formal definition of weakly convex function.\n\nQUESTIONS:\nIs this possible to generalize the results from special neural network to regular neural network with mild assumptions like the Theorem 4.7 in [1]?\n\nLIMITATIONS:\nThis work study a speical neural network, and it is unclear whether the results can be generalized to regular neural netowrks.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work studies the stability of adversarial training in two-layer neural networks in binary classification problems. The authors study gradient-descent-based adversarial training, with nearly-optimal adversarial perturbations, in two-layer neural networks with a frozen second layer, and they obtain guarantees on the stability of the algorithm and its robust generalization. Furthermore, the paper considers a smoothened empirical robust loss and obtains guarantees for this case too. The proofs of the main results are deferred to the Appendix, yet a proof sketch is presented in Section 4 for the case of (exactly) optimal adversarial perturbations during training.\n\nSTRENGTHS:\nThe paper is well written and makes it easy to follow its contributions and contextualize them with respect to prior work. Furthermore, the results are cleanly organized and presented. The main result is a stability bound on GD-adversarial training, which overcomes the non-convexity and non-smoothness of the objective. I particularly enjoyed reading the proof sketch section and, in particular, Lemma 4.1, which makes it clear how the analysis can sidestep the aforementioned challenges. I consider this work to be a valuable contribution to the field of theoretical robust (deep) learning.\n\nWEAKNESSES:\nThe theoretical results hold for a special class of networks (two-layer with smooth activations and frozen 2nd layer weights) and do not appear to be particularly surprising or useful for inspiring practical ideas. This is the reason why I do not recommend a higher score. Perhaps the authors could discuss some of their assumptions in Section 5; for instance, they could comment on the assumption of eq. (1). Should we consider $\\beta_1$ to be constant during training? Do we expect it to be smaller or larger as training progresses? Could it be empirically estimated? Similarly, the authors could comment on the feasibility of adversarial training with the smoothened loss.\n\nQUESTIONS:\nI have a few questions/suggestions:\n\n* Lines 9 and 10 in the abstract: If I understand correctly, there should be something added along the lines of “provided there exists a robust network around the initialization.”\n* Lines 193-194, “This view is also consistent with several empirical studies.”: can you please elaborate on this?\n* Theorem 3.2, for the result on the generalization gap you should explicitly state the loss function, right? (since eq. (3) is defined with respect to a generic function $f$).\n\nLIMITATIONS:\nThe limitations of the work are thoroughly discussed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-13"}

comments: SUMMARY:
This paper uses uniform stability to analyze adversarial training on wide shallow networks when the adversarial perturbations are $\beta_1$-optimal. Assuming there exists a robust network near initialization, in expectation the best network iterate has test loss that scales with $1/\sqrt{T}$. The results for GD are extended to SGD and when using Moreau's envelope.

STRENGTHS:
- The bounds are tied to how strong the adversarial training attack is, providing an approximation to practical attacks while allowing for tractability in the theoretical analysis.
- No assumptions are made on the data distribution, and the adversarial attack threat model is very general.

WEAKNESSES:
- The bounds are in expectation and not high probability bounds.
- A large width is required for the bounds to hold.
- The $\beta_1$ parameter is set in the worst-case, and as a result for practical attack algorithms is likely to be high. In fact, if $\beta_1 > 0$ is constant, then it appears Corollary 3.3 is vacuous.

QUESTIONS:
- How realistic is the assumption that there exists a robust network in the vicinity of the initialization?
- Should I be thinking of $beta_1$ as a constant? If so, how should Corollary 3.3 be interpreted?

LIMITATIONS:
Yes.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-13