Intriguing Properties of Robust Classification

Bernd Prach; Christoph H. Lampert

REVIEW 3 major objections 7 minor 1 cited by

Intriguing Properties of Robust Classification

T0 review · 3 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves a 'No Free Robustness' theorem: for any dataset size there is a classification family where a perfect robust classifier exists and accurate learning is easy, yet every learner needs exponentially many samples to beat…

desk verdict Theorem 1 is a clean, genuinely new exponential lower bound for robust classification, and the paper deserves review; just soften the 'main factor' empirical claim. read the letter →

arxiv 2412.04245 v2 pith:Z55ZBJEH submitted 2024-12-05 cs.CV

Bernd Prach , Christoph H. Lampert This is my paper · ORCID

classification cs.CV

keywords adversarialrobustnesscertified1-LipschitznetworkssamplecomplexityrobustgeneralizationNoFreeprincipalcomponentanalysisdatascaling

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial robustness research has mostly asked whether accurate robust classifiers exist or whether they are too expensive to train. This paper argues the real bottleneck is data: it constructs a family of binary classification problems in which a perfectly robust classifier provably exists and an accurate non-robust classifier is trivial to learn, yet any learning algorithm needs an amount of training data exponential in the input dimension to reach even 51% robust accuracy. The construction splits each input into high-magnitude features that are hard to relate to the label and one low-magnitude feature that reveals the label but is destroyed by any perturbation. On real data, the paper reports that certified robust accuracy (a provable lower bound on robustness) rises reliably with training-set size on CIFAR-10, MNIST, and CIFAR-100, and that low-variance principal-component directions support non-robust but not robust classification. If the authors are right, improving robust classifiers is mainly a data-collection and data-generation problem, not an architecture or optimization problem.

What carries the argument

The load-bearing object is a constructed data family $\mathcal{F} = \{D_\phi : \phi \in \Phi\}$, where $\Phi$ is the set of all Boolean functions on $\{\pm1\}^{d-1}$. A sample draws robust features $x_1,\dots,x_{d-1}$ uniformly from the hypercube, sets a non-robust feature $x_d = \delta\,\phi(x_1,\dots,x_{d-1})$, and labels the point $y = \mathrm{sign}(x_d)$. The sign of $x_d$ makes non-robust learning trivial, while its small magnitude $\delta$ means a perturbation of size $\le \delta$ can zero it, so a robust classifier must reconstruct $\phi$ from the hard high-dimensional features. Averaging over the uniform prior on $\Phi$ yields the no-free-lunch lower bound. The empirical side uses certified robust accuracy for 1-Lipschitz networks via the Lipschitz-margin bound, AOL and CPL 1-Lipschitz layers as the trainable parameterizations, and PCA projections to expose low-variance directions that carry non-robust signal.

What would settle it

Train a 1-Lipschitz classifier on CIFAR-10 after rescaling the low-variance principal components (e.g., components 2049–3072) to unit magnitude: if certified robust accuracy stays near zero despite the amplification, the paper's claim that low magnitude blocks robust use of these directions would be refuted; if it jumps, the data-scaling explanation is supported.

Watch

Extended reading notes

Core claim

The paper's central discovery is Theorem 1 ('No Free Robustness'): for any dataset size $n$, with input dimension $d = \lceil \log_2 n \rceil + 7$, there is a family $\mathcal{F}$ of binary classification problems such that (1) every problem in $\mathcal{F}$ has a classifier with 100% robust accuracy, (2) a simple linear rule reading the low-magnitude feature achieves 100% ordinary test accuracy, and (3) for any learning algorithm, averaged over $\mathcal{F}$ and over training sets of size $n$, the learned classifier has robust accuracy below 51%. The obstruction is that a robust classifier cannot rely on the low-magnitude feature $x_d = \delta\phi(x_1,\dots,x_{d-1})$, since a perturbation of size $\delta$ can set it to zero; the classifier must instead learn the arbitrary Boolean function $\phi$ on the remaining $d-1$ bits, which a no-free-lunch argument shows requires essentially $2^d$ examples. The paper pairs this lower bound with a matching upper bound (Theorem 2): if any $L_\infty$-robust classifier with margin $\delta$ exists, then roughly $(1/\delta)^d$ examples suffice for a 1-nearest-neighbor rule to achieve 99% robust accuracy. Empirically, the paper shows on CIFAR-10 that doubling the training set raises certified robust accuracy by about 5%, that the trend extends to diffusion-generated data, and that projecting CIFAR-10 onto principal components 513–3072, which hold about 2% of the variance, still allows 85% non-robust test accuracy while robust training on that subspace fails.

Load-bearing premise

The sweeping conclusion that training-data size, not architecture or optimization, governs robust performance on real images rests on the assumption that the low-magnitude principal-component directions found in CIFAR-10 cause the robust generalization gap rather than merely correlating with it.

Editorial extensions

If this is right

Doubling the training set reliably raises certified robust accuracy by about 5% on CIFAR-10, and the effect continues on MNIST, CIFAR-100, and with up to one million diffusion-generated images, so robustness comparisons should report and control for dataset size.
CIFAR-10 contains linear subspaces with tiny variance that are nevertheless useful for non-robust classification — principal components 513–3072 alone give 85% test accuracy — so robust classifiers are cut off from real predictive signal, not just from noise.
A single 1-Lipschitz architecture can be trained to 93.2% ordinary accuracy or to 61.7% certified robust accuracy by changing only the loss function, and 1-Lipschitz models can robustly overfit the training set, showing that architecture capacity is not the current bottleneck.
Scaling up compute alone yields diminishing returns on certified robust accuracy, while scaling up data keeps improving it, so future certified-robustness gains should come primarily from more or better training data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural test of the causal story the paper does not run: rescale CIFAR-10's tail principal components (e.g., 2049–3072) to unit magnitude before robust training; if certified robust accuracy jumps, low magnitude is the operative blocker, and if it stays near zero, the PCA findings are correlational.
The authors' estimate of CIFAR-10's intrinsic dimension, $d^* \approx 28$, implies around $10^{31}$ examples would be needed for a 1-nearest-neighbor classifier to be robust at unit distance, which suggests raw data collection alone cannot close the robustness gap and feature amplification or representation learning will be needed.
If dataset size is the dominant factor, then comparisons between robust-training methods are only meaningful at matched training-set sizes; otherwise reported gains may reflect extra data rather than algorithmic improvements.
The construction offers a diagnostic for other datasets: measure how much non-robust accuracy survives in low-variance linear subspaces; datasets with high such accuracy should exhibit the same data-hungry robustness scaling as CIFAR-10.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: Theorem 1 is a genuinely new and clean No-Free-Lunch-style result, and the paper deserves serious referee time. But the headline empirical claim—that dataset size is the main factor—is stated more strongly than the evidence supports, and the accepted version should soften it.

What's new: Schmidt et al. showed a polynomial sample-complexity gap for robust vs standard classification on Gaussians. Prach and Lampert construct a family of distributions where any learner needs 2^d examples to get 51% robust accuracy, while a perfect robust classifier exists and a simple linear classifier gets 100% standard accuracy. The construction is simple: a low-magnitude feature perfectly predicts the label, but a perturbation of size δ kills it; the robust features are a random Boolean function hard to learn from n samples. The proof is short and I checked the averaging step; it's sound. Theorem 2 gives a matching exponential upper bound via a covering argument for 1-NN, also standard and correct. That's a real contribution: the exponential gap was not in the prior work they cite.

Empirically, the paper does useful controlled experiments. They hold compute fixed, show that compute alone saturates, that 1-Lipschitz models can robustly overfit the training set, and that the same architecture can reach 93% accuracy or 61.7% CRA depending only on the loss. That rules out capacity and architecture as the current bottleneck. The PCA experiments show there are low-variance directions in CIFAR-10 that support 85% standard accuracy but only 9% robust accuracy—a nice existence proof consistent with the theory.

Soft spots, in proportion. The abstract says 'the amount of training data is the main factor determining robust performance.' The experiments show data scaling helps a lot, compute saturates, and capacity/architecture don't explain the gap. But all robust numbers are certified robust accuracy (CRA), a lower bound on true robust accuracy. If the CRA-to-true-robust gap shrinks as the dataset grows, the scaling curve overstates the role of data. They never measure attack-based robust accuracy. Also, the PCA results are correlational: adding low-variance PCs to the high-variance ones moves CRA from 31% to 35%, and removing them from full data barely changes anything (61% to 62%), so the story that these directions are what makes robust learning data-hungry is not yet demonstrated. And there are no error bars on the scaling curves. None of this sinks the theory, but the 'main factor' language needs to be tempered to something like 'data-limited under current certified-training methods.'

Who's it for: anyone working on certified robustness or robust generalization. Cite Theorem 1 in related work. Send it to review; it will improve with a revision that softens the empirical claims and preferably reports one attack-based robust accuracy check on a subset of the test set.

Referee Report

3 major / 7 minor

Summary. The paper studies why robust classifiers generalize poorly. It proves a 'No Free Robustness' theorem (Theorem 1) constructing, for every dataset size n, a family of binary classification problems over d = O(log n) dimensions in which a perfectly robust classifier exists and a trivial linear classifier achieves 100% standard accuracy, yet any learning algorithm requires a sample size exponential in d to obtain better-than-chance robust accuracy. It also proves an upper bound (Theorem 2) for L-infinity-robust learning via 1-nearest-neighbor classification with n = O((1/delta)^d) samples. Empirically, the paper reports that on MNIST, CIFAR-10, and CIFAR-100 the certified robust accuracy of 1-Lipschitz models grows roughly linearly in the logarithm of the training-set size, that low-variance principal components support non-robust but not robust classification, that 1-Lipschitz architectures can robustly overfit the training set, and that the same architecture can reach either high accuracy or high certified robustness depending on the loss function. The paper is accompanied by code.

Significance. If the results hold, the paper makes a valuable contribution by cleanly separating the sample complexity of robust and non-robust learning and by giving a concrete counterexample to the intuition that existence of a robust classifier plus easy standard learning implies easy robust learning. The proofs of Theorems 1 and 2 are explicit and checkable: the averaging over the uniform ensemble of Boolean functions in Theorem 1 is a standard no-free-lunch argument, and the covering argument in Theorem 2 is straightforward. The empirical study is broad and controls for compute, capacity, and architecture. The main weakness is that the headline empirical conclusion is based on certified robust accuracy, a lower bound, rather than on attack-based robust accuracy, and that the causal role of low-variance principal components is asserted rather than demonstrated. These issues are fixable and do not undermine the theoretical core, but they do affect the strength of the paper's central empirical claim.

major comments (3)

[Section 3, Theorem 1] Theorem 1 as stated does not quantify the adversarial radius epsilon even though robust accuracy in Eq. (2) depends on epsilon. The proof's lower bound uses an attack that sets the non-robust feature x_d to 0, which has norm delta; for any epsilon < delta the classifier f(x) = sign(x_d) would itself be 100% robust on the constructed distributions, contradicting property 3. The theorem should state explicitly that the robust accuracy statements hold for epsilon = delta (or for every epsilon >= delta), where delta is the feature magnitude chosen in the construction. Without this quantifier, the formal statement is incomplete.
[Section 5.1 and Abstract] The headline empirical claim that "the amount of training data is the main factor determining the robust performance" is supported only by certified robust accuracy (CRA), a lower bound on the true robust accuracy defined in Eq. (2). All scaling curves in Figures 1, 2, and 6 report CRA for 1-Lipschitz models or randomized-smoothing estimates; no attack-based robust accuracy (e.g., PGD or AutoAttack) is reported for the same model checkpoints. If the gap between CRA and true robust accuracy changes with dataset size, the scaling behavior in Figure 1 could overstate the role of dataset size. The conclusion should either be restricted to certified robust accuracy or supplemented by empirical robustness measurements.
[Section 5.2, Table 1] The PCA experiments are correlational and do not establish that low-magnitude directions cause the data-scaling gap. Table 1 shows that adding PCs 513-3072 to PCs 1-16 raises test CRA only from 31% to 35%, while it raises test accuracy from 43% to 86%; conversely, removing the low-variance PCs from the full set changes test CRA only from 62% to 61% (1-3072 vs 1-512). These results are consistent with the presence of useful non-robust features, but they do not demonstrate that these directions are the mechanism behind the robust generalization gap. The sentence in Section 5.2 claiming that "CIFAR-10 as a real dataset shares some characteristics with the hypercube example" should be softened, or an intervention experiment should be provided.

minor comments (7)

[Section 3, Eq. (10)] The notation L(Xr, phi(Xr))(x~r) is ambiguous; the learner's training set S contains the full examples (x, y) with the non-robust feature x_d = delta * phi(x_r), not just (Xr, phi(Xr)). Please clarify the shorthand.
[Section 5.1] The statement that "doubling the size of the dataset seems to reliably increase the certified robust accuracy by about 5%" is not directly readable from Figures 1 and 2, whose training sizes are spaced by factors of 4; please state whether the 5% figure comes from a fitted slope or from additional dataset sizes.
[Section 9.1] "Doubling the dataset size improves the performance less and less" should read "doubling the compute" or "increasing the number of epochs", since this subsection varies compute while keeping the dataset size fixed.
[Section 5.2] "which no robust classifier is not able to exploit" contains a double negative and should be corrected to "which no robust classifier is able to exploit."
[Section 7] "We just currently fail do both (robust fitting and generalizing) at the same." contains typos; it should read "fail to do both ... at the same time."
[Section 12] "for come value c" should be "for some value c", and "the nnt training example" should be "the n-th training example."
[Section 8, Theorem 2] The remark that L2 robustness might require O(c^d d^{d/2}) samples is stated without proof or reference; please either provide a derivation, cite a source, or label it as a conjecture.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; Theorem 1 is an explicit construction, and the empirical scaling/feature claims are direct measurements rather than fitted inputs.

full rationale

The paper's central theoretical result (Theorem 1) is proven by an explicit construction of a family of distributions over the hypercube, with the lower bound following from a standard no-free-lunch counting argument. No fitted parameter, learned quantity, or prior result of the authors is used to define the target statement; the exponential-in-dimension lower bound is derived directly from the size of the function class and the perturbation geometry. Theorem 2 is similarly self-contained, using a covering/1-nearest-neighbor argument. The empirical sections report measured certified robust accuracy of trained models on subsampled datasets, with compute held constant by scaling epochs; there is no fitted parameter that is later renamed as a prediction. The PCA analysis in Section 5.2 is correlational, but the paper does not present it as an intervention establishing causation; it directly measures that low-variance principal components support non-robust accuracy and not certified robust accuracy. The use of AOL, CPL, and the 1-Lipschitz ConvNet from the authors' prior work is standard tooling and is not load-bearing for the robustness-scaling conclusion; those are publicly available, code-reproduced methods whose correctness is not equivalent to the paper's claims. The 'linear-log scaling' is presented as an observed pattern with explicitly tentative intuitions, not as a fitted law used to predict robustness. Therefore, no circular step can be exhibited by quoting the paper's equations or derivations. The main scientific risk is an empirical overreach from certified-accuracy scaling and correlational PCA evidence to a general 'main factor' claim, but that is a validity concern, not a circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The core theorem relies only on its explicit construction and standard probabilistic arguments; no fitted parameters are used to establish the exponential gap. The only empirical free parameter, d*, is auxiliary. No new physical or conceptual entities are postulated.

free parameters (2)

delta (non-robust feature magnitude) = arbitrary small positive scalar
The constructed family F sets x_d = delta * phi(...); the lower bound holds for any delta > 0 as long as the perturbation radius epsilon >= delta, so it is a construction parameter, not a fitted number.
d* (estimated intrinsic dimension) = approximately 28
Estimated from the slope of nearest-neighbor distance versus log dataset size on CIFAR-10 (Section 12); used only in the aside about 1-NN data requirements, not in the main claim.

assumptions (3)

ad hoc to paper Uniform distribution over all Boolean functions Phi in Theorem 1
The lower bound averages phi uniformly over all Boolean functions on {+1,-1}^{d-1}; this makes unseen function values independent of the training sample. It is a worst-case construction, not a model of natural data.
domain assumption Existence of an L-infinity robust classifier with margin delta (Theorem 2)
The upper bound assumes a robust classifier exists and is L-infinity robust with margin delta; the paper notes that an L2-robust classifier would require many more samples.
domain assumption Intrinsic dimension scaling p ~ c * r^{d*} (Section 12)
Used to explain the linear-log scaling of certified robust accuracy with dataset size and to estimate d* ~ 28; this is a heuristic model, not proven.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Intriguing Properties of Robust Classification." pith.science (2026). https://pith.science/paper/Z55ZBJEH

@misc{pith2026241204245,
  author       = {Pith},
  title        = {Pith review of: Intriguing Properties of Robust Classification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z55ZBJEH}},
  note         = {Machine review of arXiv:2412.04245}
}

read the original abstract

Despite extensive research since the community learned about adversarial examples 10 years ago, we still do not know how to train high-accuracy classifiers that are guaranteed to be robust to small perturbations of their inputs. Previous works often argued that this might be because no classifier exists that is robust and accurate at the same time. However, in computer vision this assumption does not match reality where humans are usually accurate and robust on most tasks of interest. We offer an alternative explanation and show that in certain settings robust generalization is only possible with unrealistically large amounts of data. Specifically, we find a setting where a robust classifier exists, it is easy to learn an accurate classifier, yet it requires an exponential amount of data to learn a robust classifier. Based on this theoretical result, we evaluate the influence of the amount of training data on datasets such as CIFAR-10. Our findings indicate that the amount of training data is the main factor determining the robust performance. Furthermore we show that there are low magnitude directions in the data which are useful for non-robust generalization but are not available for robust classifiers. We provide code at https://github.com/berndprach/IntriguingProperties.

Figures

Figures reproduced from arXiv: 2412.04245 by the authors.

**Figure 3.** Performance on different subsets of the principal com [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

**Figure 4.** We can robustly overfit the CIFAR-10 training set with [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Figures from the paper (6 more)

**Figure 5.** Figure 5: Scaling up the compute. 9.1. Scaling up compute First we explore the question of whether increasing the amount of compute alone can have a positive effect similar to the one we observed when increasing the size of the dataset. The answer seems to be no. We analyze for…

**Figure 6.** Figure 6: Scaling the size of the training data up by using addi [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

**Figure 7.** Figure 7: Performance on different subsets of the principal com [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

**Figure 8.** Figure 8: Performance of models when projected to a subset of [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

**Figure 9.** Figure 9: The same model can reach good accuracy as well as [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

**Figure 10.** Figure 10: The distance to the nearest neighbor scales about lin [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Concept-based Visual Counterfactual Explanations with Diffusion Models
cs.AI 2026-05 conditional novelty 5.0 of 10

C-VCE embeds a concept-bottleneck classifier inside a diffusion generator so counterfactual edits are steered by interpretable attributes and a gradient mask, beating L-DVCE on proximity and realism but not on flip ra...

Reference graph

Works this paper leans on

48 extracted references · 47 canonical work pages · cited by 1 Pith paper

[1]

Raising the Bar for Certified Adversarial Robustness with Diffusion Models

Thomas Altstidl, David Dobre, Bj ¨orn Eskofier, Gauthier Gidel, and Leo Schwinn. Raising the bar for certified ad- versarial robustness with diffusion models. arXiv preprint arXiv:2305.10388, 2023. 2, 5

work page Pith review arXiv 2023
[2]

Sorting out Lip- schitz function approximation

Cem Anil, James Lucas, and Roger Grosse. Sorting out Lip- schitz function approximation. In International Conference on Machine Learning (ICML), 2019. 4

work page 2019
[3]

Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura

Brian R. Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura. Adversarial robustness limits via scaling-law and human-alignment studies. In 2nd Workshop on Advancing Neural Network Training: Compu- tational Efficiency, Scalability, and Resource Optimization (WANT@ ICML 2024), 2024. 8

work page 2024
[4]

Pay attention to your loss: understanding misconceptions about Lipschitz neural networks

Louis B ´ethune, Thibaut Boissin, Mathieu Serrurier, Franck Mamalet, Corentin Friedrich, and Alberto Gonzalez Sanz. Pay attention to your loss: understanding misconceptions about Lipschitz neural networks. Conference on Neural In- formation Processing Systems (NeurIPS), 2022. 8

work page 2022
[5]

Lower bounds on adversarial robustness from optimal trans- port

Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. Lower bounds on adversarial robustness from optimal trans- port. Conference on Neural Information Processing Systems (NeurIPS), 2019. 7

work page 2019
[6]

Sample complexity of robust linear classification on sepa- rated data

Robi Bhattacharjee, Somesh Jha, and Kamalika Chaudhuri. Sample complexity of robust linear classification on sepa- rated data. In International Conference on Machine Learn- ing (ICML), 2021. 8

work page 2021
[7]

Adversarial examples from computational con- straints

S ´ebastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razen- shteyn. Adversarial examples from computational con- straints. In International Conference on Machine Learning (ICML), 2019. 2, 8

work page 2019
[8]

A law of robustness for two-layers neural networks

S ´ebastien Bubeck, Yuanzhi Li, and Dheeraj M Nagaraj. A law of robustness for two-layers neural networks. In Confer- ence on Learning Theorey (COLT), 2021. 8

work page 2021

Show all 48 references

[9]

Parseval networks: Improv- ing robustness to adversarial examples

Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improv- ing robustness to adversarial examples. InInternational Con- ference on Machine Learning (ICML), 2017. 1

2017
[10]

Certified adversarial robustness via randomized smoothing

Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Inter- national Conference on Machine Learning (ICML), 2019. 1, 4

2019
[11]

Sharp sta- tistical guaratees for adversarially robust gaussian classifi- cation

Chen Dan, Yuting Wei, and Pradeep Ravikumar. Sharp sta- tistical guaratees for adversarially robust gaussian classifi- cation. In International Conference on Machine Learning (ICML), 2020. 7

2020
[12]

Computational limitations in robust classification and win-win results

Akshay Degwekar, Preetum Nakkiran, and Vinod Vaikun- tanathan. Computational limitations in robust classification and win-win results. In Conference on Learning Theorey (COLT), 2019. 2, 8

2019
[13]

Limitations of adversarial robust- ness: strong no free lunch theorem

Elvis Dohmatob. Limitations of adversarial robust- ness: strong no free lunch theorem. arXiv preprint arXiv:1810.04065, 2018. 8

2018 arXiv
[14]

Analy- sis of classifiers’ robustness to adversarial perturbations.Ma- chine Learning, 2018

Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analy- sis of classifiers’ robustness to adversarial perturbations.Ma- chine Learning, 2018. 2, 8

2018
[15]

Explaining and harnessing adversarial examples

Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Inter- national Conference on Learning Representations (ICLR) ,
[16]

Improving robustness using generated data

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Flo- rian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Conference on Neural Information Processing Systems (NeurIPS), 2021. 2, 5

2021
[17]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pattern Recognition (CVPR), 2016. 4

2016
[18]

Unlocking deterministic robustness certification on Imagenet

Kai Hu, Andy Zou, Zifan Wang, Klas Leino, and Matt Fredrikson. Unlocking deterministic robustness certification on Imagenet. Conference on Neural Information Processing Systems (NeurIPS), 2023. 2, 5

2023
[19]

A recipe for improved certifiable robustness

Kai Hu, Klas Leino, Zifan Wang, and Matt Fredrikson. A recipe for improved certifiable robustness. In International Conference on Learning Representations (ICLR), 2024. 2, 5

2024
[20]

Adversar- ial examples are not bugs, they are features

Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversar- ial examples are not bugs, they are features. Conference on Neural Information Processing Systems (NeurIPS), 2019. 8

2019
[21]

Batch normalization: Accelerating deep network training by reducing internal co- variate shift

Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal co- variate shift. In International Conference on Machine Learn- ing (ICML), 2015. 4

2015
[22]

Matt Jordan and Alexandros G. Dimakis. Exactly computing the local Lipschitz constant of ReLu networks. In Confer- ence on Neural Information Processing Systems (NeurIPS) ,
[23]

Why robust generalization in deep learning is diffi- cult: Perspective of expressive power

Binghui Li, Jikai Jin, Han Zhong, John Hopcroft, and Liwei Wang. Why robust generalization in deep learning is diffi- cult: Perspective of expressive power. Conference on Neural Information Processing Systems (NeurIPS), 2022. 8

2022
[24]

A dynamical system perspective for Lipschitz neural networks

Laurent Meunier, Blaise J Delattre, Alexandre Araujo, and Alexandre Allauzen. A dynamical system perspective for Lipschitz neural networks. In International Conference on Machine Learning (ICML), 2022. 3, 4

2022
[25]

The curious case of adversarially robust models: More data can help, double descend, or hurt generalization

Yifei Min, Lin Chen, and Amin Karbasi. The curious case of adversarially robust models: More data can help, double descend, or hurt generalization. In Uncertainty in Artificial Intelligence (UAI), 2021. 8

2021
[26]

Adversarial robustness may be at odds with simplicity

Preetum Nakkiran. Adversarial robustness may be at odds with simplicity. arXiv preprint arXiv:1901.00532, 2019. 2, 8

1901 arXiv
[27]

Karl Pearson. LIII. On lines and planes of closest fit to sys- tems of points in space. The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science, 1901. 6

1901
[28]

SimpleConvNet

Bernd Prach. SimpleConvNet. https://github.com/ berndprach/SimpleConvNet, 2024. 4, 5

2024
[29]

Bernd Prach and Christoph H. Lampert. Almost-orthogonal layers for efficient general-purpose Lipschitz networks. In European Conference on Computer Vision (ECCV), 2022. 3, 4 9

2022
[30]

Bernd Prach and Christoph H. Lampert. 1-Lipschitz neu- ral networks are more expressive with N-activations. arXiv preprint arXiv:2311.06103, 2023. 8

2023 arXiv
[31]

Bernd Prach, Fabio Brau, Giorgio Buttazzo, and Christoph H. Lampert. 1-Lipschitz layers compared: Memory speed and certifiable robustness. In Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 1, 3, 4

2024
[32]

Adversarial training can hurt gen- eralization

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Adversarial training can hurt gen- eralization. In ICML Workshop on Identifying and Under- standing Deep Learning Phenomena, 2019. 8

2019
[33]

Understanding and mitigating the tradeoff between robustness and accuracy

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. In International Conference on Machine Learning (ICML), 2020. 8

2020
[34]

Adversarially robust gener- alization requires more data

Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust gener- alization requires more data. Conference on Neural Informa- tion Processing Systems (NeurIPS), 2018. 7

2018
[35]

Understanding Machine Learning: From Theory to Algorithms

Shai Shalev-Shwartz and Shai Ben-David. Understanding Machine Learning: From Theory to Algorithms. Cambridge University Press, 2014. 3

2014
[36]

In- triguing properties of neural networks

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. In- triguing properties of neural networks. In International Con- ference on Learning Representations (ICLR), 2014. 1

2014
[37]

Robustness may be at odds with accuracy

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In International Conference on Learning Representations (ICLR), 2019. 2, 8, 4

2019
[38]

Lipschitz-margin training: Scalable certification of pertur- bation invariance for deep neural networks

Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz-margin training: Scalable certification of pertur- bation invariance for deep neural networks. Conference on Neural Information Processing Systems (NeurIPS), 2018. 2

2018
[39]

Lipschitz regularity of deep neural networks: analysis and efficient estimation

Aladin Virmaux and Kevin Scaman. Lipschitz regularity of deep neural networks: analysis and efficient estimation. In Conference on Neural Information Processing Systems (NeurIPS), 2018. 2

2018
[40]

Better diffusion models further improve adversarial training

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. InInternational Conference on Machine Learning (ICML), 2023. 2, 5

2023
[41]

94% on CIFAR-10 in 94 lines and 94 seconds

Johan Sokrates Wind. 94% on CIFAR-10 in 94 lines and 94 seconds. https://johanwind.github.io/2022/ 12/28/cifar_94.html, 2022. Accessed: 2024-11-12. 4, 5

2022
[42]

LOT: Layer-wise orthogo- nal training on improvingℓ2 certified robustness

Xiaojun Xu, Linyi Li, and Bo Li. LOT: Layer-wise orthogo- nal training on improvingℓ2 certified robustness. Conference on Neural Information Processing Systems (NeurIPS), 2022. 4

2022
[43]

Theoretically principled trade-off between robustness and accuracy

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Lau- rent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), 2019. 8 10 Intriguing Properties of Robust Classification S...

2019
[44]

Recall Theorem 2

Proof of Theorem 2 In this section we prove Theorem 2. Recall Theorem 2. Assume that there exists aL∞ robust classifier (margin δ) on data distributionD, where the data points are in [0, 1]d. Then as long as we have n ≥ 37 1 δ d training points independently sampled from D, fo...
[45]

Additional scaling law results In this section we provide additional results for Section 5.1. 1 24 100 300 1k 3k 10k 30k Training epochs 60% 70%acc Accuracy CPL ConvNet AOL MLP 24 100 300 1k 3k 10k 30k Training epochs 50% 60%CRA Certified Robust Accuracy CPL ConvNet AOL MLP Fi...
[46]

For the performance on additional subsets of prin- cipal components see Table 1 and Figure 7

Robust and non-robust features In this section we provide additional visualizations for Sec- tion 5.2. For the performance on additional subsets of prin- cipal components see Table 1 and Figure 7. In order to evaluate the capabilities of the models to over- fit the training da...
[47]

Often the architecture, layers, and the training pipeline in general is different depending on whether accuracy or robust accuracy is the goal metric

Robustness-accuracy trade-off In this final experimental section we want to explore whether it is the model architecture that prevents robust models from generalizing. Often the architecture, layers, and the training pipeline in general is different depending on whether accura...
[48]

In this section we want to explore why this might be the case

Details for linear-log behavior In Figure 1 it seems that the certified robust accuracy de- pends on the logarithm of the size of the training set almost in a linear way. In this section we want to explore why this might be the case. ConvNets: Standard 1-Lipschitz Activation R...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Raising the Bar for Certified Adversarial Robustness with Diffusion Models

Thomas Altstidl, David Dobre, Bj ¨orn Eskofier, Gauthier Gidel, and Leo Schwinn. Raising the bar for certified ad- versarial robustness with diffusion models. arXiv preprint arXiv:2305.10388, 2023. 2, 5

work page Pith review arXiv 2023

[2] [2]

Sorting out Lip- schitz function approximation

Cem Anil, James Lucas, and Roger Grosse. Sorting out Lip- schitz function approximation. In International Conference on Machine Learning (ICML), 2019. 4

work page 2019

[3] [3]

Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura

Brian R. Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura. Adversarial robustness limits via scaling-law and human-alignment studies. In 2nd Workshop on Advancing Neural Network Training: Compu- tational Efficiency, Scalability, and Resource Optimization (WANT@ ICML 2024), 2024. 8

work page 2024

[4] [4]

Pay attention to your loss: understanding misconceptions about Lipschitz neural networks

Louis B ´ethune, Thibaut Boissin, Mathieu Serrurier, Franck Mamalet, Corentin Friedrich, and Alberto Gonzalez Sanz. Pay attention to your loss: understanding misconceptions about Lipschitz neural networks. Conference on Neural In- formation Processing Systems (NeurIPS), 2022. 8

work page 2022

[5] [5]

Lower bounds on adversarial robustness from optimal trans- port

Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. Lower bounds on adversarial robustness from optimal trans- port. Conference on Neural Information Processing Systems (NeurIPS), 2019. 7

work page 2019

[6] [6]

Sample complexity of robust linear classification on sepa- rated data

Robi Bhattacharjee, Somesh Jha, and Kamalika Chaudhuri. Sample complexity of robust linear classification on sepa- rated data. In International Conference on Machine Learn- ing (ICML), 2021. 8

work page 2021

[7] [7]

Adversarial examples from computational con- straints

S ´ebastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razen- shteyn. Adversarial examples from computational con- straints. In International Conference on Machine Learning (ICML), 2019. 2, 8

work page 2019

[8] [8]

A law of robustness for two-layers neural networks

S ´ebastien Bubeck, Yuanzhi Li, and Dheeraj M Nagaraj. A law of robustness for two-layers neural networks. In Confer- ence on Learning Theorey (COLT), 2021. 8

work page 2021