Pith. sign in

REVIEW 3 major objections 6 minor 37 references

A constant-factor bound shows that requiring robustness does not change the order of the Lipschitz constant needed for smooth interpolation.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 21:10 UTC pith:TJAJZ375

load-bearing objection A correct but modest Rademacher bound is wrapped in claims — solving Bubeck–Sellke, recovering Ω(n^{1/d}), local-scale analysis — that the body does not support. the 3 major comments →

arxiv 2602.20971 v3 pith:TJAJZ375 submitted 2026-02-24 cs.LG cs.AI

Does Order Matter : Connecting The Law of Robustness to Robust Generalization

Mihir More , Aritra Das , Jaee Ponde , Himadri Mandal , Vishnu Varadarajan , Debayan Gupta This is my paper
classification cs.LG cs.AI
keywords law of robustnessrobust generalizationRademacher complexityLipschitz constantadversarial robustnessrobust interpolationoverparameterizationMNIST scaling
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper aims to settle the open problem, posed in the 2021 law-of-robustness work, of connecting robust generalization to the Lipschitz lower bound. Its main result is a comparison inequality: the Rademacher complexity of the robust squared-loss class is at most eight times that of the underlying Lipschitz function class. From this the authors conclude that the order of the Lipschitz constant required for robust interpolation is unchanged relative to standard interpolation. They also turn the robust generalization gap into a lower bound on expected Rademacher complexity and claim to recover the Ω(n^{1/d}) regime of the distribution-free law of robustness. Experiments on MNIST give an empirical Lipschitz scaling of order n^{0.16}, which is closer to the n^{1/d} prediction than to the n^{0.5} scaling of the original isoperimetric law.

Core claim

For every sample, the empirical Rademacher complexity of the robust loss class is bounded by eight times the Rademacher complexity of the function class: R(ℓρ ∘ B_L ∘ S) ≤ 8R(B_L ∘ S). The proof constructs, for each L-Lipschitz function, its local extremal envelopes f+ and f-, which remain L-Lipschitz, and observes that the robust squared loss at any point is the maximum of the two squared deviations (f+(x)-y)^2 and (f-(x)-y)^2. A lemma bounding the Rademacher complexity of coordinatewise maxima by the sum of the two complexities, together with a contraction lemma that reduces the squared loss to the prediction values, yields the factor 8. The paper asserts that this preserves the order of t

What carries the argument

Local extremal envelopes: for an L-Lipschitz function f, the supremum and infimum over the ρ-ball define new functions f+ and f- that remain L-Lipschitz. The robust squared loss at (x,y) equals the maximum of (f+(x)-y)^2 and (f-(x)-y)^2. Combined with a coordinatewise-maximum Rademacher bound R(A∨B)≤R(A)+R(B) and a Rademacher contraction lemma for the squared loss, this yields the factor-8 comparison R(ℓρ∘B_L∘S)≤8R(B_L∘S).

Load-bearing premise

The claimed recovery of the Ω(n^{1/d}) lower bound and the link to robust generalization rest on importing Eq. (1) of Wu et al. as an external input (and on an undefined parameter σ in Eq. (12)); if that imported bound does not apply to the robust loss class as used here, the paper's central claim that robustness does not change the order of the Lipschitz constant would reduce to the standalone factor-8 inequality.

What would settle it

For a function class and sample where both Rademacher complexities can be computed exactly (e.g., one-dimensional threshold or linear functions), evaluate the ratio R(ℓρ ∘ B_L ∘ S)/R(B_L ∘ S). If any sample yields a ratio greater than 8, Corollary 2 is false. As a secondary check, fill in the undefined σ in Eq. (12) and verify whether the resulting lower bound has the claimed n^{-1/d} order.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Generalization bounds for standard loss classes transfer to robust loss classes with the complexity term inflated by at most a constant factor of 8.
  • The minimal Lipschitz constant needed for robust interpolation has the same order in sample size as in the standard law of robustness, so overparameterization requirements are not worsened by more than a constant.
  • A robust generalization gap that is at least γ implies a lower bound on the expected Rademacher complexity of the robust loss class, giving a distribution-free necessary condition for robust generalization.
  • For MNIST, the empirical Lipschitz lower bound scales as n^{0.16}, far from the n^{0.5} prediction of the isoperimetric law and closer to the n^{0.1} prediction for effective dimension 10.
  • If the factor-8 comparison extends to other losses (including cross-entropy), robust generalization bounds can be obtained directly from existing standard-loss Rademacher bounds.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The local-scale claim in the abstract (order changes with ρ and √(r/n)) is not substantiated in the body; as it stands, the paper's established result is the global factor-8 bound.
  • The recovery of Ω(n^{1/d}) is not derived from the paper's own equations alone; it imports Eq. (1) of Wu et al. as an external ingredient. A reader should treat that recovery as conditional on the imported bound.
  • The empirical exponent α≈0.16 falls between the two candidate laws; if the effective dimension of MNIST were about 6, α=1/d would align with the Wu-style law, offering a testable way to discriminate between the laws.
  • The factor 8 is likely loose: one factor of 2 comes from the envelope maximum and a factor of 4 from the squared-loss contraction. A direct analysis of the robust squared loss could yield a smaller constant and sharpen the comparison.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript claims to solve the Bubeck–Sellke open problem by explicitly linking the law of robustness to robust generalization through Rademacher complexity. Section 3 introduces a robust–clean empirical gap (Lemma 1) and uses a standard Rademacher generalization bound (Eq. (10)) to lower-bound the expected Rademacher complexity of the robust loss class. Sections 4–8 develop technical tools: local extremal envelopes, a Rademacher contraction lemma, and a coordinatewise maximum bound, culminating in Corollary 2: R(ℓρ∘B_L∘S) ≤ 8R(B_L∘S). The paper asserts this recovers the Ω(n^{1/d}) regime of Wu et al. and that at a 'local scale' the Lipschitz order changes with ρ and sqrt(r/n). Experiments on MNIST fit L≈C·n^0.16·p^0.03 and compare with n^{0.5}p^{-0.5} and n^{0.1}.

Significance. If the advertised results were established, the paper would provide a significant unification of the law of robustness and robust generalization. The manuscript deserves credit for several correct and clean technical lemmas: Lemma 1, Lemma 5, Propositions 1–2, and Corollary 2 are valid; the contraction and coordinatewise-maximum arguments are standard but accurately proved. However, the central advertised claims—solving the Bubeck–Sellke problem, recovering Ω(n^{1/d}) from the paper's own derivation, and proving a local-scale transition—are not established in the body. The valid results are modest structural bounds on Rademacher complexities, and the bridge to the law of robustness relies on an undefined quantity and an imported black-box bound. The experimental study does not compensate because it tests cross-entropy-trained CNNs with an arbitrary effective dimension and a finite-sample slope, which is not the robust generalization gap of the theory.

major comments (3)
  1. [§3, Eq. (12)] The symbol σ in γ = ε − (2Lρσ + L²ρ²) is never defined. It is not the Rademacher vector introduced in Definition 3, which appears later and has the wrong role and dimensionality. If σ is intended to be sqrt(bR) from Lemma 1, it must be stated and controlled; otherwise Eq. (12) is not a meaningful lower bound. This is load-bearing for the claimed recovery of Ω(n^{1/d}).
  2. [§3, Eqs. (10)–(12)] The recovery of Ω(n^{1/d}) is asserted, not derived. The paper imports Wu et al.'s Eq. (1) as a black box, substitutes a lower bound for T−R, and then states that the Ω(n^{1/d}) regime is recovered, but no algebra shows how this follows from Corollary 2 or Lemma 1. Eq. (11) is merely the contrapositive of a standard generalization bound; it cannot by itself produce a Lipschitz lower bound unless the gap γ is shown to be large and the Rademacher object is related to a covering or parameter-counting quantity. This missing derivation is the central claim of the abstract.
  3. [Abstract and §4 (local-scale claim)] The abstract claims that at the local scale (subsets of functions with small empirical error) the order of the Lipschitz bound changes with ρ and sqrt(r/n). No such result appears in the body. Section 4 defines local extremal envelopes but never analyzes localized function classes, never defines a local Rademacher complexity, and never introduces a term sqrt(r/n). The claimed local-scale transition is absent, not merely underproved.
minor comments (6)
  1. [Abstract] Bubeck and Sellke's name is misspelled as 'Selke' in the abstract; the correct spelling appears elsewhere.
  2. [§2.3] Typographical issues: 'Morever' should be 'Moreover', and 'why why' appears redundantly.
  3. [§9.5.3] 'Comparsion' should be 'Comparison'.
  4. [References] Fazlyab et al. 2019 and Fazlyab et al. 2023 refer to the same arXiv paper but are listed as separate references.
  5. [§9.4.1] The empirical Lipschitz lower bound is computed over training pairs only and is called a lower bound on the global Lipschitz constant. This is true but very weak; the authors should clarify that it is not a proxy for the global quantity used in the theory.
  6. [§9.5.1] The text says there are 10 estimates of α and 10 of β, but several configurations are dropped because Lemp=0; the averaging method should be described with the actual number of surviving points.

Circularity Check

2 steps flagged

Central 'recovery' of Wu et al.'s Ω(n^{1/d}) law is imported via Eq. (1), not derived; local-scale claim absent; factor-8 bound is independent.

specific steps
  1. self definitional [Abstract; §1 Contribution 2; §3 Eq. (10)]
    "Our bounds recover the Ω(n^{1/d}) regime of (Wu et al., 2023) ... Applying Eq.(1) of (Wu et al., 2023) to the bounded loss ℓρ yields that, with probability at least 1−δconf over S∼D^n, for all f in the class, T−R≤2E_{S′∼D^n}[R(ℓρ ◦ F ◦ S′)] + aρ sqrt(2 ln(2/δconf)/n). (10)"

    The paper's advertised solution to the Bubeck–Sellke open problem and its 'recovery' of Wu et al.'s Ω(n^{1/d}) Lipschitz bound is obtained by directly importing Eq. (1) of Wu et al. as the tool that produces Eq. (10). No derivation connects the paper's own Corollary 2, R(ℓρ ◦ B_L ◦ S) ≤ 8R(B_L ◦ S), to L = Ω(n^{1/d}). The claimed recovery is therefore the input bound restated, not a consequence of the paper's derivation chain.

  2. other [§3 Eqs. (11)–(12)]
    "Consequently, whenever T−R≥γ for some γ>0, E_{S′∼D^n}[R(ℓρ ◦ F ◦ S′)] ≥ γ/2 − aρ/2 sqrt(2 ln(2/δconf)/n). (11) In particular, under the overfitting Assumption of (Bubeck and Sellke, 2021), we have γ=ε−(2Lρσ+L^2ρ^2), so ... (12)"

    Equation (11) is the logical contrapositive of the imported upper bound in Eq. (10); it adds no independent content. Equation (12) then substitutes a value of γ involving σ, which is never defined in the manuscript (later σ denotes a Rademacher vector), and the paper never shows how this yields the asserted Lipschitz order. The 'lower bound' is thus prescribed by the assumed gap and the imported Wu et al. bound, rather than derived from the paper's own Rademacher analysis.

full rationale

The paper does contain a self-contained and valid technical core: Lemma 1, Lemma 5, Theorem 1, Proposition 1, Proposition 2, and Corollary 2 establish R(ℓρ ◦ B_L ◦ S) ≤ 8R(B_L ◦ S) by elementary contraction and coordinatewise-max arguments. That part is not circular. However, the abstract and introduction claim far more: that the paper solves the Bubeck–Sellke open problem, recovers Wu et al.'s Ω(n^{1/d}) regime, and proves that robust generalization does not change the order of the Lipschitz constant. In Section 3, the key step is 'Applying Eq.(1) of (Wu et al., 2023)' to obtain Eq. (10); the purported lower bound in Eq. (11) is just the contrapositive, and Eq. (12) uses an undefined σ. No chain of inequalities from Corollary 2 to L = Ω(n^{1/d}) is provided. Abstract claim (ii), about the local-scale order changing with ρ and √(r/n), is also absent from the formal sections: Section 4 defines local extremal envelopes but never analyzes subsets of functions with small empirical error. These are the load-bearing claims of the paper, and they reduce to the imported Wu et al. bound rather than to an independent derivation. Because the factor-8 Rademacher bound is genuinely independent and remains valid even if the 'recovery' is set aside, the circularity is partial rather than total.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

The central claim rests on two external bounds (Wu et al. Eq 1 and the Ω(n^{1/d}) law) plus a hand-chosen effective dimension in the experiments. No new entities are postulated.

free parameters (2)
  • σ
    Appears in Eq (12) as γ = ε − (2Lρσ + L²ρ²); never defined in the paper. It appears to bound √R_hat but is not stated.
  • d (effective dimension) = 10
    Chosen by hand for MNIST, attributed to Fazlyab et al., but that reference concerns Lipschitz estimation, not intrinsic dimension. Determines the n^{1/d} comparison value (0.1).
axioms (4)
  • domain assumption Wu et al. (2023) Eq (1) Rademacher bound holds for the robust loss class
    Used in Eq (10) without proof; the paper's 'recovery' of Ω(n^{1/d}) depends on this external bound.
  • domain assumption Bubeck–Sellke (2021) overfitting assumption (γ = ε − (2Lρσ + L²ρ²))
    Imported into Eq (12) to set γ; not derived from the paper's own assumptions.
  • domain assumption Y ∈ [-1,1] and f ∈ [-1,1] almost surely
    Needed to bound the loss by a_ρ = (2+Lρ)² and to apply the 4-Lipschitz contraction in Proposition 2.
  • domain assumption Bounded-support distribution (from Wu et al.)
    The paper adopts Wu et al.'s distribution-free setting; the Ω(n^{1/d}) law is applicable only under the bounded-support assumption.

pith-pipeline@v1.3.0-alltime-deepseek · 11622 in / 19967 out tokens · 153917 ms · 2026-08-02T21:10:27.045255+00:00 · methodology

0 comments
read the original abstract

Bubeck and Selke (2021) propose the connection between the Law of Robustness and robust generalization error as an open problem. The Law of Robustness states that overparameterization is necessary for models to interpolate robustly, i.e., the interpolating function is required to be Lipschitz. Wu et al. (2023) extend this law to arbitrary data distributions, proving that the Lipschitz constant satisfies $L = \Omega(n^{1/d})$. Robust generalization, on the other hand, asks whether small robust training loss implies small robust test loss. This can be studied using statistical learning techniques such as Rademacher complexities, where a bound on the Rademacher complexity of the robust loss class implies a bound on the Lipschitzness of the function class. We use this connection to explicitly link the two for arbitrary data distributions. (i) We prove that the order of the Lipschitz bound remains the same when considering the global Rademacher complexity of robust loss classes. (ii) At the local scale, i.e., for subsets of functions with small empirical error, the order of the Lipschitz bound changes with the perturbation radius $\rho$ and the localized concentration term $\sqrt{r/n}$.

Figures

Figures reproduced from arXiv: 2602.20971 by Aritra Das, Debayan Gupta, Himadri Mandal, Jaee Ponde, Mihir More, Vishnu Varadarajan.

Figure 1
Figure 1. Figure 1: Loss curves of models chosen at random (the other loss curves can be found in our codebase). [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Lipschitz Growth vs Dataset Size (Plots chosen at random, others can be found in our codebase). [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Lipschitz Growth vs Model Parameters (Plots chosen at random, others can be found in our codebase). [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

37 extracted references · 2 canonical work pages

  1. [1]

    A universal law of robustness via isoperimetry

    S \'e bastien Bubeck and Mark Sellke. A universal law of robustness via isoperimetry. In Advances in Neural Information Processing Systems (NeurIPS), 2021. URL https://arxiv.org/abs/2105.12806

    Pith/arXiv arXiv 2021

  2. [2]

    S \'e bastien Bubeck, Yuanzhi Li, and Dheeraj M. Nagaraj. A law of robustness for two-layer neural networks. In Conference on Learning Theory (COLT), volume 134 of Proceedings of Machine Learning Research, pages 804--820, 2021. URL https://proceedings.mlr.press/v134/bubeck21a.html

    2021

  3. [3]

    Duchi, and Percy Liang

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C. Duchi, and Percy Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems (NeurIPS), 2019. URL https://arxiv.org/abs/1905.13736

    Pith/arXiv arXiv 2019

  4. [4]

    Robust overfitting may be mitigated by properly learned smoothening

    Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations (ICLR), 2021. URL https://openreview.net/forum?id=qZzy5urZw9

    2021

  5. [5]

    Stability and generalization in free adversarial training

    Xiwei Cheng, Kexin Fu, and Farzan Farnia. Stability and generalization in free adversarial training. Transactions on Machine Learning Research (TMLR), 2024. URL https://openreview.net/pdf?id=62BN6qLQzf

    2024

  6. [6]

    Dauphin, and Nicolas Usunier

    Moustapha Ciss \'e , Piotr Bojanowski, Edouard Grave, Yann N. Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International Conference on Machine Learning (ICML), 2017. URL https://proceedings.mlr.press/v70/cisse17a.html

    2017

  7. [7]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning (ICML), 2020. URL https://proceedings.mlr.press/v119/croce20b.html

    2020

  8. [8]

    A direct proof of a unified law of robustness for bregman divergence losses

    Santanu Das, Jatin Batra, and Piyush Srivastava. A direct proof of a unified law of robustness for bregman divergence losses. IEEE Transactions on Information Theory, 71 0 (8): 0 6340--6352, 2025. URL https://arxiv.org/abs/2405.16639

    arXiv 2025

  9. [9]

    The mnist database of handwritten digit images for machine learning research [best of the web]

    Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web]. IEEE Signal Processing Magazine, 29 0 (6): 0 141--142, 2012. doi:10.1109/MSP.2012.2211477

    arXiv 2012

  10. [11]

    Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Manfred Morari, and George J. Pappas. Efficient and accurate estimation of lipschitz constants for deep neural networks, 2023. URL https://arxiv.org/abs/1906.04893

    Pith/arXiv arXiv 2023

  11. [13]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. URL https://arxiv.org/abs/1412.6572

    Pith/arXiv arXiv 2015

  12. [14]

    The lipschitz-variance-margin tradeoff for enhanced randomized smoothing

    Chin-Wei Huang, Milad Aghajohari, Joey Bose, Prakash Panangaden, and Aaron Courville. The lipschitz-variance-margin tradeoff for enhanced randomized smoothing. In International Conference on Learning Representations (ICLR), 2024. URL https://proceedings.iclr.cc/paper_files/paper/2024/file/123d3e814e257e0781e5d328232ead9b-Paper-Conference.pdf

    2024

  13. [15]

    A law of robustness for weight-bounded neural networks

    Hisham Husain and Borja Balle. A law of robustness for weight-bounded neural networks. arXiv preprint arXiv:2102.08093, 2021. URL https://arxiv.org/abs/2102.08093

    Pith/arXiv arXiv 2021

  14. [16]

    Fantastic robustness measures: The secrets of robust generalization

    Hoki Kim, Jinseong Park, Yujin Choi, and Jaewook Lee. Fantastic robustness measures: The secrets of robust generalization. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 48793--48818. Curran Associates, Inc., 2023. URL https://proceedings.neurips.cc/paper...

    2023

  15. [17]

    Deep learning

    Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning. nature, 521 0 (7553): 0 436, 2015

    2015

  16. [18]

    On the clean generalization and robust overfitting in adversarial training from two theoretical views: Representation complexity and training dynamics

    Binghui Li and Yuanzhi Li. On the clean generalization and robust overfitting in adversarial training from two theoretical views: Representation complexity and training dynamics. In International Conference on Machine Learning (ICML), 2025. URL https://icml.cc/virtual/2025/poster/44184

    2025

  17. [19]

    Hopcroft, and Liwei Wang

    Binghui Li, Jikai Jin, Han Zhong, John E. Hopcroft, and Liwei Wang. Why robust generalization in deep learning is difficult: Perspective of expressive power. In Advances in Neural Information Processing Systems (NeurIPS), 2022. URL https://openreview.net/forum?id=Z26xiZkbjgE

    2022

  18. [20]

    Measuring the intrinsic dimension of objective landscapes, 2018

    Chunyuan Li, Heerad Farkhoor, Rosanne Liu, and Jason Yosinski. Measuring the intrinsic dimension of objective landscapes, 2018. URL https://arxiv.org/abs/1804.08838

    Pith/arXiv arXiv 2018

  19. [21]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018. URL https://arxiv.org/abs/1706.06083

    Pith/arXiv arXiv 2018

  20. [22]

    Chris Mingard, Henry Rees, Guillermo Valle-Pérez, and Ard A. Louis. Deep neural networks have an inbuilt occam’s razor. Nature Communications, 16 0 (1), January 2025. ISSN 2041-1723. doi:10.1038/s41467-024-54813-x. URL http://dx.doi.org/10.1038/s41467-024-54813-x

    work page doi:10.1038/s41467-024-54813-x 2025

  21. [23]

    Deep double descent: Where bigger models and more data hurt, 2019

    Preetum Nakkiran, Gal Kaplun, Yamini Bansal, Tristan Yang, Boaz Barak, and Ilya Sutskever. Deep double descent: Where bigger models and more data hurt, 2019. URL https://arxiv.org/abs/1912.02292

    Pith/arXiv arXiv 2019

  22. [24]

    Zico Kolter

    Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning (ICML), volume 119 of Proceedings of Machine Learning Research, pages 8093--8104, 2020. URL https://proceedings.mlr.press/v119/rice20a.html

    2020

  23. [25]

    Lipschitz regularity of deep neural networks: analysis and efficient estimation, 2019

    Kevin Scaman and Aladin Virmaux. Lipschitz regularity of deep neural networks: analysis and efficient estimation, 2019. URL https://arxiv.org/abs/1805.10965

    Pith/arXiv arXiv 2019

  24. [26]

    Adversarially robust generalization requires more data

    Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander M a dry. Adversarially robust generalization requires more data. In Advances in Neural Information Processing Systems (NeurIPS), 2018. URL https://arxiv.org/abs/1804.11285

    Pith/arXiv arXiv 2018

  25. [27]

    Davis, Gavin Taylor, and Tom Goldstein

    Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free!, 2019. URL https://arxiv.org/abs/1904.12843

    Pith/arXiv arXiv 2019

  26. [28]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. URL https://arxiv.org/abs/1312.6199

    Pith/arXiv arXiv 2013

  27. [29]

    Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks

    Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2018. URL https://papers.nips.cc/paper_files/paper/2018/hash/13d7a8f4c7e1d60d1b6c7f281f978f62-Abstract.html

    2018

  28. [30]

    Evaluating the robustness of neural networks: An extreme value theory approach

    Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. Evaluating the robustness of neural networks: An extreme value theory approach. In International Conference on Learning Representations (ICLR), 2018. URL https://arxiv.org/abs/1801.10578

    Pith/arXiv arXiv 2018

  29. [31]

    A law of robustness beyond isoperimetry

    Yihan Wu, Heng Huang, and Hongyang Zhang. A law of robustness beyond isoperimetry. In International Conference on Machine Learning (ICML), volume 202 of Proceedings of Machine Learning Research, pages 37439--37455, 2023. URL https://proceedings.mlr.press/v202/wu23g.html

    2023

  30. [32]

    Rademacher complexity for adversarially robust generalization

    Dong Yin, Kannan Ramchandran, and Peter Bartlett. Rademacher complexity for adversarially robust generalization. In International Conference on Machine Learning (ICML), volume 97 of Proceedings of Machine Learning Research, pages 7085--7094, 2019. URL https://proceedings.mlr.press/v97/yin19b.html

    2019

  31. [33]

    Understanding robust overfitting of adversarial training and beyond

    Chaojian Yu, Bo Han, Li Shen, Jun Yu, Chen Gong, Mingming Gong, and Tongliang Liu. Understanding robust overfitting of adversarial training and beyond. In International Conference on Machine Learning (ICML), volume 162 of Proceedings of Machine Learning Research, 2022. URL https://proceedings.mlr.press/v162/yu22b.html

    2022

  32. [34]

    Adversarially robust generalization just requires more unlabeled data

    Runtian Zhai, Tianle Cai, Di He, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. In International Conference on Learning Representations (ICLR), 2019. URL https://openreview.net/forum?id=H1gdAC4KDB

    2019

  33. [35]

    Rethinking lipschitz neural networks and certified robustness: A boolean function perspective

    Bohang Zhang, Du Jiang, Di He, and Liwei Wang. Rethinking lipschitz neural networks and certified robustness: A boolean function perspective. In Advances in Neural Information Processing Systems (NeurIPS), 2022. URL https://arxiv.org/abs/2210.01787

    Pith/arXiv arXiv 2022

  34. [36]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), 2019. URL https://arxiv.org/abs/1901.08573

    Pith/arXiv arXiv 2019

  35. [37]

    Stability and generalization of adversarial training for shallow neural networks with smooth activation

    Kaibo Zhang, Yunjuan Wang, and Raman Arora. Stability and generalization of adversarial training for shallow neural networks with smooth activation. In Advances in Neural Information Processing Systems (NeurIPS), 2024 a . URL https://neurips.cc/virtual/2024/poster/97015

    2024

  36. [38]

    Generating less certain adversarial examples improves robust generalization

    Zhiyu Zhang, Moritz Backes, and Yang Zhang. Generating less certain adversarial examples improves robust generalization. Transactions on Machine Learning Research (TMLR), 2024 b . URL https://openreview.net/forum?id=MFPv6d9BCx

    2024

  37. [39]

    Adversarial robustness of neural networks from the perspective of lipschitz calculus: A survey

    Monty-Maximilian Z \"u hlke and Daniel Kudenko. Adversarial robustness of neural networks from the perspective of lipschitz calculus: A survey. ACM Computing Surveys, 2025. doi:10.1145/3648351. URL https://dl.acm.org/doi/10.1145/3648351

    work page doi:10.1145/3648351 2025