Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective
Adversarial Training (AT) has become arguably the state-of-the-art algorithm for extracting robust features. However, researchers recently notice that AT suffers from severe robust overfitting problems, particularly after learning rate (LR) decay. In this paper, we explain this phenomenon by viewing adversarial training as a dynamic minimax game between the model trainer and the attacker. Specifically, we analyze how LR decay breaks the balance between the minimax game by empowering the trainer with a stronger memorization ability, and show such imbalance induces robust overfitting as a result of memorizing non-robust features. We validate this understanding with extensive experiments, and provide a holistic view of robust overfitting from the dynamics of both the two game players. This understanding further inspires us to alleviate robust overfitting by rebalancing the two players by either regularizing the trainer's capacity or improving the attack strength. Experiments show that the proposed ReBalanced Adversarial Training (ReBAT) can attain good robustness and does not suffer from robust overfitting even after very long training. Code is available at https://github.com/PKU-ML/ReBAT.
Paper
Similar papers
Peer review
Summary
This paper explains the phenomenon of robust overfitting in adversarial training from a minimax game perspective. The author considers AT as a minimax game between the model trainer and the attacker, pointing out the imbalance between them leads to the network memorizing non-robust features, causing robust overfitting. Based on these explanations, the author proposes several measures to rebalance the minimax game, thereby mitigating robust overfitting and improving adversarial robustness.
Strengths
1. It is interesting to study AT from a minimax game perspective. 2. The paper proposes multiple measures to alleviate robust overfitting and enhance adversarial robustness.
Weaknesses
1. The motivation is unclear. The author's explanation of the robust overfitting process is based on some observation-driven analysis, which are difficult to be convincing. For example, the attacker injects non-robust features for misclassification, and the cause of robust overfitting is the network's memorization of non-robust features. What exactly are the false non-robust mapping and the falsely memorized non-robust features? Can the authors use the intuitive and precise statement to explain the mechanism of robust overfitting? 2. The method's novelty is limited. The author claims that previous attempts to change attacker strength have not focused much on robust overfitting. However, there is existing research in this area: Yu C, Zhou D, Shen L, et al. Strength-Adaptive Adversarial Training, arXiv preprint arXiv:2210.01288, 2022. 3. The experimental results are incomplete and not significant. 1) Did the author confirm that the robustness of MLCAT in Table 1 is lower than AWP? 2) The author introduces multiple measures to mitigate robust overfitting and reports their combined performance. However, what are the individual performances of each technique? Considering that even combining multiple existing techniques for robust overfitting mitigation can further improve robustness, it is necessary to report the experimental results of each individual technique applied to Standard AT.
Questions
Please refer to comments in weakness.
Rating
4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
2 fair
Presentation
3 good
Contribution
2 fair
Limitations
N/A
Could you please have a look at our rebuttal?
Dear Reviewer kwEx, thanks for your time reviewing our paper. We have meticulously prepared a detailed response addressing the concerns you raised. Could you please have a look to see if there are further questions? Your invaluable input is greatly appreciated. Thank you once again, and we hope you have a wonderful day!
Summary
This paper empirically shows that robust overfitting is caused by the over-memorization of the non-robust features after learning rate decay. To mitigate the issue of robust overfitting, the authors propose to use a stronger training attack, a smaller learning rate decay rate, and a bootstrapped adversarial training loss. The comprehensive empirical results validate the effectiveness of the proposed method in mitigating robust overfitting and even improving robustness.
Strengths
1. This paper provides comprehensive verifications for their proposed reason for robust overfitting. The authors clearly show the effect of the false memorization of the adversarial non-robust features after learning decay in robust overfitting. 2. The empirical experiments on various datasets and networks are comprehensive. The results support the authors’ claim.
Weaknesses
1. Besides extensive empirical results, it would be better for the authors to provide some analyses from a theoretical perspective (possibly using game theory which could be related to the empirical results in this paper). 2. The proposed method could hurt the natural test accuracy to some extent.
Questions
1. What is the effect of the hyper-parameter \lambda? 2. Could you provide the result evaluated on CIFAR-10 in the experiments part? I am afraid that I did not find the corresponding results.
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
The proposed method can effectively mitigate the issue of robust overfitting.
Summary
This paper studies the robust overfitting phenomenon in adversarial training. Meanwhile, this paper focuses on a specific problem “the robust overfitting occurs when we use learning rate decay techniques.” This paper proposes a game perspective to explain the robust overfitting. It claims that the robust overfitting happens because of the imbalance between the attacker and the model after the LR decay. Moreover, this paper proposes ReBAT method to improve the robustness and mitigates the overfitting phenomenon.
Strengths
This paper studies a specific but interesting problem, the robust overfitting phenomenon. This paper explains that the overfitting happens because of the learned mapping of the non-robust features after LR decay. This paper provides an intersting perspective to help us to understand the cause of the robust ovetfitting. In particular, the robust problem is a min-max problem, which could be regarded as a game. The robust overfitting is because of the breaks of the original equilibrium. This paper provides extensive verification to support its explanation, which addresses most of my questions when I first review this paper.
Weaknesses
1.For the Figure 2 (b), I guess the red line denotes w/ LR decay and the blue line denotes w/o LR decay; 2.For section 3.2.1, the authors share an interesting and important insight. I’m afraid it is a little trifling. Could the author provide a figure to demonstrate it? 3.In section 4.1, the authors provide some techniques to address the robust overfitting, e.g., bootstrapping, small decay factor. From the theoretical analysis in this paper, I guess there may exist other methods to achieve the balanced learning of robust and non-robust feature, and more discussions is helpful. Could the author provide some theoretical analysis about the proposed method for the re-balance? 4.I find the proposed method ReBAT may cause more computation overhead to get a convergent result. Could the author discusses the limitations of this work? 5.Could the author share more discussions about the game idea? For example, in multi-task learning, could it be regarded as a game, where there are multiple players?
Questions
See weakness.
Rating
7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
2 fair
Contribution
4 excellent
Limitations
N/A
Summary
This paper investigates the phenomenon of robust overfitting in adversarial training and explains it from a minimax game perspective. The authors analyze how the decay of the learning rate disrupts the balance between the model trainer and the attacker, leading to robust overfitting. They propose a method called ReBalanced Adversarial Training (ReBAT) to mitigate robust overfitting and achieve good robustness even after long training.
Strengths
1 The paper is well organized and easy to follow. 2 The paper provides a holistic understanding of robust overfitting in adversarial training by analyzing the imbalance between the model trainer and the attacker from a minimax game perspective. This perspective helps explain why robust overfitting occurs in adversarial training and why it does not occur in other training methods. 3 The experiments cover different network architectures and benchmark datasets, providing strong empirical evidence.
Weaknesses
1 it is better to clearly state the diffference between the defined robust/non-robust features and the previous one in [15] 2 ReBAT[strong] seems like a strange notation, please consider to change one. 3 The caption of Table 1 seems not correct? 4 Does the minimax game view provide any insights on the accuracy and robustness tradeoff?
Questions
Please see the above weaknesses.
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
Missing... Please stately explicitly the limitations and potential negative impact.
My concerns are solved
Thanks for your replies. It is impressive to see the proposed method can improve both natural and robust test accuracy. Besides, it seems that the proposed method provides some new insights regarding explaining robust overfitting, which would be beneficial to future research in this area. Therefore, I still lean toward Weak Acceptance.
Reply
Thank you for the comprehensive explanation. Your clarification has effectively addressed my concerns. The game idea presents a compelling direction within adversarial robustness. I believe such insights could potentially influence developments in other areas as well. I'm inclined to adjust my score to a 7.
I thank the authors for their response. However, I remain unconvinced by the explanation provided for the mechanism behind robust overfitting: 1. If adversarial attacks are intended to introduce new non-robust features, why doesn't the network learn the easily learnable non-robust features from the dataset, similar to how it happens in standard training? 2. Why does the model need to memorize non-robust features? Because these are non-robust features, why wouldn't attackers try to counteract them rather than letting the model memorize them?
Further Response to Reviewer kwEx
Thanks for your reply! We will address your remaining concerns below: --- **Q1.** If adversarial attacks are intended to introduce new non-robust features, why doesn't the network learn the easily learnable non-robust features from the dataset, similar to how it happens in standard training (ST)? **A1.** In our analysis, we follow the well-known robust/non-robust feature framework for understanding adversarial training [1,2], where the attacker creates misclassification by perturbing non-robust features, and the model tries to eliminate them. Built upon this framework, our minimax game perspective gives **a more practical characterization of AT dynamics**. Ideally, if a classifier only learns robust features during AT (as analyzed in [1]), then it will be perfectly robust (i.e., clean acc = robust acc). However, this does not hold in practice, since we always observe a large gap between accuracy and robustness. Thus, **practical AT models indeed learn useful but non-robust features during training**. And as a result, the attacker can use these non-robust features to generate misclassified adversarial samples, as we always observed in practice. On the other side, unlike ST, **learning more non-robust features will face countermeasures by the attacker in AT, so the trainer cannot memorize non-robust features as easily as ST**. For example, for a non-robust feature $f(x)$ assigned to class $y$, the attacker can add this feature to another example $x’$ from the $y’(\neq y)$ class to misclassify it, and the new adversarial example $(x’_{adv},y’)$ contains the feature $f(x)$ but it is now assigned to class $y’$. If the model further memorizes this new example, it will destroy the original $f(x)\to y$ feature (and this new feature will also be destoried in the next update). Thus, due to this adversarial effect, **the model will not be able to memorize all non-robust features generated by the attacker.** Notably, if the attacker and the model trainer are properly balanced (e.g., befor LR decay), in the long run, the two players can strick a balance, where the model can memorize no more non-robust features generated by the attacker, **as we analyzed and verified in** **Sec 3.1**. In this case, the model is not perfectly robust and the attacker can also generate adversarial examples, yet the two still maintain a roughly constant level of robustness (Fig 1a). For more empirical evidence, we refer to the discussions in Sec 3.1. We will add these explanations in the revision for better understanding. **Reference:** [1] Tsipras, et al. Robustness may be at odds with accuracy. ICLR. 2019. [2] Ilyas et al. Adversarial examples are not bugs, they are features. NeurIPS 2019. --- **Q2.** Why does the model need to memorize non-robust features? Because these are non-robust features, why wouldn't attackers try to counteract them rather than letting the model memorize them? **A2.** We will address your questions point by point. > Why does the model need to memorize non-robust features? > As the model trainer’s objective is $\min_\theta\ell_{\rm CE}(x_{\rm adv},y),$ its goal is to increase training accuracy on adversarial examples $x_{\rm adv}$. As non-robust features contained in $x_{adv}$ are useful for classification and thus help decrease training loss, **the model itself wants to memorize non-robust features whenever possible**. However, due to the countermeasures of the attacker, **how much this goal can be fulfilled depends on the relative strength between the attacker and the trainer**. > Because these are non-robust features, why wouldn't attackers try to counteract them rather than letting the model memorize them? > As we elaborated in **A1** above, if the trainer and the attacker are balanced, the model is unable to memorize all non-robust features because the attacker can constantly craft countermeasures. However, as we analyzed in Sec 3.2, the trainer and the attacker become imbalanced after LR decay, and endowed with smaller LR, **the stronger trainer can now draw a more complex region that robustly memorizes this non-robust feature on training set**. In this case, **the relatively weak attacker can no longer craft enough countermeasure.** As a result, the model memorizes more and more non-robust features and the attacker cannot counteract them, **which is directly revealed in the dramatic increase of training robust accuracy after LR decay (Fig 1)**. Besides, we have verified how this imbalance leads to the memorization of non-robust features in **Sec 3.1 (Fig 2a)**, and we further analyze how this memorization leads to RO with extensive experiments in **Sec 3.2.** --- Hope the explanations above could address your concerns. Please let us know if there is more to clarify. We are happy to take your further questions before the discussion stage ends!
Thank you for the author's prompt reply. Just as the author mentioned, for a non-robust feature $f(x)$ assigned to class y, if the attacker adds this feature to x' which does not belong to class y, then for the adversarial example $(x',y')$, why doesn't the model directly learn the non-robust features in x’ that are assigned to class y'? What are memorized non-robust features and non-memorized non-robust features? In my opinion, according to the definition of non-robust features in Line 93, under adversarial attacks, the model shouldn't have any intention to memorize these non-robust features. This is because even if they are memorized, the attacker still has the capability to completely destroy the correlations of these non-robust features.
AT models do contain non-robust features
Thanks for your prompt reply! We will address your further questions below. --- **Q1**. Just as the author mentioned, for a non-robust feature $f(x)$ assigned to class $y$, if the attacker adds this feature to $x'$ which does not belong to class $y$, then for the adversarial example $(x’,y’)$, why doesn't the model directly learn the non-robust features in x’ that are assigned to class y'? **A1**. We note that in AT, we use the adversarial example $(x^\prime_{adv}, y')$ for training, instead of the original sample $(x',y')$. In order to craft an adversarial example $x^\prime_{adv}$ that is misclassified to class $y$, the attacker will modify the original non-robust features in $x'$ (belonging to class $y'$) to $f(x)$ that belongs to class $y$. Thus, the fact that $x_{adv}$ is misclassified to $y$ (a successful attack) indicates that its contained non-robust features now belong to class $y$, which leads to the adversarial effect that we elaborated on in the last reply. --- **Q2**. What are memorized non-robust features and non-memorized non-robust features? In my opinion, according to the definition of non-robust features in Line 93, under adversarial attacks, the model shouldn't have any intention to memorize these non-robust features. This is because even if they are memorized, the attacker still has the capability to completely destroy the correlations of these non-robust features. **A2**. We respectfully disagree that the AT model does not memorize any non-robust features. In the **A1 of our last reply**, we explained the fact that although ideally, AT will only learn robust features, **practical AT models indeed learn some non-robust features**, in evidence of the gap between accuracy and robustness, and the fact that adversarial attacker can always craft successful attacks **(none of these will hold if the model does not memorize any non-robust features**)**.** From our perspective, this discrepancy is caused by the limited capacity of the model on fitting all non-robust features. Indeed, before LR decay, due to the existence of non-robust features in AT models, the attacker can constantly craft a certain ratio of misclassified adversarial examples (about 30%). Yet, the training robust accuracy hinges on a constant level, indicating that these newly crafted non-robust features cannot be further fitted (or corrected) under the current trainer. Thus, there are some non-robust features memorized and some non-memorized. When the training becomes imbalanced after LR decay, the trainer with smaller LR becomes more capable at fitting non-robust features, while **the relatively weak attacker cannot craft enough countermeasures to destroy this correlation as before**. As a result, more and more non-robust features are memorized, leading to higher and higher training robust accuracy (Fig 1a). Importantly, we note that a feature that is **non-robust in the population sense** (the definition in Line 93) does NOT mean that it cannot be memorized robustly on the **finite training set**. When robust overfitting happens, the training robust accuracy can attain nearly 100%, but still, not all features it fits are truly robust on the test set. We have given a formal definition of these falsely memorized non-robust features in our **initial rebuttal (A1 (2))**. To summarize, the key message of our understanding above is that **despite the ideal settings that AT that won’t memorize any non-robust feature, we should focus more on how AT really behaves in practice**. And our analysis reveals that due to limited model capacity, **real-world AT models indeed memorize some non-robust features and the degree of this memorization changes over the training process, dependent on the relative strength of the attack and the trainer**. --- Hope our elaborations above address your concerns. We are happy to take your further questions!
My intention is not to say that the model doesn't learn any non-robust features. I agree that the model may learn some non-robust features, leading to differences in natural accuracy and robust accuracy. I just didn't understand the difference between learn and memorize. So, when the paper refers to "memorize non-robust features," it's implying that the model learns non-robust features, correct? The features that the model learns become "memorized non-robust features," while those that are not learned are "non-memorized non-robust features," is that right? Considering the difference between natural accuracy and robust accuracy, it's evident that the model has been continuously learning non-robust features. Why didn't we observe any signs of robustness degradation before the change in learning rate? What triggers the degradation of robustness? Based on your responses, it seems that the triggering mechanism is the relative strength of the attack and the trainer. Then how can we explain the classical approach in AT where the additional dataset is used to mitigate robust overfitting? In this scenario, where the attacker remains the same and the model's robustness further improves, why isn't there robust overfitting instead?
In addition, for Q1, the inner maximization objective of AT is untargeted attack, not targeted attack from y' to y. How would the attacker know which specific class it misclassified into?
Thanks for your reply
Thanks for your prompt reply and clarifications! We will address your remaining concerns as follows. --- **Q1**. My intention is not to say that the model doesn't learn any non-robust features. […] I just didn't understand the difference between learn and memorize. **A1**. Sorry for the confusion! We now get your point. Indeed, here “memorize” and “learn” mean the same thing, and we use them interchangeably most time. Sometimes we prefer to use the word “memorize” when the fitted non-robust features are not really generalizable to test data (particularly after robust overfitting). We will revise the paper to avoid potential confusion here. --- **Q2**. Considering the difference between natural accuracy and robust accuracy, it's evident that the model has been continuously learning non-robust features. Why didn't we observe any signs of robustness degradation before the change in learning rate? What triggers the degradation of robustness? **A2**. At the initial training stage, AT models can learn many new robust features, so their robustness keeps growing; although it also fits some non-robust features, overall robust features dominate the growth. Afterwards, we can observe that **model robustness actually saturates for a long time** (50-100 epochs). This is because after reaching a certain level of robustness, 1) the trainer cannot fit more robust features due to limited fitting ability; 2) it cannot fit more non-robust features either because, in view of its current fitting ability, the attacker is strong enough to counter it if it fits more non-robust features. Therefore, the two players reach constant robustness when they are properly balanced. **The key change induced by LR decay is the broken balance between the fitting and attacking abilities of the two players.** Specifically, after LR decay, the trainer with a smaller LR can draw a more complex decision boundary around training samples to fit the non-robust features, while the static attacker can no longer trigger them out. As **this imbalance persists, the trainer captures more and more remaining non-robust features and it is unstoppable by the weak trainer,** which leads to the continuous robust degradation after RO. --- **Q3**. Based on your responses, it seems that the triggering mechanism is the relative strength of the attack and the trainer. Then how can we explain the classical approach in AT where the additional dataset is used to mitigate robust overfitting? In this scenario, where the attacker remains the same and the model's robustness further improves, why isn't there robust overfitting instead? **A3**. This is an interesting question! In Sec 5, we revisited existing techniques to mitigate RO, and explained them from our perspective. For the data regularization part, we explained how data augmentations can reduce RO by corrupting non-robust features. **Adding training data, on the other hand, will significantly increase the difficulty for the model to robustly memorize the non-robust features.** As these features are essentially non-robust (in the population sense), adding more data will further approach the population distribution. Particularly, the model memorizing the original training data is still non-robust on the new data, so it needs to further spare more of its fitting abilities to these new data to robustly memorize the same non-robust feature. As a result, **using a larger dataset will make it harder for the trainer to memorize the non-robust features on so many samples**. So, using a larger dataset also helps prevent RO. Thanks for your insight, we will append this discussion to the “data regularization” part in Sec 5. --- **Q4**. In addition, for Q1, the inner maximization objective of AT is untargeted attack, not targeted attack from y' to y. How would the attacker know which specific class it misclassified into? **A4**. Indeed, AT uses untargeted attack. In this example, $y$ is not necessarily given *a priori;* instead, **it can also denote any class that $x^\prime_{adv}$ (e.g., crafted by the untargeted attacker) is misclassified into**. The fact that $x^\prime_{adv}$ is misclassified to $y$ indicates that $x^\prime_{adv}$ contains non-robust features (exacted from the model) w.r.t. class $y$. And in the same vein, fitting $(x'_{adv},y’)$ still triggers the adversarial effect on the $y$-class non-robust features in the model. So our analysis of the adversarial effect still holds for untargeted attack. --- Hope the clarification above could address your concerns. Please let us know if there is more to clarify.
If the model learns more non-robust features after the learning rate decreases, why is it that the gap between training robust accuracy and training standard accuracy becomes smaller after the learning rate decay?
Would you consider reevaluating the paper?
This phenomenon actually aligns well with our theory and is explained in Sec 3.2 (L126-131). After LR decay, the stronger trainer memorizes the non-robust features in the adversarial examples and makes these samples no longer attackable, which pushes up the overall training robust accuracy dramatically, as we have shown in Fig 1a (our paper). Since the training standard accuracy is already very high at that time (around 90%), the large increase in training robust accuracy (45%→80%) induces a decrease in their gap. As another piece of evidence, Fig 1 from Rice et al [1] gives a clear illustration of this process. We are always happy to take your further questions! Meanwhile, given that many of your previous concerns seem to have been resolved, would you please consider reevaluating our paper? **Reference:** [1] Rice et al. Overfitting in adversarially robust deep learning. ICML 2020
Response to would you consider reevaluating the paper
Thanks for the clarification. The experiments conducted in this work are solid. However, the novelty and explanation regarding robust overfitting is limited and not convincing, as outlined below. Therefore, I raised my score to 4. 1. The viewpoint of the relative strength of the attacker and the trainer as the trigger mechanism for robust overfitting is not convincing, which can not adequately explain various empirical behaviors within robust overfitting, such as the method of additional training data. Besides, there is no rigorous proof showing the relationship between non-robust features and robust overfitting. 2. Lacking novelty, despite wrapping the explanation of robust overfitting in the minimax game perspective, similar viewpoints have been proposed and discussed in prior works.
Thanks for your reply and further questions
Thank you for appreciating our response and the solidness of our experiments. However, we do not fully understand your remaining concerns, and respectfully hope that you could concretely explain your remaining concerns. > The viewpoint of the relative strength of the attacker and the trainer as the trigger mechanism for robust overfitting is not convincing, which can not adequately explain various empirical behaviors within robust overfitting, such as the method of additional training data. > We have provided a detailed explanation of how our understandings can naturally explain the methods using additional data in [A3 of our 4th-round reply](https://openreview.net/forum?id=yBoVwpGa5E¬eId=L47RaoTRc0). Could you please let us know which part of it you find problematic? For several other phenomena you mentioned, we have also provided natural and clear explanations with our framework. We even show that many existing techniques for alleviating RO can be understood within our framework in Sec 5. Please let us know if there is more to clarify. > Lacking novelty, despite wrapping the explanation of robust overfitting in the minimax game perspective, similar viewpoints have been proposed and discussed in prior works. We have extensively elaborated the difference to the previous work you mentioned, SAAT, in [our rebuttal](https://openreview.net/forum?id=yBoVwpGa5E¬eId=lf1h6AxFIT). As far as we can see, **SAAT does not explain robust overfitting from the minimax game perspective**. Specifically, our analysis provides a holistic understanding of robust overfitting based on the robust/non-robust feature framework, and verified this view with extensive experiments in Sec 3.2.2; and in our analyis, we mainly consider the RO induced by the trainer’s LR decay behaviors. In comparison, SAAT 1) only empirically studies the influence of attacker strength, 2) does not propose or adopt a minimax game view; 3) does not explain robust overfitting from robust/non-robust features. Thus, our work provides new insights on many aspects, and the designed method ReBAT outperforms SAAT significantly without using any similar techniques. If there is other related work that also explains robust overfitting from a minimax game perspective like ours, please let us know. > Besides, there is no rigorous proof showing the relationship between non-robust features and robust overfitting. As for your remaining concern about the lack of theoretical proof, we note that this is mainly because RO is a complex phenomenon of deep NNs and it is hard to be realized with theoretically tractable toy models. As far as we know, existing explanations of RO mostly rely on empirical justifications and do not have theoretical proof, including [1]. In view of this situation, we also designed extensive verification of our explanations and they all agree well with our analysis. Thus, we believe that our analysis from a minimax game perspective using robust/non-robust features can further the understanding of robust overfitting. We are looking forward to more concrete explanations of the above limitations you mentioned. **Reference:** [1] Yu et al. Understanding Robust Overfitting of Adversarial Training and Beyond. ICML 2022.
Decision
Accept (poster)