Search papers, labs, and topics across Lattice.
This paper provides the first theoretical analysis of adversarial training for Vision Transformers (ViTs), demonstrating that benign overfitting can occur under specific signal-to-noise ratio conditions and perturbation budgets. The analysis shows that adversarial training allows ViTs to achieve near-zero robust training loss and robust generalization error, even when overfitting. Empirical validation on synthetic and real-world data supports the theoretical results, extending the understanding of benign overfitting beyond CNNs.
ViTs can achieve robust generalization through adversarial training even when overfitting, mirroring a phenomenon previously observed only in CNNs.
Despite the remarkable success of Vision Transformers (ViTs) across a wide range of vision tasks, recent studies have revealed that they remain vulnerable to adversarial examples, much like Convolutional Neural Networks (CNNs). A common empirical defense strategy is adversarial training, yet the theoretical underpinnings of its robustness in ViTs remain largely unexplored. In this work, we present the first theoretical analysis of adversarial training under simplified ViT architectures. We show that, when trained under a signal-to-noise ratio that satisfies a certain condition and within a moderate perturbation budget, adversarial training enables ViTs to achieve nearly zero robust training loss and robust generalization error under certain regimes. Remarkably, this leads to strong generalization even in the presence of overfitting, a phenomenon known as \emph{benign overfitting}, previously only observed in CNNs (with adversarial training). Experiments on both synthetic and real-world datasets further validate our theoretical findings.
