Adversarially Robust Generalization Just Requires More Unlabeled Data

Understand

Neural network robustness has recently been highlighted by the existence of adversarial examples.

• Many previous works show that the learned networks do not perform well on perturbed test data, and significantly more labeled data is required to achieve adversarially robust generalization.
• In this paper, we theoretically and empirically show that with just more unlabeled data, we can learn a model with better adversarially robust generalization.
• The key insight of our results is based on a risk decomposition theorem, in which the expected robust risk is separated into two parts: the stability part which measures the prediction stability in the presence of perturbations, and the accuracy part which evaluates the standard classification accuracy.