Benign Overfitting in Adversarial Training for Vision Transformers
For researchers studying adversarial robustness in ViTs, this work offers a theoretical foundation for benign overfitting in adversarial training, previously only observed in CNNs.
This paper provides the first theoretical analysis of adversarial training for Vision Transformers, showing that under certain conditions, it achieves nearly zero robust training loss and robust generalization error, exhibiting benign overfitting. Experiments on synthetic and real-world datasets validate the theory.
Despite the remarkable success of Vision Transformers (ViTs) across a wide range of vision tasks, recent studies have revealed that they remain vulnerable to adversarial examples, much like Convolutional Neural Networks (CNNs). A common empirical defense strategy is adversarial training, yet the theoretical underpinnings of its robustness in ViTs remain largely unexplored. In this work, we present the first theoretical analysis of adversarial training under simplified ViT architectures. We show that, when trained under a signal-to-noise ratio that satisfies a certain condition and within a moderate perturbation budget, adversarial training enables ViTs to achieve nearly zero robust training loss and robust generalization error under certain regimes. Remarkably, this leads to strong generalization even in the presence of overfitting, a phenomenon known as \emph{benign overfitting}, previously only observed in CNNs (with adversarial training). Experiments on both synthetic and real-world datasets further validate our theoretical findings.