{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T14:52:05Z","timestamp":1784299925562,"version":"3.55.0"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"NSF BIGDATA Grant","award":["IIS 1837992"],"award-info":[{"award-number":["IIS 1837992"]}]},{"DOI":"10.13039\/100000121","name":"NSF-Simons Award on the Mathematical and Scientific Foundations of Deep Learning","doi-asserted-by":"publisher","award":["2031895"],"award-info":[{"award-number":["2031895"]}],"id":[{"id":"10.13039\/100000121","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NSF BIGDATA Grant","award":["IIS 1837992"],"award-info":[{"award-number":["IIS 1837992"]}]},{"name":"Dean\u2019s Fund for Post-Doctoral Research of the Wharton School"},{"DOI":"10.13039\/100000121","name":"NSF Mathematical Sciences Post-Doctoral Research Fellowship","doi-asserted-by":"publisher","award":["DMS 2103353"],"award-info":[{"award-number":["DMS 2103353"]}],"id":[{"id":"10.13039\/100000121","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NSF HDR TRIPODS","award":["1934876"],"award-info":[{"award-number":["1934876"]}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CPS-1837253"],"award-info":[{"award-number":["CPS-1837253"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CIF-1910056"],"award-info":[{"award-number":["CIF-1910056"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NSF CAREER Award","award":["CIF-1943064"],"award-info":[{"award-number":["CIF-1943064"]}]},{"DOI":"10.13039\/100000181","name":"Air Force Office of Scientific Research Young Investigator Program","doi-asserted-by":"publisher","award":["FA9550-20-1-0111"],"award-info":[{"award-number":["FA9550-20-1-0111"]}],"id":[{"id":"10.13039\/100000181","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Inform. Theory"],"published-print":{"date-parts":[[2023,12]]},"DOI":"10.1109\/tit.2022.3205449","type":"journal-article","created":{"date-parts":[[2023,7,31]],"date-time":"2023-07-31T17:29:08Z","timestamp":1690824548000},"page":"7793-7822","source":"Crossref","is-referenced-by-count":12,"title":["Provable Tradeoffs in Adversarially Robust Classification"],"prefix":"10.1109","volume":"69","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3467-8931","authenticated-orcid":false,"given":"Edgar","family":"Dobriban","sequence":"first","affiliation":[{"name":"Department of Statistics and Data Science, University of Pennsylvania, Philadelphia, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9448-8750","authenticated-orcid":false,"given":"Hamed","family":"Hassani","sequence":"additional","affiliation":[{"name":"Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4698-4175","authenticated-orcid":false,"given":"David","family":"Hong","sequence":"additional","affiliation":[{"name":"Department of Statistics and Data Science, University of Pennsylvania, Philadelphia, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-5693-2819","authenticated-orcid":false,"given":"Alexander","family":"Robey","sequence":"additional","affiliation":[{"name":"Department of Electrical and Systems Engineering, University of Pennsylvania, Philadelphia, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1038\/nature14539"},{"key":"ref2","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref4","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref6","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","volume":"80","author":"Wong"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref8","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"97","author":"Zhang"},{"key":"ref9","first-page":"1","article-title":"Robustness may be at odds with accuracy","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tsipras"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref11","first-page":"1","article-title":"Adversarially robust generalization requires more data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Schmidt"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2018.2854560"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3446776"},{"key":"ref14","first-page":"233","article-title":"A closer look at memorization in deep networks","volume-title":"Proc. 34th Int. Conf. Mach. Learn.","volume":"70","author":"Arpit"},{"key":"ref15","first-page":"1","article-title":"Adversarial training can hurt generalization","volume-title":"Proc. Workshop Identifying Understand. Deep Learn. Phenomena (ICML)","author":"Raghunathan"},{"key":"ref16","first-page":"2034","article-title":"Precise tradeoffs in adversarial training for linear regression","volume-title":"Proc. 33rd Conf. Learn. Theory","volume":"125","author":"Javanmard"},{"key":"ref17","first-page":"1670","article-title":"More data can expand the generalization gap between adversarially robust and standard models","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Chen"},{"key":"ref18","first-page":"129","article-title":"The curious case of adversarially robust models: More data can help, double descend, or hurt generalization","volume-title":"Proc. 37th Conf. Uncertainty Artif. Intell.","volume":"161","author":"Min"},{"key":"ref19","volume-title":"An Introduction to Multivariate Statistical Analysis","author":"Anderson","year":"2003"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-84858-7"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4615-7566-5"},{"key":"ref22","first-page":"8573","article-title":"Random matrix theory proves that deep learning representations of GAN-data behave as Gaussian mixtures","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Seddik"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1353\/ajm.2011.0005"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1214\/13-AOP860"},{"key":"ref25","first-page":"1485","article-title":"Robustness and regularization of support vector machines","volume":"10","author":"Xu","year":"2009","journal-title":"J. Mach. Learn. Res."},{"key":"ref26","first-page":"1","article-title":"Robust regression and Lasso","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"21","author":"Xu"},{"key":"ref27","first-page":"61","article-title":"Adversarial robustness of linear models: Regularization and dimensionality","volume-title":"Proc. Eur. Symp. Artif. Neural Netw., Comput. Intell. Mach. Learn.","author":"Megyeri"},{"key":"ref28","first-page":"884","article-title":"Sample complexity of robust linear classification on separated data","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","volume":"139","author":"Bhattacharjee"},{"key":"ref29","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","volume":"97","author":"Cohen"},{"key":"ref30","first-page":"1","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Salman"},{"issue":"211","key":"ref31","first-page":"1","article-title":"Random smoothing might be unable to certify \u2113\u221e robustness for high-dimensional images","volume":"21","author":"Blum","year":"2020","journal-title":"J. Mach. Learn. Res."},{"key":"ref32","first-page":"4033","article-title":"Hidden cost of randomized smoothing","volume-title":"Proc. 24th Int. Conf. Artif. Intell. Statist.","volume":"130","author":"Mohapatra"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413587"},{"key":"ref34","first-page":"1","article-title":"Adversarial spheres","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Gilmer"},{"key":"ref35","first-page":"1","article-title":"Are adversarial examples inevitable?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Shafahi"},{"key":"ref36","first-page":"1","article-title":"Empirically measuring concentration: Fundamental limits on intrinsic robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Mahloujifar"},{"issue":"221","key":"ref37","first-page":"1","article-title":"A Bayes-optimal view on adversarial examples","volume":"22","author":"Richardson","year":"2021","journal-title":"J. Mach. Learn. Res."},{"key":"ref38","first-page":"7909","article-title":"Understanding and mitigating the tradeoff between robustness and accuracy","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Raghunathan"},{"key":"ref39","article-title":"Provable trade-offs between private & robust machine learning","author":"Hayes","year":"2020","journal-title":"arXiv:2006.04622"},{"key":"ref40","first-page":"2345","article-title":"Sharp statistical guarantees for adversarially robust Gaussian classification","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Dan"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-017-5663-3"},{"key":"ref42","first-page":"1","article-title":"How benign is benign overfitting?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Sanyal"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1907378117"},{"key":"ref44","first-page":"7544","article-title":"Fundamental tradeoffs in distributionally adversarial training","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","volume":"139","author":"Mehrabi"},{"key":"ref45","first-page":"9561","article-title":"Fundamental tradeoffs between invariance and sensitivity to adversarial perturbations","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Tram\u00e8r"},{"key":"ref46","first-page":"1","article-title":"PAC-learning in the presence of evasion adversaries","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Cullina"},{"key":"ref47","first-page":"7085","article-title":"Rademacher complexity for adversarially robust generalization","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","volume":"97","author":"Yin"},{"key":"ref48","first-page":"162","article-title":"Improved generalization bounds for robust learning","volume-title":"Proc. 30th Int. Conf. Algorithmic Learn. Theory","volume":"98","author":"Attias"},{"key":"ref49","first-page":"431","article-title":"Adversarial learning guarantees for linear hypotheses and neural networks","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Awasthi"},{"key":"ref50","first-page":"7010","article-title":"Efficiently learning adversarially robust halfspaces with noise","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Montasser"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/s00365-006-0662-3"},{"key":"ref52","article-title":"A finer calibration analysis for adversarial robustness","author":"Awasthi","year":"2021","journal-title":"arXiv:2105.01550"},{"key":"ref53","first-page":"408","article-title":"Calibrated surrogate losses for adversarially robust classification","volume-title":"Proc. 33rd Conf. Learn. Theory","volume":"125","author":"Bao"},{"key":"ref54","first-page":"863","article-title":"Lower bounds on cross-entropy loss in the presence of test-time adversaries","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","volume":"139","author":"Bhagoji"},{"key":"ref55","first-page":"5133","article-title":"Analyzing the robustness of nearest neighbors to adversarial examples","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","volume":"80","author":"Wang"},{"key":"ref56","first-page":"832","article-title":"When are non-parametric methods robust?","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Bhattacharjee"},{"key":"ref57","first-page":"941","article-title":"Robustness for non-parametric classification: A generic attack and defense","volume-title":"Proc. 23rd Int. Conf. Artif. Intell. Statist.","volume":"108","author":"Yang"},{"key":"ref58","first-page":"8588","article-title":"A closer look at accuracy vs. robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Yang"},{"key":"ref59","first-page":"1","article-title":"Lower bounds on adversarial robustness from optimal transport","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Bhagoji"},{"key":"ref60","first-page":"7814","article-title":"Adversarial risk via optimal transport and optimal couplings","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","volume":"119","author":"Pydi"},{"key":"ref61","first-page":"1646","article-title":"Limitations of adversarial robustness: Strong no free lunch theorem","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","volume":"97","author":"Dohmatob"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/BF01425510"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/BF01086099"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1093\/acprof:oso\/9780199535255.001.0001"},{"key":"ref65","first-page":"1","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Xie"},{"key":"ref66","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","volume":"80","author":"Athalye"},{"key":"ref67","article-title":"Adversarial robustness via label-smoothing","author":"Goibert","year":"2019","journal-title":"arXiv:1906.11567"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1198\/016214505000000907"},{"key":"ref69","article-title":"Adversarial risk bounds via function transformation","author":"Khim","year":"2018","journal-title":"arXiv:1810.09519"},{"key":"ref70","first-page":"2512","article-title":"VC classes are adversarially robustly learnable, but only improperly","volume-title":"Proc. 32nd Conf. Learn. Theory","volume":"99","author":"Montasser"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177728174"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-74978-5"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1137\/1.9780898719017"},{"key":"ref74","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. 35th Int. Conf. Mach. Learn. (ICML)","volume":"80","author":"Athalye"}],"container-title":["IEEE Transactions on Information Theory"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/18\/10328924\/10197639-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/18\/10328924\/10197639.pdf?arnumber=10197639","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,1]],"date-time":"2024-03-01T16:25:59Z","timestamp":1709310359000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10197639\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12]]},"references-count":74,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tit.2022.3205449","relation":{},"ISSN":["0018-9448","1557-9654"],"issn-type":[{"value":"0018-9448","type":"print"},{"value":"1557-9654","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,12]]}}}