{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T06:04:15Z","timestamp":1784268255087,"version":"3.55.0"},"reference-count":62,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"8","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"NSF","award":["2416897"],"award-info":[{"award-number":["2416897"]}]},{"name":"NSF","award":["2505932"],"award-info":[{"award-number":["2505932"]}]},{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"crossref","award":["N000142512318"],"award-info":[{"award-number":["N000142512318"]}],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Advanced Computing Systems, and Computing Resources provided by Illinois Computes through Delta","award":["OAC 2005572"],"award-info":[{"award-number":["OAC 2005572"]}]},{"name":"DeltaAI","award":["OAC 2320345"],"award-info":[{"award-number":["OAC 2320345"]}]},{"name":"National Artificial Intelligence Research Resource (NAIRR) Pilot","award":["NAIRR250157"],"award-info":[{"award-number":["NAIRR250157"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Inform. Theory"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1109\/tit.2026.3702992","type":"journal-article","created":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T19:42:09Z","timestamp":1781293329000},"page":"6023-6053","source":"Crossref","is-referenced-by-count":0,"title":["The Surprising Harmfulness of Benign Overfitting for Adversarial Robustness"],"prefix":"10.1109","volume":"72","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-1888-5671","authenticated-orcid":false,"given":"Yifan","family":"Hao","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Illinois Urbana–Champaign, Champaign, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5511-2558","authenticated-orcid":false,"given":"Tong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Illinois Urbana–Champaign, Champaign, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1907378117"},{"key":"ref2","first-page":"1","article-title":"Understanding deep learning requires rethinking generalization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Zhang"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1903070116"},{"key":"ref4","first-page":"448","article-title":"The implicit bias of benign overfitting","volume-title":"Proc. Conf. Learn. Theory","author":"Shamir"},{"key":"ref5","article-title":"Adversarial training can hurt generalization","author":"Raghunathan","year":"2019","journal-title":"arXiv:1906.06032"},{"key":"ref6","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Rice"},{"key":"ref7","first-page":"5545","article-title":"Exploring architectural ingredients of adversarially robust deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Huang"},{"key":"ref8","first-page":"7054","article-title":"Do wider neural networks really help adversarial robustness?","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Wu"},{"key":"ref9","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref10","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref11","first-page":"804","article-title":"A law of robustness for two-layers neural networks","volume-title":"Proc. Conf. Learn. Theory","author":"Bubeck"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3578580"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3406325.3465355"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ac3a74"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"issue":"123","key":"ref16","first-page":"1","article-title":"Benign overfitting in ridge regression","volume":"24","author":"Tsigler","year":"2023","journal-title":"J. Mach. Learn. Res."},{"key":"ref17","first-page":"1","article-title":"In search of the real inductive bias: On the role of implicit regularization in deep learning","volume-title":"Proc. ICLR Workshop","author":"Neyshabur"},{"issue":"48","key":"ref18","first-page":"1","article-title":"Explaining the success of adaboost and random forests as interpolating classifiers","volume":"18","author":"Wyner","year":"2017","journal-title":"J. Mach. Learn. Res."},{"key":"ref19","first-page":"1","article-title":"To understand deep learning we need to understand kernel learning","volume-title":"Proc. 35th Int. Conf. Mach. Learn.","author":"Belkin"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1214\/19-AOS1849"},{"key":"ref21","first-page":"1","article-title":"Margins, shrinkage, and boosting","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Telgarsky"},{"key":"ref22","first-page":"1","article-title":"Path-SGD: Path-normalized optimization in deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"28","author":"Neyshabur"},{"key":"ref23","first-page":"1","article-title":"On large-batch training for deep learning: Generalization gap and sharp minima","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Keskar"},{"key":"ref24","first-page":"1","article-title":"Exploring generalization in deep learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Neyshabur"},{"key":"ref25","first-page":"1","article-title":"The marginal value of adaptive gradient methods in machine learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Wilson"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1137\/20M1336072"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/JSAIT.2020.2984716"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1214\/21-AOS2133"},{"key":"ref29","article-title":"More is better in modern machine learning: When infinite overparameterization is optimal and overfitting is obligatory","author":"Simon","year":"2023","journal-title":"arXiv:2311.14646"},{"issue":"1","key":"ref30","first-page":"5721","article-title":"Finite-sample analysis of interpolating linear classifiers in the overparameterized regime","volume":"22","author":"Chatterji","year":"2021","journal-title":"J. Mach. Learn. Res."},{"issue":"1","key":"ref31","first-page":"10104","article-title":"Classification vs regression in overparameterized regimes: Does the loss function matter?","volume":"22","author":"Muthukumar","year":"2021","journal-title":"J. Mach. Learn. Res."},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1137\/21M1415121"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2023.3320098"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref35","first-page":"1","article-title":"Are adversarial examples inevitable?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Shafahi"},{"key":"ref36","first-page":"1","article-title":"Adversarially robust generalization requires more data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Schmidt"},{"key":"ref37","first-page":"1","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Ilyas"},{"key":"ref38","first-page":"1","article-title":"Convergence of adversarial training in overparametrized neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Gao"},{"key":"ref39","first-page":"2345","article-title":"Sharp statistical guaratees for adversarially robust Gaussian classification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Dan"},{"key":"ref40","first-page":"1","article-title":"How benign is benign overfitting?","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Sanyal"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1214\/24-AOS2353"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref43","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref44","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2020.2985966"},{"key":"ref46","first-page":"13002","article-title":"Provable robustness of adversarial training for learning halfspaces with noise","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zou"},{"key":"ref47","first-page":"313","article-title":"Benign overfitting in adversarially robust linear classification","volume-title":"Proc. Uncertainty Artif. Intell.","author":"Chen"},{"key":"ref48","first-page":"1","article-title":"Robustness may be at odds with accuracy","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Tsipras"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2022.3205449"},{"key":"ref50","first-page":"2034","article-title":"Precise tradeoffs in adversarial training for linear regression","volume-title":"Proc. Conf. Learn. Theory","author":"Javanmard"},{"key":"ref51","first-page":"23465","article-title":"Interpolation can hurt robust generalization even when there is no noise","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Donhauser"},{"key":"ref52","article-title":"Overfitting or perfect fitting? risk bounds for classification and regression rules that interpolate","volume":"31","author":"Belkin","year":"2018","journal-title":"Adv. neural Inf. Process. Syst."},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.4324\/9781315675688-24"},{"key":"ref54","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0202"},{"key":"ref56","first-page":"74","article-title":"The neural tangent kernel in high dimensions: Triple descent and a multi-scale theory of generalization","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Adlam"},{"key":"ref57","article-title":"Towards an understanding of benign overfitting in neural networks","author":"Li","year":"2021","journal-title":"arXiv:2106.03212"},{"key":"ref58","first-page":"43105","article-title":"Benign overfitting in deep neural networks under lazy training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhu"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1017\/9781108231596"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1214\/08-AOS648"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.3150\/15-BEJ730"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1142\/9789812793096_0015"}],"container-title":["IEEE Transactions on Information Theory"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/18\/11611849\/11561008-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/18\/11611849\/11561008.pdf?arnumber=11561008","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T05:16:32Z","timestamp":1784265392000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11561008\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":62,"journal-issue":{"issue":"8"},"URL":"https:\/\/doi.org\/10.1109\/tit.2026.3702992","relation":{},"ISSN":["0018-9448","1557-9654"],"issn-type":[{"value":"0018-9448","type":"print"},{"value":"1557-9654","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8]]}}}