The Surprising Harmfulness of Benign Overfitting for Adversarial Robustness

The "benign overfitting" phenomenon ( Bartlett et al., 2019) refers to the ability of large (and typically "overparameterized") machine learning models to achieve near-op timal prediction performance despite being trained to exactly, or almost exactly, fit noisy training data. Its key ingredients include the inductive biases of the fitting method, such as the least norm bias in linear regr ession, as well as favorable data properties that are compatible with the inductive bias. When these p ieces are in place, "overfitted" models have high out-of-sample accuracy, which runs counter to the c onventional advice that cautions against exactly fitting training data and instead recommends the use of reg ularization to balance training error and model complexity. These estimators without any regularization have found widespread application in real-world scenarios and garnered considerable attentions owing t o their surprising generalization performance ( Zhang et al., 2017; Belkin et al., 2019; Bartlett et al., 2019; Shamir, 2022). Besides generalization performance, another much anticipated feature of machine learn ing models is the adversarial robustness. Some recent works ( Raghunathan et al., 2019; Rice et al., 2020; Huang et al., 2021; Wu et al., 2021) empirically verified that an increased model capacity deteriorates the ro bustness of neural networks. However, corresponding theoretical understandings are still lacking. For standard risk, Belkin et al. ( 2019) illustrated the advantages of improving generalization performan ce by incorporating more parameters into the prediction model, and Bartlett et al. ( 2019) verified the consistency of the "ridgeless" estimator in "benign overfitting" phase. I n this work, we continue our exploration in the same setting, and reveal a surprising finding: "benign overfit ting" estimators may become overly sensitive to adversarial attacks ( Szegedy et al., 2013; Goodfellow et al., 2014) even when the ground truth