What Can the Neural Tangent Kernel T ell Us About Adversarial Robustness? - Supplementary material

To accompany the definitions of Sec. The above framework was introduced by (Ilyas et al., 2019, Tsipras et al., 2019), and we have slightly We first derive the expression in Eq. (8) of the paper. We consider the binary and the multiclass case separately. Binary case: Suppose we would like to evaluate a model described by Eq. (7) at the end of training, Since Eq. (11) describes regression models with LSE ( Inspecting Eq. (15), maximal "confusion" of the classification model is achieved by aligning Eq. (15) has been derived for perturbations of the training data. Then, Eq. (14) becomes: f ( X + ϵ) = (Θ( X, X) +)Θ(X, X) This leads to the multi-dimensional analogue of the linear Eq. (10) for We present the two most obvious methods.