Benign Overfitting in Adversarial Training for Vision Transformers
2026-04-21 • Machine Learning
Machine LearningArtificial Intelligence
AI summaryⓘ
The authors studied why Vision Transformers (ViTs), a type of AI model for images, can be protected against tricky attacks called adversarial examples using a method called adversarial training. They provided the first theoretical explanation showing that, under certain conditions, adversarial training helps ViTs learn well and remain robust even when the model overfits the training data. This phenomenon, known as benign overfitting, was previously known mainly for CNNs. They also confirmed their findings with experiments on both made-up and real image data.
Vision TransformerAdversarial ExamplesAdversarial TrainingRobustnessSignal-to-Noise RatioBenign OverfittingGeneralization ErrorConvolutional Neural NetworksPerturbation Budget
Authors
Jiaming Zhang, Meng Ding, Shaopeng Fu, Jingfeng Zhang, Di Wang
Abstract
Despite the remarkable success of Vision Transformers (ViTs) across a wide range of vision tasks, recent studies have revealed that they remain vulnerable to adversarial examples, much like Convolutional Neural Networks (CNNs). A common empirical defense strategy is adversarial training, yet the theoretical underpinnings of its robustness in ViTs remain largely unexplored. In this work, we present the first theoretical analysis of adversarial training under simplified ViT architectures. We show that, when trained under a signal-to-noise ratio that satisfies a certain condition and within a moderate perturbation budget, adversarial training enables ViTs to achieve nearly zero robust training loss and robust generalization error under certain regimes. Remarkably, this leads to strong generalization even in the presence of overfitting, a phenomenon known as \emph{benign overfitting}, previously only observed in CNNs (with adversarial training). Experiments on both synthetic and real-world datasets further validate our theoretical findings.