# Feature Purification: How Adversarial Training Performs Robust Deep Learning

**Authors:** Zeyuan Allen-Zhu, Yuanzhi Li  
**arXiv:** [2005.10190](https://arxiv.org/abs/2005.10190)  
**Date:** 2020-05-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2005.10190v4/

## Key points

- Zeyuan Allen-Zhu and Yuanzhi Li explore the effectiveness of Adversarial Training in defending deep learning models against adversarial perturbations
- Introduction of Feature Purification concept to address accumulation of specific small dense mixtures in hidden weights during neural network training
- Demonstrated evidence that training a neural network over original data is susceptible to non-robustness against small adversarial perturbations within a certain radius
- Through adversarial training, models can be proven robust against ANY perturbations within the same radius, even with empirical perturbation algorithms like FGM
- Complexity lower bound established indicating that models with low complexity are unable to defend against perturbations within a certain radius regardless of training algorithms used

## Summary

, , , , 

In their paper "Feature Purification: How Adversarial Training Performs Robust Deep Learning," Zeyuan Allen-Zhu and Yuanzhi Li explore the effectiveness of Adversarial Training in defending deep learning models against adversarial perturbations. They introduce the concept of Feature Purification, which sheds light on one of the root causes of adversarial examples - the accumulation of specific small dense mixtures in hidden weights during neural network training. Through experiments on the CIFAR-10 dataset and theoretical analysis, they demonstrate that training a two-layer neural network with ReLU activation using randomly initialized gradient descent aligns with this principle. This work provides evidence that training a neural network over original data is susceptible to non-robustness against small adversarial perturbations within a certain radius, but through adversarial training, even employing empirical perturbation algorithms like FGM, the model can be proven robust against ANY perturbations within the same radius. The authors also establish a complexity lower bound indicating that models with low complexity are unable to defend against perturbations within this radius regardless of the training algorithms employed. This study not only elucidates the mechanisms behind adversarial perturbations and their removal through feature purification but also provides valuable insights into enhancing robustness in deep learning models through adversarial training strategies.