Despite remarkable success in practice, modern machine learning models have been found to be susceptible to adversarial attacks that make human-imperceptible perturbations to the data, but result in serious and potentially dangerous prediction errors. To address this issue, practitioners often use adversarial training to learn models that are robust against such attacks at the cost of weaker generalization accuracy on unperturbed test sets. The conventional wisdom is that more training data should shrink the generalization gap between adversarially-trained models and standard models. However, we study the training of robust classifiers for both Gaussian and Bernoulli models under $\ell_\infty$ attacks, and we prove that more data may actually increase this gap. Furthermore, our theoretical results identify if and when additional data will finally begin to shrink the gap. Lastly, we experimentally demonstrate that our results also hold for linear regression models, which may indicate that this phenomenon occurs more broadly.

针对现代机器学习模型易受到对人类不可察觉的攻击的问题，采用对抗培训来学习鲁棒模型的代价是在未被扰动的测试集上存在更高的泛化误差，此研究证明更多的数据可能会增加鲁棒分类器与标准分类器泛化误差的差距并提出了理论结果以判定何时和何种情况下添加更多数据才能缩小这种差距，此现象也出现在线性回归模型中。

更多数据可能扩大对抗性鲁棒模型和标准模型之间的泛化差距