This work investigates adversarial training in the context of margin-based linear classifiers in the high-dimensional regime where the dimension $d$ and the number of data points $n$ diverge with a fixed ratio $\alpha = n / d$. We introduce a tractable mathematical model where the interplay between the data and adversarial attacker geometries can be studied, while capturing the core phenomenology observed in the adversarial robustness literature. Our main theoretical contribution is an exact asymptotic description of the sufficient statistics for the adversarial empirical risk minimiser, under generic convex and non-increasing losses. Our result allow us to precisely characterise which directions in the data are associated with a higher generalisation/robustness trade-off, as defined by a robustness and a usefulness metric. In particular, we unveil the existence of directions which can be defended without penalising accuracy. Finally, we show the advantage of defending non-robust features during training, identifying a uniform protection as an inherently effective defence mechanism.

在高维度背景下，研究基于边界的线性分类器中的对抗性训练，提出了一个可以研究数据和对手几何结构相互作用的可行数学模型，精确描述了足够统计量的敌对经验风险最小化，揭示了存在可以在不损失准确性的情况下进行防御的方向，并且证明了防御非鲁棒特征在训练中的优势，作为一种有效的防御机制。

对抗训练的高维模型：几何与权衡