Paper deep dive
Benign Overfitting in Adversarial Training for Vision Transformers
Jiaming Zhang, Meng Ding, Shaopeng Fu, Jingfeng Zhang, Di Wang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 99%
Last extracted: 4/26/2026, 11:49:30 PM
Summary
This paper provides the first theoretical analysis of benign overfitting in the context of adversarial training for Vision Transformers (ViTs). The authors demonstrate that under specific conditions regarding the signal-to-noise ratio (SNR) and perturbation budget (τ), a simplified two-layer ViT can achieve near-zero robust training loss while maintaining strong robust generalization. The study identifies three distinct regimes based on perturbation magnitude: small perturbations (effective training), moderate perturbations (model collapses to a linear model), and large perturbations (significant generalization error). The research establishes explicit upper bounds for clean and robust test errors and provides practical guidelines for selecting optimal perturbation budgets in ViT training.
Entities (6)
Relation Signals (4)
Vision Transformer → exhibits → Benign Overfitting
confidence 100% · We validate that benign overfitting can also arise in adversarially trained Vision Transformers...
Perturbation Budget → influences → Training Dynamics
confidence 100% · The effect of perturbations on attention heads differs significantly from their effect on linear layers...
Signal-to-Noise Ratio → determines → Generalization
confidence 95% · the SNR condition guarantees that it prioritizes the signal over the noise, thereby leading to benign overfitting.
Adversarial Training → improves → Robustness
confidence 90% · Adversarial training has been widely used to improve Transformer robustness.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Despite the remarkable success of Vision Transformers (ViTs) across a wide range of vision tasks, recent studies have revealed that they remain vulnerable to adversarial examples, much like Convolutional Neural Networks (CNNs). A common empirical defense strategy is adversarial training, yet the theoretical underpinnings of its robustness in ViTs remain largely unexplored. In this work, we present the first theoretical analysis of adversarial training under simplified ViT architectures. We show that, when trained under a signal-to-noise ratio that satisfies a certain condition and within a moderate perturbation budget, adversarial training enables ViTs to achieve nearly zero robust training loss and robust generalization error under certain regimes. Remarkably, this leads to strong generalization even in the presence of overfitting, a phenomenon known as \emph{benign overfitting}, previously only observed in CNNs (with adversarial training). Experiments on both synthetic and real-world datasets further validate our theoretical findings.
Tags
Links
- Source: https://arxiv.org/abs/2604.19724v1
- Canonical: https://arxiv.org/abs/2604.19724v1
Trouble viewing inline? Open PDF directly →
Full Text
191,087 characters extracted from source content.
Expand or collapse full text
Benign Overfitting in Adversarial Training for Vision Transformers Jiaming Zhang 1 2 Meng Ding 3 Shaopeng Fu 1 Jingfeng Zhang 4 Di Wang 1 Abstract Despite the remarkable success of Vision Trans- formers (ViTs) across a wide range of vision tasks, recent studies have revealed that they remain vul- nerable to adversarial examples, much like Con- volutional Neural Networks (CNNs). A common empirical defense strategy is adversarial training, yet the theoretical underpinnings of its robustness in ViTs remain largely unexplored. In this work, we present the first theoretical analysis of adver- sarial training under simplified ViT architectures. We show that, when trained under a signal-to- noise ratio that satisfies a certain condition and within a moderate perturbation budget, adversar- ial training enables ViTs to achieve nearly zero robust training loss and robust generalization er- ror under certain regimes. Remarkably, this leads to strong generalization even in the presence of overfitting, a phenomenon known as benign over- fitting, previously only observed in CNNs (with adversarial training). Experiments on both syn- thetic and real-world datasets further validate our theoretical findings. 1. Introduction Vision Transformers (ViTs) have emerged as a power- ful alternative to convolutional neural networks (CNNs) (Krizhevsky et al., 2012) for a wide range of computer vision tasks, including image classification, object detec- tion, semantic segmentation, and vision-language model- ing (Dosovitskiy et al., 2020; Liu et al., 2021; Hu et al., 2025a). Despite their strong performance, recent studies (Hu et al., 2023; Shao et al., 2021; Hu et al., 2025b; 2024) have revealed that ViTs, similar to CNNs, can still be vul- nerable to small, carefully crafted perturbations. These per- turbations, referring to adversarial examples (Szegedy et al., 1 Division of CEMSE, King Abdullah University of Science and Technology 2 School of Statistics, Renmin University of China 3 Department of Computer Science and Engineering, State University of New York at Buffalo 4 School of Computer Sci- ence, University of Auckland. Correspondence to: Di Wang <di.wang@kaust.edu.sa>. Preprint. April 22, 2026. 2013), can often cause significant performance degradation. A widely studied defense mechanism against such vulner- abilities is adversarial training (Goodfellow et al., 2014; 2016), which augments the training process with adver- sarially perturbed samples to improve model robustness. While adversarial training has proven effective in enhanc- ing model robustness, it is frequently accompanied by a noticeable degradation in generalization performance on clean data (Raghunathan et al., 2019; Xu et al., 2023). Such a robustness-generalization trade-off (Fu & Wang, 2023; Zhang et al., 2021; Xiao et al., 2022) has been extensively studied, raising the question of whether it is possible to preserve robustness without sacrificing clean-data accuracy. Benign Overfitting (Bartlett et al., 2020) refers to the phe- nomenon that overparameterized models can interpolate the training data (achieving near-zero empirical risk) yet still generalize well. In the standard (non-adversarial) setting, this behavior has been studied across various model archi- tectures, including linear regression (Bartlett et al., 2020; Zhou & Ge, 2023), logistic regression (Wang et al., 2021; Cao et al., 2021), ridge regression (Tsigler & Bartlett, 2023), kernel methods (Mei & Montanari, 2022), and neural net- works (Li et al., 2021; Cao et al., 2022; Kou et al., 2023; Frei et al., 2023; Jiang et al., 2024; Frei & Vardi, 2024). In the adversarial setting, (Chen et al., 2023) provides the first theoretical analysis that benign overfitting can arise in adversarial training for linear regression under sub-Gaussian mixture models. Subsequently, (Wang et al., 2024) shows that adversarial training can still generalize well in the pres- ence of inference-time attacks for two-layer neural networks under appropriate distributional assumptions. However, to the best of our knowledge, it remains unclear whether anal- ogous behavior occurs in more advanced architectures such as ViTs. Compared with linear and two-layer models, analyzing ViTs poses distinctive challenges for analyzing robust benign overfitting. Unlike CNNs or two-layer neural networks with activation functions followed by a linear model, ViTs incor- porate attention heads with query, key, and value projection matrices, leading to substantially more complex training dynamics. The effect of perturbations on attention heads differs significantly from their effect on linear layers or activation-plus-linear structures, and varying perturbation 1 arXiv:2604.19724v1 [cs.LG] 21 Apr 2026 Benign Overfitting in Adversarial Training for Vision Transformers magnitudes can markedly influence the training dynamics of ViTs (A more detailed discussion is provided in Section 4). Thus, the benign overfitting behavior or its conditions for ViTs may be significantly different from previous models. To fill the gap, in this work, we provide the first comprehen- sive theoretical analysis of robust benign overfitting for a simplified ViT model. Specifically, 1. We validate that benign overfitting can also arise in adversarially trained Vision Transformers when the signal-to-noise ratio and the perturbation magnitude satisfy certain conditions, similar to linear and two- layer neural network models. That is, the adversarially trained interpolator attains near-zero robust training loss while maintaining small robust test error. 2.By analyzing the adversarial training dynamics of ViTs, we identify three key regimes: 1) Small perturbations yield trajectories close to clean training; 2) Moderate perturbations cause the attention mechanism to fail, such that the ViT collapses to a linear model; 3) Large perturbations lead to significant generalization error beyond benign overfitting. In all cases, we provide explicit upper bounds on the clean and robust test error. 3. We empirically verify our theoretical findings on both synthetic data and real-world data (MNIST, CIFAR-10, Tiny-ImageNet), demonstrating agreement between the derived bound and observed conditions for the occur- rence of benign overfitting. 2. Related Work Benign Overfitting. Benign overfitting refers to the phe- nomenon where a predictor perfectly fits (interpolates) noisy training data yet still achieves strong generalization performance on unseen data. (Bartlett et al., 2020) ana- lyzed benign overfitting in linear regression with Gaussian noise, showing that in high-dimensional (overparameter- ized) regimes, the excess risk of interpolation can be asymp- totically optimal. Foundational studies have further estab- lished benign overfitting in various linear settings, including regression, sparse regression, logistic regression, ridge re- gression, and kernel methods (Belkin et al., 2018; Bartlett et al., 2020; Hastie et al., 2022; Ding et al., 2024b;a). In neu- ral networks, (Frei et al., 2023) studied benign overfitting in two-layer networks without relying on the lazy training assumption in finite-width regimes. (Cao et al., 2022; Kou et al., 2023) examined benign overfitting in convolutional networks from a feature learning perspective. Recently, (Magen et al., 2024; Jiang et al., 2024; Sakamoto & Sato, 2024) investigated learning dynamics in Vision Transform- ers (ViTs), delineating the boundary between benign and harmful overfitting. (Frei & Vardi, 2024) also analyzed benign overfitting in trained Transformer classifiers within in-context learning setups. Benign Overfitting for Adversarial Training. (Chen et al., 2023) initiated the study of benign overfitting under ad- versarial training in the context of linear classifiers with sub-Gaussian mixture data, proving that under moderate perturbations, linear classifiers can achieve near-optimal standard and adversarial risks. Building on this line of work, (Wang et al., 2024) extended the analysis to two-layer networks and demonstrated that, regardless of whether the activation function is smooth or non-smooth, adversarial training can achieve near-optimal robust generalization er- ror. In contrast, (Hao & Zhang, 2024) showed that under non-negligible noise, linear regression and NTK regression models tend to overfit the training data, yielding estimators with inflated Lipschitz norms and consequently elevated adversarial risk. However, none of them considered and their conclusions do not hold for transformer architectures. Adversarial Robustness in Transformer. Adversarial training has been widely used to improve Transformer ro- bustness. For Vision Transformers (ViTs), Herrmann et al. (2022) proposed PyramidAT, combining consistent dropout and stochastic depth to alleviate performance degradation, while Wu et al. (2022) reduced computational cost via attention-guided dropping of patch embeddings. Gopal et al. (2025) introduced SAFER, a layer-selective fine-tuning method with sharpness-aware minimization to mitigate ad- versarial overfitting, and Islam et al. (2025) analyzed layer- wise perturbation propagation, proposing a neuron-level suppression mechanism. However, these works are purely empirical and lack theoretical guarantees. Recent studies have begun to analyze robustness from a theoretical per- spective in linear Transformer in-context learning, showing that robustness can be enhanced through adversarial training against hijacking attacks (Anwar et al.), short-suffix train- ing to defend long-suffix jailbreaks (Fu et al., 2025), and multi-task adversarial pretraining without downstream AT (Kumano et al., 2025). Yet, these analyses are restricted to the in-context learning setting with linear Transformers, and theoretical guarantees for adversarial robustness in general Transformer architectures remain an open problem. 3. Problem Setup In this section, we introduce the necessary definitions and formally describe the Gradient Descent-based Adversarial Training under the multi-patch data distribution and the two-layer Vision Transformer model. Notations. For two sequencesx n andy n , we write x n = O(y n )if there exist absolute constantsC > 0and N > 0such that|x n |≤ C|y n |for alln≥ N. Similarly, we writex n = Ω(y n )ify n = O(x n ). We sayx n = Θ(y n )if 2 Benign Overfitting in Adversarial Training for Vision Transformers bothx n = O(y n )andx n = Ω(y n ). Moreover,x n = o(y n ) iflim n→∞ |x n /y n | = 0. Finally, we use e O(·), e Ω(·), and e Θ(·)to denote the corresponding notations with logarithmic factors suppressed. Definition 3.1 (Data Generation Model). Letμ + ,μ − ∈ R d be fixed vectors representing the signals contained in data points, where∥μ + ∥ 2 = ∥μ − ∥ 2 = ∥μ∥ 2 and ⟨μ + ,μ − ⟩ = 0. Then each data point(X,y)withX = (x 1 , x 2 ,..., x M ) ⊤ ∈ R M×d andy ∈−1, 1is generated from the following distribution D: (1)The labelyis generated as a Rademacher random variable, i.e., P(y = 1) = P(y =−1) = 1 2 . (2) Ify = 1thenx 1 is given asμ + , ify =−1thenx 1 is given as μ − , which represents signals. (3) x 2 ,..., x M are given by noise vectorsξ 2 ,...,ξ M , generated i.i.d from the Gaussian distributionN (0,σ 2 p · (I−μ + μ ⊤ + ·∥μ∥ −2 2 −μ − μ ⊤ − ·∥μ∥ −2 2 ) , which represent noises. Our data generation model is motivated by the patch-level structure of real image data, where some patches encode class-relevant signals (e.g. semantic information) while others capture irrelevant noise (e.g. background artifacts). Similar constructions have been widely employed in the feature learning literature to analyze the generalization be- havior of overparameterized classifiers (Allen-Zhu & Li, 2020; Cao et al., 2022; Jelassi & Li, 2022; Kou et al., 2023; Zou et al., 2023; Jiang et al., 2024; Han et al., 2024; Ding et al., 2025). In our setup, the noise componentξis mod- eled as a Gaussian variable, with its covariance structure designed to remain orthogonal to the signal componentμ, ensuring that the data noise is independent of and unrelated to the feature. Two-layer Transformer. Following the architecture in- troduced by Jiang et al. (2024), we consider a simplified two-layer Transformer consisting of a self-attention layer followed by a fixed linear layer, defined as the following, where θ = (W Q , W K , W V ). f (X,θ) = 1 M M X l=1 φ(x ⊤ l W Q W ⊤ K X ⊤ )XW V w O .(1) Here,φ(·) : R M → R M denotes the softmax function; W Q , W K ∈ R d×d h andW V ∈ R d×d v represent the query, key, and value matrices, respectively; andw O ∈ R d v rep- resents the weight vector of the linear layer. We useθto denote the collection of all the model weights. This model is not reduced to a linear or single-layer attention architecture (Magen et al., 2024; Sakamoto & Sato, 2024); instead, it more closely resembles the structure of a real Transformer, with a correspondingly more complex parameter update pro- cess. Furthermore, our architecture readily extends to the multi-head attention mechanism, as detailed in Appendix C. Finally, the Feed-Forward Network (FFN) is simplified and subsumed into the value matrix W V . Loss Function. LetS = (X n ,y n ) N n=1 denote the train- ing dataset drawn from the distributionDdefined in Defini- tion 3.1, wherenindexes the samples (so(X n ,y n )repre- sents then-th sample). In this work, we adopt the empirical cross-entropy loss as a surrogate for the non-differentiable 0/1loss, and train the two-layer Transformer by minimizing this loss: L S (θ) = 1 N N X n=1 ℓ(y n f (X n ,θ)), whereℓ(z) = log(1 + exp(−z))andf (X,θ)is the two- layer Transformer. We measure the generalization ability of the two-layer Transformer using the test error, defined as the expected 0/1 loss over the data distribution D: L D (θ) = E (x,y)∼D 1 (yf (X,θ)≤ 0). Robust Loss. We considerℓ p -norm bounded(p≥ 2)adver- sarial perturbations 1 applied to each component of the input sequenceX = [x 1 ,..., x M ]∈X M , where eachx m ∈ R d denotes a token (or patch) embedding. For a perturbation budgetτ > 0, the admissible perturbation set isB(X,τ ) := e X = [ e x 1 ,..., e x M ] ∥ e x m − x m ∥ p ≤ τ, ∀m ∈ [M ] . Under this threat model, the robust0/1loss is defined asℓ 0/1 rob (yf (X,θ)) := max e X∈B(X,τ ) 1 y f ( e X,θ) ≤ 0 , and the robust loss is defined asℓ rob (y n f (X n ,θ)) := max e X n ∈B(X n ,τ ) ℓ y n f ( e X n ,θ) . The robust test error and robust test loss are: L rob D (θ) := E (X,y)∼D ℓ 0/1 rob (yf (X,θ)) L rob S (θ) := 1 N N X n=1 ℓ rob (y n f (X n ,θ)) Adversarial Training. We adopt a Gradient Descent-based Adversarial Training algorithm to update the network pa- rameters, as summarized in Algorithm 1. Note that we initialize the network weightsW Q ,W K , andW V with Gaussian distributions, where each entry ofW Q andW K is drawn fromN (0,σ 2 h ), and each entry ofW V is drawn fromN (0,σ 2 V ). The algorithm iteratively constructs adver- sarial training examples by maximizing the training loss with respect to the input and updates the model parameters based on them. In our setting, only the attention projection matricesW Q , W K , W V are updated during training, while the output vector w O remains fixed. 1 Our theory covers all norm attacks discussed in Appendix D; for simplicity, we only report the ℓ 2 -norm setting. 3 Benign Overfitting in Adversarial Training for Vision Transformers Algorithm 1 Gradient Descent-based Adversarial Training 1:Input: Learning rateη, perturbation budget per token τ , iterations T , init variance σ V ,σ h 2:Initialize:(W 0 Q , W 0 K ) ij ∼ N (0,σ 2 h ),(W 0 V ) ij ∼ N (0,σ 2 V ) i.i.d. and θ 0 ← (W 0 Q , W 0 K , W 0 V ) 3: for t = 0 to T − 1 do 4:// Phase 1: Generate Adversarial Examples 5:for n = 1 to N do 6: e X t n ← arg max e X∈B(X n ,τ ) ℓ y n f ( e X;θ t 7:end for 8:// Phase 2: Simultaneous Weight Update 9: θ t ← (W t Q , W t K , W t V ) 10: ∇L(θ t )← 1 N P N n=1 ∇ θ ℓ y n f ( e X t n ;θ t ) 11:Θ t+1 ← Θ t − η∇L(Θ t ) 12: end for 13: Output: Final weights θ T = (W T Q , W T K , W T V ) 4. Main Results In this section, we present our main theoretical results on the convergence and generalization of the ViT model, demon- strating how the signal-to-noise ratioSNR =∥μ∥ 2 /(σ p √ d) and the sample sizeNinfluence its adversarial training dy- namics. We first introduce the following conditions. Condition 4.1. Given a sufficiently small failure probability δ > 0 and a target training loss ε > 0, suppose that: (1)The dimensiondandd h are sufficiently large satisfyingd= e Ω ε −2 N 2 d h andd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 . (2) The training sample sizeNis large enough such that N = Ω(poly log(d)). (3)The number of input tokens is bounded asM = Θ(1), and theℓ 2 -norm of linear layer weights satisfies ∥w O ∥ 2 = Θ(1). (4)The learning rateηis chosen sufficiently small so that η≲ e O(min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h ). (5) The Gaussian initialization is appropriately chosen such that the standard deviationσ V satisfiesσ V ≤ e O(||w O || −1 2 · min∥μ|| −1 2 , (σ p √ d) −1 · d − 1 4 h d − 1 2 ) ,and the varianceσ 2 h satisfiesmin∥μ|| −2 2 , (σ 2 p d) −1 · d − 1 2 h · (log(6N 2 M 2 /δ)) −2 ≤ σ 2 h ≤ min∥μ|| −2 2 , (σ 2 p d) −1 · d − 1 2 h · (log(6N 2 M 2 /δ)) − 3 2 . (6) The target training loss is satisfyingε ≤ O(1/poly log(d)). Conditions (1) and (2) ensure that the learning problem is set in a sufficiently over-parameterized regime, allowing the model to fully capture the feature signal described in Definition 3.1. Condition (3) guarantees that each class contains enough samples with high probability. Condi- tions (4) and (5) simplify the analysis, though they can be generalized to the settingsM = Ω(1),∥w O ∥ 2 = o(1), or∥w O ∥ 2 = ω(1). Together, Conditions (4) and (5) fur- ther ensure that the Transformer can be effectively trained. Finally, Condition (6) ensures that the Transformer suffi- ciently overfits the training data. Similar conditions are widely made in the theoretical analysis of benign overfitting in neural networks (Allen-Zhu & Li, 2020; Cao et al., 2022; Frei et al., 2022; Jelassi & Li, 2022; Chatterji & Long, 2023; Zou et al., 2023; Kou et al., 2023; Frei & Vardi, 2024; Jiang et al., 2024). Theorem 4.2 (Benign Overfitting under Adversarial Train- ing). Under Condition 4.1, we distinguish two cases: Case 1. If we haveN · SNR 2 = Ω(1)andτ ≤ O( ∥μ∥ 2 logd h ), ViT’s attention head is effectively trainable . In this case, let T = Θ(η −1 ε −1 ∥μ∥ −2 2 ∥w O ∥ −2 2 ). Case 2. If we haveN· SNR 2 = Ω( 1 ε ) andω( ∥μ∥ 2 logd h )≤ τ ≤ O(∥μ∥ 2 ) , the attention head parameters barely update, causing the attention weights to remain nearly uniform and the ViT degenerates into a linear model . In this case, let T = M · Θ(η −1 ε −1 ∥μ∥ −2 2 ∥w O ∥ −2 2 ). In both cases, with probability at least1−d −1 , the following holds: 1. The robust training loss converges to ε: L rob S (θ(T ))≤ ε. 2. The clean test error satisfies: L D (θ(T ))≤ exp −C· d SNR 2 . 3. The robust test error satisfies: L rob D (θ(T ))≤ exp −C· d SNR 2 (1− τ ∥μ∥ 2 ) 2 . Theorem 4.2 demonstrates that , under the assumption onτ, the model attains adversarial robustness, while the SNR con- dition guarantees that it prioritizes the signal over the noise, thereby leading to benign overfitting. The adversarially- trained two-layer Transformer model exhibits three key ob- servations. 1) The model fits the training data well, with training loss converging toε. 2) For generalization guar- antee, the clean test error decays rapidly with increasing SNR, and obviously less thanεby Condition (2). This is consistent with classical benign overfitting phenomena established in prior work (Jiang et al., 2024). 3) For robust- ness guarantees, Theorem 4.2 provides an explicit upper bound on the robust test error as a function of the pertur- bation radiusτand the signal strength∥μ∥ 2 , showing that the bound increases with increasingτ, which is consist with prior empirical observations(Madry et al., 2017; Schmidt et al., 2018). The impact of perturbationτradius. Here, we give more discussion on the perturbation radiusτto illustrate how it 4 Benign Overfitting in Adversarial Training for Vision Transformers affects the different dynamics of ViTs, leading to the various results stated in Theorem 4.2. First, it can be observed that the softmax structure in attention is highly sensitive to pertur- bations according to Lemma 5.3. Whenτ ≤ O( ∥μ∥ 2 logd h ), ad- versarial perturbations do not dominate the learning dynam- ics, and the adversarial training trajectory of ViT remains close to standard clean training, corresponding to Case 1 in Theorem 4.2. In contrast, whenω( ∥μ∥ 2 logd h )≤ τ ≤ O(∥μ∥ 2 ) , the updates between signal and noise in attention are effec- tively canceled out by the perturbation, forcing attention weights to remain close to their initialized uniform distri- bution, under which ViT degenerates into a linear model, corresponding to Case 2 in Theorem 4.2. The relevant lem- mas will be provided in Section 5.2 later. The difference between ViT and degenerated linear model. Although both cases can achieve benign overfit- ting, the attention mechanism in ViTs in Case 1 enables the model to learn the signal more rapidly, leading to faster con- vergence, and allows it to extract useful information even from sparser signals. According to Theorem 4.2, for the de- generated linear model, the convergence timeTisMtimes slower than that of the ViT, and achieving benign overfitting requires a higher signal-to-noise ratio,N· SNR 2 = Ω(1/ε), highlighting the advantages of the ViT architecture. Comparison with prior work. The most closely related works to ours are (Chen et al., 2023; Wang et al., 2024), which also investigated the phenomenon of benign overfit- ting under adversarial training. However, Chen et al. (2023) focused on linear regression models with moderate pertur- bations, and Wang et al. (2024) studied simplified neural networks, leaving more complex architectures unexplored. Our results on ViTs therefore complement this line of re- search. In addition, even in the more complex setting, our analysis does not rely on the implicit assumption of a large ∥μ∥ 2 , i.e.,∥μ∥ 2 = Θ(d r )for somer ∈ (1/4, 1/2]in (Chen et al., 2023). Moreover, our results require a minimum convergence time ofT ∼ O(N maxSNR 2 , SNR −4 ), which is significantly smaller than the convergence time T ∼ O( d 2 ∥μ∥ 2 2 ε 2 )reported in prior studies on CNN models by (Wang et al., 2024) in the over-parameterized regime. Next, we show that once the perturbation radiusτexceeds the signal strength∥μ∥ 2 , no classifier can achieve nontriv- ial robust accuracy. This implies that excessive adversarial training leads to poor model performance, consistent with the findings of Wang et al. (2024). Combining with The- orem 4.2, we can see that the assumption regarding the relationship betweenτand∥μ∥ 2 is essential to understand- ing benign overfitting. Additionally, our radius for benign overfitting is almost tight. Theorem 4.3. For any given classifierf (·;θ), whenτ ≥ ∥μ∥ 2 , the robust test error satisfies L rob D (θ)≥ 0.25. Practical Guidelines for Adversarial Training on ViTs. Based on our theoretical framework, we provide several “take-away” tips for improving adversarial training for ViTs: 1. Optimal Selection of Perturbation Budget τ : our the- oretical analysis (Theorem 4.2) suggests that to maintain effective adversarial learning, one should choose the per- turbation budget τ ≤ O( ∥μ∥ 2 logd h ). 2.Balancing Sample ScaleNand Signal-to-Noise Ratio: Another key condition for preventing benign overfitting during adversarial training is ensuring that bothNand the SNR are large enough. In practice, researchers some- times employ data augmentation by injecting controlled noise into the dataset. From the perspective of our theo- retical results, this approach decreases theSNRwhile increasingN, since noise injection yields “new” data points. Because reducing the SNR may be harmful to generalization, it is important to ensure that a sufficiently large number of data points is used to train the model. Discussion on Multi-Norm Attacks. Forℓ p -norm (p ≥ 2), they can be mapped toℓ 2 through standard norm- equivalence∥x∥ 2 ≤ ∥x∥ p ≤ d 1 2 − 1 p ∥x∥ 2 . Thus, anℓ p perturbation budgetτcorresponds to anℓ 2 budget scaled by at mostd 1/2−1/p . This implies that all proofs still hold, with the only difference being the perturbation radius τ . For theℓ 0 -norm perturbation model, our theoretical lower bounds implicitly show that it cannot provide benign over- fitting guarantees. According to Theorem 4.3, once the ℓ 2 -norm perturbation radius becomes sufficiently large (i.e., τ ≥∥μ∥ 2 ), the model incurs a large robust test error. This implies that even anℓ 0 -norm radius of 1 can still lead to substantial robust test error in the worst case. 5. Proof Sketch In this section, we provide a proof sketch of the different adversarial training dynamics due to different perturbation radii. Based on the ViT formulation in Eq.(1), when the perturbations are relatively small, we show its impact on the learning of theW Q andW K matrices is limited. If more attention is allocated to signal tokens, the value matrixW V tends to align more closely with a perturbed signal vector e μ, while its direction remains dominated by the true signal μ. Consequently, the gradients propagated to the attention heads associated with the signal are larger than those to the noise, forming a positive feedback loop that facilitates better generalization, similar to the learning dynamics observed in the clean training (Jiang et al., 2024). When the pertur- bations are moderate, adversarial training suppresses the learning of token-to-signal attention, keeping the attention weights near their initialization. WhenW V andW K are 5 Benign Overfitting in Adversarial Training for Vision Transformers initialized with small Gaussian variance, the attention distri- bution remains nearly uniform, and the ViT degenerates into a linear model. In this regime, the model requires a larger SNR to alignW V w O with the signalμ, thereby achieving benign overfitting. 5.1. Vectorized Q & K and scalarized V with Time-Independent Directions First, unlike CNNs that treat convolutional kernels as vec- tors for signal–noise decomposition, our setting requires handling the more complex interactions among the ma- tricesW V ,W K , andW Q . Therefore, we consider vec- torizingW K , andW Q and scalarizingW V . To analyze the learning dynamics under iteration-dependent adversar- ial perturbations (as in Algorithm 1), we decompose the weight updates by projecting them onto a set of reference perturbed directions. Specifically, we fix a universal ref- erence e X = e μ, e ξ n,2 ,..., e ξ n,M within the perturbation ballB(X,τ ). Crucially, while the actual adversary e X (t) in Algorithm 1 changes per iteration, the following scalar- ization/vectorization relative to these reference directions allows us to track the growth of signal and noise components uniformly across the entire perturbation manifold. For example, for W V we have the following. Definition 5.1 (Scalarized V). LetW (t) V denote the V ma- trix of the ViT at thet-th iteration of adversarial training by Algorithm 1. For the fixed perturbed vectors above, there exist scalars γ (t) V,+ , γ (t) V,− , and ρ (t) V,n,i such that e μ ⊤ + W (t) V w O = e μ ⊤ + W (0) V w O + γ (t) V,+ ∥w O ∥ 2 2 , e μ ⊤ − W (t) V w O = e μ ⊤ − W (0) V w O + γ (t) V,− ∥w O ∥ 2 2 , e ξ ⊤ n,i W (t) V w O = e ξ ⊤ n,i W (0) V w O + ρ (t) V,n,i ∥w O ∥ 2 2 , for i∈ [M ]\1 and n∈ [N ]. We further denote theV (t) + := e μ ⊤ + W (t) V w O ,V (t) − := e μ ⊤ − W (t) V w O and V (t) n,i := e ξ ⊤ n,i W (t) V . With scalarizedVin Defintion 5.1, we can provide the dynamics of matrixW (t) V by analyzing the update of coeffi- cients γ (t) as follows: γ (t+1) V,+ = γ (t) V,+ − η NM X n∈S + e ℓ ′(t) n · " M X l=1 ⟨ e μ + , e μ (t) + ⟩φ( e x n,l W Q W ⊤ K ( e X n ) ⊤ ) 1 + M X i=2 M X l=1 ⟨ e μ + , e ξ (t) n,i ⟩φ( e x n,l W Q W ⊤ K ( e X n ) ⊤ ) i # . First, the perturbed signal and noise components break the orthogonality between signal and noise, resulting in the ap- pearance of terms of the form⟨ e μ + , e ξ (t) n,i ⟩. The upper bound of⟨ e μ + , e μ (t) + ⟩is given by(∥μ∥ 2 + τ ) 2 , while the upper bound of⟨ e μ + , e ξ (t) n,i ⟩is(∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 ). Therefore, when the perturbation magnitude is small, ⟨ e μ + , e μ (t) + ⟩dominates, and the training dynamics under ad- versarial training closely resemble those under clean train- ing. When boundingV (t) + (similar forV (t) − ), we can consider a special case e μ = e μ (t) and derive the bound via cumulative summation, yielding|V (t) + | ≤ |V (0) + | + P t−1 s=0 |γ (s+1) V,+ − γ (s) V,+ |·∥w O ∥ 2 2 by Definition 5.1. In fact, we establish that for any e μ ∈ B(μ,τ ), the quantity e μ ⊤ W (t) V w O admits a uniform upper bound. Similarly, we define vectorized W Q and W K as follows. Definition 5.2 (Vectorized Q & K.). LetW (t) Q andW (t) K be the QK matrices of the ViT at thet-th iteration of gradient descent. Then we define the vectorized Q and vectorized K as follows q (t) + = e μ ⊤ + W (t) Q , q (t) − = e μ ⊤ − W (t) Q , q (t) n,i = e ξ ⊤ n,i W (t) Q , k (t) + = e μ ⊤ + W (t) K , k (t) − = e μ ⊤ − W (t) K , k (t) n,i = e ξ ⊤ n,i W (t) K for i∈ [M ]\1,n∈ [N ]. With Definition 5.1 and 5.2, we can analyze the learning dynamics of the transformed coefficients rather than the original matrices. 5.2. Effects of Perturbation Magnitude on Attention Our second key technique is to analyze how the attention mechanism behaves under perturbations of varying magni- tudes. First, we present the following lemma, which shows that the attention mechanism is robust to small perturba- tions. Lemma5.3.UnderCondition4.1,suppose the perturbation satisfiesτ ≤ O( ∥μ∥ 2 logd h )and t ≥ Ω 1 η∥μ∥ 2 2 ∥w O ∥ 2 2 log(6N 2 M 2 /δ) .Then, there ex- ists a universal constant C ≤ e/2 such that max e X∈B(X,τ ) softmax ⟨q (t) , k (t) ⟩ min e X∈B(X,τ ) softmax ⟨q (t) , k (t) ⟩ ≤ C. This lemma implies that the relative change in attention weights under perturbations is uniformly bounded; hence, attention computed on perturbed inputs closely matches that on the clean inputs. Thus, when considering the at- tention from the perturbed patch to another, it can be well- 6 Benign Overfitting in Adversarial Training for Vision Transformers approximated by the attention from the clean signal to the clean noise. Next, we present the following lemma, which characterizes the behavior of the attention mechanism under moderate perturbations. Lemma 5.4. Under Condition 4.1, supposing the perturba- tion satisfiesω( ∥μ∥ 2 logd h )≤ τ ≤ O(∥μ∥ 2 ), for anyt≥ 0, we have: 1 M − o(1)≤ softmax(⟨q (t) , k (t) ⟩)≤ 1 M + o(1) This lemma demonstrates that, under moderate perturba- tions, the attention distribution remains invariant and stays close to its initial uniform form. 5.3. Generalization Guarantee For a new data point(X,y)generated from the distribution defined in Definition 3.1, we interpret the test error as the probability that the noise component dominates the output. For adversarial test data with added perturbations, we need to bound the maximal distance between them and the cor- responding clean test data. First, from the analysis in Sec- tion 5.1, we know that boundingV (t) = e x ⊤ W (t) V w O im- plies that its deviation from the unperturbed counterpart x ⊤ W V w O is at most ⟨ e x−x, W V w O ⟩ ≤ τ∥W V w O ∥ 2 . Second, from the analysis in Section 5.2, we know that the attention componentsoftmax(⟨q,k⟩)exhibits robustness under perturbations of bounded magnitude. Combining these insights, we state the following lemma. Lemma 5.5. Under Condition 4.1, if t ≥Ω η −1 ε −1 ∥μ∥ −2 2 ∥w O ∥ −2 2 log −1 6N 2 M 2 δ and τ ≤ ∥μ∥ 2 log(d h ) , we have: yf (X,θ(t))−min e X∈B(X,τ ) yf ( e X,θ(t))≲ M W (t) V w O 2 τ. As a result, the robust test error can be interpreted as the probability of misclassification when the output under clean test data is perturbed by its maximal adversarial deviation. Lemma 5.6. Under the same conditions of Lemma 5.5, with high probability, we have for some constant c > 0: P (∃ e X∈ B(X,τ ) : yf ( e X,θ(t))≤ 0) = P yf (X,θ(t)) + (yf (X,θ(t))−min e X∈B(X,τ) yf ( e X,θ(t)))≤ 0 ≤ exp − c( (V (t) + − V (t) − )−∥W (t) V w O ∥ 2 τ σ p ∥W (t) V w O ∥ 2 ) 2 . Consequently, the robust test error differs from the clean test error only by an additive factor that scales with both the perturbation radius and the model complexity. More details are in Appendix. 6. Experiments 6.1. Experimental Setup Datasets. For the experiments on synthetic data, we syn- thesize each sample following the distribution in Defini- tion 3.1. Specifically, we first formalize the two signal vectors in Definition 3.1 asμ + =∥μ∥ 2 · [1, 0,..., 0] ⊤ and μ − =∥μ∥ 2 · [0, 1, 0,..., 0] ⊤ , where the signal dimension dis set as1024. Then, for each generated sample, the num- berMof tokens in this sample is set as16and every noise vector in this sample is drawn independently from the Gaus- sian distributionξ i ∼N (0, 0.4· I d ). We generate up to22 samples for training and 100 samples for evaluation. For the experiments on real-world data, we employ MNIST, CIFAR-10, and Tiny-ImageNet. To better simulate the fea- ture learning setting in our theory, we transform each image to a vector with the following procedures: (1) Normalize the imageℓ 2 -norm to5to keep the same signal strength. (2) Add independent Gaussian noiseN (0,σ 2 )to each pixel to create a noise map, with the varianceσ 2 determining the SNR. (3) Superimpose this noise map onto the original clean image to produce the sample used for our experiments. Model architectures. For synthetic data experiments, we adopt the two-layer Transformer defined in (1), where both of the hidden dimensiond h and the value dimensiond v are set as128. For real-world data experiments, We implement realistic ViT architecture (Dosovitskiy et al., 2020) and a simplified ViT model consisting of two attention layers, each with four self-attention heads, followed by an MLP layer with ReLU activation. The hidden dimension of this ViT is set as128. Model parameters in all experiments are initialized by PyTorch’s default method, followed by an additional scaling factor of1/16, matching the requirement of Condition (5). Model training & evaluation. We use full-batch gradi- ent descent to train all models in our experiments, with a learning rate of0.1. Each model will be trained until its training loss falls below a target threshold0.01. Besides, in each adversarial training step, we leverage projected gradient descent (PGD; Madry et al. 2017) and state-of- the-art APGD (Croce & Hein, 2020) to generate adversar- ial examples under both singleℓ 2 -norm and multi-norm threat models. Forℓ 2 -norm PGD attack, we set base at- tack strengthτ/∥μ∥ 2 = 0.05for20steps with a step size of0.2τ, using per-tokenL 2 -normalized gradient updates with projection onto theL 2 ball of radiusτ. Detailed pa- rameters for APGD and multi-norm attacks are specified in Appendix B.2,B.3,B.4. To assess the performance of trained models, we report both their clean and robust classification errors calculated on test datasets. 7 Benign Overfitting in Adversarial Training for Vision Transformers (a) Clean Heatmap(b) Robust Heatmap(c) Clean Heatmap(d) Robust Heatmap Figure 1. Clean and robust test accuracy under adversarial training across various signal-to-noise ratios (SNR) and sample sizes (N). (a)&(b): results on synthetic data; (c)&(d): results on real-world data. High test accuracy is colored in yellow, whereas low test accuracy is colored in purple. (a) Training Loss(b) Robust Accuracy(c) Training Loss(d) Robust Accuracy Figure 2. (a)&(b): Curves of robust training loss and robust test accuracy versus training iteration under fixed training data number N = 22. (c)&(d): Curves of robust training loss and robust test accuracy versus training iteration under fixed data SNR = 12. 6.2. Results Analysis Phase Transition in benign overfitting. We perform ad- versarial training with different numberNof training data ranging from 2 to 22 and different SNR ranging from 0.16 to 16 on synthetic data. The clean and robust test accuracies of these models are collected and presented as heatmaps in Figures 1a and 1b. From the figure, we observe a clear deci- sion boundary in the form N · SNR 2 = Ω(1) separates the high-accuracy and low-accuracy regions. This observation aligns well with our Theorem 4.2 thatN · SNR 2 = Ω(1) is necessary for models in adversarial training to produce benign overfitting. To demonstrate the generality and robustness of our find- ings, we conduct an extensive suite of experiments spanning diverse datasets (MNIST, CIFAR-10, and Tiny-ImageNet), various threat models (PGD and state-of-the-art APGD at- tack (Croce & Hein, 2020)), and multiple norm constraints (ℓ 1 ,ℓ 2 , andℓ ∞ ). Notably, our conclusions remain remark- ably consistent across all these settings. Specifically, results on MNIST are shown in Figures 1c and 1d, while detailed evaluations on other datasets, multi-norm attacks, and realis- tic ViT-Base models (Dosovitskiy et al., 2020) are provided in Appendices B.2, B.3, and B.4, respectively. Effects of signal-to-noise ratio and dataset size. We then fix the numberNof training data and plot curves of the training loss/robust test accuracy versus the training itera- tion under different SNR in Figures 2a and 2b. From them, we observe that as the training iteration increases, the model overfits to training data, but its robustness does not consis- tently increase unless the SNR is large. We also fix the SNR and plot similar curves with different number of training data in Figures 2c and 2d, where we find that even the model is overfitting, its robustness improves only when the train- ing data numberNis large. All these results indicate that benign overfitting can emerge in adversarial training only when the training data numberNand the data SNR are both not too small, which coincides with the requirements that N· SNR 2 = Ω(1)orN· SNR 2 = Ω( 1 ε )in our Theorem 4.2. Empirical validation under varying perturbation radii. Our theoretical training dynamic of the different regimes is further supported by experiments in Appendix B.1, where we track the evolution of the attention mechanism and model weights across various perturbation radii τ . 7. Conclusion Our paper presents the first comprehensive theoretical anal- ysis of the generalization behavior after adversarial training on a two-layer Vision Transformer. We demonstrate that, un- der appropriate relationships between signal-to-noise ratio and perturbation magnitude, adversarially trained ViTs can interpolate the training data with vanishing robust loss while still achieving small robust test error. Our analysis reveals three perturbation regimes that clarify how adversarial train- ing shapes the learning dynamics of attention heads, from clean-like behavior to linear collapse and eventual failure beyond the benign regime. Empirical results on synthetic 8 Benign Overfitting in Adversarial Training for Vision Transformers data and real world data corroborate the theory, aligning closely with the predicted conditions under which robust benign overfitting emerges. Impact Statement This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here. References Allen-Zhu, Z. and Li, Y. Towards understanding ensem- ble, knowledge distillation and self-distillation in deep learning. arXiv preprint arXiv:2012.09816, 2020. Anwar, U., von Oswald, J., Kirsch, L., Krueger, D., and Frei, S. Understanding in-context learning of linear models in transformers through an adversarial lens. Transactions on Machine Learning Research. Bai, Y., Mei, J., Yuille, A. L., and Xie, C. Are transformers more robust than cnns? Advances in neural information processing systems, 34:26831–26843, 2021. Bartlett, P. L., Long, P. M., Lugosi, G., and Tsigler, A. Benign overfitting in linear regression. Proceedings of the National Academy of Sciences, 117(48):30063–30070, 2020. Belkin, M., Ma, S., and Mandal, S. To understand deep learning we need to understand kernel learning. In Inter- national conference on machine learning, p. 541–549. PMLR, 2018. Cao, Y., Gu, Q., and Belkin, M. Risk bounds for over- parameterized maximum margin classification on sub- gaussian mixtures. arXiv preprint arXiv:2104.13628, 2021. Cao, Y., Chen, Z., Belkin, M., and Gu, Q. Benign overfitting in two-layer convolutional neural networks. Advances in neural information processing systems, 35:25237–25250, 2022. Chatterji, N. S. and Long, P. M. Deep linear networks can benignly overfit when shallow ones do. Journal of Machine Learning Research, 24(117):1–39, 2023. Chen, J., Cao, Y., and Gu, Q. Benign overfitting in ad- versarially robust linear classification. In Uncertainty in Artificial Intelligence, p. 313–323. PMLR, 2023. Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, p. 2206–2216. PMLR, 2020. Ding, M., Ji, K., Wang, D., and Xu, J. Understanding forgetting in continual learning with linear regression. arXiv preprint arXiv:2405.17583, 2024a. Ding, M., Lei, M., Zhu, L., Wang, S., Wang, D., and Xu, J. Revisiting differentially private relu regression. Advances in Neural Information Processing Systems, 37:55470– 55506, 2024b. Ding, M., Lei, M., Fu, S., Wang, D., and Xu, J. Understand- ing private learning from feature perspective. In ICLR 2025 Workshop on Navigating and Addressing Data Prob- lems for Foundation Models, 2025. Dingeto, H. and Kim, J. Comparative study of adversarial defenses: Adversarial training and regularization in vision transformers and cnns. Electronics, 13(13):2534, 2024. Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. Frei, S. and Vardi, G. Trained transformer classifiers gen- eralize and exhibit benign overfitting in-context. arXiv preprint arXiv:2410.01774, 2024. Frei, S., Chatterji, N. S., and Bartlett, P. Benign overfitting without linearity: Neural network classifiers trained by gradient descent for noisy linear data. In Conference on Learning Theory, p. 2668–2703. PMLR, 2022. Frei, S., Vardi, G., Bartlett, P., and Srebro, N. Benign overfitting in linear classifiers and leaky relu networks from kkt conditions for margin maximization. In The Thirty Sixth Annual Conference on Learning Theory, p. 3173–3228. PMLR, 2023. Fu, S. and Wang, D. Theoretical analysis of robust over- fitting for wide dnns: An ntk approach. arXiv preprint arXiv:2310.06112, 2023. Fu, S., Ding, L., Zhang, J., and Wang, D. Short-length adversarial training helps llms defend long-length jail- break attacks: Theoretical and empirical evidence. arXiv preprint arXiv:2502.04204, 2025. Goodfellow, I., Bengio, Y., Courville, A., and Bengio, Y. Deep learning, volume 1. MIT Press, 2016. Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. Gopal, B., Yang, H., Horton, M., and Chen, Y. Safer: Sharpness aware layer-selective finetuning for enhanced robustness in vision transformers.arXiv preprint arXiv:2501.01529, 2025. 9 Benign Overfitting in Adversarial Training for Vision Transformers Han, A., Huang, W., Cao, Y., and Zou, D.On the feature learning in diffusion models. arXiv preprint arXiv:2412.01021, 2024. Hao, Y. and Zhang, T. The surprising harmfulness of be- nign overfitting for adversarial robustness. arXiv preprint arXiv:2401.12236, 2024. Hastie, T., Montanari, A., Rosset, S., and Tibshirani, R. J. Surprises in high-dimensional ridgeless least squares in- terpolation. Annals of statistics, 50(2):949, 2022. Herrmann, C., Sargent, K., Jiang, L., Zabih, R., Chang, H., Liu, C., Krishnan, D., and Sun, D. Pyramid adversarial training improves vit performance. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, p. 13419–13429, 2022. Hu, L., Liu, Y., Liu, N., Huai, M., Sun, L., and Wang, D. Seat: stable and explainable attention. In Proceedings of the AAAI Conference on Artificial Intelligence, vol- ume 37, p. 12907–12915, 2023. Hu, L., Liu, Y., Liu, N., Huai, M., Sun, L., and Wang, D. Improving interpretation faithfulness for vision transform- ers. In Forty-first International Conference on Machine Learning, 2024. Hu, L., Lai, S., Hua, Y., Yang, S., Zhang, J., and Wang, D. Stable vision concept transformers for medical diagno- sis. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, p. 317–332. Springer, 2025a. Hu, L., Wang, X., Liu, Y., Liu, N., Huai, M., Sun, L., and Wang, D. Towards stable and explainable attention mechanisms. IEEE Transactions on Knowledge and Data Engineering, 2025b. Islam, C. M., Chacko, S. J., Nishino, M., and Liu, X. Mecha- nistic understandings of representation vulnerabilities and engineering robust vision transformers. arXiv preprint arXiv:2502.04679, 2025. Jelassi, S. and Li, Y. Towards understanding how momen- tum improves generalization in deep learning. In Interna- tional Conference on Machine Learning, p. 9965–10040. PMLR, 2022. Jiang, J., Huang, W., Zhang, M., Suzuki, T., and Nie, L. Un- veil benign overfitting for transformer in vision: Training dynamics, convergence, and generalization. Advances in Neural Information Processing Systems, 37:135464– 135625, 2024. Kou, Y., Chen, Z., Chen, Y., and Gu, Q. Benign overfitting in two-layer relu convolutional neural networks. In Interna- tional conference on machine learning, p. 17615–17659. PMLR, 2023. Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012. Kumano, S., Kera, H., and Yamasaki, T. Adversarially pre- trained transformers may be universally robust in-context learners. arXiv preprint arXiv:2505.14042, 2025. Li, Z., Zhou, Z.-H., and Gretton, A. Towards an under- standing of benign overfitting in neural networks. arXiv preprint arXiv:2106.03212, 2021. Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, p. 10012–10022, 2021. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017. Magen, R., Shang, S., Xu, Z., Frei, S., Hu, W., and Vardi, G. Benign overfitting in single-head attention. arXiv preprint arXiv:2410.07746, 2024. Mei, S. and Montanari, A. The generalization error of random features regression: Precise asymptotics and the double descent curve. Communications on Pure and Applied Mathematics, 75(4):667–766, 2022. Mo, Y., Wu, D., Wang, Y., Guo, Y., and Wang, Y. When adversarial training meets vision transformers: Recipes from training to architecture. Advances in Neural Infor- mation Processing Systems, 35:18599–18611, 2022. Raghunathan, A., Xie, S. M., Yang, F., Duchi, J. C., and Liang, P. Adversarial training can hurt generalization. arXiv preprint arXiv:1906.06032, 2019. Sakamoto, K. and Sato, I.Benign overfitting in to- ken selection of attention mechanism. arXiv preprint arXiv:2409.17625, 2024. Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K., and Madry, A. Adversarially robust generalization requires more data. Advances in neural information processing systems, 31, 2018. Shao, R., Shi, Z., Yi, J., Chen, P.-Y., and Hsieh, C.-J. On the adversarial robustness of vision transformers. arXiv preprint arXiv:2103.15670, 2021. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 10 Benign Overfitting in Adversarial Training for Vision Transformers Tsigler, A. and Bartlett, P. L. Benign overfitting in ridge regression. Journal of Machine Learning Research, 24 (123):1–76, 2023. Vershynin, R. High-dimensional probability: An introduc- tion with applications in data science, volume 47. Cam- bridge university press, 2018. Wang, K., Muthukumar, V., and Thrampoulidis, C. Benign overfitting in multiclass classification: All roads lead to interpolation. In Advances in Neural Information Pro- cessing Systems (NeurIPS), volume 34, p. 14777–14790, 2021. Wang, Y., Zhang, K., and Arora, R. Benign overfitting in adversarial training of neural networks. In Forty-first International Conference on Machine Learning, 2024. Wu, B., Gu, J., Li, Z., Cai, D., He, X., and Liu, W. Towards efficient adversarial training on vision transformers. In European Conference on Computer Vision, p. 307–325. Springer, 2022. Xiao, J., Fan, Y., Sun, R., Wang, J., and Luo, Z.-Q. Stability analysis and generalization bounds of adversarial training. Advances in Neural Information Processing Systems, 35: 15446–15459, 2022. Xu, X., Kong, K., Liu, N., Cui, L., Wang, D., Zhang, J., and Kankanhalli, M. An llm can fool itself: A prompt-based adversarial attack. arXiv preprint arXiv:2310.13345, 2023. Zhang, S., Qian, Z., Huang, K., Wang, Q., Zhang, R., and Yi, X. Towards better robust generalization with shift consistency regularization. In International conference on machine learning, p. 12524–12534. PMLR, 2021. Zhou, M. and Ge, R. Implicit regularization leads to be- nign overfitting for sparse linear regression. In Inter- national Conference on Machine Learning, p. 42543– 42573. PMLR, 2023. Zou, D., Cao, Y., Li, Y., and Gu, Q. The benefits of mixup for feature learning. In International Conference on Ma- chine Learning, p. 43423–43479. PMLR, 2023. 11 Benign Overfitting in Adversarial Training for Vision Transformers A. Additional Related Work Differences in Adversarial Robustness Between Transformer and CNN. Several studies have compared Transformers and CNNs under adversarial attacks. Bai et al. (2021) observe that under unified training settings, Transformers are not inherently more robust, with their OOD generalization mainly attributed to self-attention. Mo et al. (2022) show that under standard training, Transformers do not necessarily outperform CNNs under adversarial attack, and propose training strategies to improve ViT robustness. Dingeto & Kim (2024) propose a regularization method that enables ViTs to exhibit stronger adversarial robustness than CNNs. These studies are largely empirical, focusing on performance differences, and do not analyze the learning dynamics or the role of attention in adversarial training. B. Additional Experiments B.1. Empirical validation of theoretical regimes In this section, we follow a similar setting as the experiments on synthetic data in Section 6, and add more experiments about training dynamics with different perturbation τ radius. Experiments setting. We focus on tracking the dynamics of attention entropy, training loss, andW V norm under benign overfitting regime with different perturbation τ radius, and the key parameters are as follows: • N = 25 • SNR = 16 • M = 2 • d = 1024 • d h = 512 • d v = 512 • σ p = 0.05 • τ ∥μ∥ 2 = 0.02, 0.1, 0.5 (a) Train Loss(b) Attention Entropy(c) W V Norm Figure 3. Training dynamics with different perturbation τ radius: attention entropy, training loss, and W V norm. Experiments results. 1. In Figure 3a, when τ ∥μ∥ 2 = 0.02or0.1, the adversarial training loss converges to zero, indicating that the model successfully interpolates all noise-corrupted training samples, consistent with the benign overfitting behavior in Theorem 4.2. In contrast, when τ ∥μ∥ 2 = 0.5, the adversarial training loss fails to decrease, aligning with the non-convergence regime characterized in Theorem 4.3. Moreover, the case τ ∥μ∥ 2 = 0.02exhibits a faster convergence rate than the τ ∥μ∥ 2 = 0.1 setting, highlighting the role of the attention mechanism in accelerating convergence, which is in agreement with our theoretical predictions in Theorem 4.2. 12 Benign Overfitting in Adversarial Training for Vision Transformers 2. In Figure 3b, when τ ∥μ∥ 2 = 0.02 , the attention entropy decreases to nearly zero, indicating that the attention mechanism correctly concentrates on the signal patch. This behavior is consistent with Case 1 of Theorem 4.2, where the perturbation level is sufficiently small for the model to recover the underlying signal structure. In contrast, when τ ∥μ∥ 2 = 0.1, the attention entropy fails to decrease and instead remains high, demonstrating that moderate perturbations hinder the learning of attention weights. As a result, the attention distribution remains nearly uniform rather than focusing on the signal patch. This phenomenon aligns with Case 2 of Theorem 4.2, where the perturbation magnitude prevents the attention mechanism from identifying the true signal. 3. In Figure 3c, when τ ∥μ∥ 2 = 0.1, the∥W V ∥ 2 norm exhibits the largest growth. This behavior is consistent with Case 2 of Theorem 4.2, where the ViT effectively collapses into a linear model and the value projectionW V becomes the dominant component driving the learning dynamics. In contrast, for τ ∥μ∥ 2 = 0.02 , the attention mechanism remains effective, so only mild updates toW V are required for the model to fit the noisy training data and achieve benign overfitting. When τ ∥μ∥ 2 = 0.5, the perturbation is too large for the model to learn meaningful structure, resulting in W V failing to make progress during training. B.2. Additional Experiments on MNIST, CIFAR-10 and Tiny-ImageNet with APGD In this section, we follow the same experimental setup as in Section 6 for the MNIST dataset and further extend our evaluation by conducting additional experiments on both MNIST,CIFAR-10 and Tiny-ImageNet under APGD attacks. These results demonstrate that our theoretical insights continue to hold for larger and more complex datasets, as well as under stronger adversarial attacks. Experiments setting. We conduct adversarial training using the state-of-the-art APGD attack model. For the MNIST dataset, we consider an attack strength of τ ∥μ∥ 2 = 0.05 , and vary the number of training samplesNfrom1000to6000and SNR from0.4to2. For the CIFAR-10 dataset, we set a weaker attack strength of τ ∥μ∥ 2 = 0.01, and vary the number of training samplesNfrom1000to10000and the SNR from0.4to10. For the Tiny-ImageNet dataset, we set a weaker attack strength of τ ∥μ∥ 2 = 0.10, and vary the number of training samples N from 100 to 1000 and the SNR from 0.4 to 10. Experiments results. The clean and robust test accuracies on MNIST, CIFAR-10 and Tiny-ImageNet are collected and presented as heatmaps in Figures 4, 5 and 6. In both figures, we observe a clear phase transition phenomenon. Moreover, as both the sample sizeNand the SNR increase, the clean and robust test error consistently decreases. This behavior is fully aligned with our theoretical analysis as well as the empirical findings reported in previous experiments. (a) Clean Heatmap(b) Clean Cutoff(c) Robust Heatmap(d) Robust Cutoff Figure 4. Clean and robust test accuracy heatmaps on MNIST with APGD attack across various signal-to-noise ratios (SNR) and sample sizes (N ). (b)&(d) are a heatmap that applies a cutoff value 0.93. B.3. Additional Experiments on Multi-Norm Attacks In this section, we follow the same experimental setup as in Section 6 for the MNIST dataset and further extend our evaluation by conducting additional experiments on both MNIST and CIFAR-10 under multi-norm attacks. These results demonstrate that although the model’s robust test accuracy decreases under multi-norm attacks, our theoretical insights continue to hold. Experiments setting. We perform adversarial training under a multi-norm PGD attack model spanningl 1 ,l 2 andl ∞ perturbations. 13 Benign Overfitting in Adversarial Training for Vision Transformers (a) Clean Heatmap(b) Clean Cutoff(c) Robust Heatmap(d) Robust Cutoff Figure 5. Clean and robust test accuracy heatmaps on CIFAR-10 with APGD attack across various signal-to-noise ratios (SNR) and sample sizes (N ). (b)&(d) are a heatmap that applies a cutoff value 0.65. (a) Clean Heatmap(b) Clean Cutoff(c) Robust Heatmap(d) Robust Cutoff Figure 6. Clean and robust test accuracy heatmaps on Tiny Imagenet with APGD attack across various signal-to-noise ratios (SNR) and sample sizes (N ). (b)&(d) are a heatmap that applies a cutoff value 0.70. For the MNIST dataset, we consider a base attack strength ofeps = τ 2 ∥μ∥ 2 = 0.05 , and set( τ 1 ∥μ∥ 2 , τ 2 ∥μ∥ 2 , τ ∞ ∥μ∥ 2 ) = (eps∗ 20, eps, eps/30). We vary vary the number of training samples N from 1000 to 6000 and SNR from 0.4 to 2. For the CIFAR-10 dataset, we set a weaker base attack strength ofeps = τ 2 ∥μ∥ 2 = 0.01, and set( τ 1 ∥μ∥ 2 , τ 2 ∥μ∥ 2 , τ ∞ ∥μ∥ 2 ) = (eps∗ 20, eps, eps/30). We vary vary the number of training samples N from 1000 to 10000 and the SNR from 0.4 to 10. Experiments results. The clean and robust test accuracies on MNIST and CIFAR-10 are collected and presented as heatmaps in Figures 7. We observe that although the robust test accuracy decreases under multi-norm attacks, a phase transition phenomenon still persists, and increasing either the sample sizeNor the SNR further reduces both clean and robust test error in a manner fully aligned with our theoretical results. (a) Clean Heatmap(b) Robust Heatmap(c) Clean Heatmap(d) Robust Heatmap Figure 7. Clean and robust test accuracy under multi-norm attack adversarial training across various signal-to-noise ratios (SNR) and sample sizes (N ). (a)&(b): results on MNIST data; (c)&(d): results on CIFAR-10 data. B.4. Additional Experiments on realistic ViT In this section, we conduct real-world experiments on image classification benchmarks, including MNIST, CIFAR-10, and Tiny-ImageNet, using a realistic ViT architecture (Dosovitskiy et al., 2020). The results show that when our model is scaled from the simplified two-layer ViT to a full-fledged ViT model, our theoretical insights continue to hold. 14 Benign Overfitting in Adversarial Training for Vision Transformers Experiments setting. We adoptgoogle/vit-base-patch16-224-in21k(Dosovitskiy et al., 2020) as the back- bone model to extend our analysis to real-world scenarios. To align with our theoretical setting, we freeze all parameters except for the QKV matrices in the final attention layer. This setup effectively treats all preceding layers as a fixed feature-extraction encoder, whose output serves as the input to the last Transformer layer. We conduct adversarial training on MNIST, CIFAR-10, and Tiny-ImageNet, using PGD as the threat model with a perturbation radius of ∥μ∥ 2 20 and 5 attack steps. Experiments results. The clean and robust test accuracies of ViT-base on MNIST, CIFAR-10 and Tiny-ImageNet are collected and presented as heatmaps in Figures 8. We observe that when the model is scaled from the simplified two-layer ViT to a realistic ViT architecture, a phase transition phenomenon still persists, and increasing either the sample sizeNor the SNR further reduces both clean and robust test error in a manner fully aligned with our theoretical results. (a) MNIST(b) CIFAR-10(c) Tiny-ImageNet Figure 8. Clean and robust test accuracy of ViT-base under adversarial training across various signal-to-noise ratios (SNR) and sample sizes (N). Top row: clean test accuracy. Bottom row: robust test accuracy. C. Extension to MHA We let the parameters beθ := (W Q,h ,W K,h ,W V,h ) H h=1 , whereW Q,h ,W K,h ∈ R d×d h andW V,h ∈ R d×d v for each h∈ [H]. HereHdenotes the number of attention heads, which we treat as a fixed constant. Under this parameterization, the network can be written as: f (X,θ) = H X h=1 f h (X,θ) where, f h (X,θ) = 1 M M X l=1 φ(x ⊤ l W Q,h W ⊤ K,h X ⊤ )XW V,h w O . The gradients in the multi-head attention module, ∂f h ∂W K,h , ∂f h ∂W Q,h , ∂f h ∂W V,h , remain unchanged. However, the gradient of the loss with respect to the output of each single head, i.e., ∂ℓ ∂f h , does change. 15 Benign Overfitting in Adversarial Training for Vision Transformers Intuitively, the model output increases by approximately anH-fold factor, which causes the scale of the lossℓ ′ to decrease accordingly. More concretely, following our analysis of the signal attention head,ℓ ′(t) = 1 M ± o(1)stay whent ≤ T 2 = Θ 1 η(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . Thus, this impliesf (T 2 ) h (X,θ) = o(1). TheH-fold increase in the multi-head model outputs does not alter this result, so the effect of the changes in ∂ℓ ∂f h can be ignored. Therefore, under the MHA setting, the training dynamics of the model still follow those of the single-head attention case, and our conclusions remain unchanged. D. Discussion on Multi-Norm Attacks Our analysis covers perturbations under all norm types. Forℓ ∞ orℓ 1 norms, they can be mapped toℓ 2 through standard norm-equivalence. For any x∈ R d and 1≤ p≤ q ≤∞, the following inequality holds: ∥x∥ q ≤ d ( 1 q − 1 p ) ∥x∥ p .(2) In particular, the ℓ ∞ and ℓ 1 norms satisfy: ∥x∥ ∞ ≤∥x∥ 2 ≤ √ d∥x∥ ∞ , ∥x∥ 2 ≤∥x∥ 1 ≤ √ d∥x∥ 2 .(3) Thus, anℓ ∞ orℓ 1 perturbation budgetτcorresponds to anℓ 2 budget scaled by at most √ d. This implies that all proofs still hold, with the only difference being the perturbation radius τ . For theℓ 0 -norm perturbation model, our theoretical lower bounds implicitly show that it cannot provide benign overfitting guarantees. According to Theorem 4.3, once theℓ 2 -norm perturbation radius becomes sufficiently large (i.e.,τ ≥∥μ∥ 2 ), the model incurs a large robust test error. This implies that even anℓ 0 -norm radius of 1 can still lead to substantial robust test error in the worst case. E. Basic Calculation E.1. Notion E.2. Update rules We fix a universal perturbed input f X = e μ, e ξ n,2 ,..., e ξ n,M , where e μ + ∈ B(μ + ,τ ), e μ − ∈ B(μ − ,τ ), and e ξ n,i ∈ B(ξ n,i ,τ ) are chosen once and remain fixed for all iterationst. These perturbations are universal and do not correspond to iteration-specific adversarial examples. Definition E.1 (Scalarized V). LetW (t) V be the V matrix of the ViT at thet-th iteration of adversarial training. Then there exist coefficients γ (t) V,+ ,γ (t) V,− ,ρ (t) V,n,i such that e μ ⊤ + W (t) V w O = e μ ⊤ + W (0) V w O + γ (t) V,+ ∥w O ∥ 2 2 , e μ ⊤ − W (t) V w O = e μ ⊤ − W (0) V w O + γ (t) V,− ∥w O ∥ 2 2 , e ξ ⊤ n,i W (t) V w O = e ξ ⊤ n,i W (0) V w O + ρ (t) V,n,i ∥w O ∥ 2 2 for i∈ [M ]\1,n∈ [N ]. We further denote theV (t) + := e μ ⊤ + W (t) V w O ,V (t) − := e μ ⊤ − W (t) V w O andV (t) n,i := e ξ ⊤ n,i W (t) V w O with time-independent perturbations, and e V (t) + := e μ (t)⊤ + W (t) V w O , e V (t) − := e μ (t)⊤ − W (t) V w O and e V (t) n,i := e ξ (t)⊤ n,i W (t) V w O with time-dependent perturbations, where e μ (t) + , e μ (t) − , e ξ (t) n,i is the adversarial sample at t-th iteration. We refer to it as scalarized V. Similarly, we define the vectorized queries and keys asq (t) ,k (t) with time-independent perturbations, and as e q (t) , e k (t) with time-dependent perturbations. 16 Benign Overfitting in Adversarial Training for Vision Transformers Table 1. Notations SymbolsDefinitions x n,i the i-th token in the n-th training sample if i∈ [M ]\1, x n,i = ξ n,i . φ (t) n,i the i-th row of attention for the n-th sample, i.e., φ (t) n,i := φ(x ⊤ n,i W (t) Q W (t)⊤ K X ⊤ n ) S + ,S − the training samples with +1 labels and -1 labels, i.e., S + :=n∈ [N ] : y n = 1, S − :=n∈ [N ] : y n =−1 q (t) + ,q (t) − ,q (t) n,i vectorized Q, defined as q (t) + = e μ ⊤ + W (t) Q ,q (t) − = e μ ⊤ − W (t) Q ,q (t) n,i = e ξ n,i W (t) Q k (t) + ,k (t) − ,k (t) n,i vectorized K, defined as k (t) + = e μ ⊤ + W (t) K ,k (t) − = e μ ⊤ − W (t) K ,k (t) n,i = e ξ n,i W (t) K V (t) + ,V (t) − ,V (t) n,i scalarized V, defined as V (t) + := e μ ⊤ + W (t) V w O ,V (t) − := e μ ⊤ − W (t) V w O ,V (t) n,i := e ξ ⊤ n,i W (t) V w O α (t) ±,± ,α (t) n,±,i linear combinations coefficients for the dynamics of q (t) + and q (t) − , i.e., q (t+1) ± −q (t) ± = α (t) ±,± k (t) ± + P n∈S ± P M i=2 α (t) n,±,i k (t) n,i α (t) n,i,± ,α (t) n,i,n ′ ,i ′ linear combinations coefficients for the dynamics of q (t) n,i , i.e., q (t+1) n,i −q (t) n,i = α (t) n,i,+ k (t) + + α (t) n,i,− k (t) − + P N n ′ =1 P M i ′ =2 α (t) n,i,n ′ ,i ′ k (t) n ′ ,i ′ β (t) ±,± ,β (t) n,±,i linear combinations coefficients for the dynamics of k (t) + and k (t) − , i.e., k (t+1) ± −k (t) ± = β (t) ±,± q (t) ± + P n∈S ± P M i=2 β (t) n,±,i q (t) n,i β (t) n,i,± ,β (t) n,i,n ′ ,i ′ linear combinations coefficients for the dynamics of k (t) n,i , i.e., k (t+1) n,i −k (t) n,i = β (t) n,i,+ q (t) + + β (t) n,i,− q (t) − + P N n ′ =1 P M i ′ =2 β (t) n,i,n ′ ,i ′ q (t) n ′ ,i ′ softmax(⟨q (t) ± ,k (t) ± ⟩)a general references to exp(⟨q (t) ± ,k (t) ± ⟩) exp(⟨q (t) ± ,k (t) ± ⟩)+ P M k=2 exp(⟨q (t) ± ,k (t) n,k ⟩) for n∈ S + ,i∈ [M ]\1, and exp(⟨q (t) ± ,k (t) ± ⟩) exp(⟨q (t) ± ,k (t) ± ⟩)+ P M k=2 exp(⟨q (t) ± ,k (t) n,k ⟩) for n∈ S − ,i∈ [M ]\1 softmax(⟨q (t) ± ,k (t) n,j ⟩)a general references to exp(⟨q (t) ± ,k (t) n,j ⟩) exp(⟨q (t) ± ,k (t) ± ⟩)+ P M k=2 exp(⟨q (t) ± ,k (t) n,k ⟩) for n∈ S + ,i,j ∈ [M ]\1, and exp(⟨q (t) ± ,k (t) n,j ⟩) exp(⟨q (t) ± ,k (t) ± ⟩)+ P M k=2 exp(⟨q (t) ± ,k (t) n,k ⟩) for n∈ S − ,i,j ∈ [M ]\1 softmax(⟨q (t) n,i ,k (t) n,j ⟩)a general references to exp(⟨q (t) n,i ,k (t) n,j ⟩) exp(⟨q (t) n,i ,k (t) n,+ ⟩)+ P M k=2 exp(⟨q (t) n,i ,k (t) n,k ⟩) for n∈ S + ,i,j ∈ [M ]\1, and exp(⟨q (t) n,i ,k (t) n,j ⟩) exp(⟨q (t) n,i ,k (t) n,− ⟩)+ P M k=2 exp(⟨q (t) n,i ,k (t) n,k ⟩) for n∈ S − ,i,j ∈ [M ]\1 Λ (t) n,±,j , Λ (t) n,i,±,j Λ (t) n,±,j :=⟨q (t) ± ,k (t) ± ⟩−⟨q (t) ± ,k (t) n,j ⟩, Λ (t) n,i,±,j :=⟨q (t) n,i ,k (t) ± ⟩−⟨q (t) n,i ,k (t) n,j ⟩ Definition E.2 (Vectorized Q & K). LetW (t) Q andW (t) K be the QK matrices of the ViT at thet-th iteration of adversarial training. Then we define the vectorized Q and vectorized K as follows q (t) + = e μ ⊤ + W (t) Q , q (t) − = e μ ⊤ − W (t) Q , q (t) n,i = e ξ ⊤ n,i W (t) Q , k (t) + = e μ ⊤ + W (t) K , k (t) − = e μ ⊤ − W (t) K , k (t) n,i = e ξ ⊤ n,i W (t) K , e q (t) + = e μ (t)⊤ + W (t) Q , e q (t) − = e μ (t)⊤ − W (t) Q , e q (t) n,i = e ξ (t)⊤ n,i W (t) Q , e k (t) + = e μ (t)⊤ + W (t) K , e k (t) − = e μ (t)⊤ − W (t) K , e k (t) n,i = e ξ (t)⊤ n,i W (t) K for i∈ [M ]\1,n∈ [N ]. Definition E.3 (Gradient Decomposition). There exist coefficientsα (t) +,+ ,α (t) n,+,i ,α (t) −,− ,α (t) n,−,i ,α (t) n,i,+ ,α (t) n,i,− ,α (t) n,i,n ′ ,i ′ , β (t) +,+ , β (t) n,+,i , β (t) −,− , β (t) n,−,i , β (t) n,i,+ , β (t) n,i,− , β (t) n,i,n ′ ,i ′ such that ∆q (t) + := q (t+1) + −q (t) + = α (t) +,+ k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i , 17 Benign Overfitting in Adversarial Training for Vision Transformers ∆q (t) − := q (t+1) − −q (t) − = α (t) −,− k (t) − + X n∈S − M X i=2 α (t) n,−,i k (t) n,i , ∆q (t) n,i := q (t+1) n,i −q (t) n,i = α (t) n,i,+ k (t) + + α (t) n,i,− k (t) − + N X n ′ =1 M X i ′ =2 α (t) n,i,n ′ ,i ′ k (t) n ′ ,i ′ , ∆k (t) + := k (t+1) + −k (t) + = β (t) +,+ q (t) + + X n∈S + M X i=2 β (t) n,+,i q (t) n,i , ∆k (t) − := k (t+1) − −k (t) − = β (t) −,− q (t) − + X n∈S − M X i=2 β (t) n,−,i q (t) n,i , ∆k (t) n,i := k (t+1) n,i −k (t) n,i = β (t) n,i,+ q (t) + + β (t) n,i,− q (t) − + N X n ′ =1 M X i ′ =2 β (t) n,i,n ′ ,i ′ q (t) n ′ ,i ′ . for i,i ′ ∈ [M ]\1 and n,n ′ ∈ [N ]. Lemma E.4 (Update Rule for V). The coefficientsγ (t) V,+ ,γ (t) V,− ,ρ (t) V,n,i defined in Definition 1 satisfy the following iterative equations: γ (t+1) V,+ = γ (t) V,+ − η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) γ (t+1) V,− = γ (t) V,− − η⟨ e μ − , e μ (t) − ⟩ NM X n∈S − e ℓ ′(t) n exp(⟨ e q (t) − , e k (t) − ⟩) exp(⟨ e q (t) − , e k (t) − ⟩) + P M k=2 exp(⟨ e q (t) − , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) − ⟩) exp(⟨ e q (t) n,j , e k (t) − ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ − , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) − , e k (t) n,i ⟩) exp(⟨ e q (t) − , e k (t) − ⟩) + P M k=2 exp(⟨ e q (t) − , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) − ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) , ρ (t+1) V,n,i = ρ (t) V,n,i − η NM X n ′ ∈S + e ℓ ′(t) n ′ ⟨ e ξ n,i , e μ (t) + ⟩ exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 ⟨ e ξ n,i , e μ (t) + ⟩ exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + M X i=2 ⟨ e ξ n,i , e ξ (t) n ′ ,i ′ ⟩ exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,i ′ ⟩) exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,i ′ ⟩) + P M k=2 exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,k ⟩) 18 Benign Overfitting in Adversarial Training for Vision Transformers + M X j=2 ⟨ e ξ n,i , e ξ (t) n ′ ,i ′ ⟩ exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,i ′ ⟩) exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,i ′ ⟩) + P M k=2 exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,k ⟩) − η NM X n ′ ∈S − (·) for i∈ [M ]\1,n∈ [N ]. Proof. The gradient of W V can be obtained using the chain rule as follows ∇ W V L S (θ) = 1 N N X n=1 y n ℓ ′ (y n f (X n ,θ))∇ W V f (X n ,θ) = 1 NM N X n=1 y n ℓ ′ n (θ) " w O M X l=1 φ(x n,l W Q W ⊤ K (X n ) ⊤ )X n # ⊤ Base on above, we have x ⊤ ∇ w V f L S (θ)w O = 1 NM X n∈S + e ℓ ′ n (θ) ⟨x, e μ + ⟩ exp( e μ ⊤ + W Q W ⊤ K e μ + ) exp( e μ ⊤ + W Q W ⊤ K e μ + ) + P M k=2 exp( e μ ⊤ + W Q W ⊤ K e ξ n,k ) + M X j=2 ⟨x, e μ + ⟩ exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) + P M k=2 exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,k ) + M X i=2 ⟨x, e ξ n,i ⟩ exp( e μ ⊤ + W Q W ⊤ K e ξ n,i ) exp( e μ ⊤ + W Q W ⊤ K e μ + ) + P M k=2 exp( e μ ⊤ + W Q W ⊤ K e ξ n,k ) + M X j=2 ⟨x, e ξ n,i ⟩ exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,i ) exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) + P M k=2 exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,k ) ∥w O ∥ 2 2 + 1 NM X n∈S − (·) where the second equality we expandX n into vectors and make inner products withx, the third equality we materializing all thex n,i (e.g.,x n,1 = μ + forn∈ S + ). Note the orthogonality betweenμandξ n,i , we can remove many of the terms in this equation. For any x = e μ ′ + ∈ B(μ + ,τ ), we have e μ ′ ⊤ + ∇ w V f L S (θ)w O = 1 NM X n∈S + e ℓ ′ n (θ) ⟨ e μ ′ + , e μ + ⟩ exp( e μ ⊤ + W Q W ⊤ K e μ + ) exp( e μ ⊤ + W Q W ⊤ K e μ + ) + P M k=2 exp( e μ ⊤ + W Q W ⊤ K e ξ n,k ) + M X j=2 ⟨ e μ ′ + , e μ + ⟩ exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) + P M k=2 exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,k ) + M X i=2 ⟨ e μ ′ + , e ξ n,i ⟩ exp( e μ ⊤ + W Q W ⊤ K e ξ n,i ) exp( e μ ⊤ + W Q W ⊤ K e μ + ) + P M k=2 exp( e μ ⊤ + W Q W ⊤ K e ξ n,k ) + M X j=2 ⟨ e μ ′ + , e ξ n,i ⟩ exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,i ) exp( e ξ ⊤ n,j W Q W ⊤ K e μ + ) + P M k=2 exp( e ξ ⊤ n,j W Q W ⊤ K e ξ n,k ) ∥w O ∥ 2 2 Then we have e μ ⊤ + W (t+1) V w O − e μ ⊤ + W (t) V w O = e μ ⊤ + (−η∇ W V e L S (θ(t)))w O 19 Benign Overfitting in Adversarial Training for Vision Transformers =− η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ∥w O ∥ 2 2 + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ∥w O ∥ 2 2 Dividing by∥w O ∥ 2 2 we get γ (t+1) V,+ = γ (t) V,+ − η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) This proves the update rule for γ (t) V,+ . The proof for γ (t) V,− and ρ (t) V,n,i is similar to it. Lemma E.5 (Update Rule for QK, Lemma B.3 in Jiang et al. (2024)). The dynamics ofx ⊤ W Q W K xcan be characterized as follows: ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ = α (t) + ∥k (t) + ∥ 2 2 + X n∈S + M X i=2 α (t) n,+,i ⟨k (t) + ,k (t) n,i ⟩ + β (t) + ∥q (t) + ∥ 2 2 + X n∈S + M X i=2 β (t) n,+,i ⟨q (t) + ,q (t) n,i ⟩ + α (t) + k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i · β (t) + q (t)⊤ + + X n∈S + M X i=2 β (t) n,+,i q (t)⊤ n,i , (4) 20 Benign Overfitting in Adversarial Training for Vision Transformers ⟨q (t+1) − ,k (t+1) − ⟩−⟨q (t) − ,k (t) − ⟩ = α (t) −,− ∥k (t) − ∥ 2 2 + X n∈S − M X i=2 α (t) n,−,i ⟨k (t) − ,k (t) n,i ⟩ + β (t) −,− ∥q (t) − ∥ 2 2 + X n∈S − M X i=2 β (t) n,−,i ⟨q (t) − ,q (t) n,i ⟩ + α (t) −,− k (t) − + X n∈S − M X i=2 α (t) n,−,i k (t) n,i · β (t) −,− q (t)⊤ − + X n∈S − M X i=2 β (t) n,−,i q (t)⊤ n,i , (5) ⟨q (t+1) n,i ,k (t+1) + ⟩−⟨q (t) n,i ,k (t) + ⟩ = α (t) n,i,+ ∥k (t) + ∥ 2 2 + α (t) n,i,− ⟨k (t) + ,k (t) − ⟩ + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l ⟨k (t) + ,k (t) n ′ ,l ⟩ + β (t) +,+ ⟨q (t) + ,q (t) n,i ⟩ + X n ′ ∈S + M X l=2 β (t) n ′ ,+,l ⟨q (t) n,i ,q (t) n ′ ,l ⟩ + α (t) n,i,+ k (t) + + α (t) n,i,− k (t) − + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l k (t) n ′ ,l ! · β (t) +,+ q (t)⊤ + + X n ′ ∈S + M X l=2 β (t) n ′ ,+,l q (t)⊤ n ′ ,l , (6) ⟨q (t+1) n,i ,k (t+1) − ⟩−⟨q (t) n,i ,k (t) − ⟩ = α (t) n,i,− ∥k (t) − ∥ 2 2 + α (t) n,i,+ ⟨k (t) + ,k (t) − ⟩ + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l ⟨k (t) − ,k (t) n ′ ,l ⟩ + β (t) −,− ⟨q (t) − ,q (t) n,i ⟩ + X n ′ ∈S − M X l=2 β (t) n ′ ,−,l ⟨q (t) n,i ,q (t) n ′ ,l ⟩ + α (t) n,i,+ k (t) + + α (t) n,i,− k (t) − + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l k (t) n ′ ,l ! · β (t) −,− q (t)⊤ − + X n ′ ∈S − M X l=2 β (t) n ′ ,−,l q (t)⊤ n ′ ,l , (7) 21 Benign Overfitting in Adversarial Training for Vision Transformers ⟨q (t+1) + ,k (t+1) n,j ⟩−⟨q (t) + ,k (t) n,j ⟩ = α (t) +,+ ⟨k (t) + ,k (t) n,j ⟩ + X n ′ ∈S + M X l=2 α (t) n ′ ,+,l ⟨k (t) n,j ,k (t) n ′ ,l ⟩ + β (t) n,j,+ ∥q (t) + ∥ 2 2 + β (t) n,j,− ⟨q (t) + ,q (t) − ⟩ + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l ⟨q (t) + ,q (t) n ′ ,l ⟩ + α (t) +,+ k (t) + + X n ′ ∈S + M X l=2 α (t) n ′ ,+,l k (t) n ′ ,l · β (t) n,j,+ q (t)⊤ + + β (t) n,j,− q (t)⊤ − + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l q (t)⊤ n ′ ,l ! , (8) ⟨q (t+1) − ,k (t+1) n,j ⟩−⟨q (t) − ,k (t) n,j ⟩ = α (t) −,− ⟨k (t) − ,k (t) n,j ⟩ + X n ′ ∈S − M X l=2 α (t) n ′ ,−,l ⟨k (t) n,j ,k (t) n ′ ,l ⟩ + β (t) n,j,− ∥q (t) − ∥ 2 2 + β (t) n,j,+ ⟨q (t) + ,q (t) − ⟩ + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l ⟨q (t) − ,q (t) n ′ ,l ⟩ + α (t) −,− k (t) − + X n ′ ∈S − M X l=2 α (t) n ′ ,−,l k (t) n ′ ,l · β (t) n,j,+ q (t)⊤ + + β (t) n,j,− q (t)⊤ − + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l q (t)⊤ n ′ ,l ! , (9) ⟨q (t+1) n,i ,k (t+1) n,j ⟩−⟨q (t) n,i ,k (t) n,j ⟩ = α (t) n,i,+ ⟨k (t) + ,k (t) n,j ⟩ + α (t) n,i,− ⟨k (t) − ,k (t) n,j ⟩ + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l ⟨k (t) n ′ ,l ,k (t) n,j ⟩ + β (t) n,j,+ ⟨q (t) + ,q (t) n,i ⟩ + β (t) n,j,− ⟨q (t) − ,q (t) n,i ⟩ + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l ⟨q (t) n ′ ,l ,q (t) n,i ⟩ + α (t) n,i,+ k (t) + + α (t) n,i,− k (t) − + N X n ′ =1 M X l=2 α (t) n,i,n ′ ,l k (t) n ′ ,l ! · β (t) n,j,+ q (t)⊤ + + β (t) n,j,− q (t)⊤ − + N X n ′ =1 M X l=2 β (t) n,j,n ′ ,l q (t)⊤ n ′ ,l ! , (10) for i,j ∈ [M ]\1,n∈ [N ]. F. Concentration Inequalities In this section, we will give some concentration inequalities that show some important properties of the data and the ViT parameters at random initialization. Lemma F.1 (Lemma B.1 in Cao et al. (2022)). Suppose thatδ > 0andn ≥ 8 log(4/δ). Then with probability at least 1− δ, N 4 ≤|n∈ [N ] : y n = 1|,|n∈ [N ] : y n =−1|≤ 3N 4 . 22 Benign Overfitting in Adversarial Training for Vision Transformers Lemma F.2 (Initialization of V, Lemma C.2 in Jiang et al. (2024)). Suppose thatδ > 0. Then with probability at least1− δ, |V (0) ± |≤ d − 1 4 h , |V (0) n,i |≤ d − 1 4 h for i∈ [M ]\1,n∈ [N ]. Lemma F.3 (Initialization of QK, Lemma C.3 in Jiang et al. (2024)). Suppose thatδ > 0. Then with probability at least1−δ, ∥μ∥ 2 2 σ 2 p d h 2 ≤∥q (0) ± ∥ 2 2 ≤ 3∥μ∥ 2 2 σ 2 p d h 2 , σ 2 p σ 2 h d h 2 ≤∥q (0) n,i ∥ 2 2 ≤ 3σ 2 p σ 2 h d h 2 , ∥μ∥ 2 2 σ 2 p d h 2 ≤∥k (0) ± ∥ 2 2 ≤ 3∥μ∥ 2 2 σ 2 p d h 2 , σ 2 p σ 2 h d h 2 ≤∥k (0) n,i ∥ 2 2 ≤ 3σ 2 p σ 2 h d h 2 , |⟨q (0) + ,q (0) − ⟩|≤ 2∥μ∥ 2 2 σ 2 h · p d h log(6N 2 M 2 /δ), |⟨q (0) ± ,q (0) n,i ⟩|≤ 2∥μ∥ 2 σ p σ 2 h d 3 2 · p d h log(6N 2 M 2 /δ), |⟨k (0) ± ,k (0) ± ⟩|≤ 2∥μ∥ 2 2 σ 2 h · p d h log(6N 2 M 2 /δ), |⟨q (0) ± ,k (0) ± ⟩|≤ 2∥μ∥ 2 2 σ 2 h · p d h log(6N 2 M 2 /δ), |⟨q (0) ± ,k (0) ∓ ⟩|≤ 2∥μ∥ 2 2 σ 2 h · p d h log(6N 2 M 2 /δ), |⟨q (0) n,i ,k (0) ± ⟩|≤ 2∥μ∥ 2 σ p σ 2 h d 3 2 · p d h log(6N 2 M 2 /δ), |⟨q (0) n,i ,q (0) n ′ ,j ⟩|≤ 2σ 2 p σ 2 h d· p d h log(6N 2 M 2 /δ), |⟨k (0) n,i ,k (0) n ′ ,j ⟩|≤ 2σ 2 p σ 2 h d· p d h log(6N 2 M 2 /δ), |⟨k (0) ± ,k (0) n,i ⟩|≤ 2∥μ∥ 2 σ p σ 2 h d 3 2 · p d h log(6N 2 M 2 /δ), |⟨q (0) ± ,k (0) n,i ⟩|≤ 2∥μ∥ 2 σ p σ 2 h d 3 2 · p d h log(6N 2 M 2 /δ), |⟨q (0) n,i ,k (0) n ′ ,j ⟩|≤ 2σ 2 p σ 2 h d· p d h log(6N 2 M 2 /δ) for i,j ∈ [M ]\1 and n,n ′ ∈ [N ]. Lemma F.4 (Lemma B.2 in Cao et al. (2022) and Lemma B.4 in Kou et al. (2023)). Suppose thatδ > 0andd = Ω(log(4NM/δ)). Then with probability at least 1− δ σ 2 p d 2 ≤∥ξ n,i ∥ 2 2 ≤ 3σ 2 p d 2 , |⟨ξ n,i ,ξ n ′ ,i ′ ⟩|≤ 2σ 2 p · p d log(4N 2 M 2 /δ), σ 2 p d 2 − 2σ p τ p 2 log(4NM/δ)− τ 2 ≤∥ e ξ n,i ∥ 2 2 ≤ 3σ 2 p d 2 + 2σ p τ p 2 log(4NM/δ) + τ 2 , (∥μ∥ 2 − τ ) 2 ≤⟨ e μ ± , e μ ′ ± ⟩≤ (∥μ∥ 2 + τ ) 2 , |⟨ e μ ± , e ξ n,i ⟩|≤∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 |⟨ e ξ n,i , e ξ n ′ ,i ′ ⟩|≤ 2σ 2 p · p d log(4N 2 M 2 /δ) + 2σ p τ p 2 log(4NM/δ) + τ 2 for i,i ′ ∈ [M ]\1,n,n ′ ∈ [N ],i̸= i ′ or n̸= n ′ . G. Benign Overfitting in Case 1 In this section, we consider the benign overfitting regime under the condition thatN · SNR 2 = Ω(1)andτ ≤ O( ∥μ∥ 2 logd h ). We analyze the dynamics ofV ± ,V n,i , the inner productq ± ,q n,i , andk ± ,k n,i during adversarial training, and further give 23 Benign Overfitting in Adversarial Training for Vision Transformers the upper bound for clean test error and robust test error. The proofs in this section are based on the results in Section F, which hold with high probability. G.1. Stage i In Stage I,V (t) ± ,V (t) n,i begin to pull apart until|V (t) ± |is sufficiently larger than|V (t) n,i |. At the same time, the inner products of q and k maintain their magnitude. Lemma G.1 (Gradient of Loss). As long asmax|V (t) + |,|V (t) − |,|V (t) n,i | = o(1), we have−ℓ ′ (y n f ( e X n ,θ(t)))remains 1/2± o(1). Proof.Note thatℓ(z) = log(1 + exp(−z))and−ℓ ′ = exp(−z)/(1 + exp(−z)), without loss of generality, we assume y n = 1, we have −ℓ ′ (f ( e X n ,θ(t))) = 1 1 + exp 1 M P M l=1 φ( e x ⊤ n,l W (t) Q W (t)⊤ K e X n ) e X ⊤ n W (t) V w O . Note that − max|V (t) + |,|V (t) − |,|V (t) n,i |≤ 1 M M X l=1 φ( e x ⊤ n,l W (t)⊤ Q e X ⊤ n ) e X n W (t) V w O ≤ max|V (t) + |,|V (t) − |,|V (t) n,i |. Then we have −ℓ ′ (f ( e X n ,θ(t)))≥ 1 1 + exp(0 + o(1)) ≥ 1 2 + o(1) ≥ 1 2 − o(1), −ℓ ′ (f ( e X n ,θ(t)))≤ exp(0 + o(1)) 1 + exp(0 + o(1)) ≤ 1 + o(1) 1 + 1 + o(1) ≤ 1 2 + o(1). Lemma G.2 (Bound of Attention). As long as|⟨q (t) ± , k (t) ± ⟩|,|⟨q (t) n,i , k (t) ± ⟩|,|⟨q (t) ± , k (t) n,j ⟩|,|⟨q (t) n,i , k (t) n,j ⟩| = o(1), we have 1 M − o(1)≤ softmax(⟨q (t) ± , k (t) ± ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) n,i , k (t) ± ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) ± , k (t) n,j ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) n,i , k (t) n,j ⟩)≤ 1 M + o(1). Proof. It is clear that exp(o(1)) = 1 + o(1). Therefore, as long as|⟨q (t) ± , k (t) ± ⟩| = o(1), we have 1 M − o(1) = 1 1 + (M − 1) + (M − 1)o(1) = 1 1 + (M − 1) exp(o(1)) = = exp(−o(1)) exp(−o(1)) + (M − 1) exp(o(1)) ≤ softmax(⟨q (t) ± , k (t) ± ⟩)≤ exp(o(1)) exp(o(1)) + (M − 1) exp(−o(1)) = exp(o(1)) exp(o(1)) + (M − 1) = 1 + o(1) 1 + o(1) + (M − 1) = 1 M + o(1) Similarly, we have 1 M − o(1)≤ softmax(⟨q (t) n,i , k (t) ± ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) ± , k (t) n,j ⟩)≤ 1 M + o(1), 24 Benign Overfitting in Adversarial Training for Vision Transformers 1 M − o(1)≤ softmax(⟨q (t) n,i , k (t) n,j ⟩)≤ 1 M + o(1). Lemma G.3 (Upper bound of V). LetT 0 =O 1 ηd 1 4 h (∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . Then under the same conditions as Theorem 4.2 we have |V (t) + |,|V (t) − |,|V (t) n,i | =O(d − 1 4 h ) for t∈ [0,T 0 ]. Proof. By Lemma E.4, we have |γ (t+1) V,+ − γ (t) V,+ |≤− η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ∥w O ∥ 2 2 + −η⟨ e μ + , e ξ (t) n,i ⟩ NM X n∈S + M X i=2 exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ≤ η(∥μ∥ 2 + τ ) 2 NM · 3N 4 (1 + (M − 1)) + η(∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 ) NM · 3N 4 M (M − 1) ≤ O(η(∥μ∥ 2 + τ ) 2 ), where the second inequality is by Lemma F.1 and Lemma F.4 and− e ℓ ′(t) n ≤ 1. Similarly, we have |γ (t+1) V,− − γ (t) V,− |≤ O(η(∥μ∥ 2 + τ ) 2 ). By Definition E.1, we have |V (t) + | =|V (0) + + t−1 X s=0 (γ (s+1) V,+ − γ (s) V,+ )∥w O ∥ 2 2 | ≤|V (0) + | + t−1 X s=0 |γ (s+1) V,+ − γ (s) V,+ |·∥w O ∥ 2 2 ≤ d − 1 4 h + O(η(∥μ∥ 2 + τ ) 2 )·∥w O ∥ 2 2 · O 1 ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 ! = O(d − 1 4 h ), where the first inequality is by triangle inequality, the second inequality is by Lemma F.2. Similarly, we have|V (t) − | = 25 Benign Overfitting in Adversarial Training for Vision Transformers O(d − 1 4 h ). By Lemma E.4, we have |ρ (t+1) V,n,i − ρ (t) V,n,i |≤ − η NM X n ′ ∈S + e ℓ ′(t) n ′ ⟨ e ξ n,i , e μ (t) + ⟩ exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 ⟨ e ξ n,i , e μ (t) + ⟩ exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + M X i=2 ⟨ e ξ n,i , e ξ (t) n ′ ,i ′ ⟩ exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,i ′ ⟩) exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,i ′ ⟩) + P M k=2 exp(⟨ e q (t) n ′ ,i ′ , e k (t) n ′ ,k ⟩) + M X j=2 ⟨ e ξ n,i , e ξ (t) n ′ ,i ′ ⟩ exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,i ′ ⟩) exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,i ′ ⟩) + P M k=2 exp(⟨ e q (t) n ′ ,j , e k (t) n ′ ,k ⟩) − η NM X n ′ ∈S − (·) ≤ 3ησ 2 p d 2NM · M + η NM · MN · 2σ 2 p · p d log(4N 2 M 2 /δ) + η(∥μ∥τ + (2M − 1)σ p τ p 3d/2 + Mτ 2 ) NM · NM ≤ 2ησ 2 p d N + η(∥μ∥τ + σ p τ p 2 log(4MN/δ) + τ 2 ) NM · NM 2 = O(η(max(∥μ∥ 2 + τ ) 2 , σ 2 p d N )) = O(η(∥μ∥ 2 + τ ) 2 ) where the second inequality is by Lemma F.4 and−ℓ ′(t) n ≤ 1 , the third inequality is byd = e Ω(ε −2 N 2 d h ) ≥ 4N p log(4N 2 M 2 /δ), the last inequality is by N · SNR 2 = Ω(1). Then by Definition E.1, we have |V (t) n,i | =|V (0) n,i + t−1 X s=0 (ρ (s+1) V,n,i − ρ (s) V,n,i )∥w O ∥ 2 2 | ≤|V (0) n,i | + t−1 X s=0 |ρ (s+1) V,n,i − ρ (s) V,n,i |·∥w O ∥ 2 2 ≤ d − 1 4 h + O(η(∥μ∥ 2 + τ ) 2 )·∥w O ∥ 2 2 · O 1 ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 ! = O(d − 1 4 h ), where the first inequality is by triangle inequality, the second inequality is by Lemma C.2, which completes the proof. Lemma G.4 (Inner Products Hold Magnitude). LetT 0 = O 1 ηd 1 4 h (∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . Then under the same conditions as Theorem 4.2, we have |⟨q (t) ± ,k (t) ± ⟩|,|⟨q (t) n,i ,k (t) ± ⟩|,|⟨q (t) ± ,k (t) n,j ⟩|,|⟨q (t) n,i ,k (t) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨q (t) ± ,q (t) ∓ ⟩|,|⟨q (t) n,i ,q (t) ∓ ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| 26 Benign Overfitting in Adversarial Training for Vision Transformers = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨k (t) ± ,k (t) ∓ ⟩|,|⟨k (t) n,i ,k (t) ± ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ(σ 2 p σ 2 h d h ) for i,j ∈ [M ]\1, n,n ′ ∈ [N ] and t∈ [0,T 0 ]. The proof for Lemma G.4 is in Section J.4. Note thatσ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h · (log(6N 2 M 2 /δ)) − 3 2 , thus O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · √ d h log(6N 2 M 2 /δ) = o(1). Lemma G.5 (V’s Beginning of Learning Signals). Under the same conditions as Theorem 4.2, there exists T 1 = 10M (3M + 1)N ηd 1 4 h N (∥μ∥ 2 − τ ) 2 − (N + 30M 2 )(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 )− 60M 2 σ 2 p d ∥w O ∥ 2 such that the first element of the vector e X n W (t) V w O dominates its other elements, that is, V (t) + ≥ 3M ·|V (t) n,i |,for all n∈ S + , i∈ [M ]\1, V (t) − ≤−3M ·|V (t) n,i |,for all n∈ S − , i∈ [M ]\1. Proof. Let C be a constant larger than 10M (3M + 1). As long as N (∥μ∥ 2 − τ ) 2 − (N + 30M 2 )(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 )− 60M 2 σ 2 p d≥ 10M (3M + 1) C N (∥μ∥ 2 + τ ) 2 . Thus, we further get T 1 = 10M (3M + 1)N ηd 1 4 h N (∥μ∥ 2 − τ ) 2 − (N + 30M 2 )(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 )− 60M 2 σ 2 p d ∥w O ∥ 2 ≤ C ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 =O 1 ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 ! , which satisfies the time condition in Lemma G.3 and Lemma G.4. Then by Lemma G.1 and Lemma G.2 we have: −ℓ ′(t) n = 1 2 ± o(1), 1 M − o(1)≤ softmax(⟨q (t) + ,k (t) + ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) n,i ,k (t) + ⟩)≤ 1 M + o(1), 1 M − o(1)≤ softmax(⟨q (t) n,i ,k (t) n,j ⟩)≤ 1 M + o(1). For i,j ∈ [M ]\1, n∈ [N ], and t∈ [0,T 1 ], plugging these into the update rule for γ (t) V + shown in Lemma E.4, we have: 27 Benign Overfitting in Adversarial Training for Vision Transformers γ (t+1) V + − γ (t) V + =− η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ≥ η(∥μ∥ 2 − τ ) 2 2 NM · N 4 · 1 2 ± o(1) · M 1 M ± o(1) − η(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) NM · N 4 · 1 2 ± o(1) · M (M − 1) 1 M ± o(1) ≥ η (∥μ∥ 2 − τ ) 2 2 − (∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) 10M Then by Definition E.1 and summing over T 1 steps, we have: V (T 1 ) + ≥−|V (0) + | + T 1 · η (∥μ∥ 2 − τ ) 2 2 − (∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) 10M ·∥w O ∥ 2 2 =−d − 1 4 h + T 1 · η (∥μ∥ 2 − τ ) 2 2 − (∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) 10M ·∥w O ∥ 2 2 (11) Similarly, we have: V (T 1 ) − ≤ d − 1 4 h − T 1 · η (∥μ∥ 2 − τ ) 2 2 − (∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) 10M ·∥w O ∥ 2 2 (12) Similarly, by the bound |ρ V (t+1) n,i − ρ V (t) n,i |≤ 2ησ 2 p d N + η(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) given in equation (11), we have |V (T 1 ) n,i |≤|V (0) n,i | + T 1 · 2ησ 2 p d N + η(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) ! ·∥w O ∥ 2 2 = d − 1 4 h + T 1 · 2ησ 2 p d N + η(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) ! ·∥w O ∥ 2 2 (13) According to equations (11), (12), and (13), it is easy to verify that V (T 1 ) + − 3M ·|V (T 1 ) n,i |≥ 0 and V (T 1 ) − + 3M ·|V (T 1 ) n,i |≤ 0, which completes the proof. 28 Benign Overfitting in Adversarial Training for Vision Transformers G.2. Stage i In stage I,⟨q + ,k + ⟩,⟨q n,i ,k + ⟩grows while⟨q + ,k n,j ⟩,⟨q n,i ,k n,j ⟩decreases, resulting in attention focusing more and more on the signals and less on the noises. By the results of stage I, we have the following conditions at the beginning of stage I V (T 1 ) + ≥ 3M ·|V (T 1 ) n,i |, V (T 1 ) − ≤−3M ·|V (T 1 ) n,i |, |V (T 1 ) + |,|V (T 1 ) − |,|V (T 1 ) n,i | = O(d − 1 4 h ), |⟨q (T 1 ) ± ,k (T 1 ) ± ⟩|,|⟨q (T 1 ) n,i ,k (T 1 ) ± ⟩|,|⟨q (T 1 ) ± ,k (T 1 ) n,j ⟩|,|⟨q (T 1 ) n,i ,k (T 1 ) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨q (T 1 ) ± ,q (T 1 ) ∓ ⟩|,|⟨q (T 1 ) n,i ,q (T 1 ) ± ⟩|,|⟨q (T 1 ) n,i ,q (T 1 ) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨k (T 1 ) ± ,k (T 1 ) ± ⟩|,|⟨k (T 1 ) n,i ,k (T 1 ) ± ⟩|,|⟨k (T 1 ) n,i ,k (T 1 ) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , ∥q (T 1 ) ± ∥ 2 ,∥k (T 1 ) ± ∥ 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (T 1 ) n,i ∥ 2 ,∥k (T 1 ) n,i ∥ 2 = Θ(σ 2 p σ 2 h d h ) for i,j ∈ [M ]\1,n,n ′ ∈ [N ]. Notations. To better characterize the gap between different inner products, we define the following notations: • denote Λ (t) n,+,j =⟨q (t) + ,k (t) + ⟩−⟨q (t) + ,k (t) n,j ⟩, n∈ S + . • denote Λ (t) n,−,j =⟨q (t) − ,k (t) − ⟩−⟨q (t) − ,k (t) n,j ⟩, n∈ S − . • denote Λ (t) n,i,+,j =⟨q (t) n,i ,k (t) + ⟩−⟨q (t) n,i ,k (t) n,j ⟩, n∈ S + . • denote Λ (t) n,i,−,j =⟨q (t) n,i ,k (t) − ⟩−⟨q (t) n,i ,k (t) n,j ⟩, n∈ S − . Lemma G.6 (Upper bound of V). LetT 0 = O 1 η(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 log(6N 2 M 2 /δ) . Then under the same conditions as Theorem 4.2, we have |V (t) + |,|V (t) − |,|V (t) n,i | = o(1) for t∈ [0,T 0 ]. The proof of Lemma G.6 is similar to that of Lemma G.3, except that the timeT 0 is changed.LetT 2 = Ω 1 η(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 log(6N 2 M 2 /δ) , then by Lemma G.6 and Lemma G.1 we have 1 2 − o(1) ≤ − e ℓ ′(t) n ≤ 1 2 + o(1) forn∈ [N ],t∈ [T 1 ,T 2 ], which can simplify the calculations ofαandβdefined in Definition E.3 by their bounds. Next we prove the following four propositionsB(t),C(t),D(t),E (t) by induction on t for t∈ [T 1 ,T 2 ]: 29 Benign Overfitting in Adversarial Training for Vision Transformers • B(t): V (t) + ≥ ηC 3 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 1 ) V − ≤ ηC 3 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 1 ) V (t) + ≥ 3M ·|V (t) n,i |, V (t) − ≤−3M ·|V (t) n,i |, |V (t) + |≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (t− T 1 ) |V (t) − |≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (t− T 1 ) for i∈ [M ]\1,n∈ [N ]. • C(t): ∥q (t) ± ∥ 2 ,∥k (t) ± ∥ 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (t) n,i ∥ 2 ,∥k (t) n,i ∥ 2 = Θ(σ 2 p σ 2 h d h ), |⟨q (t) + ,q (t) − ⟩|,|⟨q (t) + ,q (t) n,i ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = o(1), |⟨k (t) + ,k (t) − ⟩|,|⟨k (t) + ,k (t) n,i ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = o(1), for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . • D(t): ⟨q (t+1) + ,k (t+1) + ⟩≥⟨q (t) + ,k (t) + ⟩ ⟨q (t+1) n,i ,k (t+1) + ⟩≥⟨q (t) n,i ,k (t) + ⟩ ⟨q (t+1) + ,k (t+1) n,j ⟩≤⟨q (t) + ,k (t) n,j ⟩ ⟨q (t+1) n,i ,k (t+1) n,j ⟩≤⟨q (t) n,i ,k (t) n,j ⟩ Λ (t+1) n,±,j ≥ log exp(Λ (T 1 ) n,±,j ) + η 2 C 8 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t− T 1 )(t− T 1 + 1) ! Λ (t+1) n,i,±,j ≥ log exp Λ (T 1 ) n,i,±,j + η 2 C 8 σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d h N log(6N 2 M 2 /δ) 2 · (t− T 1 )(t− T 1 + 1) ! . for i,j ∈ [M ]\1,n∈ [N ]. • E (t): |⟨q (t) ± ,k (t) ± ⟩|,|⟨q (t) n,j ,k (t) ± ⟩|,|⟨q (t) n,i ,k (t) n,j ⟩|,|⟨q (t) n,i ,k (t) n ′ ,j ⟩|≤ log(d 1 4 h ) |⟨q (t) ± ,k (t) ± ⟩,|⟨q (t) n,i ,k (t) n,j ⟩| = o(1) for i,j ∈ [M ]\1,n, ̄n∈ [N ],n̸= ̄n. By the results of Stage I, we know thatB(T 1 ),C(T 1 ),E (T 1 )are true. To prove thatB(t),C(t),D(t)andE (t)are true in Stage I, we will prove the following claims holds for t∈ [T 1 ,T 2 ]: Claim 1. D(T 1 ),...,D(t− 1),E (T 1 ),...,E (t) =⇒ B(t + 1) Claim 2. B(T 1 ),...,B(t),C(T 1 ),...,C(t),D(T 1 ),...,D(t− 1),E (T 1 ),...,E (t) =⇒ D(t) Claim 3. B(T 1 ),...,B(t),D(T 1 ),...,D(t− 1),E (T 1 ),...,E (t) =⇒ C(t + 1) Claim 4. B(T 1 ),...,B(t),C(T 1 ),...,C(t),D(T 1 ),...,D(t− 1),E (T 1 ),...,E (t) =⇒ E (t + 1) 30 Benign Overfitting in Adversarial Training for Vision Transformers First, we emphasize that when the perturbation is sufficiently small, the softmax of the inner product⟨q, k⟩remains robust with respect to such perturbations. This is formally established in Lemma 5.3. Importantly, this lemma enables us to uniformly control the behavior of the softmax function, rather than being restricted to the specific case ofeq (t) and e k (t) at iteration t. Lemma G.7. Suppose the perturbation satisfiesτ ≤ O( ∥μ∥ 2 logd h )andt≥ Ω 1 η(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 log(6N 2 M 2 /δ) (E (t)holds). Then there exists a universal constant C ≤ e/2 such that max e X∈B(X,τ ) softmax ⟨q (t) + , k (t) n,j ⟩ / min e X∈B(X,τ ) softmax ⟨q (t) + , k (t) n,j ⟩ ≤ C. Proof. For any perturbed query-key pair, the softmax weight can be written as softmax ⟨q (t) + , k (t) n,j ⟩ = exp ⟨q (t) + ,k (t) n,j ⟩ exp ⟨q (t) + ,k (t) + ⟩ + P M j ′ =2 exp ⟨q (t) + ,k (t) n,j ′ ⟩ = 1 exp ⟨q (t) + ,k (t) + ⟩−⟨q (t) + ,k (t) n,j ⟩ + P M j ′ =2 exp ⟨q (t) + ,k (t) n,j ′ ⟩−⟨q (t) + ,k (t) n,j ⟩ . (14) Next, we analyze the difference in the logits. Expanding the perturbation terms yields ⟨q (t) + ,k (t) + ⟩−⟨q (t) + ,k (t) n,j ⟩ =⟨q + ,k + −k n,j ⟩ +⟨τ + W (t) Q ,k + −k n,j ⟩ +⟨q + ,τ + W (t) K − τ n,j W (t) K ⟩ +⟨τ + W (t) Q ,τ + W (t) K − τ n,j W (t) K ⟩ =⟨q (t) + ,k (t) + −k (t) n,j ⟩ ± o(1). (15) The first equality follows from decomposing the perturbed terms, while the second uses the perturbation boundτ ≤ O( ∥μ∥ 2 logd h ), together with the assumption that the logit magnitudes satisfy |⟨q (t) ± ,k (t) ± ⟩|, |⟨q (t) ± ,k (t) n,j ⟩|, |⟨q (t) n,i ,k (t) ± ⟩|, |⟨q (t) n,i ,k (t) n,j ⟩| ≤ log d 1/2 h . An analogous relation holds for differences involving e k (t) n,j ′ as well. Substituting (15) into (14), we obtain 1 C softmax ⟨q (t) + , k (t) n,j ⟩ ≤ softmax ⟨q (t) + , k (t) n,j ⟩ ≤ C softmax ⟨q (t) + , k (t) n,j ⟩ , for some absolute constant 1≤ C ≤ e/2. This establishes the claim. Thus, in the following discussion, we show that the updates related toq (t) andk (t) during adversarial training can be bounded, while the effect of the perturbation does not accumulate over time. SinceCis a very small function, when computing the single-step update, we approximate the perturbed softmax at the previous time step by its clean state. G.2.1. PROOF OF CLAIM 1 By the results of Stage I, we have |⟨q (T 1 ) ± ,k (T 1 ) ± ⟩|,|⟨q (T 1 ) ± ,k (T 1 ) n,j ⟩|,|⟨q (T 1 ) n,i ,k (T 1 ) ± ⟩|,|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| = o(1) Assume thatD(T 1 ),...,D(t− 1)(t∈ [T 1 ,T 2 ]) are true, then⟨q (s) ± ,k (s) ± ⟩,⟨q (s) n,i ,k (s) ± ⟩are monotonically non-decreasing and⟨q (s) ± ,k (s) n,j ⟩,⟨q (s) n,i ,k (s) n,j ⟩ are monotonically non-increasing for s∈ [T 1 ,t− 1], so we have ⟨q (s) ± ,k (s) ± ⟩,⟨q (s) n,i ,k (s) ± ⟩≥−o(1), 31 Benign Overfitting in Adversarial Training for Vision Transformers ⟨q (s) ± ,k (s) n,j ⟩,⟨q (s) n,i ,k (s) n,j ⟩≤ o(1), for s∈ [T 1 ,t]. Further we have the lower bounds for the attention on signal μ + as follows for s∈ [T 1 ,t]: softmax(⟨q (s) ± ,k (s) ± ⟩)≥ exp(−o(1)) exp(−o(1)) + (M − 1) exp(o(1)) = 1 1 + (M − 1) exp(o(1)) = 1 1 + (M − 1) + (M − 1)o(1) = 1 M − o(1), (16) where the second equality is by exp(o(1)) = 1 + o(1). Similarly, we have softmax(⟨q (s) n,i ,k (s) ± ⟩)≥ 1 M − o(1).(17) Plugging them in the update rule for γ (s) V + shown in Lemma E.4 and we have γ (s+1) V + − γ (s) V + =− η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M k=2 exp(⟨q (t) + ,k (t) n,k ⟩) + M X j=2 exp(⟨q (t) n,j ,k (t) + ⟩) exp(⟨q (t) n,j ,k (t) + ⟩) + P M k=2 exp(⟨q (t) n,j ,k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M k=2 exp(⟨q (t) + ,k (t) n,k ⟩) + M X j=2 exp(⟨q (t) n,j ,k (t) n,i ⟩) exp(⟨q (t) n,j ,k (t) + ⟩) + P M k=2 exp(⟨q (t) n,j ,k (t) n,k ⟩) ≥ η(∥μ∥ 2 − τ ) 2 2 NMC · N 4 · 1 2 ± o(1) · M 1 M ± o(1) − η(∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 ) NMC · N 4 · 1 2 ± o(1) · M (M − 1) 1 M ± o(1) ≥ η (∥μ∥ 2 − τ ) 2 − (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 ) 10MC = O η(∥μ∥ 2 − τ ) 2 10MC , for s∈ [T 1 ,t]. The first inequality is by Lemma 5.3. Then by Definition E.1 and taking a summation, we have V (t+1) + ≥ V (T 1 ) + + (t− T 1 + 1) η(∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 10MC ≥ ηC 3 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 1 + 1), (18) where the last inequality is by V (T 1 ) + ≥ 0 and M = Θ(1). Similarly, we have V (t+1) − ≤−ηC 3 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 1 + 1).(19) By|ρ V (t+1) n,i − ρ V (t) n,i |≤ η(∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 + 2σ 2 p d N ) in (11) and taking a summation, we have |V (t+1) n,i |≤|V (t) n,i | + (t− T 1 + 1)η(∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 + 2σ 2 p d N )∥w O ∥ 2 2 .(20) 32 Benign Overfitting in Adversarial Training for Vision Transformers Combining (18) and (20) we have V (t+1) + − 3M ·|V (t+1) n,i | ≥ V (T 1 ) + + (t− T 1 + 1) η(∥μ∥ 2 − τ ) 2 10M ∥w O ∥ 2 2 − 3M · (|V (T 1 ) n,i | + (t− T 1 + 1)η(max∥μ∥τ + τ 2 , 2C 2 p σ 2 p d N )∥w O ∥ 2 2 ) ≥ V (T 1 ) + − 3M ·|V (T 1 ) n,i | + (t− T 1 + 1) η(∥μ∥ 2 − τ ) 2 10M ∥w O ∥ 2 2 − 3M · (|V (T 1 ) n,i | + (t− T 1 + 1)η(max∥μ∥τ + τ 2 , 2C 2 p σ 2 p d N )∥w O ∥ 2 2 ) ≥ 0, (21) where the last inequality is byV (T 1 ) + ≥ 3M ·|V (T 1 ) n,i |and requiresN · SNR 2 ≥ 60M 2 C 2 p . The proof forV (t+1) − ≤ −3M ·|V (t+1) n,i | is the same. Next, we prove the upper bound for V + and V n,i . Based on the upper bound of attention(< 1) and− e ℓ ′ n ≤ 1 we have γ (s+1) V + ≤ γ (s) V + − η NM X n∈S + e ℓ ′(s) n ((∥μ∥ 2 + τ ) 2 + M X j=2 (∥μ∥ 2 + τ ) 2 ) − η NM X n∈S + e ℓ ′(s) n (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )· M ≤ γ (s) V + + 3η(∥μ∥ 2 + τ ) 2 4 ≤ γ (s) V + + ηC 4 (∥μ∥ 2 + τ ) 2 (22) Then we can get that |V (t+1) + |≤ V (T 1 ) + + (γ (t+1) V + − γ (T 1 ) V + )∥w O ∥ 2 ≤ V (T 1 ) + + t X s=T 1 ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 ≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (t− T 1 + 1) (23) where the first inequality is by the monotonicity ofγ V + and the definition ofV + , the last inequality is by the result of stage 1 where V (T 1 ) + = O(d −1 ). Similarly, we have |V (t+1) − |≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (t− T 1 + 1)(24) which completes the proof for the upper bound of V + . Expanding (20) yields |V (t+1) n,i |≤|V (T 1 ) n,i | + η(max∥μ∥τ + τ 2 , 2C 2 p σ 2 p d N )·∥w O ∥ 2 2 (t− T 1 + 1) ≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 2 ∥w O ∥ 2 (t− T 1 + 1) (25) where the last inequality is by the result of phase 1 where|V (T 1 ) n,i | = O(d − 1 4 h ) and the condition that N · SNR 2 ≥ Ω(1). 33 Benign Overfitting in Adversarial Training for Vision Transformers G.2.2. PROOF OF CLAIM 2 By the results of J.6, we have the dynamic of⟨q,k⟩ as follows ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ ≥ η 2 C 6 (∥μ∥ 2 − τ ) 4 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) , (26) ⟨q (s+1) − ,k (s+1) − ⟩−⟨q (s) − ,k (s) − ⟩ ≥ η 2 C 6 (∥μ∥ 2 − τ ) 4 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,−,j ) , (27) ⟨q (s+1) + ,k (s+1) n,j ⟩−⟨q (s) + ,k (s) n,j ⟩ ≤− η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) , (28) ⟨q (s+1) − ,k (s+1) n,j ⟩−⟨q (s) − ,k (s) n,j ⟩ ≤− η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,−,j ) (29) ⟨q (s+1) n,i ,k (s+1) + ⟩−⟨q (s) n,i ,k (s) + ⟩ ≥ η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ n,i,+,j ) (30) ⟨q (s+1) n,i ,k (s+1) − ⟩−⟨q (s) n,i ,k (s) − ⟩ ≥ η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ n,i,−,j ) (31) ⟨q (s+1) n,i ,k (s+1) n,j ⟩−⟨q (s) n,i ,k (s) n,j ⟩ ≤− η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ n,i,±,j ) (32) fors∈ [T 1 ,t]. The seven equations above show that⟨q (s) ± ,k (s) ± ⟩,⟨q (s) n,i ,k (s) ± ⟩are monotonically increasing and⟨q (s) ± ,k (s) n,j ⟩, ⟨q (s) n,i ,k (s) n,j ⟩are monotonically decreasing. Next, we provide the logarithmic increasing lower bounds ofΛ (s+1) n,±,j andΛ (s+1) n,±,j . We have Λ (s+1) n,+,j − Λ (s) n,+,j = (⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩)− (⟨q (s+1) n,j ,k (s+1) n,j ⟩−⟨q (s) n,j ,k (s) n,j ⟩) ≥ η 2 C 6 (∥μ∥ 2 − τ ) 4 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) + η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h N (s− T 1 )(s− T 1 + 1)· 1 exp(Λ (s) n,+,j ) ≥ η 2 C 7 max∥μ∥ 2 2 ,σ 2 p d(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) ≥ η 2 C 7 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h (s− T 1 ) 2 N (log(6N 2 M 2 /δ)) 2 · 1 exp(Λ (s) n,+,j ) (33) 34 Benign Overfitting in Adversarial Training for Vision Transformers where the last inequality is byσ 2 h ≥ min∥μ∥ −2 2 , (σ 2 p d) −1 d − 1 2 h (log(6N 2 M 2 /δ)) −2 . Multiply both sides simultaneously by exp(Λ (s) n,+,j ) and get exp(Λ (s) n,+,j )(Λ (s+1) n,+,j − Λ (s) n,+,j )≥ η 2 C 7 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h (s− T 1 ) N (log(6N 2 M 2 /δ)) 2 · 1 exp(Λ (s) n,+,j ) .(34) Taking a summation from T 1 to t and get t X s=T 1 exp(Λ (s) n,+,j )(Λ (s+1) n,+,j − Λ (s) n,+,j )≥ t X s=T 1 η 2 C 7 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h (s− T 1 ) N (log(6N 2 M 2 /δ)) 2 (35) ≥ η 2 C 8 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t− T 1 )(t− T 1 + 1).(36) By the property that Λ (t) n,+,j is monotonically increasing, we have Z T 1 Λ (T 1 ) n,+,j exp(x)dx≥ t X s=T 1 exp(Λ (s) n,+,j )(Λ (s+1) n,+,j − Λ (s) n,+,j )≥ η 2 C 8 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t−T 1 )(t−T 1 + 1). (37) By R Λ (t+1) n,+,j Λ (T 1 ) n,+,j exp(x)dx = exp(Λ (t+1) n,+,j )− exp(Λ (T 1 ) n,+,j ) we get Λ (t+1) n,+,j ≥ log exp(Λ (T 1 ) n,+,j ) + η 2 C 8 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t− T 1 )(t− T 1 + 1) ! . Similarly, we have Λ (t+1) n,−,j ≥ log exp(Λ (T 1 ) n,−,j ) + η 2 C 8 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t− T 1 )(t− T 1 + 1) ! . Thus, we have Λ (s+1) n,i,+,j − Λ (s) n,i,+,j =⟨(q (s+1) n,i ,k (s+1) + )− (q (s) n,i ,k (s) + )⟩−⟨(q (s+1) n,i ,k (s+1) n,j )− (q (s) n,i ,k (s) n,j )⟩ ≥ η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,i,+,j ) + η 2 C 6 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,i,+,j ) ≥ η 2 C 7 max∥μ∥ 2 2 ,σ 2 p d(σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,i,+,j ) ≥ η 2 C 7 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h (s− T 1 ) N (log(6N 2 M 2 /δ)) 2 · 1 exp(Λ (s) n,i,+,j ) . (38) Then using the similar method as for Λ (t) n,i,+,j , we get Λ (t+1) n,i,+,j ≥ log exp(Λ (T 1 ) n,i,+,j ) + η 2 C 8 (σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (t− T 1 )(t− T 1 + 1) , which complete the proof. The proof for Claim 3 is in Section J.9. 35 Benign Overfitting in Adversarial Training for Vision Transformers G.2.3. PROOF OF CLAIM 4 By the results of J.7, we have ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩≤ ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h exp(⟨q (s) + ,k (s) + ⟩) for s∈ [T 1 ,t]. Further we have exp(⟨q (s+1) + ,k (s+1) + ⟩)≤ exp ⟨q (s) + ,k (s) + ⟩ + ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h exp(⟨q (s) + ,k (s) + ⟩) = exp(⟨q (s) + ,k (s) + ⟩)· exp ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h exp(⟨q (s) + ,k (s) + ⟩) ! ≤ C 11 exp(⟨q (s) + ,k (s) + ⟩). (39) For the last inequality, byη ≤ e O(min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h ),σ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 d − 1 2 h (log(6N 2 M 2 /δ)) − 3 2 , ⟨q (T 1 ) + ,k (T 1 ) + ⟩ = o(1) and the monotonicity of⟨q (s) + ,k (s) + ⟩ fors ∈ [T 1 ,t], we haveexp ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 +τ ) 2 σ 2 h d h exp(⟨q (s) + ,k (s) + ⟩) ≤ exp(o(1))≤ C 11 . Multiplying both sides by ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ simultaneously gives exp(⟨q (s+1) + ,k (s+1) + ⟩) ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ ≤ C 11 exp ⟨q (s) + ,k (s) + ⟩ · ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ ≤ ηC 12 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h , (40) where the last inequality is by plugging (39). Taking a summation, we obtain Z ⟨q (t+1) + ,k (t+1) + ⟩ ⟨q (T 1 ) + ,k (T 1 ) + ⟩ exp(x)dx ≤ t X s=T 1 exp(⟨q (s+1) + ,k (s+1) + ⟩) ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ ≤ t X s=T 1 ηC 12 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h ≤ T 2 · ηC 12 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h ≤ d 1/2 h log 2 (6N 2 M 2 /δ) . (41) where the first inequality is due to⟨q (s) + ,k (s) + ⟩is monotone increasing, the last inequality is byT 2 = Θ(η −1 ∥μ∥ −2 2 ∥w O ∥ −2 2 log(6N 2 M 2 /δ) −1 ) and σ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 d − 1 2 h (log(6N 2 M 2 /δ)) − 3 2 . By Z ⟨q (t+1) + ,k (t+1) + ⟩ ⟨q (T 1 ) + ,k (T 1 ) + ⟩ exp(x)dx = exp(⟨q (t+1) + ,k (t+1) + ⟩)− exp(⟨q (T 1 ) + ,k (T 1 ) + ⟩), we have ⟨q (t+1) + ,k (t+1) + ⟩≤ log ⟨q (T 1 ) + ,k (T 1 ) + ⟩ + d 1 2 h log(6N 2 M 2 /δ) ! ≤ log d 1 2 h ,(42) 36 Benign Overfitting in Adversarial Training for Vision Transformers By the results of J.7, we also have ⟨q (s+1) − ,k (s+1) − ⟩−⟨q (s) − ,k (s) − ⟩≤ ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h exp(⟨q (s) − ,k (s) − ⟩) (43) ⟨q (s+1) ± ,k (s+1) n,j ⟩−⟨q (s) ± ,k (s) n,j ⟩≥− ηC 10 σ 2 p d(∥μ∥ 2 + τ ) 2 σ 2 h d h N · exp(⟨q (s) ± ,k (s) n,j ⟩).(44) ⟨q (s+1) n,i ,k (s+1) ± ⟩−⟨q (s) n,i ,k (s) ± ⟩≤ ηC 10 σ 2 p d(∥μ∥ 2 + τ ) 2 σ 2 h d h N exp(⟨q (s) n,i ,k (s) ± ⟩) .(45) ⟨q (s+1) n,i ,k (s+1) n,j ⟩−⟨q (s) n,i ,k (s) n,j ⟩≥− ηC 10 σ 2 p d(σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )σ 2 h d h N · exp(⟨q (s) n,i ,k (s) n,j ⟩).(46) Then using the similar method as for⟨q (t+1) + ,k (t+1) + ⟩, we get ⟨q (t+1) − ,k (t+1) − ⟩≤ log d 1 2 h ,(47) ⟨q (t+1) ± ,k (t+1) n,j ⟩≥− log d 1 2 h ,(48) ⟨q (t+1) n,i ,k (t+1) ± ⟩≤ log d 1 2 h ,(49) ⟨q (t+1) n,i ,k (t+1) n,j ⟩≥− log d 1 2 h .(50) Next we provide the upper bound for|⟨q (t+1) ± ,k (t+1) ± ⟩|,|⟨q (t+1) n,i ,k (t+1) n ′ ,j ⟩|. By the results of J.8, we have t X s=T 1 |α (s) +,+ |, t X s=T 1 |α (s) −,− |, t X s=T 1 |β (s) +,+ |, t X s=T 1 |β (s) −,− |, t X s=T 1 |β (s) n,i,+ |, t X s=T 1 |β (s) n,i,− | = O N 1 2 d − 1 4 h ,(51) for i∈ [M ]\1,n∈ S ± . t X s=T 1 |α (s) n,+,i |, t X s=T 1 |α (s) n,−,i | = O N − 1 2 d − 1 4 h ,(52) for i∈ [M ]\1,n∈ S ± . t X s=T 1 |β (s) n,+,i |, t X s=T 1 |β (s) n,−,i | = O SNR· N − 1 2 d − 1 4 h (53) for i∈ [M ]\1,n∈ S ± . t X s=T 1 |α (s) n,i,n ′ ,j |, t X s=T 1 |β (s) n,j,n ′ ,i | = O d − 1 2 d − 1 4 h log(6N 2 M 2 /δ) (54) fori,j ∈ [M ]\1,n,n ′ ∈ [N ],n ̸= n ′ . Plugging these into the update rule of⟨q (t) ± ,k (t) ± ⟩,⟨q (t) n,i ,k (t) n,j ⟩and assume that 37 Benign Overfitting in Adversarial Training for Vision Transformers propositionsC(T 1 ),...,C(t) hold, we have |⟨q (t+1) + ,k (t+1) − ⟩|≤|⟨q (T 1 ) + ,k (T 1 ) − ⟩| + t X s=T 1 |⟨q (s+1) + ,k (s+1) − ⟩−⟨q (s) + ,k (s) − ⟩| ≤|⟨q (T 1 ) + ,k (T 1 ) − ⟩| + t X s=T 1 α (s) +,+ ⟨k (s) + ,k (s) − ⟩ + X n∈S + M X i=2 α (s) n,+,i ⟨k (s) n,i ,k (s) − ⟩ +β (s) −,− ⟨q (s) + ,q (s) − ⟩ + X n∈S − M X i=2 β (s) n,−,i ⟨q (s) n,i ,q (s) + ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i · β (s)⊤ −,− q (s)⊤ − + X n∈S − M X i=2 β (s)⊤ n,−,i q (s)⊤ n,i ≤|⟨q (T 1 ) + ,k (T 1 ) − ⟩| + t X s=T 1 |α (s) +,+ ||⟨k (s) + ,k (s) − ⟩| + X n∈S + M X i=2 t X s=T 1 |α (s) n,+,i ||⟨k (s) n,i ,k (s) − ⟩| + t X s=T 1 |β (s) −,− ||⟨q (s) + ,q (s) − ⟩| + X n∈S − M X i=2 t X s=T 1 |β (s) n,−,i ||⟨q (s) n,i ,q (s) + ⟩| +lower order term =|⟨q (T 1 ) + ,k (T 1 ) − ⟩| + O N 1 2 d − 1 4 h · o(1) + N · M · O N − 1 2 d − 1 4 h · o(1) + O N 1 2 d − 1 4 h · o(1) + N · M · O SNR· N − 1 2 d − 1 4 h · o(1) =|⟨q (T 1 ) + ,k (T 1 ) − ⟩| + o N 1 2 d − 1 4 h + o SNR· N 1 2 d − 1 4 h = o(1), (55) where the first inequality is by triangle inequality, the last equality is by|⟨q (T 1 ) + ,k (T 1 ) − ⟩| = o(1)andd h = 38 Benign Overfitting in Adversarial Training for Vision Transformers e Ω maxSNR 4 , SNR −4 N 2 ε −2 . Similarly we have|⟨q (t+1) − ,k (t+1) + ⟩| = o(1). |⟨q (t+1) n,i ,k (t+1) n,j ⟩|≤|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| + t X s=T 1 |⟨q (s+1) n,i ,k (s+1) n,j ⟩−⟨q (s) n,i ,k (s) n,j ⟩| ≤|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| + t X s=T 1 α (s) n,i,+ ⟨k (s) + ,k (s) n,j ⟩ + α (s) n,i,− ⟨k (s) − ,k (s) n,j ⟩ + N X n ′ =1 M X l=2 α (s) n,i,n ′ ,l ⟨k (s) n ′ ,l ,k (s) n,j ⟩ +β (s) n,j,+ ⟨q (s) + ,q (s) n,i ⟩ + β (s) n,j,− ⟨q (s) − ,q (s) n,i ⟩ + N X n ′ =1 M X l=2 β (s) n,j,n ′ ,l ⟨q (s) n ′ ,l ,q (s) n,i ⟩ + α (s) n,i,+ k (s) + + α (s) n,i,− k (s) − + N X n ′ =1 M X l=2 α (s) n,i,n ′ ,l k (s) n ′ ,l ! · β (s)⊤ n,j,+ q (s)⊤ + + β (s)⊤ n,j,− q (s)⊤ − + N X n ′ =1 M X l=2 β (s)⊤ n,j,n ′ ,l q (s)⊤ n ′ ,l ! ≤|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| + t X s=T 1 |α (s) n,i,+ ||⟨k (s) + ,k (s) n,j ⟩| + t X s=T 1 |α (s) n,i,− ||⟨k (s) − ,k (s) n,j ⟩| + t X s=T 1 |α (s) n,i, n,j ||⟨k (s) n,j ,k (s) n,j ⟩| + M X l=2 t X s=T 1 |α (s) n,i,n,l ||⟨k (s) n,l ,k (s) n,j ⟩| + X n ′ ̸= n∧(l̸=j∨n ′ ̸=n) t X s=T 1 N X n ′ =1 M X l=2 |α (s) n,i,n ′ ,l ||⟨k (s) n ′ ,l ,k (s) n,j ⟩| + t X s=T 1 |β (s) n,j,+ ||⟨q (s) + ,q (s) n,i ⟩| + t X s=T 1 |β (s) n,j,− ||⟨q (s) − ,q (s) n,i ⟩| + t X s=T 1 |β (s) n,j,n,i ||⟨q (s) n,i ,q (s) n,i ⟩| + M X l=2 t X s=T 1 |β (s) n,j,n,l ||⟨q (s) n,l ,q (s) n,i ⟩| + X n ′ ̸=n∧(l̸=i∨n ′ ̸=n) t X s=T 1 N X n ′ =1 M X l=2 |β (s) n,j,n ′ ,l ||⟨q (s) n ′ ,l ,q (s) n,i ⟩| +lower order term =|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| + O(d − 1 4 h )· o(1) + O(d − 1 2 d − 1 4 h log(6N 2 M 2 /δ))· Θ(σ 2 p σ 2 h d h ) + M · O(d − 1 4 h )· o(1) + N · M · O(d − 1 2 d − 1 4 h log(6N 2 M 2 /δ))· o(1) + O(N 1 2 d − 1 4 h )· o(1) =|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| + o(d − 1 4 h ) + O(d − 1 2 d 1 4 h ) + o(Nd − 1 2 d − 1 4 h log(6N 2 M 2 /δ)) = o(1), (56) where the first inequality is by triangle inequality, the second equality is byσ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h · (log(6N 2 M 2 /δ)) − 3 2 , the last equality is by|⟨q (T 1 ) n,i ,k (T 1 ) n,j ⟩| = o(1) ,d = e Ω(ε −2 N 2 d h )andd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 . 39 Benign Overfitting in Adversarial Training for Vision Transformers G.3. Stage i In Stage I, the outputs of ViT grow up and the loss derivatives are no longer ato(1). We will carefully compute the growth rate ofV ± andV n,i while keeping monitoring the monotonicity of⟨q,k⟩. By substitutingt = T 2 = Θ 1 η(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 into propositionsB(t),C(t),D(t),E (t) in Stage I, we have the following conditions at the beginning of stage I |V (T 2 ) + |,|V (T 2 ) − |,|V (T 2 ) n,i | = o(1), V (T 2 ) + ≥ 3M ·|V (T 2 ) n,i |, V (T 2 ) − ≤−3M ·|V (T 2 ) n,i |, ∥q (T 2 ) + ∥ 2 2 ,∥k (T 2 ) + ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (T 2 ) n,i ∥ 2 2 ,∥k (T 2 ) n,i ∥ 2 2 = Θ(σ 2 p σ 2 h d h ), |⟨q (T 2 ) + ,q (T 2 ) − ⟩|,|⟨q (T 2 ) + ,q (T 2 ) n,i ⟩|,|⟨q (T 2 ) n,i ,q (T 2 ) n ′ ,j ⟩| = o(1), |⟨k (T 2 ) + ,k (T 2 ) − ⟩|,|⟨k (T 2 ) + ,k (T 2 ) n,i ⟩|,|⟨k (T 2 ) n,i ,k (T 2 ) n ′ ,j ⟩| = o(1), for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . Λ (T 2 ) n,±,j ≥ log exp(Λ (T 1 ) n,±,j ) + Θ d 1 2 h N (log(6N 2 M 2 /δ)) 3 !! Λ (T 2 ) n,i,±,j ≥ log exp(Λ (T 1 ) n,i,±,j ) + Θ σ 2 p d 1 2 h N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 |⟨q (T 2 ) + ,k (T 2 ) + ⟩|,|⟨q (T 2 ) + ,k (T 2 ) n,j ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) + ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) n ′ ,j ⟩|≤ log(d 1 2 h ) |⟨q (T 2 ) + ,k (T 2 ) − ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) n,j ⟩| = o(1) for i,j ∈ [M ]\1,n, n∈ [N ],n̸=n. LetT 3 = Θ 1 ηε(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . Next we prove the following four propositionsF (t),G(t),H(t),I(t)by induction ont for t∈ [T 2 ,T 3 ]: • F (t): V (t) + ≥ 3M ·|V (t) n,i |, V (t) − ≤−3M ·|V (t) n,i |, |V (t) n,i | = o(1), log exp(V (T 2 ) + ) + ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 ) ≤ V (t) + ≤ 2 log O 1 ε , − 2 log O 1 ε ≤ V (t) − ≤− log exp(−V (T 2 ) − ) + ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 ) for i∈ [M ]\1,n∈ [N ]. • G(t): ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ σ 2 p σ 2 h d h , |⟨q (t) + ,q (t) − ⟩|,|⟨q (t) ± ,q (t) n,i ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = o(1), |⟨k (t) + ,k (t) − ⟩|,|⟨k (t) ± ,k (t) n,i ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . 40 Benign Overfitting in Adversarial Training for Vision Transformers • H(t): ⟨q (t+1) ± ,k (t+1) ± ⟩≥⟨q (t) ± ,k (t) ± ⟩, ⟨q (t+1) n,i ,k (t+1) ± ⟩≥⟨q (t) n,i ,k (t) ± ⟩, ⟨q (t+1) ± ,k (t+1) n,j ⟩≤⟨q (t) ± ,k (t) n,j ⟩, ⟨q (t+1) n,i ,k (t+1) n,j ⟩≤⟨q (t) n,i ,k (t) n,j ⟩ for i,j ∈ [M ]\1,n∈ [N ]. • I(t): |⟨q (t) ± ,k (t) ± ⟩|,|⟨q (t) ± ,k (t) n,j ⟩|,|⟨q (t) n,i ,k (t) ± ⟩|,|⟨q (t) n,i ,k (t) n,j ⟩|≤ log(ε −1 d 1 2 h ), |⟨q (t) ± ,k (t) ∓ ⟩|,|⟨q (t) n,i ,k (t) n,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],n̸=n. By the results of Stage I, we know thatF (T 2 ),G(T 2 ),I(T 2 )are true. To prove thatF (t),G(t),H(t)andI(t)are true in stage 3, we will prove the following claims holds for t∈ [T 2 ,T 3 ]: • Claim 5. H(T 2 ),...,H(t− 1),I(T 2 ),...,I(t) =⇒ F (t + 1) • Claim 6. F (t),G(t),H(T 2 ),...,H(t− 1),I(T 2 ),...,I(t− 1) =⇒ H(t) • Claim 7. F (T 2 ),...,F (t),G(t),H(T 2 ),...,H(t− 1),I(T 2 ),...,I(t) =⇒ G(t + 1) • Claim 8. F (T 2 ),..,F (t),G(T 2 ),..,G(t),H(T 2 ),..,H(t− 1),I(T 2 ),..,I(t) =⇒ I(t + 1) G.3.1. PROOF OF CLAIM 5 The proofs for V (t) + ≥ 3M ·|V (t) n,i | and V (t) − ≤−3M ·|V (t) n,i | are the same as for G.2.1. Based onH(T 2 ),...,H(t) where ⟨q (s) ± ,k (s) ± ⟩ and⟨q (s) n,i ,k (s) ± ⟩ are monotonically non-decreasing andmax j ⟨q (s) ± ,k (s) n,j ⟩ ,max j ⟨q (s) n,i ,k (s) n,j ⟩are monotonically non-increasing for s∈ [T 2 ,t− 1], we have Λ (s) n,±,j ≥ Λ (T 2 ) n,±,j ≥ log exp(Λ (T 1 ) n,±,j ) + Θ d 1 2 h N (log(6N 2 M 2 /δ)) 3 !! ,(57) Λ (s) n,i,±,j ≥ Λ (T 2 ) n,i,±,j ≥ log exp(Λ (T 1 ) n,i,±,j ) + Θ σ 2 p d 1 2 h N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 (58) for i,j ∈ [M ]\1,n∈ [N ],s∈ [T 2 ,t]. We further get exp(⟨q (s) ± ,k (s) ± ⟩) exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩) ≤ exp(⟨q (s) ± ,k (s) n,j ⟩) C exp(⟨q (s) ± ,k (s) ± ⟩) = 1 C exp(Λ (s) n,±,j ) ≤ 1 C exp(Λ (T 1 ) n,±,j ) + Θ d 1 2 h N (log(6N 2 M 2 /δ)) 3 = O N (log(6N 2 M 2 /δ)) 3 d 1 2 h ! . (59) For the first inequality, by the monotonicity of⟨q (s) ± ,k (s) ± ⟩(⟨q (s) ± ,k (s) ± ⟩is increasing and⟨q (s) ± ,k (s) n,j ⟩is decreasing), there exist a constantCsuch thatC exp(⟨q (s) ± ,k (s) ± ⟩)≥ exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩) . The second inequality is 41 Benign Overfitting in Adversarial Training for Vision Transformers by plugging 57. Similarly, we have exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) n,i ,k (s) n,j ′ ⟩) ≤ 1 C exp(Λ (s) n,i,±,j ) = O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h . (60) Plugging (59) and (60) into the update rule of ρ V,n,i in Lemma E.4 and get |ρ (s+1) V,n,i − ρ (s) V,n,i |≤ η NM | e ℓ ′ (s) n |·⟨ e ξ n,i , e ξ (t) n,i ⟩· O N (log(6N 2 M 2 /δ)) 3 d 3 2 h + O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h + η NM X n ′ ̸=n∨i̸=i ′ | e ℓ ′ (t) n ′ |·⟨ e ξ n,i , e ξ (t) n ′ ,i ′ ⟩· O N (log(6N 2 M 2 /δ)) 3 d 3 2 h + O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h + o(1) ≤ 3η(σ 2 p d + o(1)) 2NM O N (log(6N 2 M 2 /δ)) 3 d 1 2 h + O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h + η NM NM (2σ 2 p p d log(4N 2 M 2 /δ) √ d + o(1))· O N (log(6N 2 M 2 /δ)) 3 d 1 2 h + O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h ≤ 2η NM O N (σ 2 p d + o(1))(log(6N 2 M 2 /δ)) 3 d 3 2 h + O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 d 3 2 h = O η(σ 2 p d + o(1))(log(6N 2 M 2 /δ)) 3 d 1 2 h + η∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 d 1 2 h (61) where the second inequality is by Lemma F.4 and| e ℓ (t) n | ≤ 1 . For the last inequality, sinced = e Ω(ε −2 N 2 d h ), we have N · M · 2σ 2 p p d log(4N 2 M 2 /δ)≤ 1 2 σ 2 p d. By Definition E.1 and taking a summation we have |V (t+1) n,i |≤|V (T 2 ) n,i | + t X s=T 2 |ρ (s+1) V,n,i − ρ (s) V,n,i |·∥w O ∥ 2 2 ≤|V (T 2 ) n,i | + T 3 ·|ρ (t+1) V,n,i − ρ (t) V,n,i |·∥w O ∥ 2 2 ≤ o(1) + Θ 1 ηε(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 · O η(σ 2 p d + o(1))(log(6N 2 M 2 /δ)) 3 d 1 2 h + η∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 d 1 2 h ·∥w O ∥ 2 2 = o(1) + O (σ 2 p d + o(1))(log(6N 2 M 2 /δ)) 3 ε(∥μ∥ 2 + τ ) 2 d 1 2 h + (log(6N 2 M 2 /δ)) 3 εd 1 2 h = o(1) + o(1) = o(1), (62) where the first equality is byN· SNR 2 ≥ Ω(1), the second equality is byd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 . Then we have a constant upper bound for the sum of V n,i as follows: X i∈[M ]\1 |V (s) n,i | = (M − 1)· o(1)≤ C 15 , for n∈ [N ],s∈ [T 2 ,t]. Expanding (59) and (60), we have exp(⟨q (s) ± ,k (s) n,j ⟩) exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩) = O N (log(6N 2 M 2 /δ)) 3 d 3/2 h ! = o(1), (63) 42 Benign Overfitting in Adversarial Training for Vision Transformers where the equality is by d h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 . Similarly, exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) n,i ,k (s) n,j ′ ⟩) = O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1/2 h ! = o(1), (64) where the equality is by the same choice of d h . Then we have softmax(⟨q (s) ± ,k (s) ± ⟩)≥ 1− (M − 1)· o(1)≥ 1− o(1), (65) softmax(⟨q (s) n,i ,k (s) ± ⟩)≥ 1− (M − 1)· o(1)≥ 1− o(1), (66) for i∈ [M ]\1,n∈ [N ],s∈ [T 2 ,t]. Thus, in the following discussion, we omit the noise-related terms as o(1). Next we provide the bounds for− e ℓ ′ (s) n . Note thatℓ(z) = log(1 + exp(−z))and−ℓ ′ (z) = exp(−z)/(1 + exp(−z)). Without loss of generality, assume y n = 1. We have −ℓ ′ (f ( f X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ( e x (s)⊤ n,l W (s) Q W (s)⊤ K ( f X (s) n ) ⊤ ) f X (s) n W (s) V w O = 1 M softmax(⟨q (s) ± ,k (s) ± ⟩) + M X l=2 softmax(⟨q (s) n,l ,k (s) ± ⟩) · e μ (s)⊤ + W (s) V w O + X j∈[M ]\1 softmax(⟨q (s) n,j ,k (s) n,j ⟩) + M X l=2 softmax(⟨q (s) n,l ,k (s) n,j ⟩) · e ξ (s)⊤ n,j W (s) V w O = 1 M M · (1− o(1))· V (s) + + M · o(1)· X j∈[M ]\1 V (s) n,i ≥ 1 2 V (s) + , (67) fors∈ [T 2 ,t], where the second equality is by plugging equations above, and the inequality follows fromV (s) + ≥ 3M·|V (s) n,i | . Similarly, we have 1 M M X l=1 φ( e x (s)⊤ n,l W (s) Q W (s)⊤ K ( f X (s) n ) ⊤ ) f X (s) n W (s) V w O ≤max i∈[M ]\1 V (s) + ,V (s) n,i = V (s) + . (68) Then we have −ℓ ′ (f ( e X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ(ex (s)⊤ n,l W (s) Q W (s)⊤ K ( e X (s) n ) ⊤ ) e X (s) n W (s) V w O ≥ 1 1 + exp(V (s) + ) ≥ C 16 exp(V (s) + ) (69) where the first inequality is by plugging (68). For the last inequality, note thatV (T 2 ) + ≥ 0andV (s) + is monotonically 43 Benign Overfitting in Adversarial Training for Vision Transformers increasing, so there exist a constant C 16 such that 1 1+exp(V (s) + ) ≥ C 16 exp(V (s) + ) . We also have the upper bound −ℓ ′ (f (X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ(x ⊤ n,l W (s) Q W (s)⊤ K (X n ) ⊤ )X n W (s) V w O ≤ 1 1 + exp(V (s) + /2) ≤ 1 exp(V (s) + /2) (70) Then by the update rule of γ (t) V,+ and in Lemma E.4 and get γ (s+1) V,+ − γ (s) V,+ =−η⟨ e μ + , e μ (s) + ⟩ X n∈S + e ℓ ′ (s) n exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M k=2 exp(⟨q (s) + ,k (s) n,k ⟩) + M X j=2 exp(⟨q (s) n,j ,k (s) + ⟩) exp(⟨q (s) n,j ,k (s) + ⟩) + P M k=2 exp(⟨q (s) n,j ,k (s) n,k ⟩) + o(1) ≥−η(∥μ∥ 2 − τ ) 2 X n∈S + e ℓ ′ (s) n (M · (1− o(1))) ≥ η(∥μ∥ 2 − τ ) 2 · N 4 · (1− o(1))· C 16 exp(V (s) + ) ≥ ηC 17 (∥μ∥ 2 − τ ) 2 2 1 exp(V (s) + ) (71) where the second inequality is by (69). Then by definition E.1, we get V (s+1) + − V (s) + = (γ (s+1) V,+ − γ (s) V,+ )∥w O ∥ 2 2 ≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 exp(V (s) + ) (72) Multiply both sides simultaneously by exp(V (s) + ) and get exp(V (s) + )(V (s+1) + − V (s) + )≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (73) Taking a summation from T 2 to t and get t X s=T 2 exp(V (s) + )(V (s+1) + − V (s) + )≥ t X s=T 2 ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 ≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (74) By the property that V (s) + is monotonically increasing, we have Z V (t+1) + V (T 2 ) + exp(x)dx≥ t X s=T 2 exp(V (s) + )(V (s+1) + − V (s) + ) ≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (75) By R V (t+1) + /2 V (T 2 ) + /2 exp(x)dx = exp(V (t+1) + /2)− exp(V (T 2 ) + /2) we get V (t+1) + ≥ log exp(V (T 2 ) + /2) + ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) ≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (76) 44 Benign Overfitting in Adversarial Training for Vision Transformers Similarly, we have V (t+1) − ≤− log exp V (T 2 ) − + ηC 17 (∥μ∥ 2 − τ ) 2 2 ∥w O ∥ 2 2 (t− T 2 + 1) (77) Next we provide upper bounds for V (t+1) + and V (t+1) − . By the update rule of γ (t) V,+ and in Lemma E.4 we have γ (s+1) V,+ − γ (s) V,+ =−η⟨ e μ + , e μ (s) + ⟩ X n∈S + e ℓ ′ (s) n exp ⟨q (s) + ,k (s) + ⟩ exp ⟨q (s) + ,k (s) + ⟩ + P M k=2 exp ⟨q (s) + ,k (s) n,k ⟩ + M X j=2 exp ⟨q (s) n,j ,k (s) + ⟩ exp ⟨q (s) n,j ,k (s) + ⟩ + P M k=2 exp ⟨q (s) n,j ,k (s) n,k ⟩ ! + o(1) ≤ η(∥μ∥ 2 + τ ) 2 X n∈S + − e ℓ ′ (s) n · M ≤ η(∥μ∥ 2 + τ ) 2 · 3N 4 · exp − V (s) + /2 = 3η(∥μ∥ 2 + τ ) 2 4 exp − V (s) + /2 . (78) where the second inequality is by (70). Then by definition E.1, we get V (s+1) + − V (s) + = (γ (s+1) V,+ − γ (s) V,+ )∥w O ∥ 2 2 ≤ 3η(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 4 exp(V (s) + /2) (79) Further we have exp(V (s+1) + /2)≤ exp(V (s) + /2 + 3η(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 8 exp(V (s) + /2) = exp(V (s) + /2)· exp( 3η(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 8 exp(V (s) + /2) ) ≤ C 18 exp(V (s) + /2) (80) For the last inequality, byη ≤ e O(min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h ) ,V (T 2 ) + = Θ(1) and the monotonicity ofV (s) + , we have exp( 3η∥μ∥ 2 2 ∥w O ∥ 2 2 8 exp(V (s) + /2) )≤ C 18 . Multiplying both sides by (V (s+1) + /2− V (s) + /2) simultaneously gives exp(V (s) + )(V (s+1) + /2− V (s) + /2)≤ C 18 exp(V (s) + /2)(V (s+1) + /2− V (s) + /2) ≤ 3ηC 18 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 8 (81) where the last inequality is by plugging (80). Taking a summation we have Z V (t+1) + /2 V (T 2 ) + /2 exp(x)dx≤ T 3 X s=T 2 exp(V (s+1) + /2)(V (s+1) + /2− V (s) + /2) ≤ T 3 X s=T 2 3ηC 18 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 8 ≤ Θ 1 ηε(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 · 3ηC 18 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 8 = O 1 ε (82) 45 Benign Overfitting in Adversarial Training for Vision Transformers By R V (t+1) + /2 V (T 2 ) + /2 exp(x)dx = exp(V (t+1) + /2)− exp(V (T 2 ) + /2) we have V (t+1) + ≤ 2 log exp(V (T 2 ) + /2) + O 1 ε = 2 log O 1 ε Similarly, we have V (t+1) − ≥−2 log O 1 ε G.3.2. PROOF OF CLAIM 6 ByH(T 2 ),...,H(t − 1),wehavesoftmax(⟨q (t) ± ,k (t) ± ⟩), softmax(⟨q (t) n,i ,k (t) ± ⟩)=1 − o(1)and softmax(⟨q (t) ± ,k (t) n,j ⟩), softmax(⟨q (t) n,i ,k (t) n,j ⟩) = o(1), which have been proved in G.3.1. By the results of J.5, we have the signs of α and β as follows: α (t) +,+ ,α (t) −,− ,β (t) +,+ ,β (t) −,− ,α (t) n,i,+ ,α (t) n,i,− ,β (t) n,+,i ,β (t) n,−,i ≥ 0, α (t) n,+,i ,α (t) n,−,i ,α (t) n,i,n,j ,β (t) n,i,+ ,β (t) n,i,− ,β (t) n,j,n,i ≤ 0. Then combined withG(T ) and we have the dynamics of⟨q,k⟩ as follows: ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ = α (t) +,+ ∥k (t) + ∥ 2 2 + X n∈S + M X i=2 α (t) n,+,i ⟨k (t) + ,k (t) n,i ⟩ + β (t) +,+ ∥q (t) + ∥ 2 2 + X n∈S + M X i=2 β (t) n,+,i ⟨q (t) + ,q (t) n,i ⟩ + α (t) +,+ k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i · β (t) +,+ q (t) + + X n∈S + M X i=2 β (t) n,+,i q (t) n,i ⊤ = α (t) +,+ ∥k (t) + ∥ 2 2 + β (t) +,+ ∥q (t) + ∥ 2 2 +lower order term ≥ 0 (83) Similarly, we have ⟨q (t+1) ± ,k (t+1) ± ⟩−⟨q (t) ± ,k (t) ± ⟩≥ 0, ⟨q (t+1) n,i ,k (t+1) ± ⟩−⟨q (t) n,i ,k (t) ± ⟩≥, 0 ⟨q (t+1) ± ,k (t+1) n,j ⟩−⟨q (t) ± ,k (t) n,j ⟩≤ 0, ⟨q (t+1) n,i ,k (t+1) n,j ⟩−⟨q (t) n,i ,k (t) n,j ⟩≤ 0 which completes the proof. The proof for Claim 7 is in Section J.12 G.3.3. PROOF OF CLAIM 8 By the results of J.10, we have ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩≤ ηC 10 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε exp ⟨q (t) + ,k (t) + ⟩ ,(84) 46 Benign Overfitting in Adversarial Training for Vision Transformers Further we have exp(⟨q (t+1) + ,k (t+1) + ⟩)≤ exp ⟨q (t) + ,k (t) + ⟩ + ηC 10 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε exp(⟨q (t) + ,k (t) + ⟩) ! = exp ⟨q (t) + ,k (t) + ⟩ · exp ηC 10 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε exp(⟨q (t) + ,k (t) + ⟩) ! ≤ C 11 exp ⟨q (t) + ,k (t) + ⟩ . For the last inequality, byη ≤ e O(minμ∥ −2 2 , (σ 2 p d) −1 ·d − 1 2 h ),σ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 ·d − 1 2 h · (log(6N 2 M 2 /δ)) − 3 2 , ⟨q (T 1 ) + ,k (T 1 ) + ⟩ = o(1)and the monotonicity of⟨q (s) + ,k (s) + ⟩fors ∈ [T 1 ,t], we haveexp ηC 10 ∥μ∥ 4 2 σ 2 h d h log ( O ( 1 ε )) exp(⟨q (t) + ,k (t) + ⟩) ≤ exp(o(1))≤ C 11 . Multiplying both sides by ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ simultaneously gives exp(⟨q (t+1) + ,k (t+1) + ⟩) ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ ≤ C 11 exp ⟨q (t) + ,k (t) + ⟩ · ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ ≤ ηC 12 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε , (85) where the last inequality is by plugging (84). Taking a summation we have Z ⟨q (t+1) + ,k (t+1) + ⟩ ⟨q (T 2 ) + ,k (T 2 ) + ⟩ exp(x)dx≤ t X s=T 2 exp ⟨q (s+1) + ,k (s+1) + ⟩ ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ ≤ t X s=T 2 ηC 12 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε ≤ T 3 · ηC 12 (∥μ∥ 2 + τ ) 2 ∥μ∥ 2 2 σ 2 h d h log O 1 ε = O d 1 2 h log O 1 ε ε(log(6N 2 M 2 /δ)) 3 2 . (86) where the first inequality is due to⟨q (s) + ,k (s) + ⟩ is monotone increasing, the last equality is byT 3 = Θ(η −1 ε −1 (∥μ∥ 2 + τ ) −2 ∥w O ∥ −2 2 ),∥w O ∥ 2 2 = Θ(1)andσ 2 h ≤ min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h · (log(6N 2 M 2 /δ)) − 3 2 . By R ⟨q (t+1) + ,k (t+1) + ⟩ ⟨q (T 2 ) + ,k (T 2 ) + ⟩ exp(x)dx = exp(⟨q (t+1) + ,k (t+1) + ⟩)− exp(⟨q (T 2 ) + ,k (T 2 ) + ⟩), we have ⟨q (t+1) + ,k (t+1) + ⟩≤ log exp(⟨q (T 2 ) + ,k (T 2 ) + ⟩) + O d 1 2 h log O 1 ε ε(log(6N 2 M 2 /δ)) 3 2 ≤ log(ε −1 d 1 2 h ) where the last inequality is by⟨q (T 2 ) + ,k (T 2 ) + ⟩≤ log(d 1 2 h ). By the results of J.10, we also have ⟨q (t+1) − ,k (t+1) − ⟩−⟨q (t) − ,k (t) − ⟩≤ ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h log O 1 ε exp(⟨q− (t) ,k (t) − ⟩) .(87) ⟨q (s+1) ± ,k (s+1) n,j ⟩−⟨q (s) ± ,k (s) n,j ⟩≥− ηC 10 σ 2 p d(∥μ∥ 2 + τ ) 2 σ 2 h d h log O 1 ε N · exp(⟨q (s) ± ,k (s) n,j ⟩).(88) ⟨q (s+1) n,i ,k (s+1) ± ⟩−⟨q (s) n,i ,k (s) ± ⟩≤ ηC 10 σ 2 p d(∥μ∥ 2 + τ ) 2 σ 2 h d h log O 1 ε N exp(⟨q (s) n,i ,k (s) ± ⟩) .(89) 47 Benign Overfitting in Adversarial Training for Vision Transformers ⟨q (s+1) n,i ,k (s+1) n,j ⟩−⟨q (s) n,i ,k (s) n,j ⟩≥− ηC 10 σ 2 p d(σ 2 p d + σ p τ p 2 log(4NM/δ) + τ 2 )σ 2 h d h log O 1 ε N · exp(⟨q (s) n,i ,k (s) n,j ⟩). (90) Then using the similar method as for⟨q (t+1) + ,k (t+1) + ⟩, we get ⟨q (t+1) − ,k (t+1) − ⟩≤ log(ε −1 d 1 2 h ), ⟨q (t+1) ± ,k (t+1) n,j ⟩≥− log(ε −1 d 1 2 h ), ⟨q (t+1) n,i ,k (t+1) ± ⟩≤ log(ε −1 d 1 2 h ), ⟨q (t+1) n,i ,k (t+1) n,j ⟩≥− log(ε −1 d 1 2 h ), (91) Next we provide the upper bound for|⟨q (t+1) ± ,k (t+1) ± ⟩|,|⟨q (t+1) n,i ,k (t+1) n ′ ,j ⟩|. By the results of J.11, we have t X s=T 2 |β (t) n,+,i |, t X s=T 2 |β (t) n,−,i | = O SNR 2 (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! , (92) for i∈ [M ]\1,n∈ S ± . t X s=T 2 |α (t) +,+ |, t X s=T 2 |α (t) −,− |, t X s=T 2 |β (t) +,+ |, t X s=T 2 |β (t) −,− |, t X s=T 2 |α (t) n,i,+ |, t X s=T 2 |β (t) n,i,− | = O N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! , (93) for i∈ [M ]\1,n∈ S ± . t X s=T 2 |α (t) n,+,i |, t X s=T 2 |α (t) n,−,i |, t X s=T 2 |α (t) n,i,+ |, t X s=T 2 |α (t) n,i,− |, t X s=T 2 |α (t) n,i,n,j |, t X s=T 2 |β (t) n,j,n,i | = O (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! , (94) for i,j ∈ [M ]\1,n∈ S ± . t X s=T 2 |α (t) n,i,n ′ ,j |, t X s=T 2 |β (t) n,j,n ′ ,i | = O (log(6N 2 M 2 /δ)) 4 log O 1 ε εd 1 2 h ! (95) fori,j ∈ [M ]\1,n,n ′ ∈ [N ],n ̸= n ′ .Plugging these and propositionG(t)into the update rule of 48 Benign Overfitting in Adversarial Training for Vision Transformers |⟨q (t) ± ,k (t) ∓ ⟩|,|⟨q (t) n,i ,k (t) ̄n,j ⟩| and get |⟨q (t+1) + ,k (t+1) − ⟩|≤|⟨q (T 2 ) + ,k (T 2 ) − ⟩| + t X s=T 2 |⟨q (s+1) + ,k (s+1) − ⟩−⟨q (s) + ,k (s) − ⟩| ≤|⟨q (T 2 ) + ,k (T 2 ) − ⟩| + t X s=T 2 α (s) +,+ ⟨k (s) + ,k (s) − ⟩ + X n∈S + M X i=2 α (s) n,+,i ⟨k (s) n,i ,k (s) − ⟩ +β (s) −,− ⟨q (s) + ,q (s) − ⟩ + X n∈S − M X i=2 β (s) n,−,i ⟨q (s) n,i ,q (s) − ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i · β (s) −,− q (s)⊤ − + X n∈S − M X i=2 β (s) n,−,i q (s)⊤ n,i ≤|⟨q (T 2 ) + ,k (T 2 ) − ⟩| + t X s=T 2 |α (t) +,+ ||⟨k (t) + ,k (t) − ⟩| + X n∈S + M X i=2 t X s=T 2 |α (t) n,+,i ||⟨k (t) n,i ,k (t) − ⟩| + t X s=T 2 |β (t) −,− ||⟨q (t) + ,q (t) − ⟩| + X n∈S − M X i=2 t X s=T 2 |β (t) n,−,i ||⟨q (t) n,i ,q (t) + ⟩| +lower order term =|⟨q (T 2 ) + ,k (T 2 ) − ⟩| + O N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! · o(1) + N · M · O SNR 2 (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! · o(1) + O N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! · o(1) + N · M · O SNR 2 (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! · o(1) =|⟨q (T 2 ) + ,k (T 2 ) − ⟩| + o N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! + o N · SNR 2 (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 1 2 h ! = o(1), (96) where the first inequality is by triangle inequality, the second inequality is by results in E.2, the last equality is by |⟨q (T 2 ) + ,k (T 2 ) − ⟩| = o(1)andd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 . Similarly we have|⟨q (t+1) − ,k (t+1) + ⟩| = o(1)and |⟨q (t+1) n,i ,k (t+1) ̄n,j ⟩| = o(1). Lemma G.8 (Convergence of Training Loss, Lemma D.7 in (Jiang et al., 2024)). There existT = C 19 ηε(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 such that L S (θ(T ))≤ ε(97) Proof.As we have the same conditions at the end of stage I as (Jiang et al., 2024), thus we have: Substitutingt = T = C 19 ηε(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 into propositionsF (t) and get V (t) + ≥ log exp(V (T 2 ) + ) + ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 ) 49 Benign Overfitting in Adversarial Training for Vision Transformers ≥ log exp(V (T 2 ) + ) + C 20 ε ≥ log C 20 ε , |V (t) n,i | = O(1). Thus, for n∈ S + , we bound f ( f X n ,θ(t)) as follows : f ( f X n ,θ) = 1 M M X l=1 φ( e x ⊤ n,l W Q W ⊤ K ( f X n ) ⊤ ) f X n W V w O ≥ log 1 ε (98) And e ℓ (t) n = log 1 + exp(−f ( f X n ,θ(t))) ≤ exp(−f ( f X n ,θ(t))) ≤ exp − log 1 ε ≤ ε. Similarly, we have e ℓ (t) n ≤ ε for n∈ S − . Therefore, we have L S (θ(T )) = 1 N N X n=1 e ℓ (t) n ≤ ε. G.4. Test error In this section, we denote cleanV + ,V − andV ξ asμ ⊤ + W V w O ,μ ⊤ − W V w O andξ ⊤ W V w O , and perturbed e V + , e V − and e V ξ as e μ ⊤ + W V w O , e μ ⊤ − W V w O and e ξ ⊤ W V w O . G.4.1. CLEAN TEST ERROR Theorem G.9. Under Assumption 4.1, in the theoretical analysis of test error in the second and third stages of benign overfitting, we defineg(ξ)asV (t) ξ = D ξ, W (t) V w O E . Then, we know that for anyx ≥ 0, ifg : R n → Ris a Lipschitz function and c is a constant, the following inequality holds for the test loss. P( M X j=2 α i (g(ξ j )− Eg(ξ j ))≥ x)≤ exp − cx 2 σ 2 p ( P M j=2 α 2 j ) W (t) V w O 2 2 . Proof. According to Theorem 5.2.2 in Vershynin (2018), we know that for anyx ≥ 0, ifg : R n → Ris a Lipschitz function, it holds that P( N X i=1 α i (g(ξ i )− Eg(ξ i ))≥ x)≤ exp − cx 2 σ 2 p ( P N i=1 α 2 i )∥g∥ 2 Lip ! (99) where g(ξ) is defined as|V (t) ξ | =|⟨ξ, W (t) V w O ⟩|, we have |g(ξ)− g(ξ ′ )| = ⟨ξ, W (t) V w O ⟩ − ⟨ξ ′ , W (t) V w O ⟩ 50 Benign Overfitting in Adversarial Training for Vision Transformers ≤ D ξ−ξ ′ , W (t) V w O E ≤∥W (t) V w O ∥ 2 ∥ξ−ξ ′ ∥ 2 So, we can get ∥g∥ Lip ≤ W (t) V w O 2 .(100) By plugging (100) into (99), we can get the result. The following inequality holds according to the update rules of theVvector in Lemma E.4, the first equality is derived from the update of triangle inequality, and the second equality is due to the initialization of the V vector. W (t) V w O 2 ≤ W (0) V w O 2 + t−1 X t ′ =0 W (t ′ +1) V w O − W (t ′ ) V w O 2 = W (0) V w O 2 + tO η· max n ∥μ∥ 2 ,σ p √ d o ·∥w O ∥ 2 = O σ V ∥w O ∥ 2 √ d + tη∥w O ∥ 2 max n ∥μ∥ 2 ,σ p √ d o ≤ O tη∥w O ∥ 2 max n ∥μ∥ 2 ,σ p √ d o (101) Since g(ξ) as|V (t) ξ | =|⟨ξ, W (t) V w O ⟩|, and since D ξ, W (t) V w O E ∼N (0,∥W (t) V w O ∥ 2 2 σ 2 p ), so we can get: Eg(ξ) = E|⟨ξ, W (t) V w O ⟩| = r 2 π ∥W (t) V w O ∥ 2 σ p The test error can be interpreted as the probability that the noise term dominates the signal term. Formally, this corresponds to the event that the cumulative contribution of the random perturbation exceeds the deterministic signal margin. After centralization, we can apply Theorem G.9 to obtain a high-probability upper bound on the test error. P (y(f (θ, X))≤ 0) = P ( M X i=1 S i,1 )(V (t) + − V (t) − ) + M X j=2 (( M X i=1 S i,j )V (t) ξ j ) ≤ 0 ≤ P M X j=2 (( M X i=1 S i,j )|V (t) ξ j |)≥ ( M X i=1 S i,1 ) V (t) + − V (t) − = P M X j=2 α j (g(ξ j )− Eg(ξ j )≥ α 1 V (t) + − V (t) − − σ p r 2 π ( M X j=2 α j ) W (t) V w O 2 ≤ exp − c 2 α 1 V (t) + − V (t) − − σ p q 2 π ( P M j=2 α j ) W (t) V w O 2 2 σ 2 p ( P M j=2 α 2 j ) W (t) V w O 2 2 ≤ exp c 4 π · exp − c 5 2 α 1 V (t) + − V (t) − σ p q P M j=2 α 2 j W (t) −V w O 2 2 We denoteα j as P i S i,j , whereS i,j issoftmax(⟨q (t) i , k (t) j ⟩). When the subscript is 1, it represents the signal, and when the subscript is from 2 to M, it represents noise. 51 Benign Overfitting in Adversarial Training for Vision Transformers Then, by the lower bound ofV (t) ± and upper bound of W (t) V w O 2 , we can further bound the test error with following inequality: P (y(f (θ, X)≤ 0)≤ exp c 4 π · exp − c 5 2 α 1 V (t) + − V (t) − σ p q P M j=2 α 2 j W (t) V w O 2 2 ≤ exp c 12 π exp − c 13 2 O V (t) + − V (t) − σ p (V (t) + −V (t) − ) ∥μ∥ 2 2 = exp c 12 π exp h − c 13 2 O dSNR 2 i where the second inequality is by W (t) V w O is almost aligned with V (t) + and V (t) − , thus∥W (t) V w O ∥ 2 ∼ V (t) + −V (t) − ∥μ∥ 2 . G.4.2. ROBUST TEST ERROR We start by writing the prediction score under perturbation e X as yf (θ, e X) = M X i=1 e S i1 e V (t) + + e V (t) − + M X j=2 M X i=1 e S ij e V (t) ξ j , We first take the first term as an example and derive an upper bound on the maximum discrepancy between the perturbed input e X ∈ B(X,τ ) and the clean input. S 11 V (t) + − e S 11 e V (t) + = (S 11 − e S 11 )V (t) + + e S 11 (V (t) + − e V (t) + ) ≤ (1− 1/C)S 11 V (t) + + e S 11 |⟨ e μ + −μ + , W (t) V w O ⟩| ≤ (1− 1/C)S 11 V (t) + + e S 11 W (t) V w O τ, where the inequality comes from Lemma G.7, and the definition ofV (t) + . This shows that the deviation can be bounded linearly in the perturbation magnitude, with only a small residual term since(C− 1) = o(1). Similarly, an analogous upper bound holds for e S i1 e V (t) ± − S i1 V (t) ± and e S ij e V (t) ξ j − S ij V (t) ξ j for i∈ [M ], j ∈ [M ]\1. Aggregating the deviations across all components, the worst-case perturbation satisfies yf (θ,X)−min e X∈B(X,τ ) yf (θ, e X) ≤ X i S i1 ∥W (t) V w O ∥τ + M X j=2 X i S ij ∥W (t) V w O ∥τ + (1− 1/C)S 11 ( e V (t) + + e V (t) + ) + o(1) ≲ M X j=1 X i S ij ! W (t) V w O τ + (1− 1/C) X i S i1 ( e V (t) + + e V (t) − ) = M W (t) V w O τ + (1− 1/C) X i S i1 ( e V (t) + + e V (t) − ) (102) where the first inequality comes from e V (t) ξ j = o(1) forj ∈ [M ]\1. Thus the adversarial effect scales with both the cumulative magnitude of the perturbed coefficients and the operator norm of the weight matrices. Then we can bound the robust test error: 52 Benign Overfitting in Adversarial Training for Vision Transformers P min e X∈B(X,τ ) yf (θ, e X)≤ 0 ! = P yf (θ,X) + yf (θ,X)−min e X∈B(X,τ ) yf (θ, e X) ≤ 0 ! ≤ P M X j=2 α j g(ξ j )− Eg(ξ j ) ≥ α 1 V (t) + − V (t) − − σ p q 2 π M X j=2 α j W (t) V w O 2 − M W (t) V w O 2 τ − (1− 1/C)α 1 (V (t) + − V (t) − ) ! ≤ exp c 12 π exp − c 13 2 α 1 (V (t) + − V (t) − ) σ p q P M j=2 α 2 j ∥W (t) V w O ∥ 2 − M∥W (t) V w O ∥τ σ p q P M j=2 α 2 j ∥W (t) V w O ∥ 2 2 ≤ exp c 12 π exp " − c 13 2 O √ dSNR(1− τ ∥μ∥ 2 ) 2 # The first inequality follows from (102). The third inequality uses the fact thatC ≤ e/2, which we absorb into the constant term. The last inequality follows from the bound on V (t) ± and∥W (t) V w O ∥ 2 . This completes the proof. H. Benign Overfitting in Case 2 Stage I stay same with G.1. Next, we aim to prove that under conditionτ = (1− o(1))∥μ∥, the attention component in a ViT will remain in its initialization state and fail to learn meaningful signal-to-signal or noise-to-signal interactions. This is because, under such perturbations, any newly emerging margin can be immediately neutralized, preventing the signal-to-signal attention from accumulating advantages. In this regime, the ViT effectively degenerates into a linear model. At the end of Stage I, sinceV T 1 + ≥ 3M|V T 1 n,i | andq = o(1)at this point, the perturbation has no significant effect. Consequently,⟨q + ,k + ⟩and⟨q n,i ,k + ⟩experiences a temporary increase, but it does not exceedΘ(logC)(as we will demonstrate later). Therefore, we assume that after Stage I, when⟨q,k⟩has stabilized and the loss derivatives are no longer at theo(1)scale. However,|V T 3 n,i |is noto(1); it is of the same order as|V T 3 + |, which implies that a larger SNR is required. The following conditions hold at the beginning of Stage I. |V (T 2 ) + |,|V (T 2 ) − |,|V (T 2 ) n,i | = o(1), V (T 2 ) + ≥ 3M ·|V (T 2 ) n,i |, V (T 2 ) − ≤−3M ·|V (T 2 ) n,i |, ∥q (T 2 ) + ∥ 2 2 ,∥k (T 2 ) + ∥ 2 2 = Θ(logC), ∥q (T 2 ) n,i ∥ 2 2 ,∥k (T 2 ) n,i ∥ 2 2 = Θ(logC), |⟨q (T 2 ) + ,q (T 2 ) − ⟩|,|⟨q (T 2 ) + ,q (T 2 ) n,i ⟩|,|⟨q (T 2 ) n,i ,q (T 2 ) n ′ ,j ⟩| = o(1), |⟨k (T 2 ) + ,k (T 2 ) − ⟩|,|⟨k (T 2 ) + ,k (T 2 ) n,i ⟩|,|⟨k (T 2 ) n,i ,k (T 2 ) n ′ ,j ⟩| = o(1), for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . |⟨q (T 2 ) + ,k (T 2 ) + ⟩|,|⟨q (T 2 ) + ,k (T 2 ) n,j ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) + ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) n ′ ,j ⟩| = Θ(logC) |⟨q (T 2 ) + ,k (T 2 ) − ⟩|,|⟨q (T 2 ) n,i ,k (T 2 ) n,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n∈ [N ],n̸=n. 53 Benign Overfitting in Adversarial Training for Vision Transformers LetT 3 = Θ M ηε(∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . Next we prove the following four propositionsJ (t),K(t),L(t)by induction ontfor t∈ [T 2 ,T 3 ]: • J (t): V (t) + ≥ 3M ·|V (t) n,i |, V (t) − ≤−3M ·|V (t) n,i |, |V (t) n,i | = o(1), log exp(V (T 2 ) + ) + η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 ) ≤ V (t) + ≤ 2 log O 1 ε , − 2 log O 1 ε ≤ V (t) − ≤− log exp(−V (T 2 ) − ) + η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 ) for i∈ [M ]\1,n∈ [N ]. • K(t): ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ(logC), ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ (logC), |⟨q (t) + ,q (t) − ⟩|,|⟨q (t) ± ,q (t) n,i ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = o(1), |⟨k (t) + ,k (t) − ⟩|,|⟨k (t) ± ,k (t) n,i ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ , C = O(1). • L(t): |⟨q (t) ± ,k (t) ± ⟩|,|⟨q (t) ± ,k (t) n,j ⟩|,|⟨q (t) n,i ,k (t) ± ⟩|,|⟨q (t) n,i ,k (t) n,j ⟩| = Θ(logC), |⟨q (t) ± ,k (t) ∓ ⟩|,|⟨q (t) n,i ,k (t) n,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],n̸= n, C = O(1). By the results of Stage I, we know thatF (T 1 ),G(T 2 ),I(T 2 )are true. To prove thatF (t),G(t),H(t)andI(t)are true in stage I, we will prove the following claims holds for t∈ [T 2 ,T 3 ]: • Claim 9. L(T 2 ),...,L(t) =⇒ J (t + 1) • Claim 10. J (t),L(t),K(t) =⇒ K(t + 1) • Claim 11. J (t),K(t),L(t), =⇒ L(t + 1) H.1. Proof of Claim 9 The proofs for V (t) + ≥ 3M ·|V (t) n,i | and V (t) − ≤−3M ·|V (t) n,i | are the same as for G.2.1. we provide the bounds for− e ℓ ′ (s) n . Note thatℓ(z) = log(1 + exp(−z))and−ℓ ′ (z) = exp(−z)/(1 + exp(−z)). Without 54 Benign Overfitting in Adversarial Training for Vision Transformers loss of generality, assume y n = 1. We have − e ℓ ′ (f ( f X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ( e x ⊤ n,l W (s) Q W (s)⊤ K ( f X n ) ⊤ ) f X n W (s) V w O = 1 M softmax(⟨ e q (s) ± , e k (s) ± ⟩) + M X l=2 softmax(⟨ e q (s) n,l , e k (s) ± ⟩) · e μ ⊤ + W (s) V w O + X j∈[M ]\1 softmax(⟨ e q (s) n,j , g k n,j (s) ⟩) + M X l=2 softmax(⟨ e q (s) n,l , e k (s) n,j ⟩) · e ξ ⊤ n,j W (s) V w O = 1 M M · C C + M − 1 · V (s) + + M · 1 C + M − 1 · X j∈[M ]\1 V (s) n,i ≥ 1 2M V (s) + , (103) fors∈ [T 2 ,t], where the second equality is byL(t)thatΛ (s) n,±,j = Θ(logC)andΛ (s) n,i,±,j = Θ(logC), and the inequality follows from V (s) + ≥ 3M ·|V (s) n,i |. Similarly, we have 1 M M X l=1 φ( e x ⊤ n,l W (s) Q W (s)⊤ K ( f X n ) ⊤ ) f X n W (s) V w O ≤max i∈[M ]\1 V (s) + ,V (s) n,i = V (s) + . (104) Then, we have − e ℓ ′ (f ( f X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ( e x ⊤ n,l W (s) Q W (s)⊤ K ( f X n ) ⊤ ) f X n W (s) V w O ≥ 1 1 + exp(V (s) + ) ≥ C 16 exp(V (s) + ) (105) For the last inequality, note thatV (T 2 ) + ≥ 0andV (s) + is monotonically increasing, so there exist a constantC 16 such that 1 1+exp(V (s) + ) ≥ C 16 exp(V (s) + ) . We also have the upper bound −ℓ ′ (f (X n ,θ(s))) = 1 1 + exp 1 M P M l=1 φ(x ⊤ n,l W (s) Q W (s)⊤ K (X n ) ⊤ )X n W (s) V w O ≤ 1 1 + exp(V (s) + /2M ) ≤ 1 exp(V (s) + /2M ) (106) 55 Benign Overfitting in Adversarial Training for Vision Transformers By the update rule of γ (t) V,+ and in Lemma E.4 and get γ (s+1) V,+ − γ (s) V,+ =− η⟨ e μ + , e μ (t) + ⟩ NM X n∈S + e ℓ ′(t) n exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) + ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) + X n∈S + e ℓ ′(t) n M X i=2 −η⟨ e μ + , e ξ (t) n,i ⟩ NM exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) + , e k (t) n,k ⟩) + M X j=2 exp(⟨ e q (t) n,j , e k (t) n,i ⟩) exp(⟨ e q (t) n,j , e k (t) + ⟩) + P M k=2 exp(⟨ e q (t) n,j , e k (t) n,k ⟩) ≥− η(∥μ∥ 2 − τ ) 2 NM X n∈S + ℓ ′ (s) n (M · C C + M − 1 ) + ητ∥μ∥ 2 NM X n∈S + ℓ ′ (s) n (M · 1 C + M − 1 ) ≥ η(∥μ∥ 2 − τ ) 2 NM · N 4 · C 16 exp(V (s) + ) − ητ∥μ∥ 2 NM · N 4 · C 16 exp(V (s) + /2M ) ≥ ηC 17 (∥μ∥ 2 − τ ) 2 M 1 exp(V (s) + ) where the second inequality is by (105)(106), the last inequality is by N · SNR 2 = Ω( 1 ε ) Then by definition E.1, we get V (s+1) + − V (s) + = (γ (s+1) V,+ − γ (s) V,+ )∥w O ∥ 2 2 ≥ ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 M exp(V (s) + ) (107) Multiply both sides simultaneously by exp(V (s) + ) and get exp(V (s) + )(V (s+1) + − V (s) + )≥ η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (108) Taking a summation from T 2 to t and get t X s=T 2 exp(V (s) + )(V (s+1) + − V (s) + )≥ t X s=T 2 η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 ≥ η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (109) By the property that V (s) + is monotonically increasing, we have Z V (t+1) + V (T 2 ) + exp(x)dx≥ t X s=T 2 exp(V (s) + )(V (s+1) + − V (s) + ) ≥ η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (110) By R V (t+1) + V (T 2 ) + exp(x)dx = exp(V (t+1) + )− exp(V (T 2 ) + ) we get V (t+1) + ≥ log exp(V (T 2 ) + ) + η M C 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (111) Similarly, we have V (t+1) − ≤− log exp V (T 2 ) − + ηC 17 (∥μ∥ 2 − τ ) 2 ∥w O ∥ 2 2 (t− T 2 + 1) (112) Similarly, we have the lower bound, the proofs are the same as for G.3.1 56 Benign Overfitting in Adversarial Training for Vision Transformers H.2. Proof of Claim 10 We first consider the increment of⟨q,k⟩at thet-th update when using the original clean data. We then show that, at this step, the effect introduced by the perturbation under adversarial samples dominates the increment learned from the clean data; hence⟨q,k⟩ remains stable and bounded. By the update rule of⟨q,k⟩ we have ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ = α (t) +,+ ∥k (t) + ∥ 2 2 + β (t) +,+ ∥q (t) + ∥ 2 2 +lower order term (113) Subsequently, we establish upper bounds for α and β for clean data. α (t) +,+ = η NM X n∈S + −ℓ ′ (t) n ∥μ∥ 2 2 · V (t) + exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) − exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! 2 − M X i=2 (V (t) n,i · exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) · exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! ≤ η NM X n∈S + ∥μ∥ 2 2 (V (t) + ) ≤ 3η 2M ∥μ∥ 2 2 V (t) + (114) Then, we can then compute the incremental growth of⟨q (t) + ,k (t) + ⟩ after one update step on clean data. ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ = α (t) +,+ ∥k (t) + ∥ 2 2 + β (t) +,+ ∥q (t) + ∥ 2 2 +lower order term ≤ 3η 2M ∥μ∥ 2 2 V (t) + Θ(logC) + 3η 2M ∥μ∥ 2 2 V (t) + Θ(logC) (115) Subsequently, we compute at the t th iteration the magnitude of the effect that the perturbation imposes on⟨q (t) + ,k (t) + ⟩. max e X (t) ∈B(X (t) ,τ ) ⟨ e q (t) + , e k (t) + ⟩−⟨q (t) + ,k (t) + ⟩ = ((1 + τ ∥μ∥ 2 ) 2 − 1)⟨q (t) + ,k (t) + ⟩ = ((1 + τ ∥μ∥ 2 ) 2 − 1)Θ(logC) (116) Asτand∥μ∥are same order, and 3η 2M ∥μ∥ 2 2 V (t) + = o( 1 N )byV (t) + ≤ 2 log O( 1 ε ) ,d h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 and η ≤ e O(min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h ). Thus, we have ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩≤ max e X (t) ∈B(X (t) ,τ ) ⟨ e q (t) + , e k (t) + ⟩−⟨q (t) + ,k (t) + ⟩ 57 Benign Overfitting in Adversarial Training for Vision Transformers which indicates that the perturbation’s effect exceeds the one-step update on clean data. Therefore,⟨q (t) + ,k (t) − ⟩stayΘ(logC). By similar methods, we can bound the other⟨q (t) ,k (t) ⟩, which complete the proof. H.3. Proof of Claim 11 We use similar methods in H.2. We first consider the increment of∥q∥ 2 2 and∥k∥ 2 2 at thet-th update when using the original clean data. We then show that, at this step, the effect introduced by the perturbation under adversarial samples dominates the increment learned from the clean data; hence∥q∥ 2 2 and∥k∥ 2 2 remains stable and bounded. By the update rule of∥q∥ 2 2 and∥k∥ 2 2 we have ∥q (t+1) + ∥ 2 2 −∥q (t) + ∥ 2 2 = 2⟨∆q (t) + ,q (t) + ⟩ +⟨∆q (t) + , ∆q (t) + ⟩ = 2α (t) +,+ ⟨q (t) + ,k (t) + ⟩ + 2 X n∈S + M X i=2 α (t) n,+,i ⟨q (t) + ,k (t) n,i ⟩ + α (t) +,+ k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i · α (t) +,+ k (t)⊤ + + X n∈S + M X i=2 α (t) n,+,i k (t)⊤ n,i ≤ 2|α (t) +,+ ||⟨q (t) + ,k (t) + ⟩| + 2 X n∈S + M X i=2 |α (t) n,+,i ||⟨q (t) + ,k (t) n,i ⟩| +lower order term ≤ 2 3η 2M ∥μ∥ 2 2 log O( 1 ε ) Θ(logC) + 2 X n∈S + M X i=2 3η 2NM ∥μ∥ 2 2 log O( 1 ε ) Θ(logC) ≤ 12η∥μ∥ 2 2 log O( 1 ε ) Θ(logC) (117) where the second inequality comes form the upper bounds for α and β on clean data similar to (114). Subsequently, we compute at the t th iteration the magnitude of the effect that the perturbation imposes on∥q (t) + ∥ 2 2 . max e X (t) ∈B(X (t) ,τ ) ∥ e q (t) + ∥ 2 2 −∥q (t) + ∥ 2 2 ≤ ((1 + τ ∥μ∥ 2 ) 2 − 1)∥q (t) + ∥ 2 2 ≤ ((1 + τ ∥μ∥ 2 ) 2 − 1)Θ(logC) (118) Asτand∥μ∥ 2 are same order, and12η∥μ∥ 2 2 log O( 1 ε ) = o( 1 NM )byd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 and η ≤ e O(min∥μ∥ −2 2 , (σ 2 p d) −1 · d − 1 2 h ). Thus, we have ∥q (t+1) + ∥ 2 2 −∥q (t) + ∥ 2 2 ≤ max e X (t) ∈B(X (t) ,τ ) ∥ e q (t) + ∥ 2 2 −∥q (t) + ∥ 2 2 which indicates that the perturbation’s effect exceeds the one-step update on clean data. Therefore,∥q (t+1) + ∥ 2 2 stayΘ(logC). By similar methods, we can bound the other∥q∥ 2 2 and∥k∥ 2 2 , which complete the proof. The proof of convergence and test error is similar with Lemma G.8 and Section G.4 I. Proof of Theorem 3 Proof. Fix an arbitrary θ. Consider the two classes separately. For the positive class (y = +): δ (+) 1 =−μ + , δ (+) 2 = 0 58 Benign Overfitting in Adversarial Training for Vision Transformers is a valid perturbation since∥δ (+) 1 ∥ 2 =∥μ + ∥ 2 ≤ τ ,∥δ (+) 2 ∥ 2 = 0≤ τ . Then the adversarially perturbed point ex (+) = [μ + −μ + ,ξ 2 ,...,ξ M ] = [0,ξ 2 ,...,ξ M ] lies inB([μ,ξ 2 ,...,ξ M ],τ ), so there exists a perturbation that can potentially flip the classifier’s output for the positive class. Similarly, for the negative class (y =−): δ (−) 1 =−μ − , δ (−) 2 = 0 produces ex (−) = [0,ξ 2 ,...,ξ M ]∈B([μ,ξ 2 ,...,ξ M ],τ ). For each class independently, there exists a perturbation that can potentially flip its label. Thus, at least one class can be adversarially fooled with probability at leastminPr[y = +], Pr[y = −]. For uniform labels, this gives L rob D (θ)≥ 1 2 · 1 2 = 1 4 . This completes the proof. J. Complete Calculation Process For Benign Overfitting J.1. Calculations for α and β In this subsection, we give the calculactions for α and β defined in Definition E.2. α (t) +,+ = η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (t) + ⟩ · V (t) + exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) − exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) 2 − M X i=2 V (t) n,i · exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) · exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) + M X i=2 ⟨ e μ + , e ξ (t) n,i ⟩· V (t) + exp(⟨ e q (t) n,i , e k (t) + ⟩) exp(⟨ e q (t) n,i , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,i , e k (t) n,j ⟩) − exp(⟨ e q (t) n,i , e k (t) + ⟩) exp(⟨ e q (t) n,i , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,i , e k (t) n,j ⟩) 2 − M X k=2 V (t) n,i · exp(⟨ e q (t) n,i , e k (t) + ⟩) exp(⟨ e q (t) n,i , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,i , e k (t) n,j ⟩) · exp(⟨ e q (t) n,i , e k (t) n,k ⟩) exp(⟨ e q (t) n,i , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,i , e k (t) n,j ⟩) 59 Benign Overfitting in Adversarial Training for Vision Transformers α (t) n,+,i =− η NM ℓ ′(t) n ⟨ e μ + , e μ (t) + ⟩ · −V (t) + · exp(⟨ e q (t) + , e k (t) + ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) + exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) + V (t) n,i exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) − exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) 2 − X k̸=i V (t) n,k · exp(⟨ e q (t) + , e k (t) n,i ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) · exp(⟨ e q (t) + , e k (t) n,k ⟩) exp(⟨ e q (t) + , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) + , e k (t) n,j ⟩) ) + M X k=2 ⟨ e μ + , e ξ (t) n,k ⟩· −V (t) + · exp(⟨ e q (t) n,k , e k (t) + ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) · exp(⟨ e q (t) n,k , e k (t) n,i ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) + V (t) n,i exp(⟨ e q (t) n,k , e k (t) n,i ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) − exp(⟨ e q (t) n,k , e k (t) n,i ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) 2 − X l̸=i V (t) n,l · exp(⟨ e q (t) n,k , e k (t) n,i ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) · exp(⟨ e q (t) n,k , e k (t) n,l ⟩) exp(⟨ e q (t) n,k , e k (t) + ⟩) + P M j=2 exp(⟨ e q (t) n,k , e k (t) n,j ⟩) We can also derive the calculations for otherαandβ, since they follow the same procedure as in Section F.1 of Jiang et al. (2024). J.2. Proof of Lemma G.4 J.3. Update Rules for Inner Products In this subsection, we give the update rules for the inner products of q and k. 60 Benign Overfitting in Adversarial Training for Vision Transformers ⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩ = α (t) +,+ ∥k (t) + ∥ 2 2 + X n∈S + M X i=2 α (t) n,+,i ⟨k (t) + ,k (t) n,i ⟩ + β (t) +,+ ∥q (t) + ∥ 2 2 + X n∈S + M X i=2 β (t) n,+,i ⟨q (t) + ,q (t) n,i ⟩ + α (t) +,+ k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i · β (t) +,+ q (t)⊤ + + X n∈S + M X i=2 β (t) n,+,i q (t)⊤ n,i , ⟨q (t+1) − ,k (t+1) − ⟩−⟨q (t) − ,k (t) − ⟩ = α (t) −,− ∥k (t) − ∥ 2 2 + X n∈S − M X i=2 α (t) n,−,i ⟨k (t) − ,k (t) n,i ⟩ + β (t) −,− ∥q (t) − ∥ 2 2 + X n∈S − M X i=2 β (t) n,−,i ⟨q (t) − ,q (t) n,i ⟩ + α (t) −,− k (t) − + X n∈S − M X i=2 α (t) n,−,i k (t) n,i · β (t) −,− q (t)⊤ − + X n∈S − M X i=2 β (t) n,−,i q (t)⊤ n,i , We can also derive the update rules for otherqandk, since they follow the same procedure as in Section F.2 of Jiang et al. (2024). 61 Benign Overfitting in Adversarial Training for Vision Transformers J.4. Proof of Lemma G.4 LetT 0 = O 1 ηd 1 4 h (∥μ∥ 2 +τ ) 2 ∥w O ∥ 2 2 . By Lemma G.3, we have|V (t) + |,|V (t) − |,|V (t) n,i | = O(d − 1 4 h )fort ∈ [0,T 0 ]by Lemma G.3. Plugging this into the expression for α and β gives |α (t) +,+ | = η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (t) + ⟩ · V (t) + exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) − exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! 2 − M X i=2 V (t) n,i · exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) · exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (t) n,i ⟩· V (t) + exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) − exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) ! 2 − M X k=2 V (t) n,i · exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) · exp(⟨q (t) n,i ,k (t) n,k ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) ! ≤ η(∥μ∥ 2 + τ ) 2 NM · 3NM 4 · O(d − 1 4 h ) + η(∥μ∥τ + 2σ p τ p 2 log(4NM/δ) + τ 2 ) NM · 3NM (M − 1) 4 · O(d − 1 4 h ) = O η(∥μ∥ 2 + τ ) 2 d 1 4 h ! (119) wheretheinequalityisby− e ℓ ′(t) n ≤1andthepropertythatattentionissmallerthan1 62 Benign Overfitting in Adversarial Training for Vision Transformers (e.g. exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩)+ P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ≤ 1 ). We also have |α (t) n,+,i | = − η NM ℓ ′(t) n ⟨ e μ + , e μ (t) + ⟩ · −V (t) + · exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) + exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) + V (t) n,i exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) − exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! 2 − X k̸=i V (t) n,k · exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) · exp(⟨q (t) + ,k (t) n,k ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! ) + M X k=2 ⟨ e μ + , e ξ (t) n,k ⟩· −V (t) + · exp(⟨q (t) n,k ,k (t) + ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) · exp(⟨q (t) n,k ,k (t) n,i ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) + V (t) n,i exp(⟨q (t) n,k ,k (t) n,i ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) − exp(⟨q (t) n,k ,k (t) n,i ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) ! 2 − X l̸=i V (t) n,l · exp(⟨q (t) n,k ,k (t) n,i ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) · exp(⟨q (t) n,k ,k (t) n,l ⟩) exp(⟨q (t) n,k ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,k ,k (t) n,j ⟩) ! ≤ η(∥μ∥ 2 + τ ) 2 NM · M · O(d − 1 4 h ) = O η(∥μ∥ 2 + τ ) 2 d 1 4 h N ! , where the inequality is by− e ℓ ′(t) n ≤ 1, Lemma F.4 and the property that attention is smaller than 1. Similarly, we have |α (t) −,− |,|β (t) +,+ |,|β (t) −,− | = O η(∥μ∥ 2 + τ ) 2 d 1 4 h ! , |α (t) n,−,l |,|β (t) n,+,l |,|β (t) n,−,l | = O η(∥μ∥ 2 + τ ) 2 d 1 4 h N ! , 63 Benign Overfitting in Adversarial Training for Vision Transformers |α (t) n,l,− |,|β (t) n,l,+ |,|β (t) n,l,− |,|α (t) n,l,n ′ ,l ′ |,|β (t) n,l,n ′ ,l ′ |= O η(∥μ∥τ + σ 2 p d) d 1 4 h N ! for t∈ [0,T 0 ]. Next we use induction to show that the following propositionA(t) holds for t∈ [0,T 0 ]. A(t): |⟨q (t) ± ,k (t) ± ⟩|,|⟨q (t) n,i ,k (t) ± ⟩|,|⟨q (t) ± ,k (t) n,j ⟩|,|⟨q (t) n,i ,k (t) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨q (t) ± ,q (t) ∓ ⟩|,|⟨q (t) n,i ,q (t) ± ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , |⟨k (t) ± ,k (t) ∓ ⟩|,|⟨k (t) n,i ,k (t) ± ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ) ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ(σ 2 p σ 2 h d h ) for i,j ∈ [M ]\1,n,n ′ ∈ [N ]. By Lemma F.3 we know thatA(0)is true. Now we assumeA(0),...,A(T )is true, then we need to prove thatA(T + 1)is true. We first proof|⟨q (T +1) + ,k (T +1) + ⟩| = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) , as an example. |⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩| = α (t) +,+ ∥k (t) + ∥ 2 2 + X n∈S + M X i=2 α (t) n,+,i ⟨k (t) + ,k (t) n,i ⟩ +β (t) +,+ ∥q (t) + ∥ 2 2 + X n∈S + M X i=2 β (t) n,+,i ⟨q (t) + ,q (t) n,i ⟩ + α (t) +,+ k (t) + + X n∈S + M X i=2 α (t) n,+,i k (t) n,i · β (t) +,+ q (t)⊤ + + X n⊤ M X i=2 β (t) n,+,i q (t)⊤ n,i ! ≤O η(∥μ∥ 2 + τ ) 2 d 1 4 h ! · Θ(∥μ∥ 2 2 σ 2 h d h ) + NM · O η(∥μ∥ 2 + τ ) 2 d 1 4 h N ! · O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) +lower order term = O η∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d 3 4 h 64 Benign Overfitting in Adversarial Training for Vision Transformers Taking a summation, we obtain that |⟨q (T +1) + ,k (T +1) + ⟩|≤|⟨q (0) + ,k (0) + ⟩| + T X t=0 |⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩| ≤|⟨q (0) + ,k (0) + ⟩| + T 0 −1 X t=0 |⟨q (t+1) + ,k (t+1) + ⟩−⟨q (t) + ,k (t) + ⟩| ≤O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) + O 1 ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 ! · O(η∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d 3 4 h ) =O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h · p d h log(6N 2 M 2 /δ) + O ∥μ∥ 2 2 σ 2 h d 1 2 h Similarly to⟨q (t) + ,k (t) + ⟩, it is easy to know that the inner product does not change by a magnitude more than the product of maxα,β and max⟨q,q⟩,⟨k,k⟩ in a single iteration, which can be expressed as follows |⟨q (t+1) ,k (t+1) ⟩−⟨q (t) ,k (t) ⟩| =O max ( η(∥μ∥ 2 + τ ) 2 d 1 4 h , η(σ 2 p d +∥μ∥τ ) d 1 4 h N )! · Θ(max∥μ∥ 2 2 σ 2 h d h ,σ 2 p σ 2 h d h ) =O η(∥μ∥ 2 + τ ) 2 d 1 4 h ! · Θ(max∥μ∥ 2 2 σ 2 h d h ,σ 2 p σ 2 h d h ) =O (∥μ∥ 2 + τ ) 2 σ 2 h d 3 4 h · max∥μ∥ 2 2 ,σ 2 p d where the second equality is by the condition that N · SNR 2 = Ω(1). Taking a summation, we obtain that |⟨q (T +1) ,k (T +1) ⟩−⟨q (0) ,k (0) ⟩|≤ T−1 X t=0 |⟨q (t+1) ,k (t+1) ⟩−⟨q (t) ,k (t) ⟩| ≤ T 0 −1 X t=0 O η(∥μ∥ 2 + τ ) 2 σ 2 h d 3 4 h · max∥μ∥ 2 2 ,σ 2 p d = O 1 ηd 1 4 h (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 ! · O η(∥μ∥ 2 + τ ) 2 σ 2 h d 3 4 h · max∥μ∥ 2 2 ,σ 2 p d = O max∥μ∥ 2 2 ,σ 2 p d· σ 2 h d 1 4 h . It is clear that the magnitude of⟨q (T +1) ,k (T +1) ⟩−⟨q (0) ,k (0) ⟩is smaller thanmax∥μ∥ 2 2 ,σ 2 p d·σ 2 h · p d h log(6N 2 M 2 /δ) . Thus the magnitude of the bound for⟨q (T +1) ,k (T +1) ⟩is the same as that of⟨q (T ) ,k (T ) ⟩. The proof for⟨q (T +1) ,q (T +1) ⟩ and⟨k (T +1) ,k (T +1) ⟩ is exactly the same, and we can conclude the proof by an induction. J.5. Lower Bounds of α and β In this subsection, we present some bounds forαandβwhich can be used in G.2 and G.3. All the calculations in this subsection are based on the precise expression forαandβin J.1 and assume thatB(T 1 ),...,B(s),D(T 1 ),...,D(s− 1) hold (s∈ [T 1 ,t]). Then the following propositions hold: V (s) + ≥ 3M ·|V (s) n,i |, 65 Benign Overfitting in Adversarial Training for Vision Transformers V (s) − ≤−3M ·|V (s) n,i |, softmax(⟨q (s) ± ,k (s) ± ⟩),softmax(⟨q (s) n,i ,k (s) ± ⟩)≥ 1 M − o(1), softmax(⟨q (s) ± ,k (s) n,j ⟩),softmax(⟨q (s) n,i ,k (s) n,j ⟩)≤ 1 M + o(1). Now we give the bounds respectively for α (s) +,+ ,α (s) n,+,i ,α (s) −,− ,α (s) n,−,i ,α (s) n,i,+ ,α (s) n,i,− ,α (s) n,i,n ′ ,i ′ , β (s) +,+ ,β (s) n,+,i ,β (s) −,− ,β (s) n,−,i ,β (s) n,i,+ ,β (s) n,i,− ,β (s) n,i,n ′ ,i ′ . α (s) +,+ = η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (s) + ⟩ · V (s) + exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) − exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! 2 − M X i=2 V (s) n,i · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · exp(⟨q (s) + ,k (s) n,i ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (s) n,i ⟩· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 − M X k=2 V (s) n,i · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) · exp(⟨q (s) n,i ,k (s) n,k ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! ≥ η NM X n∈S + − e ℓ ′(s) n ⟨ e μ + , e μ (s) + ⟩· exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · V (s) + 1− exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! − 1 2 · V (s) + M X i=2 exp(⟨q (s) + ,k (s) n,i ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! + η NM X n∈S + − e ℓ ′(s) n ⟨ e μ + , e ξ (s) n,i ⟩· exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) · V (s) + 1− exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 66 Benign Overfitting in Adversarial Training for Vision Transformers − 1 2 · V (s) + M X k=2 exp(⟨q (s) n,i ,k (s) n,k ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! ≥ η 2NM X n∈S + −ℓ ′(s) n (∥μ∥ 2 − τ ) 2 V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · 1− exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! + M X i=2 (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 where the first inequality is byV (s) + ≥ 3M ·|V (s) n,i |, the second inequality is by the fact that the sum of attention equal to 1 and Lemma F.4. Similarly, we have β (s) +,+ ≥ η 2NM X n∈S + − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + (M − 1) exp(max j ⟨q (s) + ,k (s) n,j ⟩) · exp(max j ⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + (M − 1) exp(max j ⟨q (s) + ,k (s) n,j ⟩) +lower order term(120) α (s) −,− ≥ η 2NM X n∈S − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) − · exp(⟨q (s) − ,k (s) − ⟩) exp(⟨q (s) − ,k (s) − ⟩) + (M − 1) exp(max j ⟨q (s) − ,k (s) n,j ⟩) · exp(max j ⟨q (s) − ,k (s) n,j ⟩) exp(⟨q (s) − ,k (s) − ⟩) + (M − 1) exp(max j ⟨q (s) − ,k (s) n,j ⟩) +lower order term(121) Similarly, by applying the update rules in Section J.3, we can derive the following bounds on α and β. α (s) +,+ ,α (s) −,− ,β (s) +,+ ,β (s) −,− ,α (s) n,i,+ ,α (s) n,i,− ,β (s) n,+,i ,β (s) n,−,i ≥ 0, α (s) n,+,i ,α (s) n,−,i ,α (s) n,i,n,j ,β (s) n,i,+ ,β (s) n,i,− ,β (s) n,j,n,i ≤ 0. J.6. Lower Bounds of⟨q, k⟩ In order to give the lower bounds for⟨q,k⟩, we need to rewrite the bounds ofαandβin a more concise form. We first expand the equations in J.5 under the assumption thatB(s) andE (s) holds for s∈ [T 1 ,t]. α (s) +,+ ≥ η 2NM X n∈S + − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) · 1− exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) ! + M X i=2 (∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 )· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) 67 Benign Overfitting in Adversarial Training for Vision Transformers − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 = η 2NM X n∈S + − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) · P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) +lower term ≥ η 2NM − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) · exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) +lower term ≥ η 2NM − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · 1 M − o(1) · exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) ≥ η 2NM − e ℓ ′ (s) n (∥μ∥ 2 − τ ) 2 V (s) + · 1 M − o(1) · exp(⟨q (s) + ,k (s) n,j ⟩) C exp(⟨q (s) + ,k (s) + ⟩) +lower term ≥ η 2 C 5 (∥μ∥ 2 − τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) , where the first inequality is by Lemma G.7(asE (s)holds) andsoftmax(⟨q (s) + ,k (s) + ⟩)≥ 1 M − o(1) . In the fourth inequality, by⟨q (T 1 ) ,k (T 1 ) ⟩ = o(1)and the monotonicity of⟨q (s) + ,k (s) + ⟩ (⟨q (s) + ,k (s) + ⟩ is increasing and⟨q (s) + ,k (s) n,j ⟩ is decreasing), there exist a constantCsuch thatC exp(⟨q (s) + ,k (s) + ⟩)≥ exp(⟨q (s) + ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) + ,k (s) n,j ′ ⟩) . In the last inequality, we plugging the lower bounds of V (s) + and− e ℓ ′ (s) n and then absorb all the constant factors. Similarly, we have β (s) +,+ ≥ η 2 C 5 (∥μ∥ 2 − τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) ,(122) α (s) −,− ≥ η 2 C 5 (∥μ∥ 2 − τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) N · 1 exp(Λ (s) n,−,j ) ,(123) β (s) −,− ≥ η 2 C 5 (∥μ∥ 2 − τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) N · 1 exp(Λ (s) n,−,j ) .(124) With the concise lower bounds forαandβabove and propositionC(s), we will give the lower bounds for the dynamics of ⟨q,k⟩. ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ = α (s) +,+ ∥k (s) + ∥ 2 2 + X n∈S + M X i=2 α (s) n,+,i ⟨k (s) + ,k (s) n,i ⟩ + β (s) +,+ ∥q (s) + ∥ 2 2 + X n∈S + M X i=2 β (s) n,+,i ⟨q (s) + ,q (s) n,i ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i · β (s) +,+ q (s) + + X n∈S + M X i=2 β (s) n,+,i q (s) n,i 68 Benign Overfitting in Adversarial Training for Vision Transformers = α (s) +,+ ∥k (s) + ∥ 2 2 + β (s) +,+ ∥q (s) + ∥ 2 2 +lower order term ≥ 2η 2 C 5 (∥μ∥ 2 − τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) · Θ(∥μ∥ 2 2 σ 2 h d h ) +lower order term ≥ η 2 C 6 (∥μ∥ 2 − τ ) 4 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 σ 2 h d h (s− T 1 ) N · 1 exp(Λ (s) n,+,j ) ,(125) Similarly, we have the lower bounds for the dynamics of other⟨q,k⟩. J.7. Upper Bounds of⟨q,k⟩ In order to give the upper bounds of⟨q,k⟩in stage I, we need to give the upper bounds ofαandβbased on the equations in Section J.1 under the assumption thatD(T 1 ),...,D(s− 1) hold for s∈ [T 1 ,t]. 69 Benign Overfitting in Adversarial Training for Vision Transformers α (s) +,+ ≤ η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (t) + ⟩ · V (t) + exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) − exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) ! 2 − M X i=2 V (t) n,i · exp(⟨q (t) + ,k (t) + ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) · exp(⟨q (t) + ,k (t) n,i ⟩) exp(⟨q (t) + ,k (t) + ⟩) + P M j=2 exp(⟨q (t) + ,k (t) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (t) n,i ⟩· V (t) + exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) − exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) ! 2 − M X k=2 V (t) n,i · exp(⟨q (t) n,i ,k (t) + ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) · exp(⟨q (t) n,i ,k (t) n,k ⟩) exp(⟨q (t) n,i ,k (t) + ⟩) + P M j=2 exp(⟨q (t) n,i ,k (t) n,j ⟩) ! ≤ η NM X n∈S + (∥μ∥ 2 + τ ) 2 (V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) + max i=2 |V (s) n,i |· P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ) + M X i=2 (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )(V (s) + · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) + max i=2 |V (s) n,i |· P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ) ≤ η NM · 3N 4 · (∥μ∥ 2 + τ ) 2 · V (s) + · C exp(⟨q (s) + ,k (s) + ⟩) + max i |V (s) n,i |· C exp(⟨q (s) + ,k (s) + ⟩) ! + M X i=2 (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )· V (s) + · C exp(⟨q (s) n,i ,k (s) + ⟩) + max i |V (s) n,i |· C exp(⟨q (s) n,i ,k (s) + ⟩) ! ≤ η 2 C 9 (∥μ∥ 2 + τ ) 2 exp(⟨q (s) + ,k (s) + ⟩) + M X i=2 η 2 C 9 (∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 ) exp(⟨q (s) n,i ,k (s) + ⟩) (126) where the first inequality is by− e ℓ ′ (s) n ≤ 1andsoftmax(⟨q (s) + ,k (s) + ⟩) ≤ 1. For the second inequality, we first consider P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩)+ P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ≤ P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) . 70 Benign Overfitting in Adversarial Training for Vision Transformers Then by the monotonicity of⟨q (s) + ,k (s) n,j ⟩and⟨q (T 1 ) + ,k (T 1 ) n,j ⟩ = o(1)we have P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ≤ Cfors ∈ [T 1 ,t]. The last inequality is by V (s) + ,V (s) n,i = o(1) for s∈ [T 1 ,t] and absorbing the constant factors. Similarly, we have Similar to Section J.6, we apply the bounds of α and β above to give the upper bounds for the dynamics⟨q,k⟩. ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ = α (s) +,+ ∥k (s) + ∥ 2 2 + X n∈S + M X i=2 α (s) n,+,i ⟨k (s) + ,k (s) n,i ⟩ + β (s) +,+ ∥q (s) + ∥ 2 2 + X n∈S + M X i=2 β (s) n,+,i ⟨q (s) + ,q (s) n,i ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i ⊤ · β (s) +,+ q (s) + + X n∈S + M X i=2 β (s) n,+,i q (s) n,i + X n∈S + M X i=2 α (s) n,+,i ∥k (s) n,i ∥ 2 2 = α (s) +,+ ∥k (s) + ∥ 2 + β (s) +,+ ∥q (s) + ∥ 2 +lower order terms ≤ ( η 2 C 9 (∥μ∥ 2 + τ ) 2 exp(⟨q (s) + ,k (s) + ⟩) + M X i=2 η 2 C 9 (∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 ) exp(⟨q (s) n,i ,k (s) + ⟩) )· Θ(∥μ∥ 2 2 σ 2 h d h ) +lower order terms ≤ ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ ) 2 σ 2 h d h exp(⟨q (s) + ,k (s) + ⟩) + M X i=2 ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 τ + σ p τ p 2 log(4NM/δ) + τ 2 )σ 2 h d h exp(⟨q (s) n,i ,k (s) + ⟩) . (127) Similarly, we have the upper bounds for the dynamics of other⟨q,k⟩. J.8. Bounds for the Sum of α and β The gradients of the inner products ofqandkcontain a lot of coefficientsαandβ, and in order to conveniently give the upper bounds of some lower order inner products, we will give upper bounds for the summation ofαandβ(e.g. P t s=T 1 |α (s) +,+ | ). Note that in the Jacobi matrix of the Softmax function, the elements on the diagonal aresoftmax(a i )· (1− softmax(a i )) and the elements on the off-diagonal aresoftmax(a i )· softmax(a j ). In Stage I, the attentions on signalsμ ± increase and the attentions on noises ξ decrease, then we can consider the following cases: •ifa i = ⟨q + ,k + ⟩ora i = ⟨q i ,k + ⟩,softmax(a i )has a constant upper bound 1,(1− softmax(a i ))decreases as softmax(a i ) increases. So the upper bound of softmax(a i )· (1− softmax(a i )) decreases as softmax(a i ) increases. • ifa i =⟨q + ,k j ⟩ora i =⟨q i ,k j ⟩,(1− softmax(a i ))has a constant upper bound 1. So the upper bound ofsoftmax(a i )· (1− softmax(a i )) decreases as softmax(a i ) decreases. • ifa j = ⟨q + ,k j ⟩ora j = ⟨q i ,k j ⟩,softmax(a i )has a constant upper bound 1. So the upper bound ofsoftmax(a i )· softmax(a j ) decreases as softmax(a j ) decreases. Based on the above cases, we first study the bounds of the following terms • 1− softmax(⟨q (s) + ,k (s) + ⟩) • 1− softmax(⟨q (s) n,i ,k (s) + ⟩) 71 Benign Overfitting in Adversarial Training for Vision Transformers • softmax(⟨q (s) + ,k (s) n,j ⟩) • softmax(⟨q (s) n,i ,k (s) n,j ⟩) Note that1−softmax(⟨q (s) + ,k (s) + ⟩) = P j softmax(⟨q (s) + ,k (s) n,j ⟩)and1−softmax(⟨q (s) n,i ,k (s) + ⟩) = P j softmax(⟨q (s) n,i ,k (s) n,j ⟩), we only need to give the upper bounds for softmax(⟨q (s) + ,k (s) n,j ⟩) and softmax(⟨q (s) n,i ,k (s) n,j ⟩). Assume that the propositionsB(T 1 ),...,B(s),D(T 1 ),...,D(s− 1) hold (s∈ [T 1 ,t]), we have |V (s) ± |,|V (s) n,i |≤ O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (s− T 1 ),(128) Λ (s) n,±,j ≥ log exp(Λ (T 1 ) n,±,j ) + η 2 C 8 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) ! ,(129) Λ (s) n,i,±,j ≥ log exp(Λ (T 1 ) n,i,±,j ) + η 2 C 8 (σ 2 P d + σ p τ p 2 log(4NM/δ) + τ 2 )∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) ,(130) for i,j ∈ [M ]\1,n∈ [N ],s∈ [T 1 ,t]. Then we have exp(⟨q (s) ± ,k (s) n,j ⟩) exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩) ≤ exp(⟨q (s) ± ,k (s) n,j ⟩) C exp(⟨q (s) ± ,k (s) ± ⟩) = 1 C exp(Λ (s) n,±,j ) ≤ 1 C exp(Λ (T 1 ) n,±,j ) + η 2 C 8 C(∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N log(6N 2 M 2 /δ) 2 · (s− T 1 )(s− T 1 − 1) ≤ 1 C 13 + η 2 C 13 (∥μ∥ 2 − τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N log(6N 2 M 2 /δ) 2 · (s− T 1 )(s− T 1 − 1) . (131) For the first inequality, by⟨q (T 1 ) ,k (T 1 ) ⟩ = o(1)and the monotonicity of⟨q (s) ,k (s) ⟩(⟨q (s) ,k (s) ⟩is increas- ing and⟨q (s) ± ,k (s) n,j ⟩ is decreasing), there exists a constantCsuch thatC exp(⟨q (s) ± ,k (s) ± ⟩) ≥ exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩). . The second inequality is by plugging (129). For the last inequality, byΛ (T 1 ) n,±,j = o(1), there exist a constant C 13 such that C 13 ≤ C exp(Λ (T 1 ) n,±,j ) and C 13 ≤ C 8 C. Similarly, we have exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) n,i ,k (s) n,j ′ ⟩) ≤ 1 C exp(Λ (s) n,i,+,j ) ≤ 1 C 13 + η 2 C 13 (σ 2 P d+σ p τ √ 2 log(4NM/δ)+τ 2 )∥μ∥ 2 2 ∥w O ∥ 2 2 d 1/2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) . (132) Plugging above equations into the expressions of α,β we have 72 Benign Overfitting in Adversarial Training for Vision Transformers |α (s) +,+ |≤ η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (s) + ⟩ · V (s) + exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) − exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! 2 − M X i=2 V (s) n,i · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · exp(⟨q (s) + ,k (s) n,i ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (s) n,i ⟩· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 − M X k=2 V (s) n,i · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) · exp(⟨q (s) n,i ,k (s) n,k ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! ≤ η(∥μ∥ 2 + τ ) 2 · 3N NM · O(d − 1 4 h ) + ηC 4 (∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 (s− T 1 ) · O 1 C 13 + η 2 C 13 ((∥μ∥ 2 +τ ) 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) = O η∥μ∥ 2 2 d − 1 4 h C 13 + η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) + O η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) C 13 + η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) = O η(∥μ∥ 2 + τ ) 2 d − 1 4 h + O η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) C 13 + η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) . (133) where the third equality is by η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) ≥ 0 for s ∈ [T 1 ,t]. Next, we give an 73 Benign Overfitting in Adversarial Training for Vision Transformers upper bound for η 2 (∥μ∥ 2 +τ ) 4 ∥w O ∥ 2 2 (s−T 1 ) C 13 + η 2 C 13 (∥μ∥ 2 −τ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N ( log(6N 2 M 2 /δ) ) 2 ·(s−T 1 )(s−T 1 −1) as follows: η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 (s− T 1 ) C 13 + η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )(s− T 1 − 1) = η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 C 13 (s−T 1 ) + η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 · (s− T 1 )− η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 ≤ η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 2 r η 2 C 2 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 − η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 = η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 2ηC 13 (∥μ∥ 2 −τ )∥μ∥ 2 ∥w O ∥ 2 2 d 1 4 h N 1 2 (log(6N 2 M 2 /δ)) − η 2 C 13 (∥μ∥ 2 −τ ) 2 ∥μ∥ 2 2 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 = η 2 (∥μ∥ 2 + τ ) 4 ∥w O ∥ 2 2 Θ η(∥μ∥ 2 −τ )∥μ∥ 2 ∥w O ∥ 2 d 1 4 h N 1 2 log(6N 2 M 2 /δ) = O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) , (134) where the inequality is byax + b x ≥ 2 √ abforx > 0, the third equality is by absorbing the lower order term η 2 C 13 (∥μ∥ 2 +τ ) 4 ∥w O ∥ 2 2 d 1 2 h N (log(6N 2 M 2 /δ)) 2 , the last equality is by∥w O ∥ 2 = Θ(1). Plugging this into (133) and get |α (s) +,+ | = O η(∥μ∥ 2 + τ ) 2 d − 1 4 h + O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) = O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) . (135) Similarly, we have |α (s) −,− |,|β (s) +,+ |,|β (s) −,− | = O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) , |α (s) n,+,i |,|α (s) n,−,i | = O η(∥μ∥ 2 + τ ) 2 N − 1 2 d − 1 4 h log(6N 2 M 2 /δ) , |β (s) n,+,i |,|β (s) n,−,i | = O η(∥μ∥ 2 + τ ) 2 ∥μ∥ 2 log(6N 2 M 2 /δ) σ p d 1 2 N 1 2 d 1 4 h ! = O η(∥μ∥ 2 + τ ) 2 · SNR· N − 1 2 d − 1 4 h log(6N 2 M 2 /δ) , (136) for i∈ [M ]\1,n∈ S + . |α (s) n,i,+ |,|α (s) n,i,− | = O η∥μ∥ 2 σ p d 1 2 log(6N 2 M 2 /δ) N 1 2 d 1 4 h ! = O η(∥μ∥ 2 + τ ) 2 d − 1 4 h log(6N 2 M 2 /δ) , (137) for i∈ [M ]\1,n∈ S + , the last equality is by N · SNR 2 ≥ Ω(1). |β (s) n,i,+ |,|β (s) n,i,− | = O ησ 2 p d log(6N 2 M 2 /δ) N 1 2 d 1 4 h ! = O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) , (138) 74 Benign Overfitting in Adversarial Training for Vision Transformers for i∈ [M ]\1,n∈ S + , the last equality is by N · SNR 2 ≥ Ω(1). |α (s) n,i,n,j |,|β (s) n,j,n,i | = O η(∥μ∥ 2 + τ )σ p d 1 2 log(6N 2 M 2 /δ) N 1 2 d 1 4 h ! = O η(∥μ∥ 2 + τ ) 2 d − 1 4 h log(6N 2 M 2 /δ) , (139) for i,j ∈ [M ]\1,n∈ [N ], the last equality is by N · SNR 2 ≥ Ω(1). |α (s) n,i,n ′ ,j |,|β (s) n,j,n ′ ,i | = O η(∥μ∥ 2 + τ )σ p log(6N 2 M 2 /δ) log(6N 2 M 2 /δ) N 1 2 d 1 4 h ! = O η(∥μ∥ 2 + τ ) 2 d − 1 2 d − 1 4 h (log(6N 2 M 2 /δ)) 2 , (140) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],n̸= n ′ , the last equality is by N · SNR 2 ≥ Ω(1). Taking a summation we obtain that t X s=T 1 |α (s) +,+ | = O η(∥μ∥ 2 + τ ) 2 ∥w O ∥ 2 2 log(6N 2 M 2 /δ) · O η(∥μ∥ 2 + τ ) 2 N 1 2 d − 1 4 h log(6N 2 M 2 /δ) = O N 1 2 d − 1 4 h , (141) where the last equality is by∥w O ∥ = Θ(1). Similarly, we have t X s=T 1 |α (s) −,− |, t X s=T 1 |β (s) +,+ |, t X s=T 1 |β (s) −,− |, t X s=T 1 |β (s) n,i,+ |, t X s=T 1 |β (s) n,i,− | = O N 1 2 d − 1 4 h , (142) for i∈ [M ]\1,n∈ S + . t X s=T 1 |α (s) n,+,i |, t X s=T 1 |α (s) n,−,i | = O N − 1 2 d − 1 4 h , (143) for i∈ [M ]\1,n∈ S + . t X s=T 1 |β (s) n,+,i |, t X s=T 1 |β (s) n,−,i | = O SNR· N − 1 2 d − 1 4 h (144) for i∈ [M ]\1,n∈ S + . t X s=T 1 |α (s) n,i,+ |, t X s=T 1 |α (s) n,i,− |, t X s=T 1 |α (s) n,i,n,j |, t X s=T 1 |β (s) n,j,n,i | = O d − 1 4 h (145) for i,j ∈ [M ]\1,n∈ S + . t X s=T 1 |α (s) n,i,n ′ ,j |, t X s=T 1 |β (s) n,j,n ′ ,i | = O d − 1 2 d − 1 4 h log(6N 2 M 2 /δ) (146) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],n̸= n ′ . With these sums of α and β above, we can easily prove Claim 3 and Claim 4. 75 Benign Overfitting in Adversarial Training for Vision Transformers J.9. Proof of Claim 3 In this subsection, we assume thatE (T 1 ),...,E (t) hold, and then proof thatC(t + 1) is true with the result of J.8. ∥q (t+1) + ∥ 2 2 −∥q (T 1 ) + ∥ 2 2 ≤ t X s=T 1 ∥q (s+1) + ∥ 2 2 −∥q (s) + ∥ 2 2 (147) ≤ t X s=T 1 2α (s) +,+ ⟨q (s) + ,k (s) + ⟩ + 2 X n∈S + M X i=2 α (s) n,+,i ⟨q (s) + ,k (s) n,i ⟩ + (α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i )· (α (s) +,+ k (s)⊤ + + X n∈S + M X i=2 α (s) n,+,i k (s)⊤ n,i ) ≤ 2 t X s=T 1 |α (s) +,+ ||⟨q (s) + ,k (s) + ⟩| + 2 X n∈S + M X i=2 t X s=T 1 |α (s) n,+,i ||⟨q (s) + ,k (s) n,i ⟩| +lower order term = O N 1 2 d − 1 4 h · O(log(d 1 2 h )) + N · M · O N − 1 2 d − 1 4 h · O(log(d 1 2 h )) = O N 1 2 d − 1 4 h log(d 1 2 h ) (148) where the first inequality is by triangle inequality. Sinceσ 2 h ≥ (maxσ 2 p d,∥μ∥ 2 2 ) −1 · d − 1 2 h (log(6N 2 M 2 /δ)) −2 andd h = e Ω(maxSNR 4 , SNR −4 N 2 ε −2 ) , we haveN 1 2 d − 1 4 h log(d 1 2 h ) = o(∥μ∥ 2 2 σ 2 h d h ) , so∥q (t+1) + ∥ 2 2 =∥q (T 1 ) + ∥ 2 2 +o(∥μ∥ 2 2 σ 2 h d h ) = Θ(∥μ∥ 2 2 σ 2 h d h ). Similarly, we have ∥q (t+1) − ∥ 2 2 −∥q (T 1 ) − ∥ 2 2 = O N 1 2 d − 1 4 h log(d 1 2 h ) = o(∥μ∥ 2 2 σ 2 h d h ), ∥k (t+1) + ∥ 2 2 −∥k (T 1 ) + ∥ 2 2 = O (1 + SNR)N 1 2 d − 1 4 h log(d 1 2 h ) = o(∥μ∥ 2 2 σ 2 h d h ), ∥q (t+1) n,i ∥ 2 2 −∥q (T 1 ) n,i ∥ 2 2 = O d − 1 4 h log(d 1 2 h ) = o(σ 2 p σ 2 h d h d n ), ∥k (t+1) n,i ∥ 2 2 −∥k (T 1 ) n,i ∥ 2 2 = O N 1 2 d − 1 4 h log(d 1 2 h ) = o(σ 2 p σ 2 h d h d n ), (149) so we have ∥q (t+1) ± ∥ 2 2 ,∥k (t+1) ± ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (t+1) n,i ∥ 2 2 ,∥k (t+1) n,i ∥ 2 2 = Θ(σ 2 p σ 2 h d h ) (150) for i∈ [M ]\1,n∈ [N ]. 76 Benign Overfitting in Adversarial Training for Vision Transformers |⟨q (t+1) + ,q (t+1) − ⟩|≤|⟨q (T 1 ) + ,q (T 1 ) − ⟩| + t X s=T 1 |⟨q (s+1) + ,q (s+1) − ⟩−⟨q (s) + ,q (s) − ⟩| ≤|⟨q (T 1 ) + ,q (T 1 ) − ⟩| + t X s=T 1 α (s) +,+ ⟨q (s) + ,k (s) + ⟩ + X n∈S + M X i=2 α (s) n,+,i ⟨q (s) + ,k (s) n,i ⟩ + α (s) −,− ⟨q (s) − ,k (s) − ⟩ + X n∈S − M X i=2 α (s) n,−,i ⟨q (s) + ,k (s) n,i ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i · α (s) −,− k (s) − + X n∈S − M X i=2 α (s) n,−,i k (s) n,i ⊤ (151) ≤|⟨q (T 1 ) + ,q (T 1 ) − ⟩| + t X s=T 1 |α (s) +,+ ||⟨q (s) + ,k (s) + ⟩| + X n∈S + M X i=2 t X s=T 1 |α (s) n,+,i ||⟨q (s) + ,k (s) n,i ⟩| + t X s=T 1 |α (s) −,− ||⟨q (s) − ,k (s) − ⟩| + X n∈S − M X i=2 t X s=T 1 |α (s) n,−,i |⟨q (s) + ,k (s) n,i ⟩| +lower order term ≤|⟨q (T 1 ) + ,q (T 1 ) − ⟩| + O N 1 2 d − 1 4 h · o(1) + N · M · O N − 1 2 d − 1 4 h · log(d 1 2 h ) =|⟨q (T 1 ) + ,q (T 1 ) − ⟩| + O N 1 2 d − 1 4 h log(d 1 2 h ) = o(1), (152) where the first inequality is triangle inequality, the last equality is byd h = e Ω(maxSNR 4 , SNR −4 N 2 ε −2 ). Similarly, we can prove: ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ ∥μ∥ 2 2 σ 2 h d h , ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ σ 2 p σ 2 h d h , |⟨q (t) + ,q (t) − ⟩|,|⟨q (t) ± ,q (t) n,i ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = o(1), |⟨k (t) + ,k (t) − ⟩|,|⟨k (t) ± ,k (t) n,i ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = o(1), for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . J.10. Upper Bounds of⟨q,k⟩ In order to give the upper bounds for⟨q,k⟩in stage I, we need to give the upper bounds ofαandβbased on the equations in J.1. The main difference between this subsection and J.7 is that the bounds of|V ± |,|V n,i |islog O 1 ε in this subsection, while the bounds of|V ± |,|V n,i |islog O 1 ε in J.7, resulting in different bounds forαandβ. Now we 77 Benign Overfitting in Adversarial Training for Vision Transformers take α (s) +,+ as an example α (s) +,+ ≤ η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (s) + ⟩ · V (s) + exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) − exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! 2 − M X i=2 V (s) n,i · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · exp(⟨q (s) + ,k (s) n,i ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (s) n,i ⟩· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 − M X k=2 V (s) n,i · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) · exp(⟨q (s) n,i ,k (s) n,k ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! ≤ η NM X n∈S + (∥μ∥ 2 + τ ) 2 (V (s) + · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) + max i=2 |V (s) n,i |· P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ) + M X i=2 (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )(V (s) + · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) + max i=2 |V (s) n,i |· P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ) ≤ η NM · 3N 4 · (∥μ∥ 2 + τ ) 2 · V (s) + · C exp(⟨q (s) + ,k (s) + ⟩) + max i |V (s) n,i |· C exp(⟨q (s) + ,k (s) + ⟩) ! + M X i=2 (∥μ∥τ + σ p τ p 2 log(4NM/δ) + τ 2 )· V (s) + · C exp(⟨q (s) n,i ,k (s) + ⟩) + max i |V (s) n,i |· C exp(⟨q (s) n,i ,k (s) + ⟩) ! ≤ ηC 9 (∥μ∥ 2 + τ ) 2 log O 1 ε exp(⟨q (s) + ,k (s) + ⟩) , (153) where the first inequality is by− e ℓ ′(s) n ≤ 1andsoftmax(⟨q (s) + ,k (s) + ⟩) ≤ 1. For the second inequality, we first consider P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩)+ P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ≤ P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) exp(⟨q (s) + ,k (s) + ⟩) , then by the monotonicity of⟨q (s) + ,k (s) n,j ⟩and⟨q (T 1 ) + ,k (T 1 ) n,j ⟩ = o(1)we have P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ≤ C fort ∈ [T 1 ,T 3 ]. The last inequality is byV (s) + ,|V (s) n,i | ≤ 2 log O 1 ε for 78 Benign Overfitting in Adversarial Training for Vision Transformers t∈ [T 2 ,T 3 ] and absorbing the constant factors. Similar to J.7, we can give the bounds for the other α and β as follows: α (s) −,− ≤ ηC 9 (∥μ∥ 2 + τ ) 2 log O 1 ε exp(⟨q (s) − ,k (s) − ⟩) , β (s) +,+ ≤ ηC 9 (∥μ∥ 2 − τ ) 2 log O 1 ε exp(⟨q (s) + ,k (s) + ⟩) , (154) Similar to J.6, we apply the bounds of α and β above to give the upper bounds for the dynamics⟨q,k⟩. ⟨q (s+1) + ,k (s+1) + ⟩−⟨q (s) + ,k (s) + ⟩ = α (s) +,+ ∥k (s) + ∥ 2 2 + X n∈S + M X i=2 α (s) n,+,i ⟨k (s) + ,k (s) n,i ⟩ + β (s) +,+ ∥q (s) + ∥ 2 2 + X n∈S + M X i=2 β (s) n,+,i ⟨q (s) + ,q (s) n,i ⟩ + α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i · β (s) +,+ q (s)⊤ + + X n∈S + M X i=2 β (s) n,+,i q (s)⊤ n,i = α (s) +,+ ∥k (s) + ∥ 2 2 + β (s) +,+ ∥q (s) + ∥ 2 2 +lower order term ≤ 2ηC 9 (∥μ∥ 2 + τ ) 2 log O 1 ε exp(⟨q (s) + ,k (s) + ⟩) · Θ(∥μ∥ 2 2 σ 2 h d h ) +lower order term ≤ ηC 10 ∥μ∥ 2 2 (∥μ∥ 2 + τ )σ 2 h d h log O 1 ε 1 exp(⟨q (s) + ,k (s) + ⟩) , (155) Similarly, we have the upper bounds for the dynamics of other⟨q,k⟩. J.11. Bounds for the Sum of α and β Assume that the propositionsF (T 2 ),...,F (s),H(T 2 ),...,H(s− 1) hold (s∈ [T 1 ,t]), we have |V (s) ± |≤ 2 log O 1 ε ,(156) |V (s) n,i | = O(1),(279) Λ (s) n,±,j ≥ Λ (T 2 ) n,±,j ≥ log exp(Λ (T 1 ) n,±,j ) + Θ d 1 2 h N (log(6N 2 M 2 /δ)) 3 !! ,(157) Λ (s) n,i,±,j ≥ Λ (T 2 ) n,i,±,j ≥ log exp(Λ (T 1 ) n,i,±,j ) + Θ σ 2 p d 1 2 h N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 (158) for i,j ∈ [M ]\1,n∈ [N ],s∈ [T 2 ,t]. Similar to (59) and (60), we have exp(⟨q (s) ± ,k (s) n,j ⟩) exp(⟨q (s) ± ,k (s) ± ⟩) + P M j ′ =2 exp(⟨q (s) ± ,k (s) n,j ′ ⟩) = O N (log(6N 2 M 2 /δ)) 3 d 1 2 h ! (159) 79 Benign Overfitting in Adversarial Training for Vision Transformers exp(⟨q (s) n,i ,k (s) n,j ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j ′ =2 exp(⟨q (s) n,i ,k (s) n,j ′ ⟩) = O N∥μ∥ 2 2 (log(6N 2 M 2 /δ)) 3 σ 2 p d 1 2 h (160) Plugging above equations into the expressions ofα,βand lettingO log O 1 ε be the upper bound for|V (s) ± |,|V (s) n,i |we have α (s) +,+ ≤ η NM X n∈S + − e ℓ ′ n (θ)⟨ e μ + , e μ (s) + ⟩ · V (s) + exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) − exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) ! 2 − M X i=2 V (s) n,i · exp(⟨q (s) + ,k (s) + ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) · exp(⟨q (s) + ,k (s) n,i ⟩) exp(⟨q (s) + ,k (s) + ⟩) + P M j=2 exp(⟨q (s) + ,k (s) n,j ⟩) !! + M X i=2 ⟨ e μ + , e ξ (s) n,i ⟩· V (s) + exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) − exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! 2 − M X k=2 V (s) n,i · exp(⟨q (s) n,i ,k (s) + ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) · exp(⟨q (s) n,i ,k (s) n,k ⟩) exp(⟨q (s) n,i ,k (s) + ⟩) + P M j=2 exp(⟨q (s) n,i ,k (s) n,j ⟩) ! ≤ η(∥μ∥ 2 + τ ) 2 NM · 3N 4 · O log O 1 ε · O N log(6N 2 M 2 /δ) 3 d 3 2 h ! = O ηN (∥μ∥ 2 + τ ) 2 log(6N 2 M 2 /δ) 3 log O 1 ε d 3 2 h ! (161) Taking a summation we obtain that t X s=T 2 |α (s) +,+ | = O 1 ηε∥μ∥ 2 2 ∥w O ∥ 2 2 · O η∥μ∥ 2 2 N (log(6N 2 M 2 /δ)) 3 log O 1 ε log O 1 ε d 3 2 h ! = O N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 3 2 h ! , (162) where the last equality is by∥w O ∥ = Θ(1). Similarly, we have the bounds for other sum ofαandβ. Thus, we can easily prove Claim 7 and Claim 8. 80 Benign Overfitting in Adversarial Training for Vision Transformers J.12. Proof of Claim 7 In this subsection, we assume thatI(T 2 ),...,I(t) hold, and then proof thatG(t + 1) is true with the result of J.11. q (t+1) + 2 2 − q (t) + 2 2 ≤ t X s=T 2 q (s+1) + 2 2 − q (s) + 2 2 ≤ t X s=T 2 2α (s) +,+ ⟨q (s) + ,k (s) + ⟩ + 2 X n∈S + M X i=2 α (s) n,+,i ⟨q (s) + ,k (s) n,i ⟩ + ⟨α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i ⟩· α (s) +,+ k (s) + + X n∈S + M X i=2 α (s) n,+,i k (s) n,i ⊤ ≤ 2 t X s=T 2 α (s) +,+ ⟨q (s) + ,k (s) + ⟩ + 2 X n∈S + M X i=2 t X s=T 2 α (s) n,+,i ⟨q (s) + ,k (s) n,i ⟩ +lower order term = O N (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 3 2 h ! · log ε −1 d 1 2 h + N · M · O (log(6N 2 M 2 /δ)) 3 log O 1 ε εd 3 2 h ! · log ε −1 d 1 2 h = O N (log(6N 2 M 2 /δ)) 3 log O 1 ε log ε −1 d 1 2 h εd 3 2 h (163) where the first inequality is by triangle inequality, the second inequality is by the update rules in E.2, the third inequality is byt≤ T 3 . Sinceσ 2 h ≥ maxσ 2 p d,∥μ∥ 2 2 −1 · d − 1 2 h (log(6N 2 M 2 /δ)) −2 andd h = e Ω maxSNR 4 , SNR −4 N 2 ε −2 , we have N (log(6N 2 M 2 /δ)) 3 log O 1 ε log(ε −1 d 1 2 h ) εd 1 2 h = o(∥μ∥ 2 2 σ 2 h d h ),(164) so∥q (t+1) + ∥ 2 2 =∥q (T 2 ) + ∥ 2 2 + o(∥μ∥ 2 2 σ 2 h d h ) = Θ(∥μ∥ 2 2 σ 2 h d h ). Similarly, we have ∥q (t) ± ∥ 2 2 ,∥k (t) ± ∥ 2 2 = Θ(∥μ∥ 2 2 σ 2 h d h ), ∥q (t) n,i ∥ 2 2 ,∥k (t) n,i ∥ 2 2 = Θ σ 2 p σ 2 h d h , |⟨q (t) + ,q (t) − ⟩|,|⟨q (t) ± ,q (t) n,i ⟩|,|⟨q (t) n,i ,q (t) n ′ ,j ⟩| = o(1), |⟨k (t) + ,k (t) − ⟩|,|⟨k (t) ± ,k (t) n,i ⟩|,|⟨k (t) n,i ,k (t) n ′ ,j ⟩| = o(1) for i,j ∈ [M ]\1,n,n ′ ∈ [N ],i̸= j or n̸= n ′ . 81