Toward Understanding Adversarial Distillation: Why Robust Teachers Fail

Adversarial Distillation aims to enhance student robustness by guiding the student with a robust teacher's soft labels within the min-max adversarial training framework, yet its success is notoriously inconsistent: a more robust teacher often fails to improve, or even harms, the student's robust generalization. In this paper, we identify a key mechanism of this teacher dependency: the misalignment between the teacher's supervisory confidence and the student's representational limitations on a consistent subset of training data—the Robustly Unlearnable Set. We present a theoretical framework analyzing the feature learning dynamics of a two-layer neural network, demonstrating that this mismatch creates a dichotomy in distillation outcomes. We prove that when a teacher provides confident supervision on unlearnable samples, it compels the student to memorize spurious noise patterns that eventually overpower the learned robust signal, thereby driving robust overfitting. Conversely, a teacher that exhibits high uncertainty on these samples effectively suppresses noise memorization, allowing the student to rely solely on the learnable signal for robust generalization. We empirically validate our theory across both synthetic simulations and real-image classification datasets, confirming that robust overfitting is driven by the teacher's interaction with unlearnable samples. Finally, we demonstrate that a teacher's predictive entropy on unlearnable samples serves as a strong indicator of student robustness, validating our theoretical framework and offering a principled guideline for robust teacher selection.

Robust AI models are often used as teachers to train smaller student models, but this does not always improve the student’s robustness. This paper develops a theoretical explanation for this failure. We show that a teacher may rely on robust features that the smaller student cannot represent for some hard training examples. If the teacher is too confident on those examples, the student may try to match that confidence by memorizing irrelevant noise, which hurts robustness on new inputs. Our theory explains when robust teachers help or fail, and suggests choosing teachers that remain uncertain on examples the student cannot robustly learn.