  Neural networks are known to be highly sensitive to adversarial examples.
These may arise due to different factors, such as random initialization, or
spurious correlations in the learning problem. To better understand these
factors, we provide a precise study of the adversarial robustness in different
scenarios, from initialization to the end of training in different regimes, as
well as intermediate scenarios, where initialization still plays a role due to
"lazy" training. We consider over-parameterized networks in high dimensions
with quadratic targets and infinite samples. Our analysis allows us to identify
new tradeoffs between approximation (as measured via test error) and
robustness, whereby robustness can only get worse when test error improves, and
vice versa. We also show how linearized lazy training regimes can worsen
robustness, due to improperly scaled random initialization. Our theoretical
results are illustrated with numerical experiments.
