SlowGuess/NeurIPS_2023_OCR huggingface dataset:
[1] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274-283. PMLR, 2018.
[2] Pranjal Awasthi, Vaggos Chatziafratis, Xue Chen, and Aravindan Vijayaraghavan. Adversarily robust low dimensional representations. In Conference on Learning Theory, pages 237-325. PMLR, 2021.
[3] Pranjal Awasthi, Himanshu Jain, Ankit Singh Rawat, and Aravindan Vijayaraghavan. Adversarial robustness via robust low rank representations. Advances in Neural Information Processing Systems, 33:11391-11403, 2020.
[4] Amitabh Basu. Introduction to convexity. Optimization, 52:37, 2019.
[5] Arjun Nitin Bhagoji, Daniel Cullina, and Prateek Mittal. Lower bounds on adversarial robustness from optimal transport. Advances in Neural Information Processing Systems, 32, 2019.
[6] Sébastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. Adversarial examples from computational constraints. In International Conference on Machine Learning, pages 831-840. PMLR, 2019.
[7] Raffaele Cappelli, Dario Maio, and Davide Maltoni. Subspace classification for face recognition. In International Workshop on Biometric Authentication, pages 133-141. Springer, 2002.
[8] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019.
[9] Jianbo Chen, Michael I Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 IEEE symposium on security and privacy (sp), pages 1277-1294. IEEE, 2020.
[10] Ping-yeh Chiang, Renkun Ni, Ahmed Abdelkader, Chen Zhu, Christoph Studer, and Tom Goldstein. Certified defenses for adversarial patches. In 8th International Conference on Learning Representations (ICLR 2020)(virtual). International Conference on Learning Representations, 2020.
[11] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pages 1310-1320. PMLR, 2019.
[12] Elvis Dohmatob. Generalized no free lunch theorem for adversarial robustness. In International Conference on Machine Learning, pages 1646-1654. PMLR, 2019.
[13] David L Donoho and Michael Elad. Optimally sparse representation in general (nonorthogonal) dictionaries via 11 minimization. Proceedings of the National Academy of Sciences, 100(5):2197-2202, 2003.
[14] Francisco Eiras, Motasem Alfarra, Philip Torr, M Pawan Kumar, Puneet K Dokania, Bernard Ghanem, and Adel Bibi. Ancer: Anisotropic certification via sample-wise volume maximization. Transactions of Machine Learning Research.
[15] Ehsan Elhamifar and René Vidal. Robust classification using structured sparse representation. In CVPR 2011, pages 1873-1879. IEEE, 2011.
[16] Ehsan Elhamifar and René Vidal. Block-sparse recovery via convex optimization. IEEE Transactions on Signal Processing, 60(8):4094-4107, 2012.
A Proof of Theorem 2.1
We will make the technical assumption in Section 2 precise. Recall that all quantities are normalized so that  $\mathcal{X}$  is an  $\ell_2$  ball of radius 1, i.e.,  $\mathcal{X} = B_{\ell_2}(0,1)$ . Recall that  $q_k\colon \mathcal{X}\to \mathbb{R}_{\geq 0}$  denotes the conditional distribution for class  $k\in \mathcal{V}$ , having support  $Q_{k}$ . We will assume that there is a sufficient gap between the supports and the boundary of the domain, i.e.,  $Q_{k}\subseteq B_{\ell_{2}}(0,c)$ , and that the  $\ell_2$ -adversarial attack has strength  $\epsilon \leq c$ , for some constant  $c$ , say  $c = 0.1$ .
Proof. Note that the definition (1) of  $(\epsilon, \delta)$ -robustness may be rewritten as
$$
\begin{array}{l} R (f, \epsilon) = \sum_ {k} p _ {X | Y} (X \text {a d m i t s a n} \epsilon \text {- a d v e r s a r i a l e x a m p l e} | Y = k) p _ {Y} (y = k) \\ = \sum_ {k} q _ {k} \left(\left\{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \text {s u c h t h a t} f (\bar {x}) \neq k \right\}\right) p _ {Y} (y = k), \tag {14} \\ \end{array}
$$
where  $q(S)$  denotes the  $q$ -measure of the set  $S$ . We are given  $f$  such that  $R(f, \epsilon) \leq \delta$ , and we want to find a set  $S \subseteq \mathcal{X}$  over which  $p$  concentrates.
$$
\begin{array}{l} R (f, \epsilon) \leq \delta \\ \Rightarrow \sum_ {k} q _ {k} \left(\left\{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \cap \mathcal {X} \text {s u c h t h a t} f (\bar {x}) \neq k \right\}\right) p _ {Y} (y = k) \leq \delta \tag {15} \\ \end{array}
$$
Since  $\sum_{k}p_{Y}(y = k) = 1$ , the LHS in (15) is a convex combination, and we have
$$
\begin{array}{l} \Longrightarrow \exists \hat {k} q _ {\bar {k}} \left(\left\{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \cap \mathcal {X} \text {s u c h t h a t} f (\bar {x}) \neq \hat {k} \right\}\right) \leq \delta , \tag {16} \\ \Longrightarrow q _ {\bar {k}} (U) \leq \delta , \text {w h e r e} \\ \end{array}
$$
$$
U = \{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \cap \mathcal {X} \text {s u c h t h a t} f (\bar {x}) \neq \hat {k} \}.
$$
We will express  $q_{\bar{k}}(U)$  in terms of the classification regions of  $f$ .
Let  $A \subseteq \mathcal{X}$  denote the region where the classifier predicts  $\hat{k}$ , i.e.  $A = \{x \in \mathcal{X} : f(x) = \hat{k}\}$ . Define  $A^{-\epsilon}$  to be the set of all points in  $A$  at a  $\ell_2$  distance at least  $\epsilon$  from the boundary, i.e.  $A^{-\epsilon} = \{x \in A : B(x, \epsilon) \subseteq A\}$ . Now consider any point  $x \in \mathcal{X}$ . We have the following 4 mutually exclusive, and exhaustive cases:
1.  $x$  lies outside  $A$ , i.e.,  $x \notin A$ . In this case,  $x \in U$  trivially as  $f(x) \neq k$ .
2.  $x \in A$ , and the entire  $\epsilon$ -ball around  $x$  lies inside  $A$ , i.e.,  $B(x, \epsilon) \subseteq A$ . In this case, every point in the  $\epsilon$ -ball around  $x$  is classified into class  $\hat{k}$ , and  $x$  has no  $\epsilon$ -adversarial example for class  $\hat{k}$ . Note that the set of all these points is  $A^{-\epsilon}$  by definition.
3.  $x \in A$ , and some portion of the  $\epsilon$ -ball around  $x$  lies outside  $A$ , i.e.,  $B(x, \epsilon) \nsubseteq A$ , and, there is a point  $\bar{x} \in B(x, \epsilon) \cap \mathcal{X}$  such that  $f(\bar{x}) \neq k$ . In this case,  $\bar{x}$  is an adversarial example for  $x$ , and  $\bar{x} \in U$ .
4.  $x \in A$ , and some portion of the  $\epsilon$ -ball around  $x$  lies outside  $A$ , i.e.,  $B(x, \epsilon) \not\subseteq A$ , but there is no point  $\bar{x} \in B(x, \epsilon) \cap \mathcal{X}$  such that  $f(\bar{x}) \neq k$ . This can happen only when for all  $\bar{x} \in B(x, \epsilon) \setminus A$  we have  $\bar{x} \notin \mathcal{X}$ . In other words, any  $\epsilon$  perturbation that takes  $x$  outside  $A$ , also takes it outside the domain  $\mathcal{X}$ . This implies that  $B(x, \epsilon) \not\subseteq \mathcal{X}$ , which in turn means that the distance of  $x$  from the boundary of  $\mathcal{X}$  is almost  $\epsilon$ .
We see that  $U$  comprises of the points covered in cases (1) and (3). Recall that we assumed that any point having distance less than 0.1 to the boundary of  $\mathcal{X}$  does not lie in the support of  $q_{\bar{k}}$ . But all points covered in case (4) lie less than  $\epsilon$ -close to the boundary, and  $\epsilon \leq 0.1$ . This implies that  $q_{\bar{k}}$
assigns 0 measure to the points covered in case (4). Together, cases (1), (3) and (4) comprise the set  $(\mathcal{X} \setminus A) \cup (A \setminus A^{-\epsilon})$ . Thus, we have shown
$$
\begin{array}{l} q _ {\hat {k}} (U) = q _ {\hat {k}} (\mathcal {X} \setminus A ^ {- \epsilon}) \\ \Longrightarrow q _ {\hat {k}} \left(A ^ {- \epsilon}\right) \geq 1 - \delta . \tag {17} \\ \end{array}
$$
Next, we will show that the set  $A^{-\epsilon}$  is exponentially small, by appealing to the Brunn-Minkowski inequality, which states that for compact sets  $E,F\subset \mathbb{R}^n$
$$
\operatorname {V o l} (E + F) ^ {\frac {1}{n}} \geq \operatorname {V o l} (E) ^ {\frac {1}{n}} + \operatorname {V o l} (F) ^ {\frac {1}{n}},
$$
where Vol is the  $n$ -dimensional volume in  $\mathbb{R}^n$ , and  $E + F$  denotes the minkowski sum of the sets  $E$  and  $F$ . Applying the inequality with  $E = A^{-\epsilon}$  and  $F = B_{\ell_2}(0,\epsilon)$ , we have
$$
\begin{array}{l} \operatorname {V o l} \left(A ^ {- \epsilon} + B _ {\ell_ {2}} (0, \epsilon)\right) ^ {\frac {1}{n}} \geq \operatorname {V o l} \left(A ^ {- \epsilon}\right) ^ {\frac {1}{n}} + \operatorname {V o l} \left(B _ {\ell_ {2}} (0, \epsilon)\right) ^ {\frac {1}{n}} \\ \Longrightarrow \operatorname {V o l} (A) ^ {\frac {1}{n}} \geq \operatorname {V o l} \left(A ^ {- \epsilon}\right) ^ {\frac {1}{n}} + \epsilon \operatorname {V o l} \left(B _ {\ell_ {2}} (0, 1)\right) ^ {\frac {1}{n}} \\ \Longrightarrow \operatorname {V o l} (A) ^ {\frac {1}{n}} \geq \operatorname {V o l} \left(A ^ {- \epsilon}\right) ^ {\frac {1}{n}} + \epsilon \operatorname {V o l} (A) ^ {\frac {1}{n}} \\ \Longrightarrow \frac {\operatorname {V o l} (A ^ {- \epsilon}) ^ {\frac {1}{n}}}{\operatorname {V o l} (A) ^ {\frac {1}{n}}} \leq (1 - \epsilon) \\ \Longrightarrow \operatorname {V o l} (A ^ {- \epsilon}) \leq \operatorname {V o l} (A) (1 - \epsilon) ^ {n} \leq \operatorname {V o l} (A) \exp (- \epsilon n) \\ \Longrightarrow \operatorname {V o l} \left(A ^ {- \epsilon}\right) \leq \bar {C} \exp (- n \epsilon), \tag {18} \\ \end{array}
$$
where  $\bar{C} = \operatorname{Vol}(A)$ . From (17) and (18), we see that  $q_{\bar{k}}$  is  $(\bar{C}, \epsilon, \delta)$ -concentrated. Additionally, if the classes are balanced, we can use the fact that every term of (15) can be at most  $K\delta$ , and apply the above reasoning for each class to conclude that each  $q_{k}$  is  $(C_{\max}, \epsilon, K\delta)$ -concentrated, for some suitable choice of  $C_{\max}$ , e.g.,  $C_{\max} = \max_k \operatorname{Vol}\{x \in \mathcal{X} : f(x) = k\}$ .
B Proof of Theorem 3.1
Proof. For each  $k \in \{1, 2, \dots, K\}$ , let  $S_k$  be the support of the conditional density  $q_k$ . Recall that  $S^{+\epsilon}$  is defined to be the  $\epsilon$ -expansion of the set  $S$ . Define  $C_k$  to be the  $\epsilon$ -expanded version of the concentrated region  $S_k$  but removing the  $\epsilon$ -expanded version of all other regions  $S_{k'}$ , as
$$
C _ {k} = \left(S _ {k} ^ {+ \epsilon} \setminus \cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ \epsilon}\right) \cap \mathcal {X}.
$$
We will use these regions to define our classifier  $f\colon \mathcal{X}\to \{1,2,\ldots ,K\}$  as
$$
f (x) = \left\{ \begin{array}{l l} 1, & \text {i f} x \in C _ {1} \\ 2, & \text {i f} x \in C _ {2} \\ \vdots & \\ K, & \text {i f} x \in C _ {K} \\ 1, & \text {o t h e r w i s e} \end{array} \right..
$$
We will show that  $R(f,\epsilon)\leq \delta +\gamma$  , which can be recalled to be
$$
R (f, \epsilon) = \sum_ {k} q _ {k} (\{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \cap \mathcal {X} \text {s u c h t h a t} f (\bar {x}) \neq k \}) p _ {Y} (y = k).
$$
In the above expression, the  $q_{k}$  mass is over the set of all points  $x \in \mathcal{X}$  that admit an  $\epsilon$ -adversarial example for the class  $k$ , as
$$
U _ {k} = \{x \in \mathcal {X}: \exists \bar {x} \in B (x, \epsilon) \cap \mathcal {X} \text {s u c h t h a t} f (\bar {x}) \neq k \}. \tag {19}
$$
Define  $C_k^{-\epsilon}$  to be the set of points in  $C_k$  at a distance at least  $\epsilon$  from the boundary of  $C_k$  as  $C_k^{-\epsilon} = \{x \in C_k : B(x, \epsilon) \subseteq C_k\}$ . For any point  $x \in U_k$ , we can find  $\bar{x} \in B(x, \epsilon)$  from (19) such that
$\bar{x} \notin C_k$ , showing that  $x \notin C_k^{-\epsilon}$ . Thus,  $U_k$  is a subset of the complement of  $C_k^{-\epsilon}$ , i.e.,  $U_k \subseteq \mathcal{X} \setminus C_k^{-\epsilon}$  and we have
$$
R (f, \epsilon) = \sum_ {k} q _ {k} (U _ {k}) p _ {Y} (y = k) \leq \sum_ {k} (1 - q _ {k} (C _ {k} ^ {- \epsilon})) p _ {Y} (y = k).
$$
Now we will need to show a few properties of the  $\epsilon$ -contraction. Firstly, for a set  $M = N \cap O$ , we have  $M^{-\epsilon} = N^{-\epsilon} \cap O^{-\epsilon}$ , which can be seen as
$$
\begin{array}{l} M ^ {- \epsilon} = \{x \colon x \in M, B (x, \epsilon) \subseteq M \} \\ = \{x \colon x \in N, x \in O, B (x, \epsilon) \subseteq N, B (x, \epsilon) \subseteq O \} = N ^ {- \epsilon} \cap O ^ {- \epsilon}. \\ \end{array}
$$
Secondly, for a set  $M = N^c$ , where  $c$  denotes complement, we have  $M^{-\epsilon} = (N^{+ \epsilon})^c$ . This can be seen as
$$
\begin{array}{l} M ^ {- \epsilon} = \{x: x \in M, B (x, \epsilon) \subseteq M \} = \{x: x \notin N, B (x, \epsilon) \subseteq N ^ {c} \} \\ = \{x: x \notin N, \forall x ^ {\prime} \in B (x, \epsilon) x ^ {\prime} \notin N \} \\ = \{x \colon \forall x ^ {\prime} \in B (x, \epsilon) x ^ {\prime} \notin N \} \\ \Longrightarrow (M ^ {- \epsilon}) ^ {c} = \{x: \exists x ^ {\prime} \in B (x, \epsilon) x ^ {\prime} \in N \} \\ = N ^ {+ \epsilon}. \\ \end{array}
$$
Thirdly, for a set  $M = N \setminus O$ , we have  $M^{-\epsilon} = (N \cap O^c)^{-\epsilon} = N^{-\epsilon} \cap (O^c)^{-\epsilon}$  by the first property, and then  $N^{-\epsilon} \cap (O^c)^{-\epsilon} = N^{-\epsilon} \cap (O^{+\epsilon})^c$  by the second property. This implies
$$
(N \setminus O) ^ {- \epsilon} = N ^ {- \epsilon} \setminus O ^ {+ \epsilon}.
$$
Fourthly, for a set  $M = N \cup O$ , we have  $M^c = N^c \cap O^c$ . Taking  $\epsilon$ -contractions, and applying the first and second properties, we get  $M^{+\epsilon} = N^{+\epsilon} \cup O^{+\epsilon}$ . Applying the above properties to  $C_k^{-\epsilon}$ , we have
$$
\begin{array}{l} C _ {k} ^ {- \epsilon} = \left(S _ {k} ^ {+ \epsilon} \backslash \cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ \epsilon}\right) ^ {- \epsilon} \cap \mathcal {X} ^ {- \epsilon} \\ = \left(S _ {k} \backslash \left(\cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ \epsilon}\right) ^ {+ \epsilon}\right) \cap \mathcal {X} ^ {- \epsilon} \\ \supseteq \left(S _ {k} \backslash \cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ 2 \epsilon}\right) \cap \mathcal {X} ^ {- \epsilon}. \\ \end{array}
$$
Recall that  $q_{k}(\mathcal{X}^{-\epsilon}) = q(\mathcal{X}) = 1$  by the support assumption. Hence, we have
$$
\begin{array}{l} q _ {k} \left(C _ {k} ^ {- \epsilon}\right) \geq q _ {k} \left(S _ {k} \backslash \cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ 2 \epsilon}\right) = q _ {k} \left(S _ {k}\right) - q _ {k} \left(\cup_ {k ^ {\prime} \neq k} S _ {k ^ {\prime}} ^ {+ 2 \epsilon}\right) \geq (1 - \delta) - \gamma \\ \Longrightarrow 1 - q _ {k} \left(C _ {k} ^ {- \epsilon}\right) \leq \delta + \gamma . \\ \end{array}
$$
Finally, as  $\sum_{k}p_{Y}(y = k) = 1$ , we have  $R(f,\epsilon)\leq \delta +\gamma$  by convexity.
C Proofs for Example 3.1
Let  $\theta_0\leq \pi /2$  . We will show that the following classifier  $f$  is robust in the setting of Example 3.1:
$$
f (x) = \left\{ \begin{array}{l l} 1, & \text {i f} x ^ {\top} P \geq \theta_ {0} \\ 2, & \text {o t h e r w i s e} \end{array} \right..
$$
Let  $C_1 = \{x \in \mathbb{S}^{n-1} \colon x^\top P \geq \theta_0\}$  be the set of points classified into class 1 by  $f$ . Similarly, let  $C_2 = \mathbb{S}^{n-1} \setminus C_1$  be the set of points classified into class 2. The robust risk of  $f$  (measured w.r.t. perturbations in the geodesic distance  $d$ ) can be expanded as
$$
R _ {d} (f, \epsilon) = 0. 5 q _ {1} \left(d ^ {+ \epsilon} \left(C _ {2}\right)\right) + 0. 5 q _ {2} \left(d ^ {+ \epsilon} \left(C _ {1}\right)\right), \tag {20}
$$
where  $d^{+\epsilon}(S)$  denotes the  $\epsilon$ -expansion of the set  $S$  under the distance  $d$ . Let  $\epsilon \leq \theta_0$  (otherwise, the first term is  $1/2$ ). Recall that the class conditional  $q_1$  is defined as
$$
q _ {1} (x) = \left\{ \begin{array}{l l} \frac {1}{c _ {\psi}} \frac {\psi (d (x , P))}{\sin^ {n - 2} d (x , P)}, & \text {i f} d (x, P) \leq \theta_ {0} \\ 0, & \text {o t h e r w i s e} \end{array} \right.,
$$
where  $c_{\psi}$  is a normalizing constant which ensures that  $q_{1}$  integrates to 1, i.e.,  $c_{\psi} = \int_{\mathbb{S}^{n - 1}}q_1$ . Then,  $q_{2}$  was defined to be uniform over the complement of the support of  $q_{1}$ , i.e.  $q_{2} = \mathrm{Unif}(\{x\in \mathbb{S}^{n - 1}\colon d(x,P) > \theta_0\})$ .
We can expand the first term of Eq. (20) as
$$
\begin{array}{l} q _ {1} \left(d ^ {+ \epsilon} \left(C _ {2}\right)\right) = q _ {1} \left(d ^ {+ \epsilon} \left(C _ {2}\right) \backslash C _ {2}\right) + q _ {1} \left(C _ {2}\right) \\ = q _ {1} \left(\left\{x: 0 <   d \left(x, C _ {2}\right) \leq \epsilon \right\}\right) + 0. \\ \end{array}
$$
Now for any  $x \notin C_2$ , we have  $d(x, C_2) = \theta_0 - d(x, P)$ . Hence,  $\{x: 0 < d(x, C_2) \leq \epsilon\} = \{x: 0.1 - \epsilon \leq d(x, P) < \theta_0\}$ . Let  $\theta(x)$  denote the angle that  $x$  makes with  $P$ . Then, the geodesic distance is  $d(x, P) = \theta(x)$ . The earlier set is the same as the set of all points satisfying  $\theta_0 - \epsilon \leq \theta(x) < 1$ . This is nothing but the  $\epsilon$ -base of the hyper-spherical cap having angle  $\theta_0$ .
We continue,
$$
q _ {1} \left(\left\{x: \theta_ {0} - \epsilon <   d (x, P) \leq \theta_ {0} \right\}\right) = q _ {1} \left(\left\{x: \theta_ {0} - \epsilon \leq \theta (x) <   \theta_ {0} \right\}\right)
$$
With a change of variables, the above can be evaluated as
$$
\begin{array}{l} q _ {1} \left(\left\{\theta_ {0} - \epsilon \leq \theta (x) <   \theta_ {0} \right\}\right) = \frac {1}{c _ {\psi}} \int_ {\theta_ {0} - \epsilon \leq \theta (x) <   \theta_ {0}} \frac {\psi (d (x , P))}{\sin (d (x , P)) ^ {n - 2}} d x \\ = \frac {1}{c _ {\psi}} \int_ {\theta_ {0} - \epsilon} ^ {\theta_ {0}} \frac {\psi (\theta)}{(\sin \theta) ^ {n - 2}} \mu_ {n - 2} (\{x \in \mathbb {S} ^ {n - 1} \colon \theta (x) = \theta \}) d \theta , \\ \end{array}
$$
where  $\mu_{n - 2}$  is the  $n - 2$ -dimensional volume ( $n - 1$ -dimensional surface area). Now,  $\mu_{n - 2}(\{x \in \mathbb{S}^{n - 1} : \theta(x) = \theta\})$  is nothing but the volume of an slice of the hypersphere  $\mathbb{S}^{n - 1}$ . This slice is in itself a hypersphere in  $\mathbb{R}^{n - 1}$ , having radius  $\sin \theta$ . Thus, its volume is the same as the volume of the  $\mathbb{S}^{n - 2}$ , scaled by  $(\sin \theta)^{n - 2}$ . We continue,
$$
\begin{array}{l} \int_ {\theta_ {0} - \epsilon} ^ {\theta_ {0}} \frac {\psi (\theta)}{(\sin \theta) ^ {n - 2}} \mu_ {n - 2} \left(\left\{x \in \mathbb {S} ^ {n - 1}: \theta (x) = \theta \right\}\right) d \theta = \int_ {\theta_ {0} - \epsilon} ^ {\theta_ {0}} \frac {\psi (\theta)}{(\sin \theta) ^ {n - 2}} (\sin \theta) ^ {n - 2} d \theta \\ = \int_ {\theta_ {0} - \epsilon} ^ {\theta_ {0}} \psi (\theta) d \theta \\ \end{array}
$$
For illustration, we can take  $\psi (\theta) = 1$ , giving  $q_{1}(d^{+\epsilon}(C_{1})) = \epsilon /C$  from the above integral, with  $c_{\psi} = \int_0^{\theta_0}\psi (\theta)d\theta = \theta_0 = \theta_0$ .
We can now follow the same process as above, and expand the Eq. (20) as
$$
q _ {2} \left(d ^ {+ \epsilon} \left(C _ {1}\right)\right) = \mu_ {n - 1} \left(\left\{x: \theta_ {0} \leq \theta (x) \leq \theta_ {0} + \epsilon\right), \right.
$$
where  $\mu_{n - 1}$  is again the  $n - 1$ -dimensional volume. We use the following formula [31] for the surface area of a hyperspherical cap (valid when  $\alpha \leq \pi /2$ ):
$$
\mu_ {n - 1} (\{x \colon 0 \leq \theta (x) \leq \alpha \}) = m (\alpha) \stackrel {\mathrm {d e f}} {=} 0. 5 \mu_ {n - 1} (\mathbb {S} ^ {n - 1}) I _ {\sin^ {2} \alpha} \left(\frac {n - 1}{2}, \frac {1}{2}\right),
$$
where  $I(\cdot, \cdot)$  is the incomplete regularized beta function. Letting  $d_{\theta_0} = m(\pi/2) + m(\pi/2) - m(\theta_0)$ , we continue,
$$
q _ {2} (d ^ {+ \epsilon} (C _ {1})) = \left\{ \begin{array}{l l} \frac {1}{d _ {\theta_ {0}}} \big (m (\theta_ {0} + \epsilon) - m (\theta_ {0}) \big), & \text {i f} \epsilon + \theta_ {0} \leq \pi / 2 \\ \frac {1}{d _ {\theta_ {0}}} \big (m (\pi / 2) + m (\pi / 2) - m (\theta_ {0} + \epsilon - \pi / 2) \big), & \text {i f} \pi / 2 \leq \epsilon + \theta_ {0} \leq \pi \\ \frac {1}{d _ {\theta_ {0}}}, & \text {e l s e} \end{array} \right..
$$
The risk from class 1 dominates till  $\epsilon$  reaches around  $\pi /2$ , then the risk from class 2 shoots up. We plot the resultant risk in Fig. 7 (left).
Having presented the basic construction, we now comment on how Example 3.1 can be generalized. Firstly, we can vary the support of  $q_{1}$ , to have it cover a different fraction of the sphere. For instance, we can set  $\theta_0 = \pi /2$  to get a modified  $q_{1}$  as
$$
q _ {1} ^ {\prime} (x) = \left\{ \begin{array}{l l} \frac {1}{C} \frac {1}{\sin^ {n - 2} d (x , P)}, & \text {i f} d (x, P) \leq \pi / 2 \\ 0, & \text {o t h e r w i s e} \end{array} \right.,
$$
Figure 7: Robust risk for classifiers for concentrated distributions on the sphere  $\mathbb{S}^{n-1}$ , for dimension  $n = 100$ . (Left): A plot of  $R_{d}(f, \epsilon)$  w.r.t  $p_1$ . As  $\epsilon$  grows from 0 to 0.1, class 1 is the major contributor to the risk. At  $\epsilon = 0.1$ , all points in class 1 admit an adversarial perturbation, taking them to class 2. As  $\epsilon$  grows further, the risk for class 2 grows slowly, till  $\epsilon$  reaches close to  $\pi/2$ , after which it blows up abruptly due to the high-dimensional fact that most of the mass of the uniform distribution lies near the equator of the sphere. (Middle): A plot of  $R_{d}(g, \epsilon)$  w.r.t  $p_2$ . As we make the support of the concentrated class larger, the distribution admits a classifier  $g$  with slightly improved robustness for smaller  $\epsilon$  values ( $\leq 0.1$ ). (Right): A plot of  $R_{d}(g, \epsilon)$  w.r.t  $p_3$ : Finally, as both class conditionals are made concentrated, the classifier  $g$  becomes quite robust.
and let  $q_2'$  be uniform over the complement of the support of  $q_1'$ . Along with balanced classes (i.e.,  $P(Y = 1) = P(Y = 2) = 1/2$ ), this gives the data distribution  $p_2$ . The robust classifier would now be given by the half-space  $\{x: d(x, P) \leq \pi/2\}$ . The risk over  $p_2$  can be computed as earlier, and is plotted in Fig. 7 (middle).
We can take this example further, and make both  $q_{1}$  and  $q_{2}$  concentrated. This can be done, for instance, by setting  $q_{1}^{\prime \prime} = q_{1}$ , and setting  $q_{2}^{\prime \prime}$  as follows:
$$
q _ {2} ^ {\prime \prime} (x) = \left\{ \begin{array}{l l} \frac {1}{C} \frac {1}{\sin^ {n - 2} d (x , - P)}, & \text {i f} d (x, - P) \leq \pi / 2 \\ 0, & \text {o t h e r w i s e} \end{array} \right.,
$$
where  $-P$  is the antipodal point of  $P$ . As both class conditionals are now concentrated, the halfspace separating their supports becomes quite robust. This can be seen in the Fig. 7 (right).
Lastly,  $\psi$  can be taken to be a rapidly decaying function for even greater concentration and lesser robust risk, e.g.,  $\psi (\theta) = \exp (-\theta)$ .
D Proofs for Example 4.1
Example 4.1. The data domain is the ball  $B_{\ell_{\infty}}(0,1)$  equipped with the  $\ell_2$  distance. The label domain is  $\{1,2\}$ . Subspace  $S_{1}$  is given by  $S_{1} = \{x\colon x^{\top}e_{1} = 0\}$ , and  $S_{2}$  is given by  $S_{2} = \{x\colon x^{\top}e_{2} = 0\}$ , where  $e_1,e_2$  are the standard unit vectors. The conditional densities are defined as
It would be helpful to have Fig. 8 in mind for what follows.
Figure 8: A plot of  $q_{1}$  (orange),  $q_{2}$  (violet) and the decision boundaries of  $f$  (dashed).
We will demonstrate that the classifier  $f$  illustrated in Fig. 8 has low robust risk. We define  $f$  for any  $x \in B_{\infty}(0,1)$ , as follows (let  $\gamma = e^{-\alpha}$ ):
$$
f (x) = \left\{ \begin{array}{l l} 1, & \text {i f} | x _ {1} | \leq \gamma / 2 + \epsilon , | x _ {2} | \geq \gamma / 2 + \epsilon \\ 2, & \text {i f} | x _ {2} | \leq \gamma / 2 + \epsilon , | x _ {1} | \geq \gamma / 2 + \epsilon \\ 1, & \text {o t h e r w i s e} \end{array} . \right.
$$