SlowGuess/NeurIPS_2023_OCR huggingface dataset:
While our work focuses on statistical aspects, it will also be interesting to understand the kinds of computation required for our results. For example, we rely on the existence of an MRERM oracle. When are they computationally feasible? Do we require accurate MRERM oracles or can approximate (and hence potentially more tractable) versions also be used for the learning task?
Another question is to find a dimension that characterizes learning in various settings. This was only recently resolved for adversarially robust learning (for the case when  $u$  is known) Montasser et al. [2022], however, the dimension proposed in the paper is not easy to define. On the other hand, in the setting when the only information we can obtain about  $u$  is through a perfect attack oracle, the Littlestone dimension of  $\mathcal{H}$  has been shown to characterize adversarially robust learning Montasser et al. [2021]. It will be interesting to see if such a simple dimension can be obtained for the settings considered in our paper.
Ruth Urner is also a faculty affiliate member at Toronto's Vector institute, and acknowledges research support through an NSERC discovery grant. Tosca Lechner is supported by a Vector Research Grant and a Waterloo Apple PhD Fellowship in Data Science and Machine Learning.
Chicheng Zhang and Kamalika Chaudhuri. The extended littlestone's dimension for learning with mistakes and abstentions. In Proceedings of the 29th Conference on Learning Theory, COLT, pages 1584-1616, 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, ICML, pages 7472-7482, 2019.
A Maximally Robust Empirical Risk Minimization
Recall the definition of the empirical risk minimization oracles:
$$
\operatorname {E R M} _ {\mathcal {H}}: S \mapsto h _ {S} \in \operatorname * {a r g m i n} _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {0 / 1} (h)
$$
While there always exists functions  $h_S$  and  $h_S^u$  that are solutions to the queries in the first two oracles, the last one requires a bit more care.
Let  $S$  be some labeled dataset and assume that  $\mathcal{H}$  and  $\mathcal{U}$  are hypothesis and perturbation type classes such that  $S$  is  $\mathcal{H}$ -realizable for the true perturbation type  $u^{*} \in \mathcal{U}$ . We can then define a maximal perturbation type  $u_{S}^{*}$  for  $S$ ,  $\mathcal{H}$  and  $\mathcal{U}$  as follows:
$$
u^{*}_{S}(x) = \bigcup_{\substack{u\in \mathcal{U}\text{such that}\min_{h\in \mathcal{H}}\mathcal{L}^{u}_{S}(h) = 0}}u(x).
$$
This defines a perturbation type  $u_{S}^{*}(x)$ , which is not necessarily in  $\mathcal{U}$  but does satisfy  $u^{*} \preceq_{\mathcal{H}} u_{S}^{*}$ , which suffices for our purposes.
If, given  $u_{S}^{*}$ , the set  $\operatorname{argmin}_{h \in \mathcal{H}} \mathcal{L}_{S}^{u_{S}^{*}}(h)$  is non-empty, the oracle can return any function in this set as  $h_{S}^{u_{S}^{*}}$ . We will now argue that we can define a "closure"  $\bar{\mathcal{H}}$  of the hypothesis class  $\mathcal{H}$ , which has the same VC-dimension as  $\mathcal{H}$  and such that  $h_{S}^{u_{S}^{*}} \in \bar{\mathcal{H}}$ .
We here show how such an embedding of  $\mathcal{H}$  into the closure class  $\bar{\mathcal{H}}$  can be constructed in the case of a countable domain  $\mathcal{X}$  and a perturbation class  $\mathcal{U}$  that is separable, in the sense that for every  $\mathcal{U}' \subset \mathcal{U}$  there exists a countable subset  $\mathcal{U}'' \subset \mathcal{U}'$ , such that for every  $x \in \mathcal{X}: \bigcup_{u \in \mathcal{U}'} u(x) = \bigcup_{u \in \mathcal{U}''} u(x)$ . This is the case for a wide range of perturbation types, in particular in the case for which the sets  $u(x)$  are always open balls with respect to some  $\ell_p$ -norm in  $\mathbb{R}^d$ . In the general case (where  $\mathcal{X}$  may be uncountable and  $\mathcal{U}$  not separable in the above sense) recent work has shown that the existence of a closure class with identical VC-dimension is still guaranteed [Lechner et al., 2023]. The more general construction there employs the set-theoretic concept of filters. It is shown in the context of strategic classification, but the technique is readily available to adversarial perturbation sets. We here illustrate the intuition behind that abstract construction by focusing on countable and separable case.
We now assume that  $\mathcal{X}$  is countable and let  $(x_{i})_{i\in \mathbb{N}}$  be an enumeration of the elements of  $\mathcal{X}$ . The separability assumption on the perturbation class  $\mathcal{U}$  implies that for all  $S$  there is a countable subset  $\mathcal{U}^c\subseteq \mathcal{U}$  such that for all  $x\in \mathcal{X}$  we have
$$
u^{*}_{S}(x) = \bigcup_{\substack{u\in \mathcal{U}^{c}\text{such that}\min_{h\in \mathcal{H}}\mathcal{L}^{u}_{S}(h) = 0}}u(x).
$$
For a given sample  $S$ , let  $(u_{i})_{i\in \mathbb{N}}$  be an enumeration of the set
$$
\left\{u \in \mathcal {U} ^ {c} \mid \min  _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {u} (h) = 0 \right\}
$$
and let  $(h_i)_{i\in \mathbb{N}}$  be an enumeration of corresponding empirical risk minimizing hypotheses from  $\mathcal{H}$ :
$$
h _ {i} = \operatorname {R E R M} _ {\mathcal {H}} ^ {\mathrm {u} _ {\mathrm {i}}} (S).
$$
We will now define the function  $h_S^*$  by successively choosing subsequences from the sequence  $(h_i)_{i \in \mathbb{N}}$  as follows. We set  $F_0 = (h_i)_{i \in \mathbb{N}}$  and  $J_0 = \mathbb{N}$ . Then, for every  $i \in \mathbb{N}$ , we define a set of indices  $J_i$  such that
- Case 1: There exists a  $k \in J_{i-1}$  such that  $h_j(x_i) = h_k(x_i)$  for all  $j \geq k, j \in J_{i-1}$ . Then we define:
$$
J _ {i} = \left\{j \in J _ {i - 1} \mid h _ {j} \left(x _ {i}\right) = h _ {k} \left(x _ {i}\right) \right\}
$$
- Case 2: Both labels are assigned infinitely often to  $x_{i}$  by the sequence  $(h_j)_{j\in J_{i - 1}}$ . Then we define
$$
J _ {i} = \left\{j \in J _ {i - 1} \mid h _ {j} \left(x _ {i}\right) = 1 \right\}
$$
and we define subsequence  $F_{i} = (h_{j})_{j\in J_{i}}$ . Note that, by construction, in each resulting sequence  $F_{i}$  the first  $i$  points  $x_{1},x_{2},\ldots ,x_{i}$  receive the same label by all functions in the sequence. Now, by choosing indices to select the  $i$ -th function from each sequence  $F_{i}$  (by choosing the first index of  $J_{1}$ , the second index in  $J_{2}$ , the third in  $J_{3}$  and so on), and re-identifying these indices with the natural numbers, we obtain yet another subsequence  $F = (f_{i})_{i\in \mathbb{N}}$ . In this sequence we now have for every  $i\in \mathbb{N}$  and every  $k\geq i$
$$
f _ {k} (x _ {i}) = f _ {i} (x _ {i}).
$$
That is, this sequence of functions converges pointwise and we can use the above equation define the function  $h_S^*$  as follows:
$$
h _ {S} ^ {u _ {S} ^ {*}} (x _ {i}) = f _ {i} (x _ {i}).
$$
It is not difficult to see that the so defined function  $h_S^{u_S^*}$  satisfies  $\mathcal{L}_{u_S^*}^S(h_S^{u_S^*}) = 0$ . Let let  $\bar{\mathcal{H}}$  be defined by adding these functions  $h_S^{u_S^*}$  to  $\mathcal{H}$  for all possible  $S$ .
$$
\bar {\mathcal {H}} = \mathcal {H} \cup \{h _ {S} ^ {u _ {S} ^ {*}} \in \{0, 1 \} ^ {\mathcal {X}} \mid S \in (\mathcal {X} \times \mathcal {Y}) ^ {*} \}
$$
We observe that every behavior that  $\bar{\mathcal{H}}$  exhibits on a finite subset  $C\subseteq \mathcal{X}$ , is already witnessed by a function from  $\mathcal{H}$ . Thus we get  $\mathrm{VC}(\mathcal{H}) = \mathrm{VC}(\mathcal{H})$ , and we can always let  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  return a function from  $\bar{\mathcal{H}}$ .
B Agnostic learning for finite unions of total orders
Theorem 7. Let  $\mathcal{H}$  be a hypothesis class with  $\mathrm{VC}(\mathcal{H}) = d < \infty$ , and let  $\mathcal{U}$  be a perturbation class, which is a union  $\mathcal{U} = \mathcal{U}_1 \cup \mathcal{U}_2 \cup \ldots \cup \mathcal{U}_k$  of  $k$  subclasses which are each totally ordered with respect to class  $\mathcal{H}$ . Then  $\mathcal{H}$  is agnostically learnable with access to a perfect attack oracle  $\mathcal{O}_{u^*}$  with respect to  $\mathcal{U}$  with sample complexity  $m_1(\epsilon, \delta) + m_2(\epsilon, \delta)$ , and query complexity  $n_1(\epsilon, \delta) + n_2(\epsilon, \delta)$  where:
$m_{1}(\epsilon ,\delta) = O(\frac{d\cdot 2^{d}\cdot\log(k / \delta)}{\epsilon^{2}})$
-  $m_2(\epsilon, \delta)$  is the sample complexity of agnostically learning a hypothesis class of size  $k$  wrt  $\mathcal{U}^{\mathrm{all}}$ .
-  $n_1(\epsilon, \delta) = k \cdot (m_1(\epsilon, \delta))^2$
-  $n_2(\epsilon, \delta)$  is the query complexity of agnostically learning a hypothesis class of size  $k$  wrt  $\mathcal{U}^{\mathrm{all}}$ .
Proof. We can generate  $k$  hypotheses  $h_1, h_2, \ldots, h_k$  that are the output of an  $(\epsilon, \delta)$ -successful learner for  $\mathcal{H}$  with respect to each of the  $\mathcal{U}_i$ . Since each of the classes  $\mathcal{U}_i$  are totally ordered with respect to  $\mathcal{H}$ , the result of Theorem 2 (combined with a union bound) tells us that  $m_1(\epsilon, \delta)$  sample points and  $n_1(\epsilon, \delta)$  queries suffice to guarantee that, with probability at least  $1 - \delta$ , we have  $\ell^u^*(h_i) \leq \mathrm{opt}_P^u(\mathcal{H}) + \epsilon$  for all  $i$  with  $u^* \in \mathcal{U}_i$ . Thus the class  $\mathcal{H}_k = \{h_1, h_2, \ldots, h_k\}$  of these  $k$  learning outputs has approximation error at most  $\mathrm{opt}_P^u(\mathcal{H}) + \epsilon$  with respect to the data generating distribution  $P$ . Note that, since we have  $|\mathcal{H}_k| = k$ , this class has bounded Littlestone dimension at most  $\log(k)$ , VC-dimension at most  $\log(k)$ , and dual VC-dimension at most  $k$ . Employing a result (Montasser et al. [2021], Theorem 4) on agnostically learning finite VC classes with access to a perfect attack oracle, we get that both  $m_2(\epsilon, \delta)$  and  $n_2(\epsilon, \delta)$  are finite and  $\mathcal{L}_P^u(h) \leq \mathrm{opt}_P^u(\mathcal{H}) + 2\epsilon$ .
C  $\epsilon$ -cover Learning
C.1 Abstention learning for regions with different radii
Let us now explore the case, where we allow our perturbation types to consist of perturbation sets whose size varies throughout the domain. While a lot of work assumes that the size of the radius
is fixed throughout the domain, it is not a prior clear that the distances in the domain correspond perfectly to what humans find perceptible. This was noted in prior works [Bhattacharjee and Chaudhuri, 2021, Chowdhury and Urner, 2022] and motivated their adaptive adversarial loss. We explore such variation of local radii for the setting of uncertain perturbation sets. We have seen examples of this in Observation 3 and Observation 4. We will now generalize these perturbation types. Let  $\mathcal{X} = \mathbb{R}$ . For a function  $f:\mathcal{X}\to [k]$ , let the perturbation type  $u_{f,a_1,\dots,a_k}$  defined by:
$$
u _ {f, a _ {1}, \dots , a _ {k}} (x) = B _ {a _ {f (x)}} (x).
$$
That is, we have  $k$  different regions in the domain, which are determined by  $f$ . Furthermore, we assume that each perturbation set within a region  $i$  is a ball with radius of a fixed size  $a_i$ , while radii can vary between regions. For a fixed function  $f$ , let us now consider
$$
\mathcal {U} _ {f} = \left\{u _ {f, a _ {1}, \dots , a _ {k}}: a _ {1}, \dots , a _ {k} \in \mathbb {R} \right\}.
$$
Let  $\mathrm{VC}(\mathcal{H})\leq \mathrm{VC}(\mathcal{H}\times \mathcal{U})_{\ell}\leq d$  . We note that in general, that is excluding particular hypothesis sets  $\mathcal{H}$  and function  $f$  , this set of perturbation sets cannot be expressed as a finite union of totally ordered sets.
For every  $i\in [k]$  consider the classes  $\mathcal{U}_{f,i} = \{u_{f,0,\ldots ,0,a_i,0,\ldots ,0}:a_i\in \mathbb{R}\}$ . Let  $P$  be a realizable distribution with respect to  $\mathcal{H}$  and  $u^{*}\in \mathcal{U}$ . Let  $m(\epsilon ,\delta) = C\frac{d + \log(\frac{1}{\delta})}{\epsilon^2}$ , where  $C$  is the constant we require to get a uniform-convergence guarantee (which exists due to the corresponding VC-dimensions being finite, see Shalev-Shwartz and Ben-David [2014]), and let  $m\geq m(\frac{\epsilon}{k(2k^2 + 1)},\frac{\delta}{k})$ . Now for a sample  $S$  and any  $i$ , let  $(h_i,u_i) = \mathrm{MRERM}_{\mathcal{U}_{\mathrm{f},i}}^{\mathcal{H}}(S)$ . We denote by  $a_{i}^{max}$  the maximum realizable radius for component  $i$ , i.e.  $h_0,\dots,0,a_i^{max},0,\dots,0 = h_i$ . Now let  $u^{*} = u_{f,a_{1}^{*},\dots,a_{k}^{*}}$  be the ground true perturbation set. Then for every  $i$ ,  $a_{i}^{*}\leq a_{i}^{max}$ . Let  $u^{max} = u_{f,a_{1}^{max},\dots,a_{k}^{max}}$ . We note that for every  $x\in \mathcal{X},y\in \mathcal{Y}$  and  $h\in \mathcal{F}$ , we have  $\ell^{u^{max}}(h,x,y)\leq \max_{i\in [k]}\ell^{u_i}(h,x,y)$ . Now let
$$
h (x) = \left\{ \begin{array}{l l} y & \text {i f f o r a l l i : h _ {i} (x) = y} \\ \star & \text {o t h e r w i s e .} \end{array} \right.
$$
We note that by the PAC-learning guarantee with respect to  $0/1$ -loss, with probability  $1 - \delta$ , for every  $i,j \in [k]$  we have a pairwise disagreement between  $h_i$  and  $h_j$  of at most  $\frac{2\epsilon}{(2k^2 + 1)k}$ . Thus the disagreement-region of  $\{h_i : i \in [k]\}$  has mass at most  $\frac{k^2\epsilon}{k(2k^2 + 1)}$ . Thus, with probability  $1 - \delta$  over the sample generation the abstention loss of  $h$  we have
$$
\begin{array}{l} \mathcal {L} _ {P} ^ {u ^ {*}, \mathrm {a b s t}} (h) \leq \mathcal {L} _ {P} ^ {u ^ {m a x}, \mathrm {a b s t}} (h) \leq \sum_ {i = 1} ^ {k} \mathcal {L} _ {P} ^ {u ^ {i}, \mathrm {a b s t}} (h) \leq \sum_ {i = 1} ^ {k} (\mathcal {L} _ {P} ^ {u ^ {i}} (h _ {i}) + P _ {\mathcal {X}} (\{x: h (x) = \star \})) \\ \leq k \left(\frac {\epsilon}{k \left(2 k ^ {2} + 1\right)} + \frac {k ^ {2} \epsilon}{k \left(2 k ^ {2} + 1\right)}\right) = \epsilon . \\ \end{array}
$$
Note, that we can thus view  $\{h\}$  as an  $(\mathcal{H},\epsilon)$ -cover of  $\mathcal{U}$  with respect to  $P$  and adversarial abstention loss.
D Proofs
D.1 Proof of Theorem 1
Proof. For this result we adapt a compression based argument for the case of fixed perturbation type [Montasser et al., 2019] to the case of a class  $\mathcal{U}$  of perturbation types. A similar adaptation has recently been shown for the setting of strategic classification [Lechner et al., 2023]. The key difference to the original compression scheme is that we use the  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  oracle for the weak learners in each round of boosting, rather than the simple  $\mathrm{RERM}_{\mathcal{H}}^{\mathrm{u}}$  oracle as is done in the original publication [Montasser et al., 2019]. Importantly, the maximal ERM paradigm is well defined on all subsets of an original given data sample, and thus each required weak hypothesis can be encoded with a finite number of samples. Finally, since the maximal perturbation type for any subsample is always at least as large as the true perturbation type (under the realizability assumption), using  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  for each boosting step we obtain the required guarantee for the true perturbation type (without the learner/compressor requiring knowledge of the true type). We thus obtain the same compression size and implied sample complexity in the case of a totally ordered class of perturbation types as for a fixed perturbation type.
D.2 Proof of Observation 1
Proof. Consider a finite domain  $\mathcal{X} = \{x_1, x_2, x_3\}$  and distribution  $P$  over  $\mathcal{X} \times \{0, 1\}$  with  $P((x_1, 1)) = 1/4$ ,  $P((x_3, 0)) = 3/4$  and  $P((x, y)) = 0$  for all  $(x, y) \notin \{(x_1, 1), (x_3, 0)\}$ . We define a class  $\mathcal{U} = \{u_1, u_2\}$  containing two perturbation types  $u_1$  and  $u_2$  defined as follows:
$$
u _ {1} (x _ {1}) = \left\{x _ {1}, x _ {2} \right\}, u _ {1} (x _ {2}) = \left\{x _ {2} \right\}, u _ {1} (x _ {3}) = \left\{x _ {3} \right\}
$$
$$
u _ {2} (x _ {1}) = \left\{x _ {1}, x _ {2} \right\}, u _ {2} (x _ {2}) = \left\{x _ {2} \right\}, u _ {2} (x _ {3}) = \left\{x _ {2}, x _ {3} \right\}
$$
We let  $h_{y_1y_2y_3}$  denote the function that labels  $x_i$  with  $y_i$  on this domain (there are only 8 different non-abstaining predictors over  $\mathcal{X}$ ), and let  $H = \{h_{110}, h_{100}\}$  be a hypothesis class containing only two of these predictors. Clearly  $\mathrm{VC}(\mathcal{H}) = 1$  and  $u_1 \preceq_{\mathcal{H}} u_2$ . Note that
$$
\operatorname {o p t} _ {P} ^ {u _ {1}} (\mathcal {H}) = \mathcal {L} _ {P} ^ {u _ {1}} (h _ {1 1 0}) = 0
$$
while  $\mathcal{L}_P^{u_1}(h_{y_1y_2y_3})\geq 1 / 4$  for all predictors  $h_{y_1y_2y_3}\neq h_{110}$ . We further note that
$$
\operatorname {o p t} _ {P} ^ {u _ {2}} (\mathcal {H}) = \mathcal {L} _ {P} ^ {u _ {2}} (h _ {1 0 0}) = \mathcal {L} _ {P} ^ {u _ {2}} (h _ {0 0 0}) = 1 / 4
$$
while  $\mathcal{L}_P^{u_2}(h_{y_1y_2y_3})\geq 3 / 4$  for all predictors  $h_{y_1y_2y_3}\notin \{h_{000},h_{100}\}$ . Samples from  $P$  will not allow distinguishing whether the true perturbation type is  $u_{1}$  or  $u_{2}$  (since we are not imposing a realizability assumption here). Thus, no learner will be able to output predictors that are (close to) optimal for all possible perturbation types in  $\mathcal{U}$ .
D.3 Proof of Observation 2
Proof. We consider  $\mathcal{X} = \mathbb{R}$  and  $\mathcal{H}$  to be the class of threshold classifiers:
Further consider  $\mathcal{U} = \mathcal{U}_{-}\cup \mathcal{U}_{+}$ , where  $\mathcal{U}_{-}$  consists of perturbation types  $u_{r}^{-}$  that assign each  $x$  to a ball (interval) of radius  $r$  around  $x$  if  $x\leq 0$  and a ball of radius  $r / 2$  around  $x$  if  $x > 0$ , and  $\mathcal{U}_{+}$  similarly consists of perturbation types  $u_{r}^{+}$  that assign each  $x$  to a ball (interval) of radius  $r$  around  $x$  if  $x > 0$  and a ball of radius  $r / 2$  around  $x$  if  $x\leq 0$ . Both  $\mathcal{U}_{-}$  and  $\mathcal{U}_{+}$  are totally ordered (with respect to any hypothesis class) but their union  $\mathcal{U}$  is not totally ordered with respect to  $\mathcal{H}$ . Consider a distribution  $P$  with  $P((-3,1) = P((3,0)) = 0.5$ . Then, even when promised realizability, a learner cannot distinguish the cases  $u^{*} = u_{4}^{-}$  and  $u^{*} = u_{4}^{+}$  from samples; and performing well with respect to one of these perturbation types will induce loss 0.5 with respect to the other.
D.4 Proof of Observation 4
Proof. We consider the example from Observation 3. Now consider the classes  $\mathcal{U}_1 = \{u_{a,0} : a \in \mathbb{R}\}$  and  $\mathcal{U}_2 = \{u_{0,b} \in \mathbb{R}\}$ . Since both  $\mathcal{U}_1$  and  $\mathcal{U}_2$  are totally ordered there are successful robust learners  $\mathcal{A}_1$  for  $\mathcal{H}$  with respect to  $\mathcal{U}_1$  and  $\mathcal{A}_2$  with respect to  $\mathcal{U}_2$ . We run both learners on a sample with a size to guarantee  $(\epsilon/2, \delta/2)$ -success in both cases. We denote the resulting hypotheses with  $h_1$  and  $h_2$  respectively. We now define  $h: \mathcal{X} \to \{0,1,\star\}$  by  $h(x) = y$  if  $h_1(x) = h_2(x) = y$  and  $h(x) = \star$  otherwise.
We now argue that with probability  $1 - \delta$ ,  $h$  has adversarial abstention loss less than  $\epsilon$ . Let  $u^{*} = u_{a^{*},b^{*}} \in \mathcal{U}$  be the ground-truth perturbation type. Now let  $P$  be any  $\ell^{u_{a^{*},b^{*}}}$ -realizable distribution. Let  $(\cdot, u_{a_1,0}) = \mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}_1}(S)$  and  $(\cdot, u_{0,b_2}) = \mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}_2}(S)$ . With probability 1, we have both  $a_1 > a^*$  and  $b_2 > b^*$ . Further, we note every  $x \in \mathcal{X}$  and every  $u_{a,b} \in \mathcal{U}$ ,  $\ell^{u_{a,b}}(h,x,y)$  is either determined by  $a$ ,  $h$  and  $y$  or  $b$ ,  $h$  and  $y$ , not both, since either  $x \leq 0$  or  $x > 0$ . This means, that for every  $x \in \mathcal{X}$ ,  $\ell^{u_{a_1,b_2}}(h,x,y) \leq \max \{\ell^{u_{a_1,0}}(h,x,y), \ell^{u_{0,b_2}}(h,x,y)\}$ .
Combining these observations, we get
$$
\mathcal {L} _ {P} ^ {u ^ {*}, \text {a b s t}} (h) \leq \mathcal {L} _ {P} ^ {u _ {a _ {1}, b _ {2}}, \text {a b s t}} (h) \leq \mathcal {L} _ {P} ^ {u _ {a _ {1}, 0}, \text {a b s t}} (h) + \mathcal {L} _ {P} ^ {u _ {0, b _ {2}}, \text {a b s t}} (h) \leq \frac {\epsilon}{2} + \frac {\epsilon}{2} = \epsilon .
$$
D.5 Proof of Theorem 4
Proof. We assume robust realizability with respect to  $\mathcal{U}$ . In particular this means that we are in the non-robustly realizable case. Thus for any  $\mathcal{U}_i$ , we know that the set  $\mathcal{U}_i' = \mathcal{U}_i \cup \{\{x : x \in \mathcal{X}\}\}$  is totally ordered and that it contains some  $u_i \in \mathcal{U}_i'$  such that  $\mathcal{H}$  is robustly realizable with respect to the ground truth distribution  $P$  and  $u_i$ . We know from Theorem 1, that for every  $i$ , there is a successful maximally robust learner  $\mathcal{A}_i$  for  $\mathcal{H}$  with respect to  $\mathcal{U}_i'$  in the realizable case, since  $\mathcal{U}_i'$  is totally ordered.
Now let  $\mathcal{A}$  be defined by
$$
A (S) (x) = \left\{ \begin{array}{l l} 1 & \text {i f f f o r a l l} i \in [ k ] \text {w e h a v e} \mathcal {A} _ {i} (S) (x) = 1 \\ 0 & \text {i f f f o r a l l} i \in [ k ] \text {w e h a v e} \mathcal {A} _ {i} (S) (x) = 0 \\ \star & \text {o t h e r w i s e .} \end{array} \right.
$$
Furthermore, let  $(h,u_i(S)) = \mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}_i}(S)$ . Now let  $u^{*}\in \mathcal{U}$  be the ground-truth perturbation type. We know that there is  $i^{*}\in [k]$ , such that  $u^{*}\preceq u_{i^{*}}$ . Let  $P$  be a distribution with  $\mathrm{opt}_P^{u^*}(\mathcal{H}) = 0$ . Now if  $S\sim P^m$  with  $m\geq \max_{i\in [k]}m(\frac{\epsilon}{2k^2 + 1},\frac{\delta}{k})$ , then with probability  $1 - \delta$ , for every  $i\in [k]$ ,  $\mathcal{L}_P^{u_i}(\mathcal{A}_i(S))\leq \frac{\epsilon}{2k^2 + 1}$  and therefore,  $\mathcal{L}_P^{0 / 1}(\mathcal{A}_i(S))\leq \frac{\epsilon}{2k^2 + 1}$ . Thus, for any two  $i,j\in [k]$ , we have
$$
P _ {\mathcal {X}} \left(\left\{x \in X: \mathcal {A} _ {i} (S) (x) \neq \mathcal {A} _ {j} (S) (x) \right\}\right) \leq \frac {2 \epsilon}{2 k ^ {2} + 1}.
$$
$$
\begin{array}{l} \mathcal {L} _ {P} ^ {u ^ {*}, \text {a b s t}} (\mathcal {A} (S)) \leq \mathcal {L} _ {P} ^ {u ^ {*}, \text {a b s t}} \left(\mathcal {A} _ {i ^ {*}} (S)\right) + P _ {\chi} \left(\left\{x \in \mathcal {X}: A (S) (x) = \star \right\}\right) \\ \leq \mathcal {L} _ {P} ^ {u _ {i ^ {*}}, \text {a b s t}} \left(\mathcal {A} _ {i ^ {*}} (S)\right) + P _ {\mathcal {X}} \left(\left\{x \in X: \exists i, j, \mathcal {A} _ {i} (S) (x) \neq \mathcal {A} _ {j} (S) (x) \right\}\right) \\ \leq \frac {\epsilon}{2 k ^ {2} + 1} + \frac {2 k ^ {2} \epsilon}{2 k ^ {2} + 1} = \epsilon . \\ \end{array}
$$
D.6 Proof of Theorem 5
Proof. Let  $u^{*} \in \mathcal{U}^{\mathrm{all}}$  be any perturbation set and  $P$  any distribution with  $\operatorname{opt}_P^u^*(\mathcal{H}) = 0$ . Furthermore, let  $m \geq m_{\mathcal{H}}(\epsilon, \delta)$  where  $m_H$  is the sample complexity function in  $O\left(\frac{d + \log\left(\frac{1}{\delta}\right)}{\left(\frac{\epsilon}{\theta(\mathcal{H})}\right)^2}\right)$ . Let  $S \sim P^m$ . Let  $\hat{\mathcal{H}} = \{h \in \mathcal{H} : \mathcal{L}_S^{0/1}(h) = 0\}$ . Now we define our output hypothesis  $\hat{h}$  by
$$
\hat {h} = \left\{ \begin{array}{l l} 1 & \text {i f f o r e v e r y} h \in \hat {\mathcal {H}}: h (x) = 1 \\ 0 & \text {i f f o r e v e r y} h \in \hat {\mathcal {H}}: h (x) = 0 \\ \star & \text {o t h e r w i s e .} \end{array} \right.
$$
We note that there is some  $h^* \in \hat{\mathcal{H}}$  with  $\mathcal{L}_P^{u^*}(h^*) = \mathcal{L}_P^{0/1}(h^*) = 0$ . Since every  $h \in \hat{H}$  is an  $\mathrm{ERM}_{\mathrm{H}}$  hypothesis and  $\mathcal{H}$  has VC dimension  $d$ , the sample of ERMs gives us