SlowGuess/NeurIPS_2023_OCR huggingface dataset:
In Section 4 we will consider more general pairs of hypothesis and perturbation classes  $\mathcal{H}$  and  $\mathcal{U}$ . We will show that if  $\mathcal{U}$  is not necessarily totally ordered with respect to  $\mathcal{H}$  (or a finite union of such totally
ordered classes) there are tasks on which no learner (even with access to a perfect attack oracle) can succeed (see Observation 3 below). For such cases we will explore learnability with respect to the adversarial abstention loss:
Definition 5 (Learnability with abstentions). Let  $\mathcal{H} \subseteq \{0,1\}^{\mathcal{X}}$  be a hypothesis class and  $\mathcal{U}$  a class of perturbation types. We say that  $\mathcal{H}$  is robustly learnable with abstentions with respect to perturbation class  $\mathcal{U}$  if there exists a learner  $A$  and a function  $m:(0,1)^2 \to \mathbb{N}$  such that for every  $\epsilon, \delta > 0$ , every  $m \geq m(\epsilon, \delta)$ , every  $u^* \in \mathcal{U}$  and every data-generating distribution  $P$  we have
$$
\mathbb {P} _ {S \sim P ^ {m}} \left[ \mathcal {L} _ {P} ^ {u ^ {*}, \text {a b s t}} (A (S)) \leq \operatorname {o p t} _ {P} ^ {u ^ {*}} (\mathcal {H}) + \epsilon \right] \geq 1 - \delta .
$$
Note that since  $\mathcal{H}$  contains only non-abstaining predictors, we have  $\mathrm{opt}_P^{u^*}(\mathcal{H}) = \mathrm{opt}_P^{u^*,\mathrm{abs}}(\mathcal{H})$
Discussion on additional parameters and assumptions Throughout this paper, we will also work with various standard complexity measures, such as bounded VC-dimension or bounded Littlestone dimension of the hypothesis class  $\mathcal{H}$ , bounded VC-dimension of the loss class or the adversarial component loss class. We refer the reader to the appendix for a reminder of the definitions of these notions.
We will further assume that learners have the capability to identify empirical risk minimizing hypotheses from a class. It is standard (though often implicit) to assume this as oracle access for the learner as well. We consider the standard ERM oracle, a robust ERM (RERM) oracle (for a fixed perturbation type  $u$ ) and a maximally robust ERM (MRERM) oracle (for a class  $\mathcal{U}$  of perturbation types, and realizable samples only). We define the following oracles:
$$
\operatorname {E R M} _ {\mathcal {H}}: S \mapsto h _ {S} \in \operatorname {a r g m i n} _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {0 / 1} (h)
$$
$$
\operatorname {R E R M} _ {\mathcal {H}} ^ {u}: S \mapsto h _ {S} ^ {u} \in \operatorname {a r g m i n} _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {u} (h)
$$
$$
\mathrm {M R E R M} _ {\mathcal {H}} ^ {\mathcal {U}}: S \mapsto \left\{ \begin{array}{l} (h _ {S} ^ {u _ {S} ^ {*}}, u _ {S} ^ {*}) \text {w i t h} h _ {S} ^ {u _ {S} ^ {*}} \in \operatorname * {a r g m i n} _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {u _ {S} ^ {*}} (h), \\ \qquad \text {a n d} u _ {S} ^ {*} \text {i s} \preceq_ {\mathcal {H}} \text {m a x i m a l i n t h e s e t} \{u \in \mathcal {U} \mid \min  _ {h \in \mathcal {H}} \mathcal {L} _ {S} ^ {u} (h) = 0 \} \\ \text {e r r o r i f} \mathcal {L} _ {S} ^ {u} (h) > 0 \text {f o r a l l} u \in \mathcal {U} \text {a n d} h \in \mathcal {H} \end{array} \right.
$$
That is, we will assume that  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  will return an error if the input sample  $S$  is not  $\ell^u$ -realizable for any  $u \in \mathcal{U}$ . If, on the other hand, there does exist a  $u \in \mathcal{U}$  for which  $S$  is  $\ell^u$ -realizable, then  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  will return a maximal (with respect to  $\preceq_{\mathcal{H}}$ ) such perturbation type  $u_S^*$  and corresponding hypothesis  $h_S^{u_S^*}$  with  $\mathcal{L}_S^{u^*}(h_S^{u^*}) = 0$ . In particular, we assume that for every non-empty sample  $S$  there exists such a maximal element  $u_S^* \in \mathcal{U}$  and corresponding ERM hypothesis from  $\mathcal{H}$ . While these do not always exist in  $\mathcal{U}$  and  $\mathcal{H}$  a priori, it has recently been shown that it is possible to embed  $\mathcal{U}$  and  $\mathcal{H}$  into slightly larger classes so that the  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$  oracle is always well defined [Lechner et al., 2023]. See Appendix Section A for more details on this.
Since we focus on studying sample complexity (independently of computational considerations) and consider learners as functions throughout, assuming access to the above oracles is not restricting the validity of our bounds. It is still interesting to understand when is their existence reasonable to assume. Both ERM and RERM oracles have been widely used in the literature and they are often computationally hard to implement. Assuming their existence, however, an MRERM oracle can be easily implemented for the case where  $\mathcal{U}$  is finite and totally ordered by running a binary search over  $\mathcal{U}$  and calling RERM for the comparison step. If we assume  $\mathcal{U}$  is parametrized by a  $k$ -bit number, then this requires  $O(k)$  queries to RERM.
3 Learning with a totally ordered perturbation class
We will start with investigating the case where the perturbation class  $\mathcal{U}$  is totally ordered with respect to hypothesis class  $\mathcal{H}$  (see Definition 2). Note that if two perturbation types  $u_{1}$  and  $u_{2}$  we satisfy  $u_{1}(x)\subseteq u_{2}(x)$  for all  $x\in \mathcal{X}$ , then  $u_{1}$  is smaller than  $u_{2}$ ,  $u_{1}\preceq_{\mathcal{H}}u_{2}$ , for every hypothesis class  $\mathcal{H}\subset \{0,1\}^{\mathcal{X}}$ . This is, for example, the case when  $u_{1}$  and  $u_{2}$  assign balls (with respect to some metric) centered at  $x$  to every domain point  $x$  and  $u_{2}$  always assigns a ball of radius at least as large as the ball assigned by  $u_{1}$  (while the balls assigned by  $u_{1}$  and  $u_{2}$  are not necessarily required to have the same radii uniformly over the space  $\mathcal{X}$ ).
In this section, we will focus on learning with respect to the standard adversarial loss and thus only consider non-abstaining predictors. We first show that for  $\mathcal{H}$  and totally ordered  $\mathcal{U}$ , whenever the class  $\mathcal{H}$  has bounded VC-dimension we get learnability in the realizable case. This result is based on adapting a compression argument for adversarially robust learning [Montasser et al., 2019] to the case of uncertain perturbation sets. A very similar adaptation has recently been made for the related problem of strategic classification [Lechner et al., 2023]. The proof of this result can be found in the appendix.
Theorem 1. Let  $\mathcal{U}$  be a perturbation class that is totally ordered with respect to a hypothesis class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = d < \infty$ . Then  $\mathcal{H}$  is learnable in the realizable case with respect to  $\mathcal{U}$  with sample complexity  $O\left(\frac{d \cdot 2^d \cdot \log(1 / \delta)}{\epsilon}\right)$ .
Recall that realizability here means  $\mathrm{opt}_P^{u^*}(\mathcal{H}) = 0$  for the true perturbation type  $u^*$  (with respect to which the learner is evaluated). We now show that without this assumption learning guarantees are impossible without equipping the learner with additional resources (or weakening the success criteria).
Observation 1. There exists a class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = 1$  and a perturbation class  $\mathcal{U}$  that is totally ordered with respect to  $\mathcal{H}$  that is not learnable (in the sense of Definition 3).
We will now show that allowing a learner access to a perfect attack oracle yields learnability in the agnostic case.
Theorem 2. Let  $\mathcal{U}$  be a perturbation class that is totally ordered with respect to a hypothesis class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = d < \infty$  and assume access to a perfect attack oracle. Then  $\mathcal{H}$  is learnable in the agnostic case with respect to  $\mathcal{U}$  with sample complexity  $m(\epsilon, \delta) = O\left(\frac{d \cdot 2^d \cdot \log(1 / \delta)}{\epsilon^2}\right)$  and oracle complexity  $O(m(\epsilon, \delta)^2)$ .
Proof. We will employ a well-known reduction from agnostic learning to realizable compression-based learning [Montasser et al., 2019]. Since our proof for Theorem 1 for the realizable case of learning with uncertain, totally ordered perturbation sets employs a compression-based learner, for the agnostic case it suffices to show that, given any sample  $S = ((x_{1},y_{1}),\ldots ,(x_{m},y_{m}))$ , we can identify a largest subsample  $S^{\prime}$  of  $S$  that is realizable with respect to the underlying perturbation type  $u^{*}$ . We will now outline how the perfect attack oracle can be employed to achieve this.
Employing the  $\mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}$ -oracle, the learner can generate an ordered list  $T = ((S_{1}, h_{1}, u_{1}), \ldots (S_{n}, h_{n}, u_{n})))$  of subsamples of  $S$  that are realizable with respect to some  $u \in \mathcal{U}$  such that  $(h_{i}, u_{i}) = \mathrm{MRERM}_{\mathcal{H}}^{\mathcal{U}}(S_{i})$  for all  $i$  and  $u_{i} \preceq_{\mathcal{H}} u_{j}$  for all  $i \leq j$ . Note that we have  $u^{*} \preceq_{\mathcal{H}} u_{i}$  if and only if the perfect attack oracle returns robust for all sample points in  $S_{i}$  when tested on  $h_{i}$ , that is  $\mathcal{O}_{u^{*}}(h_{i}, x) = \text{robust}$  for all  $x$  with  $(x, y) \in S_{i}$  for some  $y$ . Thus, using a binary search over the list  $T$ , we can identify the smallest index  $\iota$  for which  $u^{*} \preceq_{\mathcal{H}} u_{\iota}$ . Since we have  $n \leq 2^{m}$  and every test in the search employs at most  $m$  calls to the perfect attack oracle, this search terminates after at most  $m^{2}$  queries. Finally, note that all subsets  $S_{i}$  from  $T$  for which  $i \geq \iota$  are realizable with respect to  $u^{*}$ . Thus we can choose any largest among  $S_{\iota}, \ldots, S_{n}$  as a maximal realizable subset with respect to the unknown perturbation type  $u^{*}$ .
In Section B we provide additional guarantees for the agnostic case.
4 Beyond totally ordered perturbation classes
We now consider a more general setting where  $\mathcal{U}$  is not necessarily totally ordered with respect to  $\mathcal{H}$ .
4.1 Learning with the standard adversarial loss
We will start by showing that  $\mathcal{H},\mathcal{U}$  are learnable with access to a perfect attack oracle if  $\mathcal{U}$  is the union of  $k$  sub-classes which are each totally ordered with respect to  $\mathcal{H}$ . This naturally contains the case that  $\mathcal{U}$  is finite. Another natural case where this occurs is considering perturbation sets that are balls around domain points of certain radii and with respect to one of a number of possible norms. Consider  $\mathcal{X} = \mathbb{R}^d$  and the set
$$
\mathcal {U} = \left\{u _ {r} ^ {p}: x \mapsto B _ {r} ^ {p} (x) \mid r \in \mathbb {R}, p \in 0, 1, 2, \infty \right\}
$$
where we let  $B_r^p(x)$  denote the  $\ell^p$ -norm ball around  $x$ . Then the above class  $\mathcal{U}$  is a union of 4 totally ordered perturbation classes (one for balls of each norm) with respect to any hypothesis class  $\mathcal{H}$ .
Theorem 3. Let  $\mathcal{H}$  be a hypothesis class with  $\mathrm{VC}(\mathcal{H}) = d < \infty$ , and let  $\mathcal{U}$  be a perturbation class, which is a union  $\mathcal{U} = \mathcal{U}_1 \cup \mathcal{U}_2 \cup \ldots \cup \mathcal{U}_k$  of  $k$  subclasses which are each totally ordered with respect to class  $\mathcal{H}$ . Then  $\mathcal{H}$  is learnable with access to a perfect attack oracle  $\mathcal{O}_{u^*}$  in the realizable case with respect to  $\mathcal{U}$  with sample complexity  $O\left(\frac{d \cdot 2^d \cdot \log(k / \delta)}{\epsilon} + \frac{\log(k) \cdot \log(1 / \epsilon) + \log(1 / \delta)}{\epsilon^2}\right)$  and query complexity  $O\left(\left(\frac{\log(k) \cdot \log(1 / \epsilon) + \log(1 / \delta)}{\epsilon^2}\right)^2\right)$ .
Proof. We can generate  $k$  hypotheses  $h_1, h_2, \ldots, h_k$  that are the output of an  $(\epsilon, \delta)$ -successful learner for  $\mathcal{H}$  with respect to each of the  $\mathcal{U}_i$ . Since each of the classes  $\mathcal{U}_i$  are totally ordered with respect to  $\mathcal{H}$ , the result of Theorem 1 tells us that  $O\left(\frac{d \cdot 2^d \cdot \log(k / \delta)}{\epsilon}\right)$  sample points suffice to guarantee that, with probability at least  $1 - \delta$ , we have  $\ell^{u^*}(h_i) \leq \epsilon$  for all  $i$  with  $u^* \in \mathcal{U}_i$ . Thus the class  $\mathcal{H}_k = \{h_1, h_2, \ldots, h_k\}$  of these  $k$  learning outputs has approximation error at most  $\epsilon$  with respect to the data generating distribution  $P$ . Note that, since we have  $|\mathcal{H}_k| = k$ , this class has also bounded Littlestone dimension at most  $\log(k)$ . Employing a result (Montasser et al. [2021], Theorem 3) on agnostically learning finite Littlestone classes with access to a perfect attack oracle, an additional  $O\left(\frac{\log(k) \cdot \log(1 / \epsilon) + \log(1 / \delta)}{\epsilon^2}\right)$  samples and the stated number of queries suffice to output a hypothesis  $h$  with  $\mathcal{L}_P^{u^*}(h) \leq 3\epsilon$ .
It is not difficult to see that, even in the realizable case, and when  $\mathcal{U}$  is the union of just two totally ordered subclasses, a learner without access to a perfect attack oracle cannot succeed with respect to the standard adversarial loss.
Observation 2. There exists a class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = 1$  and a perturbation class  $\mathcal{U}$  that is the union of two totally ordered subclasses with respect to  $\mathcal{H}$  that are not learnable in the realizable case (in the sense of Definition 3) without access to a perfect attack oracle.
For the proof of this observation we refer the reader to the supplementary material. Now we show that if we remove even more structure from the set of perturbation types  $\mathcal{U}$  then learning success becomes impossible even with access to a perfect attack oracle. The following observation will then motivate to investigate learning with respect to the adversarial abstention loss (rather than the standard adversarial loss).
Observation 3. There exists a class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = 1$  and a perturbation class  $\mathcal{U}$  that are not learnable (in the sense of Definition 3), even with access to a perfect attack oracle.
Proof. We consider the same domain, class, and distribution as in the proof of the previous observation:  $\mathcal{X} = \mathbb{R}$ ,  $P$  with  $P((-3,1) = P((3,0)) = 0.5$ , and
$$
\mathcal {H} = \left\{h _ {t}: x \mapsto \mathbb {1} [ x \leq t ] \mid t \in \mathbb {R} \right\}.
$$
Further, we consider the class  $\mathcal{U} = \{u_{a,b}\mid a,b\in \mathbb{R}\}$  of perturbation types  $u_{a,b}$ , that assign all points  $x\leq 0$  to a ball of radius  $a$  around  $x$  and all points  $x > 0$  to a ball of radius  $b$ . Then, even when promised realizability, a learner cannot distinguish the cases where  $u^{*} = u_{a,b}$  for some values  $a,b$  with  $a + b\leq 6$  from samples and any finite number of queries to the perfect attack oracle. In particular, if  $u^{*} = u_{a,b}$  for some  $a,b$  with  $a + b = 6$ , predicting with respect to one such pair  $a,b$  will induce loss 0.5 for all other such pairs.
4.2 Learning with the adversarial abstention loss
We will now consider learning with respect to the adversarial abstention loss. We will first show that learning with abstentions can actually help overcome some of the impossibilities shown above. For this, let us revisit the example seen in Observation 3.
Observation 4. There exists a class  $\mathcal{H}$  with  $\mathrm{VC}(\mathcal{H}) = 1$  and a perturbation class  $\mathcal{U}$  that are not learnable (in the sense of Definition 3), even with access to a perfect attack oracle, but that is robustly learnable with abstentions (in the sense of Definition 5) in the realizable case (without access to a perfect attack oracle).
Proof sketch. We consider the example from the proof of Observation 3. Now consider the subclasses  $\mathcal{U}_1 = \{u_{a,0} : a \in \mathbb{R}\}$  and  $\mathcal{U}_2 = \{u_{0,b} : b \in \mathbb{R}\}$ . Since both  $\mathcal{U}_1$  and  $\mathcal{U}_2$  are totally ordered we can learn successful hypotheses  $h_1$  and  $h_2$  respectively. We now define  $h: \mathcal{X} \to \{0,1,\star\}$  by  $h(x) = y$  if  $h_1(x) = h_2(x) = y$  and  $h(x) = \star$  otherwise. This is a successful hypothesis. For more detail, we refer the reader to the appendix.
We will now continue by showing that, similar to the case where we have access to a perfect-attack-oracle, a finite union  $\mathcal{U} = \bigcup_{i=1}^{k} \mathcal{U}_i$  of totally ordered perturbation sets  $\mathcal{U}_i$  is robustly learnable with abstention in the robustly realizable case.
Theorem 4. Let  $\mathcal{U} = \bigcup_{i=1}^{k} \mathcal{U}_{i}$ , where every  $\mathcal{U}_{i}$  is totally ordered. Furthermore, let  $\mathcal{H}$  have a finite VC dimension. Then  $\mathcal{H}$  is robustly learnable with abstension with respect to  $\mathcal{U}$  in the robustly realizable case with sample complexity  $O\left(\frac{d \cdot 2^{d} \cdot k^{2} \log(k / \delta)}{\epsilon}\right)$ .
4.2.1 Abstention learning with disagreement coefficient
The proof of Theorem 4 shows how bounding the mass of the region on which two learners with small  $0/1$ -loss disagree, yields a robust error guarantee for learning with abstentions. In this section, we will review the definition of the disagreement coefficient (Hanneke [2007], Hanneke et al. [2014]), and show that hypothesis classes  $\mathcal{H}$  with finite disagreement coefficient are robustly learnable with abstention in the realizable case with respect to every class of perturbation types  $\mathcal{U}$ .
For a distribution  $P_{\mathcal{X}}$  over  $\mathcal{X}$ , we let the  $P_{\mathcal{X}}$ -induced difference between two hypotheses be denoted by
$$
d _ {P _ {\mathcal {X}}} (h, h ^ {\prime}) = \mathbb {P} _ {x \sim P _ {\mathcal {X}}} [ h (x) \neq h ^ {\prime} (x) ].
$$
The ball in  $\mathcal{H}$  around a hypothesis  $h$  with radius  $r$  is then denoted by
$$
B _ {P _ {\mathcal {X}}} (h, r) = \left\{h ^ {\prime} \in \mathcal {H}: d _ {P _ {\mathcal {X}}} (h, h ^ {\prime}) \leq r \right\}.
$$
Lastly, let the disagreement region of a set of hypotheses  $\mathcal{H}$  be
$$
\operatorname {D I S} (\mathcal {H}) = \{x \in \mathcal {X}: \exists h, h ^ {\prime} \in \mathcal {H} \text {w i t h} h (x) \neq h ^ {\prime} (x) \}.
$$
We can now state the definition of the disagreement coefficient.
Definition 6 (Hanneke et al. [2014]). For a distribution  $P$  over  $\mathcal{X} \times \mathcal{Y}$  and a class  $\mathcal{H} \subseteq \{0,1\}^{\mathcal{X}}$ , let  $h^{*} \in \arg \min_{h' \in \mathcal{H}} \mathcal{L}_{P}(h')$ . The disagreement-coefficient of  $\mathcal{H}$  with respect to  $P$  is defined by:
$$
\theta_ {P} (\mathcal {H}) = \sup  _ {r \in (0, 1)} \frac {P _ {\mathcal {X}} (\mathrm {D I S} (B (h ^ {*} , r)))}{r}.
$$
Furthermore, let the worst-case disagreement coefficient be  $\theta (\mathcal{H}) = \sup_{P\in \Delta (\mathcal{X}\times \mathcal{Y})}\theta_P(\mathcal{H})$
Theorem 5. Let  $\mathcal{H}$  be a hypothesis class with  $\theta(\mathcal{H}) < \infty$  and  $VC(\mathcal{H}) = d < \infty$ . Then the class  $\mathcal{H}$  is robustly learnable with abstention in the realizable case with respect to the class of all perturbation types  $\mathcal{U}^{\mathrm{all}}$  with sample complexity  $O\left(\frac{d + \log\left(\frac{1}{\delta}\right)}{\left(\frac{\epsilon}{\theta(\mathcal{H})}\right)^2}\right)$ .
The proof can be found in Appendix D.6, but the main idea is that for any point  $x$ , we return a  $y \in \{0,1\}$  if and only if every  $h$  with  $\mathcal{L}_S^{0/1}(h) = 0$  agrees with  $y$ , otherwise we abstain. Because of the bound on the disagreement coefficient, one can show that for a large enough  $S$ , this leads to a hypothesis with low abstention loss.
4.2.2 Abstention learning via  $\epsilon$ -cover
We will now generalize our previous results, by introducing the concept of an  $(\epsilon ,\mathcal{H})$  -cover.
Definition 7  $((\epsilon, \mathcal{H})$ -cover of  $\mathcal{U}$ . Let  $\mathcal{H} \subseteq \{0,1\}^{\mathcal{X}}$  be a hypothesis class,  $P$  a distribution over  $\mathcal{X} \times \mathcal{Y}$  and  $\mathcal{U}$  a class of perturbation types. A set of hypotheses  $\mathcal{H}'$  is a  $(\epsilon, \mathcal{H})$ -cover for  $\mathcal{U}$  with respect to  $P$ , if for every  $u \in \mathcal{U}$ , there exists an  $h' \in \mathcal{H}'$  such that  $\mathcal{L}_P^u(h') < \inf_{h \in \mathcal{H}} \mathcal{L}_P^u(h) + \epsilon$ .
We will now provide the definition of a successful cover learner.
Definition 8. Let  $\mathcal{H} \subseteq \{0,1\}^{\mathcal{X}}$  be a hypothesis class, and  $\mathcal{U}$  be a class of perturbation types. We say a function  $\mathcal{A}_{\text{cover}}: (\mathcal{X} \times \mathcal{Y})^{*} \to 2^{\{0,1\}^{\mathcal{X}}}$  that maps a sample  $S$  to a hypothesis class  $\hat{\mathcal{H}} \subset \mathcal{F}$  is a successful finite-disagreement-cover learner for  $(\mathcal{H}, \mathcal{U})$ , if there is a function  $m_{(\mathcal{H}, \mathcal{U}), \text{cover}}: (0,1)^{3} \to \mathbb{N}$ , such that for every  $\epsilon, \eta, \delta \in (0,1)$ , every  $m \geq m_{(\mathcal{H}, \mathcal{U}), \text{cover}}(\epsilon, \eta, \delta)$  and every distribution  $P$  over  $\mathcal{X} \times \{0,1\}$  with probability  $1 - \delta$  over  $S \sim P^{m}$  both of the following statements hold:
-  $\mathcal{A}(S)$  is an  $(\epsilon, \mathcal{H})$ -cover for  $\mathcal{U}$  with respect to  $P$
-  $P_{\mathcal{X}}(\mathrm{DIS}(\mathcal{A}(S)) \leq \eta$
We note that any successful cover learner, that is guaranteed to output a finite set is a successful finite-disagreement cover learner. The case, where  $\mathcal{U}$  is a union of  $k$  totally ordered perturbation type classes  $\mathcal{U}_i$ , we have seen before, can be interpreted as first learning a cover  $\hat{H}$  of size  $k$ , where each of the elements of the union "covers" one of the classes. The case in which  $\mathcal{H}$  has a finite disagreement coefficient can furthermore be seen as a case where the set of all  $\mathrm{ERM_H}$  hypotheses constitute an  $(\epsilon, \mathcal{H})$ -cover  $\mathcal{H}'$  for every class of perturbation types  $\mathcal{U}$ . The mass of the disagreement region of  $\mathcal{H}$  is then bounded by the disagreement coefficient. We now state our result generalizing these observations.
Theorem 6. A class  $\mathcal{H}$  is robustly learnable with abstentions with respect to  $\mathcal{U}$  in the robustly realizable case, if there is a successful finite-disagreement-cover learner for  $(\mathcal{H},\mathcal{U})$ . Furthermore, the sample complexity of robustly learning with abstentions is then bounded by  $m_{\mathcal{H},\mathcal{U}}(\epsilon,\delta) \leq m_{\mathcal{H},\mathcal{U},\text{cover}}(\epsilon/2,\epsilon/2,\delta)$ .
Inspired by considerations of adaptive robustness radii [Chowdhury and Urner, 2022, Bhattacharjee and Chaudhuri, 2021], in Section C of the appendix we discuss a setting of abstention learning in which we allow the size of the perturbation sets to vary locally between different regions of the domain. We provide a learning guarantee for this setting that is not covered by our previous results.
In this work we relaxed the assumption that we know exactly the perturbation sets that are to be used by an adversary. Our model provides an interpolation between knowing the perturbation sets exactly and not knowing them at all. Many of our results rely on realizability. We have also shown that without realizability, learning is not possible unless the learner receives other feedback, such as access to a perfect attack oracle. It might be interesting to consider some milder relaxations of realizability. For example, instead of saying  $\mathrm{opt}_P^u (\mathcal{H}) = 0$ , what if we only know that the adversarial Bayes loss is zero for some  $u^{*}\in \mathcal{U}$ ?