SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Proof. Let  $f$  be the representative function from the characterization in Theorem C.1. Further, let  $\mathfrak{T}$  be the tree corresponding to the tree order on  $\mathcal{X}$ . Since  $f$  is a fixed function that does not depend on the algorithm or the history of interaction with adversary, we can preprocess all points and labels to be xored with the labels of  $f$ . In other words, we transform the class to be such that  $f$  is the all zeros function. In this setting, the true hypothesis  $f^{\star}$  corresponds to a path  $p$  and a threshold  $x^{\star}$  on  $\mathfrak{T}$  such that  $f^{\star}(x) = 1$  if and only if  $x \in p$  and  $x \prec x^{\star}$ . For this proof, it is important to consider only adversaries that do not get to choose the true hypothesis  $f^{\star}$  adaptively. Thus the path is fixed throughout the history of the interaction.
Let  $S$  be the data set under consideration. First note that by definition, we only need to consider the points  $x$  in the disagreement region. The labels of all points that are not in the subtree of the deepest 1 labeled point in  $S$  are fixed and thus cannot be in the disagreement region. Thus, we only need to consider the points in the subtree of the deepest 1 labeled point in  $S$ .
First note that points that have more than  $\alpha$  points in descendant subtree cannot be attacked. This is because if the point is labelled as a 0 then all its descendants are in the disagreement region. This remains true even for any points that are added to the data set. Thus,  $\left|\Gamma\left(S \cup A_x \setminus \{x\}, \mathcal{F}^{x \rightarrow 0}\right)\right| > \alpha$ . This is because in the definition of  $\gamma$  we remove all points labelled 0.
For any node  $u$ , denote by  $\mathrm{pos}(v)$  the closest ancestor on the path  $p$  corresponding to the positive points. We claim that if  $u$  has fewer than  $\alpha$  points in its descendant subtree, then  $u$  is attackable only if
$$
\left| \left\{v \in S: \operatorname {p o s} (u) \preceq \operatorname {p o s} (v) \wedge v \text {i s n o t a d e s c e n d a n t o f} u \right\} \right| \leq \alpha \tag {11}
$$
First note that adding any 0 labelled points to  $S$  as  $A_u$  does not change the number of points in  $\Gamma$ . Further note that for  $v$  such that  $\mathrm{pos}(u) \preceq \mathrm{pos}(v)$ , adding a 1 labelled point must be on the path between  $\mathrm{pos}(u)$  and  $\mathrm{pos}(v)$ . But, this would remove  $u$  from the disagreement region. Thus, all point  $v$  would be counted in  $\Gamma$  and if these are greater than  $\alpha$  then  $u$  is not attackable.
Consider the point  $w$  that is minimal amongst  $\mathrm{pos}(u)$  for  $u$  satisfying (11) and  $u$  be a node such that  $\mathrm{pos}(u) = w$ . First note that all points that satisfy (11) are in the subtree of  $w$ . Second, note that this subtree has at most  $\alpha$  points. This is because if there were more than  $\alpha$  points,  $u$  would not satisfy (11) which is a contradiction.
Proof of Lemma 5.3. Let  $i_T$  be the number of i.i.d. points in the data set at time  $T$ . Note that the only i.i.d. points that we abstain on are the attackable points. But, since the i.i.d. points are exchangeable if  $i$  i.i.d. points are seen so far, the probability of abstain is given by  $\frac{\alpha}{i}$ . Thus, the expected total number of abstentions is at most
$$
\sum_ {i = 1} ^ {i _ {T}} \frac {\alpha}{i} \leq \alpha \log T
$$
as required.
C.3.1 Structure-based Algorithm for Axis-aligned rectangles
Recall that the class of axis-aligned rectangles consists of functions  $f$  parameterized by  $(a_{1}, b_{1}, \ldots, a_{p}, b_{p})$  such that
$$
f _ {(a _ {1}, b _ {1}, \ldots , a _ {p}, b _ {p})} (x) = \left\{ \begin{array}{l l} 1 & \text {i f \forall i \in [ p ] , a _ {i} \leq \hat {x} _ {i} \leq b _ {i}} \\ 0 & \text {o t h e r w i s e .} \end{array} \right.
$$
Now consider the following algorithm:
Algorithm 3: Structure-based learning for Axis-aligned Rectangles
Set  $a_1,\ldots ,a_p = -\infty$  and  $b_{1},\dots,b_{p} = \infty$    
for  $t = 1,\ldots ,T$  doReceive  $\hat{x}_t$  if  $\forall \tau < t,y_{\tau} = 0$  then  $\hat{y}_t = 0$  else if  $\hat{x}_t\notin S_1(\mathcal{F}_{t - 1})$  then  $\hat{y}_t = f(\hat{x}_t)$  for any  $f\in \mathcal{F}_{t - 1}$  else if  $\exists s_1,\ldots ,s_\alpha <  t$  and  $\exists i_1,\ldots ,i_\alpha \in [p]$  such that  $\hat{x}_{s_j,i_j}\in [\hat{x}_{t,i_j},a_{i_j})\cup (b_{i_j},\hat{x}_{t,i_j}]$  then  $\hat{y}_t = 0$  else  $\hat{y}_t = \bot$  Receiving label  $y_{t}$  Update  $S_{t}\gets S_{t - 1}\cup \{(\hat{x}_{t},y_{t})\}$  and  $\mathcal{F}_t\gets \mathcal{F}_{t - 1}^{\hat{x}_t\to y_t}$  Update  $a_1,\ldots ,a_p$  and  $b_{1},\ldots ,b_{p}$  such that  $[a_1,b_1]\times \ldots [a_p,b_p]$  is the smallest rectangle containing the points labelled positive so far. i.e.  $a_i = \min \{x_i:(x,1)\in S_t\}$
If we have only seen 0 labels so far, the algorithm predicts 0. Otherwise, let  $[a_1, b_1] \times [a_2, b_2] \times \ldots \times [a_p, b_p]$  be the minimal rectangle enclosing the positive examples so far (i.e., the Closure hypothesis). For the next point  $\hat{x}_t$ , if it isn't in the region of disagreement, we predict the agreed-upon label. Otherwise, we check whether there exist at least  $\alpha$  examples  $\hat{x}_s$ ,  $s < t$ , for each of which there exists
a coordinate  $i$  with  $\hat{x}_{si} \in [\hat{x}_{ti}, a_i) \cup (b_i, \hat{x}_{ti}]$  (at most one of these sides is non-empty – or sometimes both sides will be empty for some coordinates  $i$ ). If so, we predict 0. Otherwise, we abstain. (The algorithm never predicts 1 in the region of disagreement, similar to the Closure algorithm).
Proof of Theorem 5.4. For any example with target label 1, if the algorithm predicts 0, there are at least  $\alpha$  examples  $\hat{x}_s$  which each have some coordinate  $\hat{x}_{s,i}$  that was not in  $[a_i,b_i]$  before the update, but which will have  $\hat{x}_{s,i}$  in  $[a_i,b_i]$  after the update. For each example  $\hat{x}_s$ , this can happen at most  $p$  times (corresponding to each coordinate) before it will never again be included in a future set of  $\alpha$  examples that convince us to predict 0. So we make at most  $pT / \alpha$  misclassifications on adversarially injected examples. Since the algorithm never predicts 1 unless the true label is 1, we never misclassify a negative example. So it remains only to bound the number of abstentions on the i.i.d. examples.
For any  $n$ , suppose  $\hat{x}_t$  is the  $n$ -th i.i.d. example, and let  $\tilde{x}_1, \dots, \tilde{x}_n$  be these  $n$  i.i.d. examples (so  $\tilde{x}_n = \hat{x}_t$ ). If  $\hat{x}_t$  is "attackable" (same to Definition C.2 meaning that there is some set of examples the adversary could add, knowing  $\hat{x}_t$ , to make us abstain) then it must be that either  $\hat{x}_t$  is a positive example in the region of disagreement of the version space induced by the other  $n - 1$  points, or else  $\hat{x}_t$  is a negative example such that there are  $< \alpha$  points  $\tilde{x}_s, s < n$ , for which there exists  $i$  with  $\tilde{x}_{s,i} \in [\hat{x}_{t,i},a_i) \cup (b_i,\hat{x}_{t,i}]$ . In particular, in the latter case, it must be that each coordinate  $i$  has  $< \alpha$  examples  $\tilde{x}_s$  with  $\tilde{x}_{s,i} \in [\hat{x}_{t,i},a_i^{\star}) \cup (b_i^{\star},\hat{x}_{t,i}]$ , where the target concept is  $[a_1^\star ,b_1^\star ]\times \ldots \times [a_p^\star ,b_p^\star ]$ . This is because the current estimated rectangle will be inside the true rectangle.
We will use exchangeability to bound the probability that  $\tilde{x}_n$  is attackable by  $\frac{1}{n}$  times the number of  $\tilde{x}_s$ ,  $s \leq n$ , which would be attackable if they were swapped with  $\tilde{x}_n$ . Among  $\tilde{x}_1, \ldots, \tilde{x}_n$  there are at most  $2p$  positive examples in the region of disagreement of the version space induced by the others (namely, the minimum spanning set of the positive examples). For each coordinate  $i$ , there are at most  $2\alpha$  examples  $\tilde{x}_s$ ,  $s \leq n$ , with  $< \alpha$  other examples  $\tilde{x}_{s,i}$  in  $[\tilde{x}_{s,i}, a_i^\star) \cup (b_i^\star, \tilde{x}_{s,i}]$  (namely, the  $\leq \alpha$  examples with smallest  $\tilde{x}_{s,i}$  such that  $\tilde{x}_{s,i} > b_i^\star$ , and the  $\leq \alpha$  examples with largest  $\tilde{x}_{s,i}$  such that  $\tilde{x}_{s,i} < a_i^\star$ ). So there are at most  $2\alpha p$  negative examples  $\tilde{x}_s$  which would be attackable if they were swapped with  $\tilde{x}_n$ .
Altogether there are at most  $2p(\alpha + 1)$  examples  $\tilde{x}_s$  which would be attackable if they were swapped with  $\tilde{x}_n$ . Thus, the probability i.i.d. example  $\hat{x}_t$  is attackable is at most  $2p(\alpha + 1)/n$  where  $n$  is the number of i.i.d. points seen so far including  $\hat{x}_t$ . Summing, the expected number of abstentions on i.i.d. examples is at most  $2p(\alpha + 1)\log T$ . Now setting  $\alpha = \sqrt{T/\log T}$ , gives us the desired result.