SlowGuess/NeurIPS_2023_OCR huggingface dataset:
class of  $d$  intervals in one dimension where the positive examples form a union of intervals. That is  $\mathcal{F} = \left\{\sum_{i=1}^{k} \mathbb{1}_{[a_i, b_i]} : a_1 \leq b_1 \leq \dots \leq a_k \leq b_k \in [0,1]\right\}$  over the domain  $\mathcal{X} = [0,1]$ . This class has VC dimension  $2d$  but infinite star number. Suppose that  $d = 2$  but examples in the second interval are very rarely selected by i.i.d. examples. Then the disagreement-based learner would suggest to abstain on all examples to protect against the possibility that our new example is in the second interval. However, consider the following simple strategy: if the new example lies between two positives (resp. negatives), we predict positive (resp. negative), else we abstain.
Proposition 3.2. The proposed strategy for the class of  $d$ -intervals in one dimension has
$$
\text {M i s c l a s s i c i a t i o n E r r o r} \leq d \text {a n d A b s t e n t i o n E r r o r} \leq 2 d \log T.
$$
To see this, note that whenever we predict, either we are correct or we have identified the location of a new interval, hence reducing the VC dimension of the version space by 1. Since there are at most  $d$  intervals, we will therefore make at most  $2d$  errors when we predict, implying MisclassificationError  $\leq 2d$ . As for abstaining on i.i.d. examples, the same argument for thresholds can be applied here by treating the intervals as at most  $d$  thresholds.
4 Higher-order Disagreement-based learner with Known marginals
We will first focus on the setting when the marginal distribution of the i.i.d. distribution  $\mathfrak{D}$  is known to the learner. Suppose  $\mathcal{F}$  has VC dimension  $d$ . In this setting, the algorithm that naturally suggests itself is to take a cover for the class under  $\mathfrak{D}$  of accuracy  $\mathrm{poly}(T^{-1})$  and use an adversarial algorithm for prediction. Since there are covers of size  $T^{O(d)}$  and Littlestone dimension of any finite class is bounded by the logarithm of the size, this seems to indicate that this algorithm will achieve our goal with misclassification error  $O(d\log T)$  and zero abstention error. But unfortunately note that this algorithm competes only with the best classifier on the cover. The cover is a good approximation only on the marginal distribution  $\mathfrak{D}$  and not on the adversarial examples. In fact, when we restrict to the hypothesis class being the cover, the data may no longer even be realizable by the cover. Therefore, we need to use the access to the distribution is a completely different way.
The inspiration for our approach comes from the work of [Han09, Han12] on active learning strategies that go beyond disagreement-based learning by making use of higher-order notions of disagreement based on shattering. We note, however, that while the work of [Han09, Han12] only yields asymptotic and distribution-dependent guarantees (and necessarily so, in light of the minimax characterization of [HY15] based on the star number), our analysis differs significantly in order to yield distribution-free finite-sample bounds on the misclassification error and abstention rate.
As we saw earlier, just looking at the disagreement region does not lead to a good algorithm for general VC classes (whenever the star number is large compared to the VC dimension). The main algorithmic insight of this section is that certain higher-order versions of disagreement sets do indeed lead to good notions of uncertainty for VC classes. Our measure uses the probability of shattering  $k$  examples (see definition below) for different values of  $k$  freshly drawn from the underlying distribution, under the two restrictions of the class corresponding to the two labels for the current test example, to make the abstention decision. One can think of the probability of shattering as a proxy for the complexity of the version space. This serves both as a method to quantify our uncertainty about whether the current example is from the distribution or not, since we can understand the behavior of this quantity in the i.i.d. case, and also as potential function which keeps track of the number of mistakes. In order to formally state this, we will need some definitions.
Definition 4.1 (Shattering and VC Dimension). Let  $\mathcal{X}$  be a domain and  $\mathcal{F}$  be a binary function class on  $\mathcal{X}$  i.e.  $\mathcal{F} \subset \{0,1\}^{\mathcal{X}}$ . A set  $\{x_1,\ldots,x_k\} \subseteq \mathcal{X}$  is said to be shattered by  $\mathcal{F}$  if for all  $y \in \{0,1\}^k$  there exists a function  $f \in \mathcal{F}$  such that  $f(x_i) = y_i$ . The VC dimension of  $\mathcal{F}$  is defined as the maximum  $k$  such that there is a set of size  $k$  that is shattered.
Definition 4.2 (Shattered  $k$ -tuples). Let  $k$  be a positive integer. The set of shattered  $k$ -tuples, denoted by  $\mathcal{S}_k$ , for hypothesis class  $\mathcal{F}$  over a domain  $\mathcal{X}$  is defined as
$$
\mathcal {S} _ {k} \left(\mathcal {F}\right) = \left\{\left(x _ {1}, \dots , x _ {k}\right): \left\{x _ {1}, \dots x _ {k} \right\} \text {i s s h a t t e r e d b y} \mathcal {F} \right\}.
$$
Additionally, given a distribution  $\mathfrak{D}$  on the domain, we will refer to as the  $k$  shattering probability of  $\mathcal{F}$  with respect to  $\mathfrak{D}$ , denoted by  $\rho_{k}(\mathcal{F},\mathfrak{D})$ , as
$$
\rho_ {k} \left(\mathcal {F}, \mathfrak {D}\right) = \mathfrak {D} ^ {\otimes k} \left(\mathcal {S} _ {k} \left(\mathcal {F}\right)\right) = \Pr_ {x _ {1}, \dots , x _ {k} \sim \mathfrak {D} ^ {\otimes k}} \left[ \left\{x _ {1}, \dots , x _ {k} \right\} \text {i s s h a t t e r e d b y} \mathcal {F} \right].
$$
Let us now describe the algorithm (see Algorithm 1). The algorithm maintains a state variable  $k$  which we will refer to as the level the algorithm is currently in. The level can be thought of as the complexity of the current version space. At level  $k$ , we will work with shattered sets of size  $k$ . At each round, the algorithm, upon receiving the example  $\hat{x}_t$ , computes the probabilities of shattering  $k$  examples (drawn i.i.d. from  $\mathfrak{D}$ ) for each of the classes corresponding to sending  $\hat{x}_t$  to 0 and 1 respectively. The algorithm abstains if both these probabilities are large, else predicts according to whichever one is larger. At the end of the round, after receiving the true label  $y_t$ , the algorithm checks whether the probability of shattering  $k$  examples is below a threshold  $\alpha_k$ , in which case it changes the level, that is, updates  $k$  to be  $k - 1$ .
Algorithm 1: Level-based learning for Prediction with Abstension
Set  $k = d$  and  $\mathcal{F}_1 = \mathcal{F}$    
for  $t = 1,\dots ,T\land k > 1$  do Receive  $\hat{x}_t$  if min  $\left\{\rho_k\left(\mathcal{F}_t^{\hat{x}_t\to 1}\right),\rho_k\left(\mathcal{F}_t^{\hat{x}_t\to 0}\right)\right\} \geq 0.6\rho_k\left(\mathcal{F}_t\right)$  then predict  $\hat{y}_t = \bot$  else predict  $\hat{y}_t = \mathrm{argmax}_{j\in \{0,1\}}\left\{\rho_k\left(\mathcal{F}_t^{\hat{x}_t\to j}\right)\right\}$  Upon receiving label  $y_{t}$  update  $\mathcal{F}_{t + 1}\gets \mathcal{F}_t^{\hat{x}_t\rightarrow y_t}$  if  $\rho_{k}(\mathcal{F}_{t + 1})\leq \alpha_{k}$  then Set  $k = k - 1$  if  $k = 1\wedge \hat{x}_t\in S_1$  then  $\hat{y}_t = \bot$  if  $k = 1\wedge \hat{x}_t\notin S_1$  then Predict with the consistent label for  $\hat{x}_t$
Below, we state the main error bound of the algorithm and give an overview of the analysis. We defer the detailed proofs to Appendix B. Our theorem shows that both the misclassification error and the abstension error are bounded in terms of the VC dimension.
Theorem 4.1. In the adversarial injection model with abstentions with time horizon  $T$ , Algorithm 1 with  $\alpha_{k} = T^{-k}$  gives the following,
$$
\mathbb {E} [ \text {M i s c l a s s i f i c a t i o n E r r o r} ] \leq d ^ {2} \log T \quad \text {a n d} \quad \mathbb {E} [ \text {A b s t e n t i o n E r r o r} ] \leq 6 d.
$$
We will now present the main technical idea that we will use to analyze the theorem. Let  $k$  be a positive integer and  $x$  be any example in  $\mathcal{X}$ . The following lemma upper bounds the probability for a random example the shattering probability of the two restrictions of the class are both large compared to the original shattering probability of the class. That is to say for most examples, one of the two restrictions of the class will have a smaller shattering probability compared to the original class.
Lemma 4.2. For any  $k \in \mathbb{N}$  and any  $\eta > 1/2$ , we have
$$
\Pr_ {x \sim \mathfrak {D}} \left[ \rho_ {k} \left(\mathcal {F} ^ {x \rightarrow 1}\right) + \rho_ {k} \left(\mathcal {F} ^ {x \rightarrow 0}\right) \geq 2 \eta \rho_ {k} (\mathcal {F}) \right] \leq \frac {1}{2 \eta - 1} \cdot \frac {\rho_ {k + 1} (\mathcal {F})}{\rho_ {k} (\mathcal {F})}. \tag {1}
$$
With this in hand, we will first look at the abstention error. The intuition is that when the algorithm is at level  $k$ , an abstention occurs only if the condition from (1) is satisfied and Lemma 4.2 bounds the probability of this event. It remains to note that when the algorithm is at level  $k$  we both have an upper bound on  $\rho_{k+1}$  (since this is the condition to move down to level  $k$  from level  $k+1$ ) and a lower bound on the  $\rho_k$  (since this is the condition to stay at level  $k$ ).
Lemma 4.3 (Abstention error). For any  $k \leq d$ , let  $[\ell_k, e_k]$  denote the interval of time when Algorithm 1 is at level  $k$ . Then, the expected number of non-adversarial rounds at level  $k$  on which the algorithm abstains satisfies
$$
\mathbb {E} \left[ \sum_ {t = \ell_ {k}} ^ {e _ {k}} \mathbb {I} \left[ c _ {t} = 0 \wedge \hat {y} _ {t} = \bot \right] \right] \leq 5 T \cdot \frac {\alpha_ {k + 1}}{\alpha_ {k}}. \tag {2}
$$
Next, we bound the misclassification error. The main idea here is to note that every time a misclassification occurs at level  $k$ , the  $k$ -th disagreement coefficient reduces by a constant factor. Since we have a lower bound on the disagreement coefficient at a fixed level, this leads to a logarithmic bound on the number of misclassifications at any given level.
Lemma 4.4 (Misclassification error). For any  $k \leq d$ , let  $[\ell_k, e_k]$  denote the interval of time when Algorithm 1 is at level  $k$ . For any threshold  $\alpha_k$  in Algorithm 1,
$$
\mathbb {E} \left[ \sum_ {t = \ell_ {k}} ^ {e _ {k}} \mathbb {I} \left[ \hat {y _ {t}} = 1 - f ^ {*} (\hat {x _ {t}}) \right] \right] \leq 2 \cdot \log \left(\frac {1}{\alpha_ {k}}\right).
$$
Putting together Lemma 4.4 and Lemma 4.3 along with a setting of  $\alpha_{k} = T^{-k}$ , gives us Theorem 4.1. Remark. Closer inspection at the algorithm and the analysis reveals that the algorithm gives the same guarantees even in the setting where the learner does not receive the label  $y_{t}$  during rounds that it abstains (hinted at in Section 2). To see this note that during the rounds that we abstain, we only use the fact that  $\rho_{k}\left(\mathcal{F}_{t}\right)$  does not increase which would remain true when if we did not update the class.
5 Structure-based Algorithm for Unknown Distribution
We move to the case of unknown distributions. In this setting, the example  $x$  are drawn from a distribution  $\mathfrak{D}$  that is unknown to the learner. As we saw earlier, it is challenging to decide whether a single point is out of distribution or not, even when the distribution is known. This current setting is significantly more challenging since the learner needs to abstain on examples that are out of distribution for a distribution that it doesn't know. A natural idea would be to use the historical data to build a model for the distribution. The main difficulty is that, since we do not get feedback about what examples are corrupted, our historical data has both in-distribution and out-of-distribution examples. The only information we have about what examples are out of distribution is the prediction our algorithm has made on them. Such issues are a major barrier in moving from the known distribution case to the unknown distribution case. In this section, we will design algorithms for two commonly studied hypothesis classes: VC dimension 1 classes, and axis-aligned rectangles. Though, VC dimension 1 seems restrictive, there are classes with VC dimension 1 with large Littlestone dimension and large star number, which capture the complexity of sequential prediction and active learning respectively. Thus, our results separate the complexity of those models from our model of abstention.
5.1 Structure-based Algorithm for VC Dimension 1 Classes
A key quantity that we will use in our algorithm will be a version of the probability of the disagreement region but computed on the historical data. The most natural version of this would be the leave-one-out disagreement. That is, consider the set of examples which are in the disagreement region when the class is restricted using the data set with the point under consideration removed. This estimate would have been an unbiased estimator for the disagreement probability (referred to earlier as  $\rho_{1}$  in Definition 4.2). As mentioned earlier, unfortunately, in the presence of adversarial injections, this need not be a good estimate for the disagreement probability.
In order to remedy this, we consider a modified version of the leave-one-out disagreement estimate which considers examples  $x$  in the disagreement region for the class  $\mathcal{F}|_{S_f\backslash (x,y)}$  where  $S_{f}$  is the subset of the datapoints which disagrees with a fixed reference function  $f$ . It is important to note that this function  $f$  is fixed independent of the true labelling function  $f^{\star}$ . Though this seems a bit artificial at first, but this turns out to be a natural quantity to consider given the structure theorem for VC dimension one classes (see Appendix C.1 for more details).
Definition 5.1. Let  $\mathcal{F}$  be a class of functions and let  $f\in \mathcal{F}$  be a reference function. Let  $S = \{(x_{i},y_{i})\}$  be a realizable data set. Define
$$
\Gamma (S, \mathcal {F}, f) = \left\{x: \exists y (x, y) \in S \wedge x \in \mathcal {S} _ {1} \left(\mathcal {F} | _ {S _ {f} \backslash (x, y)}\right) \right\}
$$
where  $S_{f} = \{(x,y)\in S:f(x)\neq y\}$ . Further, we will denote the size of this set by  $\gamma (S,\mathcal{F}) = \left|\Gamma (S,\mathcal{F},f)\right|$ . We will suppress the dependence on  $\mathcal{F}$  when it is clear from context.
Let us now present the main algorithm (see Algorithm 2). The main idea of the algorithm is similar to Algorithm 1 in the known distribution case. We will make a prediction in the case when the difference between  $\Gamma$  for the two classes corresponding to the two labels for the point  $x$  is large. The idea is that when a prediction is made and a mistake happens, the size of  $\Gamma$  goes down similar to  $\rho_{k}$  in the known distribution case. In the case when the difference is small, we will abstain.
Algorithm 2: Structure-based learning for Prediction with Abstention for Unknown Distribution
Let  $f\in \mathcal{F}$  be a reference function and  $\alpha$  be the abstention threshold.   
Set  $\mathcal{F}_0 = \mathcal{F}$  and  $S_0 = \emptyset$    
for  $t = 1,\dots ,T$  do   
Receive  $\hat{x}_t$    
Let  $a_0 = \left|\Gamma \left(S_{t - 1},\mathcal{F}^{\hat{x}_t\to 0},f\right)\right|$  and  $a_1 = \left|\Gamma \left(S_{t - 1},\mathcal{F}^{\hat{x}_t\to 1},f\right)\right|$    
if  $\hat{x}_t\notin S_1(\mathcal{F}_t)$  then Predict with the consistent label for  $\hat{x}_t$    
else if max  $\{a_0,a_1\} \geq \alpha$  then  $\hat{y}_{t} = \operatorname {argmax}_{b}a_{b}$    
else  $\hat{y}_{t} = \bot$    
Upon receiving label  $y_{t}$  ,update  $S_{t}\gets S_{t - 1}\cup \{(\hat{x}_{t},y_{t})\}$  and  $\mathcal{F}_t\gets \mathcal{F}_{t - 1}^{\hat{x}_t\to y_t}$
Though the algorithm is simple and can be made fairly general, our analysis is restricted to the case of VC dimension one. The main reason for this restriction is that our analysis relies on a structure theorem for VC dimension one classes which has no direct analogy for higher VC dimension. But since the algorithm has a natural interpretation independent of this representation, we expect similar algorithms to work for higher VC dimension classes as well.
Theorem 5.1. Let  $\mathcal{F}$  be a hypothesis class with VC dimension 1. Then, in the corruption model with abstentions with time horizon  $T$ , Algorithm 2 with parameter  $\alpha = \sqrt{T}$  gives the following guarantee
$$
\mathbb {E} [ \text {M i s c l a s s i f i c a t i o n E r r o r} ] \leq 2 \sqrt {T \log T} \quad \text {a n d} \quad \mathbb {E} [ \text {A b s t e n t i o n E r r o r} ] \leq \sqrt {T \log T}.
$$
We will now present the main technical ideas that we use to analyze the algorithm. We will keep track of the mistakes using the size of the disagreement region, which we denote by  $\gamma_t = \gamma(S_t, \mathcal{F})$ . The main idea for the proof is to note that when we decide to predict the label with the larger value of  $\Gamma$  is bigger by an additive  $\alpha$ . Thus, when a mistake occurs the value of  $\gamma$  decreases by at least  $\alpha$ . Summing the errors over all time steps gives the following bound.
Lemma 5.2. Algorithm 2 has  $\mathbb{E}[\text{MisclassificationError}] \leq 2T / \alpha$ .
Next, we move on to the number of abstentions. In fact, we will prove a stronger structural result that shows that the number of examples such that there is any set of adversarial injections that would make the algorithm abstain is small. We refer to examples on which algorithm can be made to abstain as attackable examples (formally defined in Definition C.2). The main idea is to prove that in any set of iid examples, there are only a few attackable ones. This is formally stated and proved as Lemma C.3. Using this claim, we can bound the number of abstentions using an exchangeability argument.
Lemma 5.3. Algorithm 2 has  $\mathbb{E}[\text{AbstentionError}] \leq \alpha \log T$ .
The proof of Theorem 5.1 follows from Lemma 5.2 and Lemma 5.3 by setting  $\alpha = \sqrt{T / \log T}$ .
5.2 Structure-based Algorithm for Axis-aligned Rectangles
We can extend the idea from above to design an algorithm for the class of axis-aligned rectangles in dimension  $p$  (VC dimension is  $2p$ ) that achieves abstention and misclassification error bounded by  $O(p\sqrt{T\log T})$ . This exhibits a class of VC dimension  $> 1$  for which we can attain the desired guarantees without access to the distribution.
Theorem 5.4. Let  $\mathcal{F}$  be the class of axis aligned rectangles in  $\mathbb{R}^p$ . Then, Algorithm 3 with  $\alpha = \sqrt{T / \log T}$  satisfies
MisclassificationError  $\leq p\sqrt{T\log T}$  AbstentionError  $\leq 2p\sqrt{T\log T} +2p\log T$
For details of the algorithm and analysis, we refer the reader to Appendix C.3.1.
6 Discussion and Future Directions
In this paper, we introduce a framework for beyond-worst case adversarial sequential predictions by using abstention. Our proposed framework falls at the intersection of several learning paradigms such as active learning, uncertainty quantification, and distribution testing. In this framework we show two main positive results, validating the beyond-worse case nature of our framework. However, our work has only scratched the surface of understanding learnability for VC classes in this new framework. Here we discuss several exciting future directions:
General VC classes with unknown distribution. Extending the structure-based algorithms for general VC classes is wide open. Even characterizing the complexity of learning in the unknown distribution is open. One could attempt to convert the algorithm from Section 4 that for any class  $\mathcal{F}$  with VC dimension  $d$ , achieves abstention error and misclassification error bounded only as a function of  $d$ . Recall that Algorithm 1 computed the probabilities of shattering  $k$  points using the knowledge of the distribution and made a prediction  $\hat{y}_t$  depending on the relative magnitudes of the probabilities corresponding to the two restricted classes. The main challenge in the unknown distribution case is that it is not immediately obvious how to compute these quantities.
One natural approach is to use the historical data as a proxy for the distribution. That is, given the data set  $S_{t}$  of size  $n$ , compute the leave-  $k$ -out estimator for the probability as follows  $\tilde{\rho}_{k}(S,\mathcal{F}) = 1 / \binom{n}{k}\sum_{T\subset S;|T| = k}\mathbb{1}\left[T\text{is shattered by}\mathcal{F}|_{S\setminus T}\right]$ . There are a few things to observe about this estimator. First, in the case when the data is generated i.i.d., this estimator is unbiased. Further, though each of the summands is not independent, one can show concentration for estimators of this form using the theory of U-statistics. Additionally, recall that in Algorithm 1 required the thresholds  $\alpha_{k}$  to be set to  $T^{-O(k)}$  (we use  $T^{-k}$  but it is straightforward to extend this to  $T^{-ck}$  for  $c < 1$ ). This appears to be high precision but note that the "number of samples" one has for a data set of size  $n$  is  $n^{O(k)}$ . Thus, it is conceivable that such an estimator can give the necessary bounds. Unfortunately, the challenge with analyzing this in our setting is that we do no know which of the examples are adversarial. Thus, the adversary could inject examples to make our estimates arbitrarily inaccurate. Thus, as in the case of the VC dimension 1 classes and rectangles, our analysis would need to not rely on the accuracy of the estimates but rather use these estimates to maintain progress or construct other versions of estimators that are unaffected by the adversarial injections.
Tight bounds for known distribution. In the known distribution case, it remains to find the optimal error bound. It would be interesting to improve the upper bound or perhaps even more interesting to show a separation between stochastic sequential prediction and our model. We conjecture that the correct dependence on VC dimension  $d$  should be linear and not quadratic, and our analysis is potentially lose in this aspect. A potential strategy to obtain an improved bound would be to choose the level  $k$  at each iteration in an adaptive manner.
Beyond realizability. Our techniques rely strongly on the realizability (no label noise), however our framework can naturally be extended to settings with label noise. Immediate questions here would be to extend our results to simple noise models such as random classification noise and Massart noise or more ambitiously the agnostic noise model.
Beyond binary classification. Our framework can naturally be extended to more general forms of prediction such as multiclass classification, partial concept classes, and regression. It would be interesting to characterize the complexity of learning in these settings.
Connections to conformal prediction and uncertainty quantification. The unknown distribution case can be seen as a form of distribution-free uncertainty quantification. It would be interesting to understand connections to other forms such as conformal prediction. On a technical level, our work exploits exchangeability of the i.i.d. sequence which is the foundation of conformal prediction, though the main challenge in our setting is the presence of adversarial inputs. It would be interesting to build on this connection and understand whether techniques can be ported over in either direction.
Computationally efficient algorithms. Our focus for this paper has been entirely on the statistical benefits of abstention. Understanding the computational complexity in this setting is an exciting avenue for research. Concretely, for halfspaces in  $d$  dimensions, is there a polynomial time algorithm for learning with abstentions, even for well-behaved distributions such as Gaussians. On a related note, showing computational-statistical gaps in this specialized setting would be interesting, albeit disappointing.