SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Distribution Learnability and Robustness*
Shai Ben-David
University of Waterloo, Vector Institute shai@uwaterloo.ca
University of Waterloo yabie@uwaterloo.ca
Gautam Kamath
University of Waterloo, Vector Institute g@csail.mit.edu
University of Waterloottlechner@uwaterloo.ca
We examine the relationship between learnability and robust (or agnostic) learnability for the problem of distribution learning. We show that learnability of a distribution class implies robust learnability with only additive corruption, but not if there may be subtractive corruption. Thus, contrary to other learning settings (e.g., PAC learning of function classes), realizable learnability does not imply agnostic learnability. We also explore related implications in the context of compression schemes and differentially private learnability.
Distribution learning (sometimes called density estimation) refers to the following statistical task: given i.i.d. samples from some (unknown) distribution  $p$ , produce an estimate of  $p$ . This is one of the most fundamental and well-studied questions in both statistics [DL01] and computer science [Dia16], often equivalent to classic problems of parameter estimation (e.g., mean estimation) in parametric settings. It is easy to see that no learner can meaningfully approximate any given  $p$  without having some prior knowledge. The problem then becomes: assuming the sample generating distribution  $p$  belongs to a given class of distributions  $\mathcal{C}$ , and given parameters  $\varepsilon, \delta \in (0,1)$ , output some distribution  $\hat{p}$  such that with probability at least  $1 - \delta$ , the statistical distance between  $p$  and  $\hat{p}$  is at most  $\varepsilon$ . Specifically, we employ total variation distance, the most studied metric in density estimation [DL01, Dia16], using  $d_{\mathrm{TV}}(p,q)$  to denote the distance between distributions  $p$  and  $q$ . This case, when  $p \in \mathcal{C}$ , is often called the realizable setting. If, for some particular class  $\mathcal{C}$ , this is doable with a finite number of samples  $n(\varepsilon, \delta)$ , then we say the distribution class is  $(\varepsilon, \delta)$ -learnable. A class is learnable if it is  $(\varepsilon, \delta)$ -learnable for every  $(\varepsilon, \delta) \in (0,1)^2$ . A significant amount of work has focused on proving bounds on  $n(\varepsilon, \delta)$  for a number of classes  $\mathcal{C}$  of interest – for example, one can consider the class  $\mathcal{C}$  of all Gaussian distributions  $\mathcal{N}(\mu, \Sigma)$  in some Euclidean space  $\mathbb{R}^d$ .
However, this framework is restrictive in the sense that it requires the unknown distribution to be exactly a member of the class  $\mathcal{C}$  of interest. This may not be the case for a variety of possible reasons, including some innocuous and some malicious. As one example, while it is a common modelling assumption to posit that data comes from a Gaussian distribution, Nature rarely samples exactly from Gaussians, we consider this only to be a convenient approximation. More generally, the class  $\mathcal{C}$  that the learner assumes can be thought of as reflecting some prior knowledge about the task at hand. Such prior knowledge is almost always only an approximation of reality. Alternatively, we may be in an adversarial setting, where a malicious actor has the ability to modify an otherwise well-behaved
*Authors are listed in alphabetical order.
For the sake of exposition, we defer formal definitions of our learnability notions to Section 1.1.
distribution, say by injecting datapoints of their own (known in the machine learning literature as data poisoning attacks [BNL12, SKL17, DKK+19, GTX+20, GFH+21, LKY23]).
More formally, the classic problem of agnostic learnability is generally described as follows: given a (known) class of distributions  $\mathcal{C}$ , and a (finite) set of samples drawn i.i.d. from some (unknown) distribution  $p$ , find a distribution  $\hat{p}$  whose statistical distance from  $p$  is not much more than that of the closest member of  $\mathcal{C}$ . It is not hard to see that this is equivalent to a notion of robust learnability, where the distribution  $p$  is not viewed as arbitrary, but instead an adversarial corruption of some distribution within  $\mathcal{C}$ . Given their equivalence, throughout this work, we will use agnostic and robust learnability interchangeably.
The difference between a robust setting and the previous realizable one is that now, instead of assuming  $p \in \mathcal{C}$  and asking for an arbitrarily good approximation of  $p$ , we make no prior assumption about the data-generating distribution and only ask to approximate as well as (or close to) what the best member of some "benchmark" class  $\mathcal{C}$  can do.
We address the following question: Assuming a class of distributions is learnable, under which notions of robustness is it guaranteed to be robustly learnable? We focus entirely on information-theoretic learnability, and eschew concerns of computational efficiency. Indeed, our question of interest is so broad that computationally efficient algorithms may be too much to hope for.
We shall consider a few variants of robust learnability. Specifically, we will impose requirements on the nature of the difference between the data-generating distribution  $p$  and members of the class  $\mathcal{C}$ . Obviously, such requirements can only make the task of robust learning easier.
One such model considers additive robustness. The underlying distribution is restricted to be a mixture of a distribution  $p$  from  $\mathcal{C}$ , and some 'contaminating' distribution  $q$ . In this Statistics community, this celebrated model is known as Huber's contamination model [Hub64]. Analogously, one can consider subtractive robustness. It includes the case where the starting point is a distribution in the class  $\mathcal{C}$ , but a fraction of the probability mass is removed and samples are drawn from the resulting distribution (after rescaling). These two models are related to adversaries who can add or remove points from a sampled dataset, see discussion at the end of Section 1.2.
A significant line of work focuses on understanding the sample complexity of agnostic distribution learning (see examples and discussion in Section 1.3). Most study restricted classes of distributions, with analyses that are only applicable in certain classes. Some works have found quantitative separations between the different robustness models. For instance, in the specific case of Gaussian mean estimation,  $\mathrm{[DKK^{+}16}$ , LRV16, DKS17,  $\mathrm{[DKK^{+}18]}$  give strong evidence that efficient algorithms can achieve better error if they must only be additively robust, rather than robust in general. However, such findings are again restricted to specific cases, and say little about the overall relationship between learnability in general and these various robust learning models.
Current results leave open a more comprehensive treatment of robustness in distribution learning. Specifically, what is the relative power of these different robustness models, and what is their impact on which types of distributions are learnable? Are there more generic ways to design robust learning algorithms?
Our two main contributions are the following:
- We give a generic algorithm which converts a learner for a distribution class into a learner for that class which is robust to additive corruptions.
- We show that there exist distribution classes which are learnable, but are no longer learnable after subtractive corruption.
Stated succinctly: we show that learnability implies robust learnability when an adversary can make additive corruptions, but not subtractive corruptions. Other results explore implications related to compression schemes and differentially private learnability.
${}^{2}$  A related notion of robust learnability instead imagines the adversary modifies the samples from a distribution in  $\mathcal{C}$  ,rather than the distribution itself. This adaptive model is discussed further in Section 1.2.
1.1 Definitions of Learnability
In order to more precisely describe our results, we define various notions of learnability. We start with the standard notion of PAC learnability for a distribution class. We get samples from a distribution  $p$  belonging to a distribution class  $\mathcal{C}$ , and the goal is to output a distribution similar to  $p$ .
Definition 1.1 (Learnability). We say that a class  $\mathcal{C}$  of probability distributions is learnable (or, realizably learnable) if there exists a learner  $A$  and a function  $n_{\mathcal{C}}:(0,1)^2\to \mathbb{N}$ , such that for every probability distribution  $p\in \mathcal{C}$ , and every  $(\varepsilon ,\delta)\in (0,1)^2$ , for  $n\geq n_{\mathcal{C}}(\varepsilon ,\delta)$  the probability over samples  $S$  of that size drawn i.i.d. from the distribution  $p$  that  $d_{\mathrm{TV}}(p,A(S))\leq \varepsilon$  is at least  $1 - \delta$ .
We next introduce the more challenging setting of robust, or agnostic, learning. In this setting, the sampled distribution is within bounded distance to the distribution class  $\mathcal{C}$ , rather than being in  $\mathcal{C}$  itself. For technical reasons, we introduce two closely-related definitions. Roughly speaking, the latter definition assumes the distance from the sampling distribution to  $\mathcal{C}$  is fixed, whereas the former (more commonly considered in the agnostic learning literature) doesn't. Note that in many cases, robust algorithms designed with knowledge of the distance  $\eta$  to  $\mathcal{C}$  can be modified to do without [JOR22].
Definition 1.2 (Robust learnability).
1. For  $\alpha > 0$ , we say that a class  $\mathcal{C}$  of probability distributions is  $\alpha$ -robustly learnable (also referred to as  $\alpha$ -agnostically learnable) if there exists a learner  $A$  and a function  $n_{\mathcal{C}}: (0,1)^2 \to \mathbb{N}$ , such that for every probability distribution  $p$ , and  $(\varepsilon, \delta) \in (0,1)^2$ , for  $n \geq n_{\mathcal{C}}(\varepsilon, \delta)$  the probability over samples  $S$  of that size drawn i.i.d. from the distribution  $p$  that  $d_{\mathrm{TV}}(p, A(S)) \leq \alpha \min \{d_{\mathrm{TV}}(p, p') : p' \in \mathcal{C}\} + \varepsilon$  is at least  $1 - \delta$ .
When  $\alpha = 1$  we omit it and say that the class is robustly (or agnostically) learnable.
2. For  $0 \leq \eta \leq$  and  $\alpha > 0$ , we say that a class  $\mathcal{C}$  of probability distributions is  $\eta$ -robustly learnable if there exists a learner  $A$  and a function  $n_{\mathcal{C}}: (0,1)^2 \to \mathbb{N}$ , such that for every probability distribution  $p$  such that  $\min \{d_{\mathrm{TV}}(p,p'): p' \in \mathcal{C}\} \leq \eta$  and  $(\varepsilon, \delta) \in (0,1)^2$ , for  $n \geq n_{\mathcal{C}}(\varepsilon, \delta)$  the probability over samples  $S$  of that size drawn i.i.d. from the distribution  $p$  that  $d_{\mathrm{TV}}(p,A(S)) \leq \alpha \eta + \varepsilon$  is at least  $1 - \delta$ .
Finally, we introduce notions of robust learnability which correspond to only additive or subtractive deviations from the distribution class  $\mathcal{C}$ . These more stringent requirements than standard (realizable) learnability, but more lenient than  $\eta$ - $\alpha$ -robust learnability: the adversary in that setting can deviate from the distribution class  $\mathcal{C}$  with both additive and subtractive modifications simultaneously.
Definition 1.3 (Additive robust learnability). Given parameters  $0 \leq \eta \leq 1$  and  $\alpha > 0$ , we say that a class  $\mathcal{C}$  of probability distributions is  $\eta$ -additive  $\alpha$ -robustly learnable if there exists a learner  $A$  and a function  $n_{\mathcal{C}}: (0,1)^2 \to \mathbb{N}$ , such that for every probability distribution  $q$ , every  $p \in \mathcal{C}$ , and  $(\varepsilon, \delta) \in (0,1)^2$ , for  $n \geq n_{\mathcal{C}}(\varepsilon, \delta)$  the probability over samples  $S$  of that size drawn i.i.d. from the distribution  $\eta q + (1 - \eta)p$ , that  $d_{\mathrm{TV}}(A(S), p) \leq \alpha \eta + \varepsilon$  is at least  $1 - \delta$ .
Definition 1.4 (Subtractive robust learnability). Given parameters  $0 \leq \eta \leq 1$  and  $\alpha > 0$ , we say that a class  $\mathcal{C}$  of probability distributions is  $\eta$ -subtractive  $\alpha$ -robustly learnable if there exists a learner  $A$  and a function  $n_{\mathcal{C}}: (0,1)^2 \to \mathbb{N}$ , such that for every probability distribution  $p$  for which there exists a probability distribution  $q$  such that  $\eta q + (1 - \eta)p \in \mathcal{C}$ , and for every  $(\varepsilon, \delta) \in (0,1)^2$ , for  $n \geq n_{\mathcal{C}}(\varepsilon, \delta)$  the probability over samples  $S$  of that size drawn i.i.d. from the distribution  $p$ , that  $d_{\mathrm{TV}}(A(S), p) \leq \alpha \eta + \varepsilon$  is at least  $1 - \delta$ .
1.2 Results and Techniques
We explore how different robustness models affect learnability of distributions, showing strong separations between them. Our first main result shows that learnability implies additively robust learnability.
Theorem 1.5. Any class of probability distributions  $\mathcal{Q}$  which is realizably learnable, is also  $\eta$ -additively 2-robustly learnable for every  $\eta \in (0,1/4)$ .
Note that, since additively robust learnability trivially implies learnability, this shows an equivalence between learnability and additively robust learnability.
Our algorithm enumerates over all subsets of the dataset of an appropriate size, such that at least one subset contains no samples from the contaminating distribution. A realizable learner is applied to
each subset, and techniques from hypothesis selection [Yat85, DL96, DL97, DL01] are used to pick the best of the learned distributions. Further details appear in Section 2.
We also note that since our robust learning algorithm enumerates all large subsets of the training dataset, it is not computationally efficient. Indeed, for such a broad characterization, this would be too much to ask. Efficient algorithms for robust learnability are an exciting and active field of study, but outside the scope of this work. For further discussion see Section 1.3.
Our other main result shows that a distribution class being learnable does not imply that it is subtractive robustly learnable.
Theorem 1.6. For every  $\alpha > 0$ , there exists a class that is learnable, but not  $\eta$ -subtractively  $\alpha$ -robustly learnable for any  $0 \leq \eta \leq \frac{1}{16\alpha}$ .
An immediate corollary is that learnability does not imply robust (or agnostic) learnability, since this is a more demanding notion than subtractive robust learnability.
Our proof of this theorem proceeds by constructing a class of distributions that is learnable, but classes obtained by subtracting light-weight parts of these distributions are not  $\alpha$ -robustly learnable with respect to the original learnable class. More concretely, our construction works as follows. We start by considering a distribution class that, by itself, is not learnable with any finite number of samples. We map each distribution in that class to a new distribution, which additionally features a point with nontrivial mass that "encodes" the identity of the distribution, thus creating a new class of distributions which is learnable. Subtractive contamination is then able to "erase" this point mass, leaving a learner with sample access only to the original (unlearnable) class. Our construction is inspired by the recent construction of Lechner and Ben-David [LBD23], showing that the learnability of classes of probability distributions cannot be characterized by any notion of combinatorial dimension. For more details, see Section 3.
Thus far, we have only considered additive and subtractive robustness separately. General robustness, where probability mass can be both added and removed, is more powerful than either model individually. However, if a class is additive robustly learnable and subtractive robustly learnable, is it robustly learnable? Though this is intuitively true, we are not aware of an immediate proof. Using a similar argument as Theorem 1.5, we derive a stronger statement: that subtractively robust learnability implies robust learnability.
Theorem 1.7. If a class  $\mathcal{C}$  is  $\eta$ -subtractive  $\alpha$ -robustly learnable, then it is also  $\eta-(2\alpha + 4)$ -robustly learnable.
Adjacent to distribution learning is the notion of sample compression schemes. Recent work by Ashtiani, Ben-David, Harvey, Liaw, Mehrabian, and Plan  $\left[\mathrm{ABDH}^{+}18\right]$  expanded notions of sample compression schemes to apply to the task of learning probability distributions. They showed that the existence of such sample compression schemes for a class of distributions imply the learnability of that class. While the existence of sample compression schemes for classification tasks imply the existence of such schemes for robust leaning, the question if similar implication hold for distribution learning schemes was not answered. We strongly refute this statement. We use a construction similar to that of Theorem 1.6, see Section 3.1 for more details.
Theorem 1.8. The existence of compression schemes for a class of probability distributions does not imply the existence of robust compression schemes for that class.
Finally, a natural question is whether other forms of learnability imply robust learnability. We investigate when differentially private $^3$  (DP) learnability does or does not imply robust learnability. We find that the same results and separations as before hold when the distribution class is learnable under approximate differential privacy (i.e.,  $(\varepsilon, \delta)$ -DP), but, perhaps surprisingly, under pure differential privacy (i.e.,  $(\varepsilon, 0)$ -DP), private learnability implies robust learnability for all considered adversaries. $^4$
Theorem 1.9 (Informal).  $(\varepsilon, 0)$ -DP learnability implies robust  $(\varepsilon, 0)$ -DP learnability. For any  $\delta > 0$ ,  $(\varepsilon, \delta)$ -DP learnability implies additively robust learnability, but not subtractively robust learnability.
3 Differential privacy is a popular and rigorous notion of data privacy. For the definition of differential privacy, see Section 4.
In the context of differential privacy, we diverge slightly from the established notation. Specifically, we align ourselves with common notation in the DP literature, using  $\varepsilon$  and  $\delta$  for privacy parameters, and use  $\alpha$  (in place of  $\varepsilon$ ) and  $\beta$  (in place of  $\delta$ ) for accuracy parameters.
For pure DP learnability, we employ an equivalence between learnability under pure differential privacy and packing [BKSW19]. Existence of such a packing in turn implies learnability under both pure differential privacy and with both additive and subtractive contamination. For approximate DP learnability, we note that the corresponding version of Theorem 1.5 automatically holds, since private learnability implies learnability. We show that our construction for Theorem 1.6 is still learnable under approximate differential privacy, and thus the corresponding non-implication holds. See Section 4 for more details.
To summarize the qualitative versions of our findings:
- Learnability and additively robust learnability are equivalent (Theorem 1.5);
- Learnability does not imply subtractively robust learnability (Theorem 1.6);
- Subtractively robust learnability implies robust learnability (Theorem 1.7);
- Pure DP learnability is equivalent to robust pure DP learnability (Theorem 1.9);
- Approximate DP learnability implies additively robust learnability, $^{5}$  but not subtractively robust learnability (Theorem 1.9);
- Existence of sample compression schemes does not imply the existence of robust sample compression schemes (Theorem 1.8).
Quantitative versions of these statements can be found in their respective theorems.
Adaptive Adversaries. Our definition of robustness allows an adversary to make changes to the underlying distribution. Equivalently, it corresponds to an adversary who can add or remove points from a dataset, but must commit to these modifications before the dataset is actually sampled. A stronger adversary would be able to choose which points to add or remove after seeing the sampled dataset. Such an adversary is referred to as adaptive. Since adaptive adversaries are stronger than the ones we consider, any impossibility result that we show also holds in this settings (e.g., learnability does not imply subtractive robust learnability when the adversary is adaptive). It is an interesting open question to understand whether our algorithms can be strengthened to work in this setting. Some positive evidence in this direction is due to Blanc, Lange, Malik, and Tan [BLMT22], who show that adaptive and non-adaptive adversaries have qualitatively similar power in many settings.
Robust estimation is a classic subfield of Statistics, see, for example, the classic works [Tuk60, Hub64]. Our work fits more into the Computer Science literature on distribution estimation, initiated by the work of  $\mathrm{[KMR^{+}94]}$ , which was in turn inspired by Valiant's PAC learning model [Val84]. Since then, several works have focused on algorithms for learning specific classes of distributions, see, e.g., [CDSS13, CDSS14a, CDSS14b, LS17,  $\mathrm{ABDH^{+}20}$ ]. A recent line of work, initiated by  $\mathrm{[DKK^{+}16, LRV16]}$ , focuses on computationally-efficient robust estimation of multivariate distributions, see, e.g.,  $\mathrm{[DKK^{+}17, SCV18, DKK^{+}18, KSS18, HL18, DKK^{+}19, LM21, LM22, BDJ^{+}22, JKV23]}$  and [DK22] for a reference. In contrast to all of these works, we focus on broad and generic connections between learnability and robust learnability, rather than studying robust learnability of a particular class of distributions.
Some of our algorithmic results employ tools from hypothesis selection, a problem which focuses on agnostic learning with respect to a specified finite set of distributions. The most popular approaches are based on ideas introduced by Yatracos [Yat85] and subsequently refined by Devroye and Lugosi [DL96, DL97, DL01]. Several others have studied hypothesis selection with an eye for several considerations, including running time, approximation factor, robustness, privacy, parallelization, and more [MS08, DDS12, DK14, SOAJ14, DKK $^{+}$ 16, ABDH $^{+}$ 18, AFJ $^{+}$ 18, BKSW19, BKM19, GKK $^{+}$ 20, BBK $^{+}$ 22, AAK21].
Distribution learning under the constraint of differential privacy [DMNS06] has been an active area of research, see, e.g., [KV18, KLSU19, BS19, ASZ21, CWZ21,  $\mathrm{KMS}^{+}22\mathrm{b}$ , KMS22a], and
${}^{5}$  A natural open question is whether approximate DP learnability implies additively-robust approximate-DP learnability.
<sup>6</sup>And in the case of removals, much more natural
[KU20] for a survey. A number of these works have focused on connections between robustness and privacy [DL09, BKSW19, KSU20, AM20, BGS $^{+}$ 21, LKKO21, LKO22, KMV22, RJC22, SM22, HKM22, GH22, HKMN23, AKT $^{+}$ 23]. Again, these results either focus on specific classes of distributions, or give implications that require additional technical conditions, whereas we aim to give characterizations of robust learnability under minimal assumptions.
The question whether learnability under realizability assumptions extends to non-realizable setting has a long history. For binary classification tasks, both notions are characterized by the finiteness of the VC-dimension, and are therefore equivalent [VC71, VC74, BEHW89, Hau92]. [BPS09] show a similar result for online learning. Namely, that agnostic (non-realizable) learnability is characterized by the finiteness of the Littlestone dimension, and is therefore equivalent to realizable learnability.