SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Vinod Raman*
Department of Statistics  
University of Michigan  
Ann Arbor, MI 48104  
vkraman@umich.edu
Unique Subedi*
Department of Statistics  
University of Michigan  
Ann Arbor, MI 48104  
subedi@umich.edu
Ambuj Tewari
Department of Statistics  
University of Michigan  
Ann Arbor, MI 48104  
tewaria@umich.edu
Recently, Montasser et al. [2019] showed that finite VC dimension is not sufficient for proper adversarially robust PAC learning. In light of this hardness, there is a growing effort to study what type of relaxations to the adversarially robust PAC learning setup can enable proper learnability. In this work, we initiate the study of proper learning under relaxations of the adversarially robust loss. We give a family of robust loss relaxations under which VC classes are properly PAC learnable with sample complexity close to what one would require in the standard PAC learning setup. On the other hand, we show that for an existing and natural relaxation of the adversarially robust loss, finite VC dimension is not sufficient for proper learning. Lastly, we give new generalization guarantees for the adversarially robust empirical risk minimizer.
As deep neural networks become increasingly ubiquitous, their susceptibility to test-time adversarial attacks has become more and more apparent. Designing learning algorithms that are robust to these test-time adversarial perturbations has garnered increasing attention by machine learning researchers and practitioners alike. Prior work on adversarially robust learning has mainly focused on learnability under the worst-case adversarily robust risk [Montasser et al., 2019, Attias et al., 2021, Cullina et al., 2018],
$$
R _ {\mathcal {U}} (h; \mathcal {D}) := \underset {(x, y) \sim \mathcal {D}} {\mathbb {E}} \left[ \sup  _ {z \in \mathcal {U} (x)} \mathbb {1} \{h (z) \neq y \} \right],
$$
where  $\mathcal{U}(x) \subset \mathcal{X}$  is an arbitrary but fixed perturbation set (for example  $\ell_p$  balls). In practice, worst-case robustness is commonly achieved via Empirical Risk Minimization (ERM) of the adversarially robust loss or some convex surrogate [Madry et al., 2017; Wong and Kolter, 2018; Raghunathan et al., 2018; Bao et al., 2020]. However, a seminal result by Montasser et al. [2019] shows that any proper learning rule, including ERM, even when trained on an arbitrarily large number of samples, may not return a classifier with small adversarially robust risk. These high generalization gaps for the adversarially robust loss have also been observed in practice [Schmidt et al., 2018]. Even worse, empirical studies have shown that classifiers trained to achieve worst-case adversarial robustness exhibit degraded nominal performance [Dobriban et al., 2020; Raghunathan et al., 2019; Su et al., 2018; Tsipras et al., 2018; Yang et al., 2020; Zhang et al., 2019; Robey et al., 2022].
In light of these difficulties, there has been a recent push to study when proper learning, and more specifically, when learning via ERM is possible for achieving adversarial robustness. The ability to achieve test-time robustness via proper learning rules is important from a practical standpoint. It
aligns better with the current approaches used in practice (e.g. (S)GD-trained deep nets), and proper learning algorithms are often simpler to implement than improper ones. In this vain, [2022] and Bhattacharjee et al. [2022] consider adversarial robust learning in the tolerant setting, where the error of the learner is compared with the best achievable error with respect to a slightly larger perturbation set. They show that the sample complexity of tolerant robust learning can be significantly lower than the current known sample complexity for adversially robust learning and that proper learning via ERM can be possible under certain assumptions. Additionally, [2020] provide some sufficient conditions under which proper robust learnability of VC classes becomes possible under a PAC-type framework of semi-supervised learning. More recently, [2022] show that finite VC dimension is sufficient for proper semi-supervised adversially robust PAC learning if the support of the marginal distribution on instances is known. On the other hand, [2023] study the adversially robust PAC learnability of real-valued functions and show that every convex function class is properly learnable.
In a different direction, several works have studied the consistency of various surrogates of the adversarially robust loss  $\ell_{\mathcal{U}}(h,(x,y)) = \sup_{z\in \mathcal{U}(x)}\mathbb{1}\{h(z)\neq y\}$  [Awasthi et al., 2022a,b, 2023; Mao et al., 2023], while others have considered relaxing its worst-case nature [Robey et al., 2022; Li et al., 2020, 2021; Laidlaw and Feizi 2019; Rice et al., 2021]. However, the PAC learnability of these relaxed notions of the adversarially robust loss has not been well-studied.
In this paper, we study relaxations of the worst-case adversarially robust learning setup from a learning-theoretic standpoint. We classify existing relaxations of worst-case adversarially robust learning into two approaches: one based on relaxing the loss function and the other based on relaxing the benchmark competitor. Much of the existing learning theory work studying relaxations of adversarial robustness focus on the latter approach. These works answer the question of whether proper PAC learning is feasible if the learner is evaluated against a stronger notion of robustness. In contrast, we focus on the former relaxation and pose the question: can proper PAC learning be feasible if we relax the adversarially robust loss function itself? In answering this question, we make the following main contributions:
- We show that the finiteness of the VC dimension is not sufficient for properly learning a natural relaxation of the adversarially robust loss proposed by Robey et al. [2022]. Our proof techniques involve constructing a VC class that is not properly learnable.
- We give a family of adversarially robust loss relaxations that interpolate between average-and worst-case robustness. For these losses, we use Rademacher complexity arguments relying on the Ledoux-Talagrand contraction to show that all VC classes are learnable via ERM.
- We extend a property implicitly appearing in margin theory (e.g., see Mohri et al. [2018], Section 5.4]), which we term "Sandwich Uniform Convergence" (SUC), to show new generalization guarantees for the adversarially robust empirical risk minimizer.
Throughout this paper we let  $[k]$  denote the set of integers  $\{1,\dots,k\}$ ,  $\mathcal{X}$  denote an instance space,  $\mathcal{Y} = \{-1,1\}$  denote our label space, and  $\mathcal{D}$  be any distribution over  $\mathcal{X} \times \mathcal{Y}$ . Let  $\mathcal{H} \subseteq \mathcal{Y}^{\mathcal{X}}$  denote a hypothesis class mapping examples in  $\mathcal{X}$  to labels in  $\mathcal{Y}$ .
In the standard adversarially robust learning setting, the learner, during training time, picks a set  $\mathcal{G} \subseteq \mathcal{X}^{\mathcal{X}}$  of perturbation functions  $g: \mathcal{X} \to \mathcal{X}$  against which they wish to be robust. At test time, an adversary intercepts the labeled example  $(x,y)$ , exhaustively searches over the perturbation set to find the worst  $g \in \mathcal{G}$ , and then passes the perturbed instance  $g(x)$  to the learner. The learner makes a prediction  $\hat{y}$  and then suffers the loss  $\mathbb{1}\{\hat{y} \neq y\}$ . The goal of the learner is to find a hypothesis  $h \in \mathcal{Y}^{\mathcal{X}}$  that minimizes the adversarially robust risk  $R_{\mathcal{G}}(h; \mathcal{D}) = \mathbb{E}_{(x,y) \sim \mathcal{D}}[\ell_{\mathcal{G}}(h,(x,y))]$  where  $\ell_{\mathcal{G}}(h,(x,y)) := \sup_{g \in \mathcal{G}} \mathbb{1}\{h(g(x)) \neq y\}$  is the adversarially robust loss.
2We highlight that our use of perturbation functions  $\mathcal{G}$  instead of perturbation sets  $\mathcal{U}$  is without loss of generality (see Appendix A for an equivalence).
In practice, however, such a worst-case adversary may be too strong and unnatural, especially in high-dimension. Accordingly, we relax this model by considering a lazy, computationally-bounded adversary that is unable to exhaustively search over  $\mathcal{G}$ , but can randomly sample a perturbation function  $g \sim \mu$  given access to a measure  $\mu$  over  $\mathcal{G}$ . In this setup, the learner picks both a perturbation set  $\mathcal{G}$  and a measure  $\mu$  over  $\mathcal{G}$ . At test-time, the lazy adversary intercepts the labeled example  $(x,y)$ , randomly samples a perturbation function  $g \sim \mu$ , and then passes the perturbed instance  $g(x)$  to the learner. From this perspective, the goal of the learner is to output a hypothesis such that the probability that the lazy adversary succeeds in sampling a bad perturbation function, for any labeled example in the support of  $\mathcal{D}$ , is small. In other words, the learner strives to be robust to most, but not all, perturbation functions in  $\mathcal{G}$ .
We highlight that the set  $\mathcal{G}$  and the measure  $\mu$  are fixed and chosen by the learner at training time. As a result, the measure  $\mu$  does not depend on the unperturbed point  $x$ . Allowing the measure to depend on the unperturbed point  $x$  is an interesting future direction that lies between our model and adversarial robustness. Nevertheless, fixing the measure  $\mu$  is still relevant from a practical standpoint and non-trivial from a theoretical standpoint. Indeed, a popular choice for  $\mathcal{G}$  and  $\mu$  are  $\ell_p$  balls and the uniform measure respectively. These choices have been shown experimentally to strike a better balance between robustness and nominal performance [Robey et al., 2022]. Moreover, in Section 3 we show that even when the measure  $\mu$  is fixed apriori, there are learning problems for which ERM does not always work. This parallels the hardness result from Montasser et al. [2019], who prove an analogous result for adversariably robust PAC learning.
2.2 Probabilistically Robust Losses and Proper Learnability
Given a perturbation set  $\mathcal{G}$  and measure  $\mu$ , we quantify the probabilistic robustness of a hypothesis  $h$  on a labeled example  $(x,y)$  by considering losses that are a function of  $\mathbb{P}_{g\sim \mu}[h(g(x))\neq y]$ . For a labeled example  $(x,y)\in \mathcal{X}\times \mathcal{Y}$ ,  $\mathbb{P}_{g\sim \mu}[h(g(x))\neq y]$  measures the fraction of perturbations in  $\mathcal{G}$  for which the classifier  $h$  is non-robust. Observe that  $\mathbb{P}_{g\sim \mu}[h(g(x))\neq y] = \frac{1 - y\mathbb{E}_{g\sim\mu}[h(g(x))]}{2}$  is an affine transformation of quantity  $y\mathbb{E}_{g\sim \mu}[h(g(x))]$ , the probabilistically robust margin of  $h$  on  $(x,y)$  with respect to  $(\mathcal{G},\mu)$ . Thus, we focus on loss functions that operate over the margin  $y\mathbb{E}_{g\sim \mu}[h(g(x))]$ . One important loss function is the  $\rho$ -probabilistically robust loss,
$$
\ell_ {\mathcal {G}, \mu} ^ {\rho} (h, (x, y)) := \mathbb {1} \left\{\mathbb {P} _ {g \sim \mu} \left(h (g (x)) \neq y\right) > \rho \right\},
$$
where  $\rho \in [0,1)$  is selected apriori. The  $\rho$ -probabilistically robust loss was first introduced by Robey et al. [2022] for the case when  $\mathcal{X} = \mathbb{R}^d$ ,  $g_c(x) = x + c$ , and the set of perturbations  $\mathcal{G} = \{g_c : c \in \Delta\}$  for some  $\Delta \subset \mathbb{R}^d$ . In this paper, we generalize this loss to an arbitrary instance space  $\mathcal{X}$  and perturbation set  $\mathcal{G}$ . As highlighted by Robey et al. [2022], this notion of robustness is desirable as it nicely interpolates between worst- and average-case robustness via an interpretable parameter  $\rho$ , while being more computationally tractable compared to existing relaxations.
In this work, we are primarily interested in understanding whether probabilistic relaxations of the adversarially robust loss enable proper learning. That is, given a hypothesis class  $\mathcal{H}$ , perturbation set and measure  $(\mathcal{G},\mu)$ , loss function  $\ell_{\mathcal{G},\mu}(h,(x,y)) = \ell(y\mathbb{E}_{g\sim \mu}[h(g(x))])$ , and labeled samples from an unknown distribution  $\mathcal{D}$ , our goal is to design a learning algorithm  $\mathcal{A}:(\mathcal{X}\times \mathcal{Y})^*\to \mathcal{H}$  such that for any distribution  $\mathcal{D}$  over  $\mathcal{X}\times \mathcal{Y}$ , the algorithm  $\mathcal{A}$ , given a sample of labeled examples from  $\mathcal{D}$ , finds a hypothesis  $h\in \mathcal{H}$  with low risk with regards to  $\ell_{\mathcal{G},\mu}(h,(x,y))$ .
Definition 1 (Proper Probabilistically Robust PAC Learnability). Let  $\ell_{\mathcal{G},\mu}(h,(x,y))$  denote an arbitrary probabilistically robust loss function. For any  $\epsilon, \delta \in (0,1)$ , the sample complexity of probabilistically robust  $(\epsilon, \delta)$ -learning  $\mathcal{H}$  with respect to  $\ell_{\mathcal{G},\mu}$ , denoted  $n(\epsilon, \delta; \mathcal{H}, \ell_{\mathcal{G},\mu})$  is the smallest number  $m \in \mathbb{N}$  for which there exists a proper learning rule  $\mathcal{A} : (\mathcal{X} \times \mathcal{Y})^* \to \mathcal{H}$  such that for every distribution  $\mathcal{D}$  over  $\mathcal{X} \times \mathcal{Y}$ , with probability at least  $1 - \delta$  over  $S \sim \mathcal{D}^m$ ,
$$
\mathbb {E} _ {\mathcal {D}} \left[ \ell_ {\mathcal {G}, \mu} (\mathcal {A} (S), (x, y)) \right] \leq \inf  _ {h \in \mathcal {H}} \mathbb {E} _ {\mathcal {D}} \left[ \ell_ {\mathcal {G}, \mu} (h, (x, y)) \right] + \epsilon .
$$
We say that  $\mathcal{H}$  is proper probabilistically robustly PAC learnable with respect to  $\ell_{\mathcal{G},\mu}$  if  $\forall \epsilon, \delta \in (0,1)$ ,  $n(\epsilon, \delta; \mathcal{H}, \ell_{\mathcal{G},\mu})$  is finite.
An important class of proper learning rules is ERMs which simply output the hypothesis  $h \in \mathcal{H}$  that minimizes the loss  $\ell_{\mathcal{G},\mu}$  over the training sample. In this paper, we ultimately show that for a wide family of probabilistically robust loss functions, ERM is a proper learner according to Definition 1. On the other hand, in Section 3, we show that proper probabilistically robust PAC learning is not always possible for the loss function  $\ell_{\mathcal{G},\mu}^{\rho}(h,(x,y))$ .
2.3 Complexity Measures
Under the standard 0-1 risk, the Vapnik-Chervonenkis dimension (VC dimension) plays an important role in characterizing PAC learnability, and more specifically, when ERM is possible. A hypothesis class  $\mathcal{H}$  is PAC learnable with respect to the 0-1 loss if and only if its VC dimension is finite [Vapnik and Chervonenkis, 1971].
Definition 2 (VC dimension). A set  $\{x_1, \dots, x_n\} \in \mathcal{X}$  is shattered by  $\mathcal{H}$ , if  $\forall y_1, \dots, y_n \in \mathcal{Y}$ ,  $\exists h \in \mathcal{H}$ , such that  $\forall i \in [n]$ ,  $h(x_i) = y_i$ . The VC dimension of  $\mathcal{H}$ , denoted  $\mathrm{VC}(\mathcal{H})$ , is defined as the largest natural number  $n \in \mathbb{N}$  such that there exists a set  $\{x_1, \dots, x_n\} \in \mathcal{X}$  that is shattered by  $\mathcal{H}$ .
One sufficient condition for proper learning, based on Vapnik's "General Learning" [Vapnik, 2006], is the finiteness of the VC dimension of a binary loss class
$$
\mathcal {L} ^ {\mathcal {H}} := \{(x, y) \mapsto \ell (h, (x, y)): h \in \mathcal {H} \}
$$
where  $\ell(h, (x, y))$  is some loss function mapping to  $\{0, 1\}$ . In particular, if the VC dimension of the loss class  $\mathcal{L}^{\mathcal{H}}$  is finite, then  $\mathcal{H}$  is PAC learnable with respect to  $\ell$  using ERM with sample complexity that scales linearly with  $\mathrm{VC}(\mathcal{L}^{\mathcal{H}})$ . In this sense, if one can upper bound  $\mathrm{VC}(\mathcal{L}^{\mathcal{H}})$  in terms of  $\mathrm{VC}(\mathcal{H})$ , then finite VC dimension is sufficient for proper learnability. Unfortunately, for adversariably robust learning, [Montasser et al. 2019] show that there can be an arbitrary gap between the VC dimension of the adversariably robust loss class  $\mathcal{L}_{\mathcal{G}}^{\mathcal{H}} := \{(x, y) \mapsto \ell_{\mathcal{G}}(h, (x, y)): h \in \mathcal{H}\}$  and the VC dimension of  $\mathcal{H}$ . Likewise, in Section 3 we show that for the  $\rho$ -probabilistically robust loss  $\ell_{\mathcal{G}, \mu}^{\rho}$ , there can also be an arbitrarily large gap between the VC dimension of the loss class and the VC dimension of the hypothesis class.
As many of the loss functions we consider will actually map to values in  $\mathbb{R}$ , the VC dimension of the loss class will not be well-defined. Instead, we can capture the complexity of the loss class via the empirical Rademacher complexity.
Definition 3 (Empirical Rademacher Complexity of Loss Class). Let  $\ell$  be a loss function,  $S = \{(x_1,y_1),\ldots ,(x_n,y_n)\} \in (\mathcal{X}\times \mathcal{Y})^*$  be any sequence of examples, and  $\mathcal{L}^{\mathcal{H}} = \{(x,y)\mapsto \ell (h,(x,y)): h\in \mathcal{H}\}$  be a loss class. The empirical Rademacher complexity of  $\mathcal{L}^{\mathcal{H}}$  is defined as
$$
\hat {\mathfrak {R}} _ {m} (\mathcal {L} ^ {\mathcal {H}}) = \mathbb {E} _ {\sigma} \left[ \sup  _ {f \in \mathcal {L} ^ {\mathcal {H}}} \left(\frac {1}{n} \sum_ {i = 1} ^ {m} \sigma_ {i} f (x _ {i}, y _ {i})\right) \right]
$$
where  $\sigma_{1},\ldots ,\sigma_{m}$  are independent Rademacher random variables.
A standard result relates the empirical Rademacher complexity to the generalization error of hypotheses in  $\mathcal{H}$  with respect to a real-valued bounded loss function  $\ell(h, (x, y))$  [Bartlett and Mendelson, 2002].
Theorem 2.1 (Rademacher-based Uniform Convergence). Let  $\mathcal{D}$  be a distribution over  $\mathcal{X} \times \mathcal{Y}$  and  $\ell(h, (x, y)) \leq c$  be a bounded loss function. With probability at least  $1 - \delta$  over the sample  $S \sim \mathcal{D}^m$ , for all  $h \in \mathcal{H}$  simultaneously,
$$
\left| \mathbb {E} _ {\mathcal {D}} [ \ell (h (x), y) ] - \hat {\mathbb {E}} _ {S} [ \ell (h (x), y) ] \right| \leq 2 \hat {\mathfrak {R}} _ {m} (\mathcal {F}) + O \left(c \sqrt {\frac {\ln \left(\frac {1}{\delta}\right)}{n}}\right)
$$
where  $\hat{\mathbb{E}}_S[\ell (h(x),y)] = \frac{1}{|S|}\sum_{(x,y)\in S}\ell (h(x),y)$  is the empirical average of the loss over  $S$ .
3 Not All Robust Loss Relaxations Enable Proper Learning
Recall the  $\rho$ -probabilistically robust loss
and its corresponding risk  $R_{\mathcal{G},\mu}^{\rho}(h;\mathcal{D}) \coloneqq \mathbb{E}_{(x,y)\sim \mathcal{D}}\left[\ell_{\mathcal{G},\mu}^{\rho}(h,(x,y))\right]$ . At a high-level, proper learning under the  $\ell_{\mathcal{G},\mu}^{\rho}$  requires finding a hypothesis  $h \in \mathcal{H}$  that is robust to at least a  $1 - \rho$  fraction of the perturbations in  $\mathcal{G}$  for each example in the support of the data distribution  $\mathcal{D}$ .
Which hypothesis classes are properly learnable with respect to  $\ell_{\mathcal{G},\mu}^{\rho}$  according to Definition 1? In Appendix B.1, we show that if  $\mathcal{G}$  is finite, then finite VC dimension is sufficient for proper learning with respect to  $\ell_{\mathcal{G},\mu}^{\rho}$ . On the other hand, in this section, we show that if  $\mathcal{G}$  is allowed to be arbitrary, VC dimension is not sufficient for proper learning with respect to  $\ell_{\mathcal{G},\mu}^{\rho}$ , let alone learning via ERM.
Theorem 3.1. There exists  $(\mathcal{G},\mu)$  such that for every  $\rho \in [0,1)$ , there exists a hypothesis class  $\mathcal{H}\subseteq \mathcal{V}^{\mathcal{X}}$  with  $\mathrm{VC}(\mathcal{H})\leq 1$  such that  $\mathcal{H}$  is not properly probabilistically robust PAC learnable with respect to  $\ell_{\mathcal{G},\mu}^{\rho}$ .
To prove Theorem 3.1, we fix  $\mathcal{X} = \mathbb{R}^d$ ,  $\mathcal{G} = \{g_{\delta} : \delta \in \mathbb{R}^d, ||\delta||_p \leq \gamma\}$  such that  $g_{\delta}(x) = x + \delta$  for all  $x \in \mathcal{X}$  for some  $\gamma > 0$ , and  $\mu$  to be the uniform measure over  $\mathcal{G}$ . In other words, we are picking our perturbation sets to be  $\ell_p$  balls of radius  $\gamma$  and our perturbation measures to be uniform over each perturbation set. Note that by construction of  $\mathcal{G}$ , a uniform measure  $\mu$  over  $\mathcal{G}$  also induces a uniform measure  $\mu_x$  over  $\mathcal{G}(x) := \{g_{\delta}(x) : g_{\delta} \in \mathcal{G}\} \subset \mathbb{R}^d$ . We start by showing that for every  $\rho \in [0,1)$ , there can be an arbitrary gap between the VC dimension of  $\mathcal{H}$  and the loss class  $\mathcal{L}_{\mathcal{G},\mu}^{\mathcal{H},\rho} := \{(x,y) \mapsto \ell_{\mathcal{G},\mu}^\rho(h, (x,y)) : h \in \mathcal{H}\}$ .
Lemma 3.2. For every  $\rho \in [0,1)$  and  $m\in \mathbb{N}$ , there exists a hypothesis class  $\mathcal{H}\subseteq \mathcal{V}^{\mathcal{X}}$  such that  $\mathrm{VC}(\mathcal{H})\leq 1$  but  $\mathrm{VC}(\mathcal{L}_{\mathcal{G},\mu}^{\mathcal{H},\rho})\geq m$ .
The proof of Lemma 3.2 is found in Appendix B.2. We highlight two key differences between Lemma 3.2 and its analog, Lemma 2, in Montasser et al. [2019]. First, we need to provide both a perturbation set and a perturbation measure. The interplay between these two objects is not present in Montasser et al. [2019] and, apriori, it is not clear that these would indeed be  $\ell_p$  balls and the uniform measure. Second, in order for a hypothesis to be probabilistically non-robust there needs to exist a large enough region of perturbations over which it makes mistakes. This is in contrast to Montasser et al. [2019], where a hypothesis is adversarially non-robust as long as there exists one non-robust perturbation. Constructing a hypothesis class that achieves all possible probabilistically robust loss behaviors while also having low VC dimension is non-trivial - we need hypotheses to be expressive enough to have large regions of non-robustness while not being too expressive such that VC dimension increases.
Next, we show that the hypothesis class construction in Lemma 3.2 can be used to show the existence of a hypothesis class that cannot be learned properly. Lemma 3.3 is similar to Lemma 3 in Montasser et al. [2019] and is proved in Appendix B.3.
Lemma 3.3. For every  $\rho \in [0,1)$  and  $m\in \mathbb{N}$  there exists  $\mathcal{H}\subseteq \mathcal{V}^{\mathcal{X}}$  with  $\mathrm{VC}(\mathcal{H})\leq 1$  such that for any proper learner  $\mathcal{A}:(\mathcal{X}\times \mathcal{Y})^{*}\to \mathcal{H}$ : (1) there is a distribution  $\mathcal{D}$  over  $\mathcal{X}\times \mathcal{Y}$  and a hypothesis  $h^*\in \mathcal{H}$  where  $R_{\mathcal{G},\mu}^{\rho}(h^{*};\mathcal{D}) = 0$  and (2) with probability at least  $1 / 7$  over  $S\sim D^{m}$ ,  $R_{\mathcal{G},\mu}^{\rho}(\mathcal{A}(S);\mathcal{D}) > 1 / 8$ .
Finally, the proof of Theorem 3.1 uses Lemma 3.3 and follows a similar idea as its analog in Montasser et al. [2019] (Theorem 1). However, since our hypothesis class construction in Lemma 3.2 is different, some subtle modifications need to be made. We include a complete proof in Appendix B.4.
4 Proper Learnability Under Relaxed Losses
Despite the fact that VC classes are not  $\rho$ -probabilistically robust learnable using proper learning rules, our framework still enables us to capture a wide range of relaxations to the adversarially robust loss for which proper learning is possible.
In particular, consider robust loss relaxations of the form  $\ell_{\mathcal{G},\mu}(h,(x,y)) = \ell (y\mathbb{E}_{g\sim \mu}[h(g(x)])$  where  $\ell (t):\mathbb{R}\to \mathbb{R}$  is a  $L$ -Lipschitz function. This class of loss functions is general, capturing many natural robust loss relaxations like the hinge loss  $1 - y\mathbb{E}_{g\sim \mu}[h(g(x))]$ , squared loss  $(y-$