SlowGuess/NeurIPS_2023_OCR huggingface dataset:
where  $\mathcal{H}_{vb}(x,y) \subseteq \mathcal{H}_b$  denotes the vulnerable subset and  $\mu^{\max}(x,y)$  the maximal simultaneous vulnerability of base classifiers  $\mathcal{H}_b$ , defined below.
$$
\mathcal {H} _ {v b} (x, y) = \left\{h \in \mathcal {H} _ {b}: \exists x _ {h} ^ {\prime} \in B _ {\epsilon} (x) \text {s u c h t h a t} h \left(x _ {h} ^ {\prime}\right) \neq y \right\},
$$
$$
\mathfrak {H} _ {s v b} (x, y) = \left\{\mathcal {H} ^ {\prime} \subseteq \mathcal {H} _ {b}: \exists x ^ {\prime} \in B _ {\epsilon} (x) \text {s u c h t h a t} \forall h \in \mathcal {H} ^ {\prime}, h \left(x ^ {\prime}\right) \neq y \right\},
$$
$$
\mu^{\max}(x,y) = \sup_{\mathcal{H}^{\prime}\in \mathfrak{H}_{svb}(x,y)}\mu (\mathcal{H}^{\prime}).
$$
If  $\pi_{\mathbf{h}_{\mu}}(x,y) > 0$ , we say that  $\mathbf{h}_{\mu}$  is in matching penny configuration at  $(x,y)$ .
For example, in Figure 1a,  $\pi_{\mathbf{h}_{\mu}}(x_0,y_0) = 1 - \max \{\mu (f_1),\mu (f_2)\} = \min \{\mu (f_1),\mu (f_2)\}$  where  $\mathcal{H}_b = \{f_1,f_2\}$ . The subset  $\mathcal{H}_{vb}(x,y)$  contains all classifiers that can be individually fooled by an
optimal attacker. The collection of subsets  $\mathfrak{H}_{svb}(x,y)$  contains all subsets  $\mathcal{H}'$  of classifiers that can be simultaneously fooled. Then,  $\mu^{\max}(x,y)$  is the maximum mass of classifiers that can be fooled simultaneously. Thus,  $\pi_{\mathbf{h}_\mu}(x,y)$  measures the gap between the mass of classifiers that are individually vulnerable and the maximum mass of classifiers that can be fooled with only one perturbation.
(a) A matching penny configuration at  $x_0$  with two deterministic classifiers  $f_1$  and  $f_2$  with  $f_1(x_0) = f_2(x_0) = y_0$ . In the top-left colored region,  $f_1(x) \neq y_0$ , and on the bottom-right colored region  $f_2(x) \neq y_0$  (vulnerability regions). Both  $f_1, f_2$  can be made to incur a loss of 1 at  $B_{\epsilon}(x_0)$  by separate perturbations, but not with the same perturbation.
(b) Binary classification example with discrete data distribution  $\frac{1}{2}\delta (x = x_1,y = 1) + \sum_{j = 2}^{4}\frac{1}{6}\delta (x = x_j,y = 0)$ . No linear classifier can attain adversarial risk better than  $\frac{1}{3}$  (attained by both  $f_{1}$  and  $f_{2}$ ). Any REC with  $\mu (f_1) = 1 - \mu (f_2)\in (0,1)$  achieves a strictly better risk. A REC with  $\mu (f_{1}) = \mu (f_{2}) = 1 / 2$  is optimal with risk  $\frac{1}{4}$ . See Appendix C.4 for details.
The following theorem strengthens Theorem 3.1 by showing that  $\mathcal{R}_{\epsilon}(\mathbf{h})$  is a strictly convex function if and only if there is a non-zero expected matching penny gap.
Theorem 3.2. For a probabilistic classifier  $\mathbf{h}_{\mu}:\mathcal{X}\to \mathcal{P}(\mathcal{Y})$  constructed from a BHS  $\mathcal{H}_b$  using any  $\mu \in \mathcal{P}(\mathcal{H}_b)$
$$
\mathcal {R} _ {\epsilon} \left(\mathbf {h} _ {\mu}\right) = \underset {h \sim \mu} {\mathbb {E}} \left[ \mathcal {R} _ {\epsilon} (h) \right] - \underset {(x, y) \sim \rho} {\mathbb {E}} \left[ \pi_ {\mathbf {h} _ {\mu}} (x, y) \right]. \tag {6}
$$
Proof sketch. By interchanging expectations over  $h \sim \mu$  and  $(x, y) \sim \rho$  and using the fact that  $\sup_{x' \in B_e(x)} \mathbb{1}\{h(x') \neq y\} = 1$  if and only if  $h \in \mathcal{H}_{vb}(x, y)$ , we first show the following.
$$
\underset {h \sim \mu} {\mathbb {E}} \left[ \mathcal {R} _ {\epsilon} (h) \right] = \underset {(x, y) \sim \rho} {\mathbb {E}} \left[ \mu \left(\mathcal {H} _ {v b} (x, y)\right) \right]. \tag {7}
$$
Arguing from the definition of  $\mu^{\max}(x,y)$ , we then show that  $\sup_{x' \in B_{\epsilon}(x)} \mathbb{E}_{h \sim \mu}[\mathbb{1}\{h(x') \neq y\}] = \mu^{\max}(x,y)$ . Taking expectation with respect to  $(x,y) \sim \rho$ , we get,
$$
\mathcal {R} _ {\epsilon} \left(\mathbf {h} _ {\mu}\right) = \underset {(x, y) \sim \rho} {\mathbb {E}} \left[ \mu^ {\max } (x, y) \right]. \tag {8}
$$
Combining (8) and (7) yields (6).
Figure 1: Toy examples demonstrating a strict gap in adversarial risk between deterministic and probabilistic classifiers (RECs).
The following corollary shows that a lower bound on the expected matching penny gap is both necessary and sufficient for a mixture to strictly outperform any deterministic classifier in  $\mathcal{H}_b$ .
Corollary 3.1. For  $\mu' \in \mathcal{P}(\mathcal{H}_b)$ ,  $\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu'}) < \inf_{h \in \mathcal{H}_b} \mathcal{R}_{\epsilon}(h)$  if and only if the following condition holds.
$$
\underset {(x, y) \sim \rho} {\mathbb {E}} \left[ \pi_ {\mathbf {h} _ {\mu^ {\prime}}} (x, y) \right] > \underset {h \sim \mu^ {\prime}} {\mathbb {E}} \left[ \mathcal {R} _ {\epsilon} (h) \right] - \inf  _ {h \in \mathcal {H} _ {b}} \mathcal {R} _ {\epsilon} (h) \tag {9}
$$
Additionally,  $\inf_{\mu \in \mathcal{P}(\mathcal{H}_b)}\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu}) < \inf_{h\in \mathcal{H}_b}\mathcal{R}_{\epsilon}(h)$  if and only if there exists  $\mu^{\prime}\in \mathcal{P}(\mathcal{H}_b)$  for which (9) holds.
Remark 2 (Multiple optimal classifiers in matching penny configuration). For finite  $\mathcal{H}_b$ , the assumption (9) of Corollary 3.1 holds whenever there exist two distinct optimal classifiers  $h_1^*, h_2^* \in \mathcal{H}_b$  with a positive expected matching penny gap. In such a case, the RHS of (9) is zero for any  $\mu$  that is a mixture of  $h_1^*, h_2^*$ . This is indeed the case in Figure 1b. More generally, assumption (9) holds if there is a subset of classifiers in a matching penny configuration that are "near optimal" on average. More details in Appendix C.3.
The following example depicts the scenario of Remark 2 in the extreme case in which there exist infinitely many distinct optimal classifiers in matching penny configuration, leading to the maximum possible advantage of using probabilistic classifiers.
Example 1 (Maximum expected matching penny gap of 1). Consider a discrete data distribution  $\rho = \delta(x = 0, y = 1)$  and a BHS composed of infinitely many linear classifiers,  $\mathcal{H}_b = \{h : h(x) = \mathbb{1}\{w^T x < 1\}, \| w\|_2 = \frac{1}{\epsilon}\}$  where  $\|\cdot\|_2$  is the Euclidean norm. Observe that every classifier in  $\mathcal{H}_b$  is vulnerable at  $(x, y) = (0, 1)$  and so  $\mathcal{R}_{\epsilon}(h) = 1$  for all  $h \in \mathcal{H}_b$ . However, no pair is simultaneously vulnerable. Hence,  $\pi_{\mathbf{h}_{\mu}}(x, y) = 1$  for any distribution  $\mu \in \mathcal{P}(\mathcal{H}_b)$  that is continuous over the entire support  $\mathcal{H}_b$ . By Theorem 3.2 we get that  $\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu}) = 0$  for any such  $\mu$ . Therefore, any such  $\mathbf{h}_{\mu}$  outperforms every  $h \in \mathcal{H}_b$ , and we have  $0 = \inf_{\mu \in \mathcal{P}(\mathcal{H}_b)} \mathcal{R}_{\epsilon}(\mathbf{h}_{\mu}) < \inf_{h \in \mathcal{H}_b} \mathcal{R}_{\epsilon}(h) = 1$ . More details on Appendix C.1.
Remark 3 (Probabilistic classifiers with zero matching penny gap are not useful). Suppose the expected matching penny gap  $\mathbb{E}_{(x,y)\sim \rho}[\pi_{\mathbf{h}_{\mu '}}(x,y)]$  is zero for some  $\mu^{\prime}\in \mathcal{P}(\mathcal{H}_b)$ . Then the left hand side of (9) is zero, whereas the right-hand side  $\mathbb{E}_{h\sim \mu '}[\mathcal{R}_{\epsilon}(h)] - \inf_{h\in \mathcal{H}_b}\mathcal{R}_{\epsilon}(h)$  is always non-negative. Hence, (9) does not hold and so  $\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu^{\prime}})\geq \inf_{h\in \mathcal{H}_b}\mathcal{R}_{\epsilon}(h)$ . Therefore, any such probabilistic classifier underperforms the best deterministic classifier in the base set  $\mathcal{H}_b$ .
The following example illustrates a scenario described in Remark 3, where we examine classifiers with decision boundaries that are parallel sets [23].
Example 2 (Minimum expected matching penny gap of  $0 / \text{Parallel decision boundaries}$ ). Fix any binary classifier  $h: \mathcal{X} \to \{0,1\}$  with non-empty decision region  $A_h = \{x \in \mathcal{X}: h(x) = 1\} \subset \mathcal{X} \subseteq \mathbb{R}^d$ . Let  $\mathcal{H}_b$  be composed of all classifiers whose decision regions are  $r$ -parallel sets of  $A_h$  defined as  $A_h^r = A_h \oplus B_r(0)$  where  $\oplus$  denotes the Minkowski sum, i.e.,  $\mathcal{H}_b = \{h : \exists r \geq 0 \text{ s.t. } A_h^r = \{x \in \mathcal{X}: h(x) = 1\}\}$ . Because of the parallel decision boundaries, whenever two classifiers in  $\mathcal{H}_b$  are vulnerable, they are simultaneously vulnerable, and never exhibit a matching penny configuration. Therefore,  $\mathbb{E}_{(x,y) \sim \rho}[\pi_{\mathbf{h}_\mu}(x,y)] = 0$  for any  $\mu \in \mathcal{P}(\mathcal{H}_b)$ . More details on Appendix C.2.
Application to RECs and Links with [13]. In the case of RECs where  $\mu = \sum_{m\in [M]}p_m\delta_{h_m}$  i.e.,  $\mathbf{h}_{\mu}$  is a mixture of  $M$  deterministic classifiers in  $\mathcal{H}_b = \{h_m\}_{m\in [M]}$ , we can instantiate Theorem 3.2 as follows. As the family  $\mathfrak{H}_{svb}(x,y)$  is finite, the supremum  $\mu^{\max}(x,y)$  is always attained by some subset of simultaneously vulnerable classifiers  $\mathcal{H}_{svb}^{\max}(x,y)$ . We can then write:
$$
\mathcal {R} _ {\epsilon} \left(\mathbf {h} _ {\mu}\right) = \sum_ {m \in [ M ]} p _ {m} \mathcal {R} _ {\epsilon} \left(h _ {m}\right) - p _ {m} \left[ \underset {(x, y) \sim \rho} {\mathbb {E}} \mathbb {1} \left\{h _ {m} \in \mathcal {H} _ {v b} (x, y) \backslash \mathcal {H} _ {s v b} ^ {\max } (x, y) \right\} \right] \tag {10}
$$
Alternatively, we can use (8) to write  $\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu}) = \sum_{m\in [M]}p_m\mathbb{E}_{(x,y)\sim \rho}\mathbb{1}\{h_m\in \mathcal{H}_{svb}^{max}(x,y)\}$ . At each  $(x,y)$ , testing whether  $h_m\in \mathcal{H}_{svb}^{max}(x,y)$  reduces to solving a combinatorial optimization problem, as noted in [13]. Any  $(x,y)$  falls into one of finitely many configurations, depending on which subset of classifiers are vulnerable or simultaneously vulnerable at  $(x,y)$ . Dbouk and Shanbhag [13] use this to derive upper and lower bounds on  $\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu})$ . Specifically, [13, Proposition 1] is equivalent to (8) for the special case of RECs. Also, [13, Theorem 1] can be proved as an application of Theorem 3.2 to RECs with  $M = 2$ . To establish the link, one must note that  $\mathbb{E}_{(x,y)\sim \rho}[\pi_{\mathbf{h}_{\mu '}}(x,y)] = \frac{1}{2}\rho (\{(x,y)\in R\})$  where  $R\subseteq \mathcal{X}\times \mathcal{Y}$  indicates the set of all points where  $h_1,h_2$  are in matching penny configuration.
4 From Probabilistic to Deterministic Classifiers
In this section, we prove that for any probabilistic binary classifier  $\mathbf{h}$ , there exists a deterministic classifier  $h$  in a "threshold" hypothesis set  $\mathcal{H}_T(\mathbf{h})$  with at least the same adversarial risk. In
Section 4.1 we present the main theorem and in Section 4.2 we apply the theorem to various classes of probabilistic classifiers.
4.1 Reducing a Probabilistic Classifier to a Deterministic One Through Threshold Classifiers
In the case of binary classification, i.e.  $\mathcal{V} = \{0,1\}$  any distribution  $\nu \in \mathcal{P}(\mathcal{V})$  is uniquely determined by a scalar  $\alpha = \nu(y = 1) \in [0,1]$ . Hence, any probabilistic binary classifier is identified with a function  $\mathbf{h}: \mathcal{X} \to [0,1]$ , where  $\mathbf{h}(x) = \nu(y = 1|x) \in [0,1]$ . Accordingly,  $\ell^{0-1}((x,0),\mathbf{h}) = \mathbf{h}(x)$  and  $\ell^{0-1}((x,1),\mathbf{h}) = 1 - \mathbf{h}(x)$ .
Given a probabilistic binary classifier  $\mathbf{h}:\mathcal{X}\to [0,1]$  and a threshold  $\alpha \in [0,1]$ , the  $\alpha$ -threshold classifier  $h^\alpha :\mathcal{X}\rightarrow \{0,1\}$  is defined as  $h^\alpha (x) = \mathbb{1}\{\mathbf{h}(x) > \alpha \}$ , and the threshold hypothesis set (THS) of  $\mathbf{h}$  is given by  $\mathcal{H}_T(\mathbf{h}) = \{h^\alpha \}_{\alpha \in [0,1]}$ . In Theorem 4.1 we show that there exists  $h^{\alpha_{*}}\in \mathcal{H}_{T}(\mathbf{h})$  such that  $\mathcal{R}_{\epsilon}(h^{\alpha_{*}})\leq \mathcal{R}_{\epsilon}(\mathbf{h})$ . The following lemma plays a crucial role in proving Theorem 4.1.
Lemma 4.1. Let  $\mathbf{h}:\mathcal{X}\to [0,1]$  be any measurable function. For any  $\succ \in \{>,\geq \}$ , the following inequality holds, and it becomes an equality if  $\mathbf{h}$  is continuous or takes finitely many values:
$$
\mathbb {1} \left\{\left. \sup  _ {x ^ {\prime} \in B _ {\epsilon} (x)} \mathbf {h} \left(x ^ {\prime}\right)\right) \succ \alpha \right\} \geq \sup  _ {x ^ {\prime} \in B _ {\epsilon} (x)} \mathbb {1} \left\{\mathbf {h} \left(x ^ {\prime}\right) \succ \alpha \right\} \tag {11}
$$
Note that Lemma 4.1 is a generalization of the layer-cake representation of  $\mathbf{h}(x)$  given by,
$$
\mathbf {h} (x) = \int_ {0} ^ {1} \mathbb {1} \{\mathbf {h} (x) > \alpha \} d \alpha = \int_ {0} ^ {1} \mathbb {1} \{\mathbf {h} (x) \geq \alpha \} d \alpha .
$$
Theorem 4.1. Let  $\mathbf{h}:\mathcal{X}\to [0,1]$  be any probabilistic binary classifier. Let  $h^\alpha$  be the  $\alpha$ -threshold classifier. Then the following equation holds:
$$
\mathcal {R} _ {\epsilon} (\mathbf {h}) \geq \int_ {0} ^ {1} \mathcal {R} _ {\epsilon} \left(h ^ {\alpha}\right) d \alpha \geq \inf  _ {\alpha} \mathcal {R} _ {\epsilon} \left(h ^ {\alpha}\right). \tag {12}
$$
Further, if  $\mathbf{h}$  is either continuous or takes finitely many values, the first inequality in (12) becomes an equality.
Note that  $\mathbf{h}$  takes finitely many values in the case of RECs, and  $\mathbf{h}$  is continuous in the case of INCs and WNCs whenever the noise distribution admits a density. Hence,  $R_{\epsilon}(\mathbf{h}) = \int_0^1\mathcal{R}_{\epsilon}(h^\alpha)d\alpha$  in all these cases.
Remark 4. Theorem 4.1 says that in the binary case  $(\mathbf{K} = 2)$ , if one is able to consider complex enough hypotheses sets that contain the  $\mathcal{H}_T(\mathbf{h})$ , then randomization is not necessary because there is a deterministic classifier with equal or better adversarial risk.
It was very recently shown with a toy example [45, Section 5.2] that Theorem 4.1 does not hold in the multi-class case  $K > 2$ . This example shows that even when the family of probabilistic classifiers considered is very general (all Borel measurable functions), simple data distributions can create a situation in which the optimal classifier is probabilistic, and there is no optimal deterministic classifier. In other words, there is a strict gap in adversarial risk between the best deterministic classifier and the best probabilistic one.
4.2 Applications: Connections to Weighted Ensembles and Randomized Smoothing
In this section, we apply Theorem 4.1 to probabilistic classifiers presented in Section 2.3.
RECs. When  $\mu = \sum_{m\in [M]}p_m\delta_{h_m}$  and  $\mathcal{V} = \{0,1\}$ , the REC  $\mathbf{h}_{\mu}$  can be written as  $\mathbf{h}_{\mu}(x) = \sum_{m = 1}^{M}p_{m}h_{m}(x)$ . Let us introduce the constant classifier  $h_0(x) = 1$  for all  $x$ , and  $p_0 = -\alpha$ . Then  $h^\alpha (x) = \mathbb{1}\{\sum_{m = 1}^K p_m h_m(x) > \alpha \} = \mathbb{1}\{\sum_{m = 0}^M p_m h_m(x) > 0\}$ . This shows that  $h^\alpha$  is a weighted ensemble, such as those that the boosting algorithm can learn [17].
Further, a REC  $\mathbf{h}$  built with  $M$  base binary classifiers can take at most  $p \leq 2^M$  distinct values, corresponding to all possible partial sums of the weights  $p_m$ . Let  $0 = r_1 \leq \ldots \leq r_p = 1$  be
the possible values. Then, for any  $\alpha \in [r_i,r_{i + 1})$ ,  $h^\alpha = h^{r_i}$ . Applying Theorem 4.1 yields,
$$
\mathcal {R} _ {\epsilon} (\mathbf {h}) = \int_ {0} ^ {1} \mathcal {R} _ {\epsilon} \left(h ^ {\alpha}\right) d \alpha = \sum_ {i = 1} ^ {p - 1} \int_ {r _ {i}} ^ {r _ {i + 1}} \mathcal {R} _ {\epsilon} \left(h ^ {r _ {i}}\right) d \alpha = \sum_ {i = 1} ^ {p - 1} \left(r _ {i + 1} - r _ {i}\right) \mathcal {R} _ {\epsilon} \left(h ^ {r _ {i}}\right) \tag {13}
$$
Equation (13) shows that the THS  $\mathcal{H}_T(\mathbf{h}) = \{h^\alpha\}_{\alpha \in [0,1]}$  is composed of at most  $p \leq 2^M$  distinct classifiers, each of which is in turn a weighted ensemble. In case of uniform weights i.e.  $p_m = \frac{1}{M}$ , there are only  $M$  distinct weighted ensembles in  $\mathcal{H}_T(\mathbf{h})$ .
INCs. Let  $h_{\eta}: \mathcal{X} \to \{0,1\}$  be the deterministic binary classifiers created from a base classifier  $h$ , as defined in Section 2.3. The probabilistic classifier  $\mathbf{h}_{\mu}$  is defined as  $\mathbf{h}_{\mu}(x) = \mathbb{P}_{\eta \sim \mu}(h(x + \eta) = 1)$ . Thus, the  $\alpha$ -threshold classifier takes a similar form to the well-known classifier obtained by randomized smoothing.
$$
h ^ {\alpha} (x) = \mathbb {1} \left\{\underset {\eta \sim \mu} {\mathbb {P}} \left(h (x + \eta) = 1\right) > \alpha \right\}. \tag {14}
$$
Randomized smoothing was first introduced in [26] and refined in [8, 27, 42] as a way to create classifiers that are certifiably robust. Given a deterministic classifier  $h: \mathcal{X} \to \mathcal{Y}$  and a noise distribution  $\mu \in \mathcal{P}(\mathcal{X})$ , the smoothed model will output a prediction according to the following rule:
$$
h _ {R S (\mu)} (x) = \underset {y \in \mathcal {Y}} {\operatorname {a r g m a x}} \mathbb {P} _ {\eta \sim \mu} (h (x + \eta) = y) = \mathbb {1} \left\{\mathbb {P} _ {\eta \sim \mu} (h (x + \eta) = 1) > \frac {1}{2} \right\} \tag {15}
$$
In other words, Equation (14) generalizes the randomized smoothing classifier in the binary case by replacing the  $\frac{1}{2}$  threshold by  $\alpha$ . Theorem 4.1 then states that for any INC, there exists a deterministic randomized smoothing classifier with threshold  $\alpha$  that is at least as robust.
5 Families of Binary Classifiers for Which Randomization Does not Help
In Sections 3 and 4, we discussed two types of hypothesis sets for binary classification: 1) base set  $\mathcal{H}_b$  from which a probabilistic classifier is built using some  $\mu \in \mathcal{P}(\mathcal{H}_b)$ , and 2) threshold set  $\mathcal{H}_T(\mathbf{h})$  which is built from a base probabilistic classifier  $\mathbf{h}$ . Recapitulating this two-step process, one may define the completion of a base set  $\mathcal{H}_b$  of binary classifiers w.r.t. a set of probability distributions  $\mathcal{M} \subseteq \mathcal{P}(\mathcal{H}_b)$  as,  $\overline{\mathcal{H}_b}(\mathcal{M}) = \cup_{\mu \in \mathcal{M}} \mathcal{H}_T(\mathbf{h}_\mu)$ . Observe that  $\mathcal{H}_b \subseteq \overline{\mathcal{H}_b}(\mathcal{P}(\mathcal{H}_b))$ . In the following theorem, we show that if  $\mathcal{H}_b = \overline{\mathcal{H}_b}(\mathcal{M})$ , then probabilistic binary classifiers built from  $\mathcal{H}_b$  using any  $\mu \in \mathcal{M}$  do not offer robustness gains compared to the deterministic classifiers in  $\mathcal{H}_b$ .
Theorem 5.1. If  $\mathcal{H}_b = \overline{\mathcal{H}_b} (\mathcal{M})$  and  $\delta_h\in \mathcal{M}$  for all  $h\in \mathcal{H}_b$ , then  $\inf_{h\in \mathcal{H}_b}\mathcal{R}_{\epsilon}(h) = \inf_{\mu \in \mathcal{M}}\mathcal{R}_{\epsilon}(\mathbf{h}_{\mu})$ .
$$
\inf  _ {h \in \overline {{\mathcal {H} _ {b}}} (\mathcal {M})} \mathcal {R} _ {\epsilon} (h) = \inf  _ {\mu \in \mathcal {M}} \inf  _ {h \in \mathcal {H} _ {T} \left(\mathbf {h} _ {\mu}\right)} \mathcal {R} _ {\epsilon} (h) \leq \inf  _ {\mu \in \mathcal {M}} \mathcal {R} _ {\epsilon} \left(\mathbf {h} _ {\mu}\right) \leq \inf  _ {h \in \mathcal {H} _ {b}} \mathcal {R} _ {\epsilon} (h), \tag {16}
$$
where the first inequality follows from Theorem 4.1 and the second by considering  $\mu = \delta_h$  for any  $h\in \mathcal{H}_b$ . The desired conclusion follows by observing that the first and last terms in (16) are identical from the assumption  $\mathcal{H}_b = \overline{\mathcal{H}_b} (\mathcal{M})$ .
A trivial example where the assumptions of Theorem 5.1 hold is when  $\mathcal{H}_b$  is the set of all measurable functions  $h: \mathcal{X} \to \{0,1\}$ . Such a  $\mathcal{H}_b$  is commonly used in the study of optimal adversarial risk [2, 40]. In the following corollary, we show that the assumptions of Theorem 5.1 also hold in the case of RECs built using  $\mathcal{H}_b$  that satisfy a "closure" property.
Corollary 5.1. Let  $\mathcal{H}_b$  be any family of deterministic binary classifiers. Let  $\mathcal{M} = \mathcal{P}_M(\mathcal{H}_b) \subset \mathcal{P}(\mathcal{H}_b)$  be the subset of probability measures over  $\mathcal{H}_b$  defining RECs as in Section 2.3. Let  $\mathcal{A} = \{h^{-1}(1): h \in \mathcal{H}_b\}$ . If  $\mathcal{A}$  is closed under union and intersection, then
$$
\inf  _ {h \in \mathcal {H} _ {b}} \mathcal {R} _ {\epsilon} (h) = \inf  _ {\mu \in \mathcal {P} _ {M} (\mathcal {H} _ {b})} \mathcal {R} _ {\epsilon} (\mathbf {h} _ {\mu}).
$$
Remark 5 (Implications on the optimal adversarial classifier). Pydi and Jog [40, Theorem 8] show the existence of a binary deterministic classifier attaining the minimum adversarial risk over the space of all Lebesgue measurable classifiers in  $\mathbb{R}^d$ . Awasthi et al. [2, Theorem 1] prove a similar result over the space of universally measurable classifiers in  $\mathbb{R}^d$ . For both these families the assumptions of Theorem 5.1 hold for  $\mathcal{M} = \mathcal{P}(\mathcal{H}_b)$ , and so probabilistic classifiers offer no additional advantage over deterministic ones. Further, suppose  $\mathcal{H}^*$  is a finite subset of classifiers achieving optimal adversarial risk. Then by Theorem 3.2, for any  $\mu \in \mathcal{P}(\mathcal{H}^*)$ , the expected matching penny gap for  $\mathbf{h}_{\mu}$  must be zero, otherwise we could strictly improve the adversarial risk by considering the mixture built using  $\mu$ . In other words, any pair of optimally robust binary deterministic classifiers in the settings of [2, 40] can only be in a matching penny configuration on a null subset  $E \subset \mathcal{X} \times \mathcal{Y}$ .
In this paper, we have studied the robustness improvements brought by randomization. First, we studied the situation in which one expands a base family of classifiers by considering probability distributions over it. We showed that under some conditions on the data distribution and the configuration of the base classifiers, such a probabilistic expansion could offer gains in adversarial robustness (See Corollary 3.1), characterized by the matching penny gap. These results generalize previous work that focused on RECs [13]. Next, we showed that for any binary probabilistic classifier, there is always another deterministic extension with classifiers of comparable or better robustness. This result is linked with the existence results in [2, 40]. As a direct consequence of this result, we show that in the binary setting, deterministic weighted ensembles are at least as robust as randomized ensembles and randomized smoothing is at least as robust as noise injection.
There are many avenues for future research.
Improving the Matching Penny Gap. An interesting direction would be finding tighter bounds on the matching penny gap for particular and widely used probabilistic classifiers like RECs, INCs and WNCs. It would be interesting to establish the conditions under which each method can offer robustness gains, and to quantify those gains in terms of parameters such as the strength of the noise injected or the number of classifiers in the REC.
Studying the Threshold Hypothesis Sets. We have seen in Section 4.2 that different probabilistic classifiers induce different THS. In particular, we showed the THS corresponding to RECs and INCs. It would be useful to formally describe the THS induced by other popular families of probabilistic classifiers in the literature. It would also be useful to quantify the complexity gap between the initial  $\mathcal{H}_b$  and the THS to understand the risk-complexity trade-off we would have to incur.