Calibration and Consistency of Adversarial Surrogate Losses

1 Introduction . Complex multi-layer neural networks trained on large datasets have achieved a remarkable performance in several applications in recent years , in particular in speech and visual recognition tasks ( Sutskever et al. , 2014 ; Krizhevsky et al. , 2012 ) . However , these rich models are susceptible to imperceptible perturbations ( Szegedy et al. , 2013 ) . A complex neural network may , for example , misclassify a traffic sign , as a result of a minor variation , which may be the presence of a small advertisement sticker on the sign . Such misclassifications can have dramatic consequences in practice , for example with self-driving cars . These concerns have motivated the study of adversarial robustness , that is the design of classifiers that are robust to small ` p norm input perturbations ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Tsipras et al. , 2018 ; Carlini and Wagner , 2017 ) . The standard 0/1 loss is 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . then replaced with a more stringent adversarial loss , which requires a predictor to correctly classify an input point x and also to maintain the same classification for all points at a small ` p distance of x . But , can we devise efficient learning algorithms with theoretical guarantees for the adversarial loss ? Designing such robust algorithms requires resorting to appropriate surrogate losses since optimizing the adversarial loss is NP-hard for most hypothesis sets . A key property for surrogate adversarial losses is their consistency , that is , that exact or near optimal minimizers of the surrogate loss be also exact or near optimal minimizers of the original adversarial loss . The notion of consistency has been extensively studied in the case of the standard 0/1 loss or the multi-class setting ( Zhang , 2004 ; Bartlett et al. , 2006 ; Tewari and Bartlett , 2007 ; Steinwart , 2007 ) . However , those results or proof techniques can not be used to establish or characterize consistency in adversarial settings . This is because the adversarial loss of a predictor f at point x is inherently not just a function of f ( x ) but also of its values around a neighborhood of x . As we shall see , the study of consistency is significantly more complex in the adversarial setting , with subtleties that have in fact led to some inaccurate claims made in prior work that we discuss later . Consistency requires a property of the surrogate and the original losses to hold true for the family of all measurable functions . As argued by Long and Servedio ( 2013 ) , the notion of H-consistency , which requires a similar property for the surrogate and original losses , but with the near or optimal minimizers considered on the restricted hypothesis set H , is a more relevant and desirable property for learning . Long and Servedio ( 2013 ) gave examples of surrogate losses that are not H-consistent when H is the class of all measurable functions but that satisfy a realizable H-consistency condition when H is the class of linear functions . More recently , Zhang and Agarwal ( 2020 ) studied the notion of improper realizable H-consistency of linear classes where the surrogate φ can be optimized over a larger class , such as that of piecewise linear functions . Note that these studies only deal with the standard 0/1 classification loss . This motivates our main objective : an extensive study of the H-consistency of adversarial surrogate losses , which is critical to the design of robust algorithms with guarantees in this setting . A more convenient notion in the study of H-consistency is that of H-calibration , which is a related notion that involves conditioning on the input point . H-calibration often is a sufficient condition for H-consistency in the standard classification settings ( Steinwart , 2007 ) . However , the adversarial loss presents new challenges and requires carefully distinguishing among these notions to avoid drawing false conclusions . As an example , the recent COLT 2020 paper of Bao et al . ( 2020 ) presents a study of H-calibration for the adversarial loss in the special case where H is the class of linear functions . However , several comments are due regarding that work . See a detailed discussion in Appendix B . Our Contributions . We present a more systematic study of the H-calibration and H-consistency including for the case where H =Hall of adversarial surrogate losses . In Section 4 , we give a detailed analysis of the H-calibration properties of several natural surrogate losses . We present a series of new negative results showing that , under some general assumptions , convex loss functions and supremumbased convex losses , that are loss functions defined as the supremum over a ball of a convex function , which are those commonly used in applications , are not H-calibrated for common hypothesis sets used in machine learning . Next , we give a characterization of calibration and prove that a family of proposed surrogates are H-calibrated , with common hypothesis sets . These fix previous calibration results presented for the family of linear models in ( Bao et al. , 2020 ) and significantly generalize the results to the nonlinear hypothesis sets . In Section 5 , we study the H-consistency of surrogate loss functions . We prove that , in the absence of distributional assumptions , many surrogate losses shown to be H-calibrated in Section 4 are in fact not H-consistent . This , in particular , proves that a claim presented in a COLT 2020 publication is inaccurate . Next , in contrast , we show that when the minimum of the surrogate loss is achieved within H , under some general conditions , the ρ-margin ramp loss ( see , for example , ( Mohri et al. , 2018 ) ) is H-consistent for H being the linear hypothesis set , or any non-decreasing and continuous g-based hypothesis set , including the ReLU-based hypothesis set . We then give similar H-consistency guarantees for supremum-based surrogate losses based on a non-increasing auxiliary function , including the calibrated supremum-based ρ-margin ramp loss when H is any symmetric hypothesis set , e.g. , the multi-layer neural networks . In Section 6 , we further report a series of empirical results on simulated data , which show that many H-calibrated surrogate losses are indeed not H-consistent , and justify our conditions for consistency . Overall , our results imply that the loss functions commonly used in practice for optimizing the adversarial loss are not H-consistent and that minimizing such losses may not lead to a more favorable adversarial loss . This could be in fact the reason why the empirical results reported in the literature have not been favorable . Instead , we suggest alternative surrogate losses that we prove are H-consistent and that can be useful to the design of effective algorithms . We give a detailed discussion of related work in Appendix A . We start with basic concepts of calibration and consistency ( Section 2 ) and an introduction of robust classification ( Section 3 ) . 2 Preliminaries . We will denote vectors as lowercase bold letters ( e.g . x ) . The d-dimensional l2-ball with radius r is denoted by Bd2 ( r ) ∶= { z ∈ Rd ∣ ∥z∥2 ≤ r } . We denote by X the set of all possible examples . X is also sometimes referred to as the input space . The set of all possible labels is denoted by Y . We will limit ourselves to the case of binary classification where Y = { −1 , +1 } . Let H be a family of functions from Rd to R. Given a fixed but unknown distribution P over X×Y , the binary classification learning problem is then formulated as follows . The learner seeks to select a predictor f ∈ H with small generalization error with respect to the distribution P. The generalization error of a classifier f ∈H is defined byR ` 0 ( f ) = E ( x , y ) ∼P [ ` 0 ( f , x , y ) ] , where ` 0 ( f , x , y ) = 1yf ( x ) ≤0 is the standard 0/1 loss . More generally , the ` -risk of a classifier f for a surrogate loss ` ( f , x , y ) is defined by R ` ( f ) = E ( x , y ) ∼P [ ` ( f , x , y ) ] . ( 1 ) Moreover , the minimal ( ` , H ) -risk , which is also called the Bayes ( ` , H ) -risk , is defined byR∗ ` , H = inff∈HR ` ( f ) . In the standard classification setting , the goal of a consistency analysis is to determine whether the minimization of a surrogate loss ` can lead to that of the binary loss generalization error . Similarly , in adversarially robust classification , the goal of a consistency analysis is to determine if the minimization of a surrogate loss ` yields that of the adversarial generalization error defined by R ` γ ( f ) = E ( x , y ) ∼P [ ` γ ( f , x , y ) ] , where ` γ ( f , x , y ) ∶= sup x′∶∥x−x′∥≤γ 1yf ( x′ ) ≤0 ( 2 ) is the adversarial 0/1 loss . This motivates the definition of H-consistency . Definition 1 ( H-Consistency ) . Given a hypothesis set H , we say that a loss function ` 1 is Hconsistent with respect to a loss function ` 2 , if the following holds : R ` 1 ( fn ) −R∗ ` 1 , H n→+∞ÐÐÐ→ 0 Ô⇒ R ` 2 ( fn ) −R∗ ` 2 , H n→+∞ÐÐÐ→ 0 , ( 3 ) for all probability distributions and sequences of { fn } n∈N ⊂H . For a distribution P over X × Y with random variables X and Y , let ηP∶X→ [ 0,1 ] be a measurable function such that , for any x ∈ X , ηP ( x ) = P ( Y = 1 ∣ X = x ) . By the property of conditional expectation , we can rewrite ( 1 ) as R ` ( f ) = EX [ C ` ( f , x , ηP ( x ) ) ] , where C ` ( f , x , η ) is the inner ` -risk defined as followed : ∀x ∈ X , ∀η ∈ [ 0,1 ] , C ` ( f , x , η ) ∶= η ` ( f , x , +1 ) + ( 1 − η ) ` ( f , x , −1 ) . ( 4 ) Moreover , the minimal inner ` -risk on H is denoted by C∗ ` , H ( x , η ) ∶= inff∈H C ` ( f , x , η ) . For a margin-based loss φ , the generic conditional φ-risk is C̄φ ( t , η ) ∶= ηφ ( t ) + ( 1 − η ) φ ( −t ) for any η ∈ [ 0,1 ] and t ∈ R ( Bartlett et al. , 2006 ) . The notion of calibration for the inner risk is often a powerful tool for the analysis of H-consistency ( Steinwart , 2007 ) . Definition 2 ( H-Calibration ) . [ Definition 2.7 in ( Steinwart , 2007 ) ] Given a hypothesis set H , we say that a loss function ` 1 is H-calibrated with respect to a loss function ` 2 if , for any > 0 , η ∈ [ 0,1 ] , and x ∈ X , there exists δ > 0 such that for all f ∈H we have C ` 1 ( f , x , η ) < C∗ ` 1 , H ( x , η ) + δ Ô⇒ C ` 2 ( f , x , η ) < C ∗ ` 2 , H ( x , η ) + . ( 5 ) Steinwart ( 2007 ) points out that if ` 1 is H-calibrated wrt ` 2 , then H-consistency , that is condition ( 3 ) , holds for any probability distribution verifying the additional condition of minimizability ( Steinwart , 2007 , Definition 2.4 ) . Next , we introduce the notions of calibration function from ( Steinwart , 2007 ) . Definition 3 ( Calibration function ) . Given a hypothesis set H , we define the calibration function δmax for a pair of losses ( ` 1 , ` 2 ) as follows : for all x ∈ X , η ∈ [ 0,1 ] and > 0 , δmax ( , x , η ) = inf f∈H { C ` 1 ( f , x , η ) − C∗ ` 1 , H ( x , η ) ∣ C ` 2 ( f , x , η ) − C ∗ ` 2 , H ( x , η ) ≥ } . ( 6 ) For any x ∈ X , η ∈ [ 0,1 ] and > 0 , the calibration function gives the maximal δ satisfying the calibration condition ( 5 ) . The following proposition is an important result from ( Steinwart , 2007 ) . Proposition 4 ( Lemma 2.9 in ( Steinwart , 2007 ) ) . Given a hypothesis set H , loss ` 1 is H-calibrated with respect to ` 2 if and only if its calibration function δmax satisfies δmax ( , x , η ) > 0 for all x ∈ X , η ∈ [ 0,1 ] and > 0 . Since the concepts of calibration and consistency may not be familiar to readers without an extensive background in this area , we further comment on these notions before presenting our main results . Informally , a loss function is H-consistent if minimizing it results in a classifier whose generalization error is close to the minimal generalization error within H. Similarly , a loss function is H-calibrated if minimizing it results in a classifier whose inner ` 2-risk is close to the minimal inner ` 2-risk within H for each x ∈ X. H-calibration ( 5 ) is a necessary condition for H-consistency ( 3 ) , but is not always sufficient . As an example , we show in Section 5.1 that H-calibrated surrogate losses proposed in ( Bao et al. , 2020 ) are not H-consistent . For this reason , H-consistency , that is consistency for a particular hypothesis set H , is a difficult problem even in standard non-adversarial scenarios . When H is the family of all measurable functions , the notions of calibration and consistency with respect to the 0/1 loss have been widely studied in the literature to analyze the properties of margin-based losses ( Zhang , 2004 ; Bartlett et al. , 2006 ) . In this special case , calibration implies consistency . Steinwart ( 2007 ) further establishes a sufficient condition called minimizability under which H-calibration ( 5 ) implies H-consistency ( 3 ) . Note that the minimizability condition holds in ( Zhang , 2004 ; Bartlett et al. , 2006 ) . However , it does not hold in general in the adversarial scenario and thus analyzing H-consistency becomes much harder . To the best of our knowledge , our work is the first to prove H-consistency results for general hypothesis sets H , including for the case where H =Hall , in the context of adversarial classification . We conclude this section with an illustration of the connection between the notations of calibration and consistency in Figure 1 .

Summary: This paper focuses on the H-calibration and H-consistency of loss functions in terms of adversarial robustness. The authors claim that the reason for the difficulty in achieving the adversarial robustness is related to the current convex surrogate losses. Theoretically, they showed the limitation of H-calibration of convex loss functions and surrogate loss functions. Furthermore, they rejected the result from previous studies which provides the relationship between H-calibration and H-consistency, and found a condition that the relationship working correctly. They proposed a non-convex loss function to satisfy H-calibration and experimentally showed the advantages of the proposed loss.