Corruption Robust Active Learning

1 Introduction . An active learning algorithm for binary classification aims to obtain the best hypothesis ( classifier ) from some given hypothesis set while requesting as few labels as possible . Under some favorable conditions , active learning algorithms can require exponentially fewer labels then passive , random sampling [ Hanneke , 2014 ] . Active learning is ideally suited for applications where large datasets are required for accurate inference , but the cost of paying human annotators to label a dataset is prohibitively large [ Joshi et al. , 2009 , Yang et al. , 2015 , Beluch et al. , 2018 ] . A bit more formally , for an example space X ( such as a set of images ) and label space { 0 , 1 } ( like whether the image contains a human-made object or not ) , let H be a hypothesis class such that for each h ∈ H , we have h : X → { 0 , 1 } . After a certain number of labels are requested , the learner will output a target hypothesis hout ∈ H. In this paper , we consider the streaming setting where at each time t nature reveals xt ∼ DX and an active learning algorithm must make the real-time decision on whether to request the corresponding label yt or not . Such a streaming setting of active learning is frequently encountered in online environments such as learning a spam filter or fraud detection ( i.e. , mark as spam/fraudulent and do not request the label , or send to inbox/expert to obtain a label ) . This paper is interested in a setting when the requested label yt is potentially corrupted by an adversary . That is , when requesting the label for some example xt ∈ X , if uncorrupted the learner will receive a label drawn according to the “ true ” conditional label distribution , but if corrupted , the learner will receive a label drawn from an arbitrary distribution decided by an adversary . This setting is challenging because the learner has no a priori knowledge of when or how many corruptions will occur . And if the learner is collecting data adaptively , he may easily be misled into becoming confident in an incorrect belief , collect data based on that belief , and never recover to output an accurate classifier even if the adversary eventually stops serving corrupted labels later . This greatly contrasts with the passive setting ( when all labels are observed ) where as long as the number of 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . corrupts grows sub-linearly over time , the effect of the corruptions will fade and the empirical risk minimizer will converge to an accurate classifier with respect to the uncorrupted labels . The source of corruptions can come from automatic labeling , non-expert labeling , and , mostly severely , adaptive data poisoning adversaries . Particularly , with the rise of crowdsourcing , it is increasingly feasible for such malicious labelers to enter the system ( Miller et al . [ 2014 ] , Awasthi et al . [ 2014 ] ) . There have been many prior works that consider robust offline training using corrupted labels ( i.e. , the passive setting ) [ Hendrycks et al. , 2018 , Yu et al. , 2019 ] . Correspondingly , related corruption settings have also been considered in online learning [ Gupta et al. , 2019 , Zimmert and Seldin , 2019 , Wei et al. , 2020 ] and reinforcement learning [ Lykouris et al. , 2020 , Chen et al. , 2021a , Wei et al. , 2021 ] . However , there is a striking lack of such literature in the active learning area . Existing disagreement-based active learning algorithms nearly achieve the minimax label complexity for a given target accuracy when labels are trusted [ Hanneke , 2014 ] , but they fail to deal with the case where the labels are potentially corrupted . Our contributions : In this paper , we study active learning in the agnostic , streaming setting where an unknown number of labels are potentially corrupted by an adversary . We begin with the performance of existing baseline algorithms . • Firstly , we analyze the performance of empirical risk minimization ( ERM ) for the passive setting where all labels are observed , which will output an ( ε+ R ∗Ctotal n ) -optimal hypothesis as long as n ' 1 + R∗ ε2 , where R ∗ is the risk of best hypothesis . This result serves as a benchmark for the following active learning results ( Section 3 ) . If we assume that the disagreement coefficient , a quantity that characterizes the sample complexity of active learning algorithms [ Hanneke , 2014 ] , is some constant , then we obtain the following results for active learning . • Secondly , we analyze the performance of a standard active learning algorithm called RobustCAL [ Balcan et al. , 2009 , Dasgupta et al. , 2007 , Hanneke , 2014 ] under a benign assumption on the corruptions ( misspecification model is a special case under that assumption ) .We show that , by slightly enlarging the hypothesis elimintion threshold , this algorithm can achieve almost the same label complexity as in the non-corrupted setting . That is , the algorithm will output an O ( ε + R ∗Ctotal n ) -optimal hypothesis as long as n ' R∗ ε2 + 1 ε with at most Õ ( R∗n+ log ( n ) ) number of labels ( Section 4 ) . • Finally and most importantly , in the general corruption case without any assumptions on how corruptions allocated , we propose a new algorithm that matches RobustCAL in the non-corrupted case and only requires Õ ( Ctotal ) additional labels in the corrupted setting . That is , the algorithm will output an ( ε+ Ctotaln ) -optimal hypothesis as long as n ' 1ε2 with at most Õ ( ( R∗ ) 2n+ log ( n ) + Ctotal ) number of labels . Besides , this algorithm also enjoys an improved bound under a benign assumption on the corruptions . That is , the algorithm will output an ( ε+ R ∗Ctotal n ) -optimal hypothesis with at most Õ ( ( R∗ ) 2n+ log ( n ) +R∗Ctotal ) number of labels ( Section 5 ) Note that Ctotal can be regarded as a fixed budget or can be increasing with incoming samples . In the latter case , Ctotal in the second and third result can be different since they may require different n. Detailed comparison between these two results will be discussed in corresponding sections . Related work : For nearly as long as researchers have studied how well classifiers generalize beyond their performance on a finite labelled dataset , they have also been trying to understand how to minimize the potentially expensive labeling burden . Consequently , the field of active learning that aims to learn a classifier using as few annotated labels as possible by selecting examples sequentially is also somewhat mature [ Settles , 2011 , Hanneke , 2014 ] . Here , we focus on just the agnostic , streaming setting where there is no relationship assumed a priori between the hypothesis class and the example-label pairs provided by Nature . More than a decade ago , a landmark algorithm we call RobustCAL was developed for the agnostic , streaming setting and analyzed by a number of authors that obtains nearly minimax performance [ Balcan et al. , 2009 , Dasgupta et al. , 2007 , Hanneke , 2014 ] . The performance of RobustCAL is characterized by a quantity known as the disagreement coefficient that can be large , but in many favorable situations can be bounded by a constant θ∗ which we assume is the case here . In particular , for any > 0 , once Nature has offered RobustCAL n unlabelled samples , RobustCAL promises to return a classifier with error at most √ R∗ log ( |H| ) /n+log ( |H| ) /n and requests just nR∗ + θ∗ ( √ nR∗ log ( |H| ) + log ( |H| ) ) labels with high probability . Said another way , RobustCAL returns an -good classifier after requesting just θ∗ ( ( R∗ ) 2/ 2 + log ( 1/ ) ) labels . If θ is treated as an absolute constant , this label complexity is minimax opitmal [ Hanneke , 2014 ] . While there exist algorithms with other favorable properties and superior performance under special distributional assumptions ( c.f. , Zhang and Chaudhuri [ 2014 ] , Koltchinskii [ 2010 ] , Balcan et al . [ 2007 ] , Balcan and Long [ 2013 ] , Huang et al . [ 2015 ] ) , we use RobustCAL as our benchmark in the uncorrupted setting . We note that since RobustCAL is computationally inefficient for many classifier classes of interest , a number of works have addressed the issue at the cost of a higher label sample complexity [ Beygelzimer et al. , 2009 , 2010 , Hsu , 2010 , Krishnamurthy et al. , 2017 ] or higher unlabeled sample complexity [ Huang et al. , 2015 ] . Our own work , like RobustCAL , is also not computationally efficient but could benefit from the ideas in these works as well . To the best of our knowledge , there are few works that address the non-IID active learning setting , such as the corrupted setting of this paper . Nevertheless , Miller et al . [ 2014 ] describes the need for robust active learning algorithms and the many potential attack models . While some applied works have proposed heuristics for active learning algorithms that are robust to an adversary [ Deng et al. , 2018 , Pi et al. , 2016 ] , we are not aware of any that are provably robust in the sense defined in this paper . Active learning in crowd-sourcing settings where labels are provided by a pool of a varying quality of annotators , some active learning algorithms have attempted to avoid and down-weight poorly performing annotators , but these models are more stochastic than adversarial [ Khetan and Oh , 2016 ] . The problem of selective sampling or online domain adaptation studies the setting where P ( Yt = 1|Xt = x ) remains fixed , but P ( Xt = x ) drifts and the active learner aims to compete with the best online predictor that observes all labels [ Yang , 2011 , Dekel et al. , 2012 , Hanneke and Yang , 2021 , Chen et al. , 2021b ] . Another relevant line of work considers the case where the distribution of the examples drifts over time ( i.e. , P ( Xt = x ) ) [ Rai et al. , 2010 ] or the label proportions have changed ( i.e , P ( Yt = 1 ) ) [ Zhao et al. , 2021 ] , but the learner is aware of the time when the change has occurred and needs to adapt . These setting are incomparable to our own . Despite the limited literature in active learning , there have been many existing corruption-related works in the related problem areas of multi-arm bandits ( MAB ) , linear bandits and episodic reinforcement learning . To be specific , for MAB , Gupta et al . [ 2019 ] achieves Õ ( ∑ a6=a∗ 1 ∆a +KC ) by adopting a sampling strategy based on the estimated gap instead of eliminating arms permanently . Our proposed algorithm is inspired by this “ soft elimination '' technique and requests labels based on the estimated gap of each hypothesis . Later , Zimmert and Seldin [ 2019 ] achieves a near-optimal result Õ ( ∑ a6=a∗ 1 ∆a + √∑ a6=a∗ C ∆a ) in MAB by using Follow-the-Regularized Leader ( FTRL ) with Tsallis Entropy . How to apply the FTRL technique in active learning , however , remains an open problem . Besides MAB , Lee et al . [ 2021 ] achieves Õ ( GapComplexity + C ) in stochastic linear bandits . We note that the linear bandits papers of Lee et al . [ 2021 ] and Camilleri et al . [ 2021 ] both leverage the Catoni estimator that we have repurposed for robust gap estimation in our algorithm . Finally , in the episodic reinforcement learning , Lykouris et al . [ 2020 ] achieves Õ ( C · GapComplexity + C2 ) in non-tabular RL and Chen et al . [ 2021a ] achieves Õ ( PolicyGapComplexity + C2 ) in tabular RL . Very recently , Wei et al . [ 2021 ] obtains an GapComplexity + C bounds for linear MDP .

Summary: This paper considers active learning with an "oblivious adversarial model": before the start of learning, an adversarial chooses a series of distributions $P_t(Y\mid X)$ , and at time t the label $Y$ would be drawn from that distribution. The adversarial level is characterized by $C_{total}=\sum_t \sup_x |P_t(Y\mid X=x)-P(Y\mid X=x)|$ where $P(Y\mid X=x)$ is the distribution over which the error for the model is calculated.   It first shows an error bound for passive learning with ERM. Then, it shows a slightly modified version of CAL (disagreement based active learning) could tolerate around $C_{total} <= n/8$ and achieve an error of $R^* + \epsilon + O(R^* C_{total}/n)$ where R* is the best error achievable without corruption and n is the number of unlabeled samples. Its label complexity is similar to that of the original CAL.   To tolerate any level of adversarial, instead of shrinking the version space permanently, it proposes a new algorithm that queries examples with some carefully designed probabilities. It gives its label complexity bounds, and shows that (1) its label complexity matches standard CAL without corruption; (2) it can tolerate higher corruption ($C_{total}>n/8$) while the previous modified CAL cannot; (3) its label complexity is slightly worse when the adversarial corruption is not high (e.g. the mispecification case where the probability that the adversarial corrupts the label in each round is uniformly upper bounded).