On the Existence of The Adversarial Bayes Classifier

1 Introduction . A key problem with using neural networks is their susceptibility to small perturbations : imperceptible changes to the input at test time may result in an incorrect classification by the network ( Szegedy et al. , 2013 ) . A slightly perturbed picture of a dog could be misclassified as a hand-blower . The same phenomenon appears with other types of data such as biosequences , text , or speech . This problem has motivated a series of research publications studying the design of adversarially robust algorithms , both from an empirical and a theoretical perspective ( Szegedy et al. , 2013 ; Biggio et al. , 2013 ; Madry et al. , 2017 ; Schmidt et al. , 2018 ; Athalye et al. , 2018 ; Bubeck et al. , 2018b ; Montasser et al. , 2019 ) . In the context of classification problems , instead of the standard zero-one loss , an adversarial zero-one loss has been adopted which penalizes a classifier not only if it misclassifies an input x but also if it does not maintain the correct x-label in a ϵ-neighborhood around x ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Tsipras et al. , 2018 ; Carlini and Wagner , 2017 ) . Since optimizing the adversarial zero-one loss is computationally intractable , a common approach for adversarial learning is to use a surrogate loss instead . However , optimizing a surrogate loss over a class of functions may not always lead to a minimizer of the true underlying loss over that class . In the case of the standard zero-one loss , there is a large body of literature identifying conditions under which surrogate losses are consistent , that is , minimizing them over the family of all measurable functions leads to minimizers of the true loss ( Zhang , 2004 ; Bartlett et al. , 2006 ; Steinwart , 2005 ; Lin , 2004 ) . More precisely , as argued by Long and Servedio ( 2013 ) , it is in fact H-consistency that is needed , which is consistency restricted to the hypothesis set under consideration . A surrogate loss may be consistent for the family of all measurable functions but not for the specific family of functions H , and a surrogate loss can be H-consistent for a particular family H , without being consistent for all measurable functions . When are adversarial surrogate losses H-consistent ? This problem is already non-trivial for the standard zero-one loss : while there are well-known results for the consistency of losses for the zero- 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . one loss such as ( Bartlett et al. , 2006 ; Steinwart , 2005 ) , these results do not hold for H-consistency . Existing theoretical results for H-consistency assume that the Bayes risk is zero ( Long and Servedio , 2013 ; Zhang and Agarwal , 2020 ) . A similar situation seems to hold for the more complex case of the adversarial loss . Recently , Awasthi et al . ( 2021 ) gave a detailed study of H-calibration and H-consistency of surrogates to the adversarial loss and also pointed out some technical issues with some H-consistency claims made in prior work ( Bao et al. , 2020 ) . These authors presented a number of negative results for adversarial H-consistency and positive results for some surrogate losses which assume realizability . For these positive results , the zero Bayes adversarial loss seems necessary . In fact , the authors show empirically that without the realizability assumption , H-consistency does not hold for a variety of surrogate losses , even when they are H-calibrated . But when is the Bayes adversarial loss zero ? Clearly , the adversarial risk can only be zero if it admits a minimizer , which we call the adversarial Bayes classifier . However , it is unclear under what conditions such a classifier exists . This is the primary theoretical question that we study in this work . We now describe the challenges involved in finding minimizers of the adversarial zero-one loss . Most of the existing work on the study of Bayes optimal classifiers focuses on loss functions such as the zero-one loss that admit the pointwise optimality property ( Steinwart , 2005 ; Steinwart et al. , 2006 ) . To illustrate this better , consider the case of binary classification where on a given input x , η ( x ) denotes the conditional class probability , that is , η ( x ) : = P ( y = 1 | x ) . In this case , it is well-known that the Bayes optimal classifier can be obtained by making optimal predictions per point in the domain : at a point x predict 1 if η ( x ) ≥ 12 , −1 otherwise . Similar to the notion of a Bayes optimal classifier , an adversarial Bayes optimal classifier is the one that minimizes the adversarial loss . However , an immediate obstacle is that the pointwise optimality property does not hold for adversarial losses . As an example , consider the case of binary classification and perturbations measured in the ℓ2 norm . Then , for a given labeled point ( x , y ) and a perturbation radius ϵ , the adversarial zero-one loss of a classifier f is defined as maxx′ : ∥x′−x∥2≤ϵ 1 ( f ( x ′ ) ̸= y ) . Thus , the loss at a point x can not be measured simply by inspecting the prediction of the classifier at x . In other words , the construction of an adversarial Bayes optimal classifier necessarily involves arguing about the global patterns in the predictions of the classifier across the entire input domain . As a result , most of the technical tools developed for the study of Bayes optimal classifiers for traditional loss functions are not applicable to the analysis of adversarial loss functions , and new mathematical techniques are required . The above discussion leads to our second motivation for studying the question of existence of the adversarial Bayes classifier . Insights regarding the structure of the adversarial Bayes optimal classifier could have algorithmic implications . For example , in the case of the standard zero-one loss , many popular learning algorithms seek to approximate the conditional probability of a class at a point because the conditional probability defines the Bayes optimal classifier in this case . Analogously , one could hope to develop new algorithmic techniques for adversarial learning with a better understanding of the properties of adversarial Bayes classifiers . In fact , two recent publications propose this approach ( Yang et al. , 2020 ; Bhattacharjee and Chaudhuri , 2020 ) . Although their results do not rely on the existence of the adversarial Bayes classifier , they implicitly make this assumption to make their arguments clearer . Our work provides a rigorous basis for this premise . A second related concept is certified robustness . A point x is certifiably robust for a classifier f and a perturbation radius ϵ if every perturbation of radius at most ϵ leaves the class of x unchanged . In this paper , we further study a property which we refer to as pseudo-certified robustness , which is necessary for certified robustness . We show that there always exists an adversarial Bayes classifier which satisfies the pseudo-certified robustness condition for a fixed radius at every point . However , a non-trivial classifier can not be certifiably robust for a fixed radius at every point – specifically , a classifier is not certifiably robust at points within ϵ of the decision boundary . Furthermore , we argue that a classifier that is not pseudo-certifiably robust is typically not optimal . Lastly , Lewicka and Peres ( 2020 ) prove that for 2-norm perturbations , the boundary of a pseudo-certifiably robust set is differentiable and has Lipschitz normals . The concept of certified robustness has algorithmic implications . Cohen et al . ( 2019 ) recently showed that after training a classifier , a process called randomized smoothing makes the classifier certifiably robust at a point x in the ℓ2 norm with a radius that depends on the point x . As the adversarial Bayes classifier is pseudo-certifiably robust but not certifiably robust with a fixed radius at every point , one could try to design algorithms which ensure pseudo-certifiable robustness during or after training . Recent works have explored constructing certificates of robustness as well ( Raghunathan et al. , 2018 ; Weng et al. , 2018 ; Zhang et al. , 2018 ; Wong and Kolter , 2018 ) . A better understanding of the adversarial Bayes classifier could help find additional learning algorithms . By studying the existence of the adversarial Bayes classifier , we take a first step towards this broader goal . We now describe the organization of the paper . Section 2 summarizes related work and Section 3 presents the mathematical formulation of our problem . Section 4 discusses our main result and the proof . Next , Section 5 addresses the measurability issues relating to this problem . Section 6 demonstrates how our techniques might apply to other models of perturbations . Subsequently , in Appendix A , we prove the measurability results stated in Section 5 and , in Appendix B , we prove a variant of Prokhorov ’ s theorem that is essential for our proofs . Next , in Appendix C , we prove one of our key lemmas . Appendicies A , B and C present stand-alone results which do not depend on material elsewhere in the appendix . In Appendix D , we subsequently provide some background material for the results in Appendicies E-G. Next , we prove the rest of our key lemmas in Appendicies E and F. Lastly , Appendix G states and proves two generalizations of our main result . 2 Related Work . Existing theoretical work on adversarial robustness focuses on questions such as adversarial counterparts of VC-dimension and Rademacher complexity ( Cullina et al. , 2018 ; Khim and Loh , 2018 ; Yin et al. , 2019 ; Awasthi et al. , 2020 ) , evidence of computational barriers ( Bubeck et al. , 2018b , a ; Nakkiran , 2019 ; Degwekar et al. , 2019 ) and statistical barriers towards ensuring low adversarial test error ( Tsipras et al. , 2018 ) . Cullina et al . ( 2018 ) formulate a notion of adversarial VC-dimension , aimed at capturing uniform convergence of robust empirical risk minimization . The authors show that , for linear models , adversarial VC-dimension coincides with the VC-dimension . However , in general , the two could be arbitrarily separate . In a similar vein , Khim and Loh ( 2018 ) , Yin et al . ( 2019 ) and Awasthi et al . ( 2020 ) study the Rademacher complexity of adversarially robust losses for binary and multi-class classification . Schmidt et al . ( 2018 ) provide an instance of a learning problem where one can provably demonstrate a gap between the sample complexity of ( standard ) learning and adversarial learning . Tsipras et al . ( 2018 ) points out a problem where any learning algorithm that achieves low ( standard ) test error must necessarily admit high adversarial test error , that is close to 1 . This highlights a fundamental tension between ensuring low test error and low adversarial error . There are also studies of the conditions on the data distribution that lead to the presence of adversarial examples and the design of adversaries that can exploit them ( Diochnos et al. , 2018 ; Bartlett et al. , 2021 ) . The recent work of Montasser et al . ( 2019 ) shows that any function class with finite VC-dimension d can be adversarially robustly learned ( in a PAC-style model ) using exp ( d ) many samples . Bubeck et al . ( 2018b , a ) provide evidence of computational barriers in adversarial learning by constructing learning tasks that are easy in the PAC model , but that become intractable when adversarial robustness is required . Several recent publications have studied the question of characterizing the Bayes adversarial risk ( Pydi and Jog , 2019 ; Bhagoji et al. , 2019 ) for binary classification and relate it to the optimal transportation cost between the two class conditional distributions . While these studies aim to establish a lower bound on the Bayes adversarial risk , we study a more fundamental question of when the Bayes adversarial classifier exists . There have also been publications studying robustness beyond ℓp norm perturbations ( Feige et al. , 2015 , 2018 ; Attias et al. , 2018 ) . Finally , there are studies in the mathematical community of various properties regarding the direct sum of a set and an ϵ-ball , which we use to model adversarial perturbations . Similar , but not identical mathematical constructions have also appeared in the PDE literature . Cesaroni and Matteo ( 2017 ) and Cesaroni et al . ( 2018 ) consider perturbations to the measure-theoretic boundary of a set . However , the measure-theoretic boundary and the topological boundary behave quite differently . Chambolle et al . ( 2012 ) consider problems involving integrals of indicator functions of perturbed sets Aϵ divided by the size of the perturbation . Additionally , Bellettini ( 2004 ) and Chambolle et al . ( 2015 ) assume some set properties that are satisfied by sets perturbed by ℓp balls , and then use these to show regularity and the curvature of the boundary . Lastly , Bertsekas and Shreve ( 1996 ) study the universal σ-algebra in detail , however they did not show that the sets we use in this paper are universally measurable . We prove a new measurability result in Section 5 .

Summary: This paper studies a fundamental question regarding the adversarial Bayes classifier, i.e., does the optimal Bayes classifier exists and does it have any robustness guarantee. The contribution of this paper is theoretical: it proposes the concept of ‘pseudo-certifiable robustness’ and proves that the optimal Bayes classifier exists and satisfies the proposed ‘pseudo-certified robustness’. The proofs are mostly about real analysis and measure theory.