Calibration and Consistency of Adversarial Surrogate Losses

1 Introduction . Complex multi-layer neural networks trained on large datasets have achieved a remarkable performance in several applications in recent years , in particular in speech and visual recognition tasks ( Sutskever et al. , 2014 ; Krizhevsky et al. , 2012 ) . However , these rich models are susceptible to imperceptible perturbations ( Szegedy et al. , 2013 ) . A complex neural network may , for example , misclassify a traffic sign , as a result of a minor variation , which may be the presence of a small advertisement sticker on the sign . Such misclassifications can have dramatic consequences in practice , for example with self-driving cars . These concerns have motivated the study of adversarial robustness , that is the design of classifiers that are robust to small ` p norm input perturbations ( Goodfellow et al. , 2014 ; Madry et al. , 2017 ; Tsipras et al. , 2018 ; Carlini and Wagner , 2017 ) . The standard 0/1 loss is 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . then replaced with a more stringent adversarial loss , which requires a predictor to correctly classify an input point x and also to maintain the same classification for all points at a small ` p distance of x . But , can we devise efficient learning algorithms with theoretical guarantees for the adversarial loss ? Designing such robust algorithms requires resorting to appropriate surrogate losses since optimizing the adversarial loss is NP-hard for most hypothesis sets . A key property for surrogate adversarial losses is their consistency , that is , that exact or near optimal minimizers of the surrogate loss be also exact or near optimal minimizers of the original adversarial loss . The notion of consistency has been extensively studied in the case of the standard 0/1 loss or the multi-class setting ( Zhang , 2004 ; Bartlett et al. , 2006 ; Tewari and Bartlett , 2007 ; Steinwart , 2007 ) . However , those results or proof techniques can not be used to establish or characterize consistency in adversarial settings . This is because the adversarial loss of a predictor f at point x is inherently not just a function of f ( x ) but also of its values around a neighborhood of x . As we shall see , the study of consistency is significantly more complex in the adversarial setting , with subtleties that have in fact led to some inaccurate claims made in prior work that we discuss later . Consistency requires a property of the surrogate and the original losses to hold true for the family of all measurable functions . As argued by Long and Servedio ( 2013 ) , the notion of H-consistency , which requires a similar property for the surrogate and original losses , but with the near or optimal minimizers considered on the restricted hypothesis set H , is a more relevant and desirable property for learning . Long and Servedio ( 2013 ) gave examples of surrogate losses that are not H-consistent when H is the class of all measurable functions but that satisfy a realizable H-consistency condition when H is the class of linear functions . More recently , Zhang and Agarwal ( 2020 ) studied the notion of improper realizable H-consistency of linear classes where the surrogate φ can be optimized over a larger class , such as that of piecewise linear functions . Note that these studies only deal with the standard 0/1 classification loss . This motivates our main objective : an extensive study of the H-consistency of adversarial surrogate losses , which is critical to the design of robust algorithms with guarantees in this setting . A more convenient notion in the study of H-consistency is that of H-calibration , which is a related notion that involves conditioning on the input point . H-calibration often is a sufficient condition for H-consistency in the standard classification settings ( Steinwart , 2007 ) . However , the adversarial loss presents new challenges and requires carefully distinguishing among these notions to avoid drawing false conclusions . As an example , the recent COLT 2020 paper of Bao et al . ( 2020 ) presents a study of H-calibration for the adversarial loss in the special case where H is the class of linear functions . However , several comments are due regarding that work . See a detailed discussion in Appendix B . Our Contributions . We present a more systematic study of the H-calibration and H-consistency including for the case where H =Hall of adversarial surrogate losses . In Section 4 , we give a detailed analysis of the H-calibration properties of several natural surrogate losses . We present a series of new negative results showing that , under some general assumptions , convex loss functions and supremumbased convex losses , that are loss functions defined as the supremum over a ball of a convex function , which are those commonly used in applications , are not H-calibrated for common hypothesis sets used in machine learning . Next , we give a characterization of calibration and prove that a family of proposed surrogates are H-calibrated , with common hypothesis sets . These fix previous calibration results presented for the family of linear models in ( Bao et al. , 2020 ) and significantly generalize the results to the nonlinear hypothesis sets . In Section 5 , we study the H-consistency of surrogate loss functions . We prove that , in the absence of distributional assumptions , many surrogate losses shown to be H-calibrated in Section 4 are in fact not H-consistent . This , in particular , proves that a claim presented in a COLT 2020 publication is inaccurate . Next , in contrast , we show that when the minimum of the surrogate loss is achieved within H , under some general conditions , the ρ-margin ramp loss ( see , for example , ( Mohri et al. , 2018 ) ) is H-consistent for H being the linear hypothesis set , or any non-decreasing and continuous g-based hypothesis set , including the ReLU-based hypothesis set . We then give similar H-consistency guarantees for supremum-based surrogate losses based on a non-increasing auxiliary function , including the calibrated supremum-based ρ-margin ramp loss when H is any symmetric hypothesis set , e.g. , the multi-layer neural networks . In Section 6 , we further report a series of empirical results on simulated data , which show that many H-calibrated surrogate losses are indeed not H-consistent , and justify our conditions for consistency . Overall , our results imply that the loss functions commonly used in practice for optimizing the adversarial loss are not H-consistent and that minimizing such losses may not lead to a more favorable adversarial loss . This could be in fact the reason why the empirical results reported in the literature have not been favorable . Instead , we suggest alternative surrogate losses that we prove are H-consistent and that can be useful to the design of effective algorithms . We give a detailed discussion of related work in Appendix A . We start with basic concepts of calibration and consistency ( Section 2 ) and an introduction of robust classification ( Section 3 ) . 2 Preliminaries . We will denote vectors as lowercase bold letters ( e.g . x ) . The d-dimensional l2-ball with radius r is denoted by Bd2 ( r ) ∶= { z ∈ Rd ∣ ∥z∥2 ≤ r } . We denote by X the set of all possible examples . X is also sometimes referred to as the input space . The set of all possible labels is denoted by Y . We will limit ourselves to the case of binary classification where Y = { −1 , +1 } . Let H be a family of functions from Rd to R. Given a fixed but unknown distribution P over X×Y , the binary classification learning problem is then formulated as follows . The learner seeks to select a predictor f ∈ H with small generalization error with respect to the distribution P. The generalization error of a classifier f ∈H is defined byR ` 0 ( f ) = E ( x , y ) ∼P [ ` 0 ( f , x , y ) ] , where ` 0 ( f , x , y ) = 1yf ( x ) ≤0 is the standard 0/1 loss . More generally , the ` -risk of a classifier f for a surrogate loss ` ( f , x , y ) is defined by R ` ( f ) = E ( x , y ) ∼P [ ` ( f , x , y ) ] . ( 1 ) Moreover , the minimal ( ` , H ) -risk , which is also called the Bayes ( ` , H ) -risk , is defined byR∗ ` , H = inff∈HR ` ( f ) . In the standard classification setting , the goal of a consistency analysis is to determine whether the minimization of a surrogate loss ` can lead to that of the binary loss generalization error . Similarly , in adversarially robust classification , the goal of a consistency analysis is to determine if the minimization of a surrogate loss ` yields that of the adversarial generalization error defined by R ` γ ( f ) = E ( x , y ) ∼P [ ` γ ( f , x , y ) ] , where ` γ ( f , x , y ) ∶= sup x′∶∥x−x′∥≤γ 1yf ( x′ ) ≤0 ( 2 ) is the adversarial 0/1 loss . This motivates the definition of H-consistency . Definition 1 ( H-Consistency ) . Given a hypothesis set H , we say that a loss function ` 1 is Hconsistent with respect to a loss function ` 2 , if the following holds : R ` 1 ( fn ) −R∗ ` 1 , H n→+∞ÐÐÐ→ 0 Ô⇒ R ` 2 ( fn ) −R∗ ` 2 , H n→+∞ÐÐÐ→ 0 , ( 3 ) for all probability distributions and sequences of { fn } n∈N ⊂H . For a distribution P over X × Y with random variables X and Y , let ηP∶X→ [ 0,1 ] be a measurable function such that , for any x ∈ X , ηP ( x ) = P ( Y = 1 ∣ X = x ) . By the property of conditional expectation , we can rewrite ( 1 ) as R ` ( f ) = EX [ C ` ( f , x , ηP ( x ) ) ] , where C ` ( f , x , η ) is the inner ` -risk defined as followed : ∀x ∈ X , ∀η ∈ [ 0,1 ] , C ` ( f , x , η ) ∶= η ` ( f , x , +1 ) + ( 1 − η ) ` ( f , x , −1 ) . ( 4 ) Moreover , the minimal inner ` -risk on H is denoted by C∗ ` , H ( x , η ) ∶= inff∈H C ` ( f , x , η ) . For a margin-based loss φ , the generic conditional φ-risk is C̄φ ( t , η ) ∶= ηφ ( t ) + ( 1 − η ) φ ( −t ) for any η ∈ [ 0,1 ] and t ∈ R ( Bartlett et al. , 2006 ) . The notion of calibration for the inner risk is often a powerful tool for the analysis of H-consistency ( Steinwart , 2007 ) . Definition 2 ( H-Calibration ) . [ Definition 2.7 in ( Steinwart , 2007 ) ] Given a hypothesis set H , we say that a loss function ` 1 is H-calibrated with respect to a loss function ` 2 if , for any > 0 , η ∈ [ 0,1 ] , and x ∈ X , there exists δ > 0 such that for all f ∈H we have C ` 1 ( f , x , η ) < C∗ ` 1 , H ( x , η ) + δ Ô⇒ C ` 2 ( f , x , η ) < C ∗ ` 2 , H ( x , η ) + . ( 5 ) Steinwart ( 2007 ) points out that if ` 1 is H-calibrated wrt ` 2 , then H-consistency , that is condition ( 3 ) , holds for any probability distribution verifying the additional condition of minimizability ( Steinwart , 2007 , Definition 2.4 ) . Next , we introduce the notions of calibration function from ( Steinwart , 2007 ) . Definition 3 ( Calibration function ) . Given a hypothesis set H , we define the calibration function δmax for a pair of losses ( ` 1 , ` 2 ) as follows : for all x ∈ X , η ∈ [ 0,1 ] and > 0 , δmax ( , x , η ) = inf f∈H { C ` 1 ( f , x , η ) − C∗ ` 1 , H ( x , η ) ∣ C ` 2 ( f , x , η ) − C ∗ ` 2 , H ( x , η ) ≥ } . ( 6 ) For any x ∈ X , η ∈ [ 0,1 ] and > 0 , the calibration function gives the maximal δ satisfying the calibration condition ( 5 ) . The following proposition is an important result from ( Steinwart , 2007 ) . Proposition 4 ( Lemma 2.9 in ( Steinwart , 2007 ) ) . Given a hypothesis set H , loss ` 1 is H-calibrated with respect to ` 2 if and only if its calibration function δmax satisfies δmax ( , x , η ) > 0 for all x ∈ X , η ∈ [ 0,1 ] and > 0 . Since the concepts of calibration and consistency may not be familiar to readers without an extensive background in this area , we further comment on these notions before presenting our main results . Informally , a loss function is H-consistent if minimizing it results in a classifier whose generalization error is close to the minimal generalization error within H. Similarly , a loss function is H-calibrated if minimizing it results in a classifier whose inner ` 2-risk is close to the minimal inner ` 2-risk within H for each x ∈ X. H-calibration ( 5 ) is a necessary condition for H-consistency ( 3 ) , but is not always sufficient . As an example , we show in Section 5.1 that H-calibrated surrogate losses proposed in ( Bao et al. , 2020 ) are not H-consistent . For this reason , H-consistency , that is consistency for a particular hypothesis set H , is a difficult problem even in standard non-adversarial scenarios . When H is the family of all measurable functions , the notions of calibration and consistency with respect to the 0/1 loss have been widely studied in the literature to analyze the properties of margin-based losses ( Zhang , 2004 ; Bartlett et al. , 2006 ) . In this special case , calibration implies consistency . Steinwart ( 2007 ) further establishes a sufficient condition called minimizability under which H-calibration ( 5 ) implies H-consistency ( 3 ) . Note that the minimizability condition holds in ( Zhang , 2004 ; Bartlett et al. , 2006 ) . However , it does not hold in general in the adversarial scenario and thus analyzing H-consistency becomes much harder . To the best of our knowledge , our work is the first to prove H-consistency results for general hypothesis sets H , including for the case where H =Hall , in the context of adversarial classification . We conclude this section with an illustration of the connection between the notations of calibration and consistency in Figure 1 .

Summary: This paper provides a detailed analysis on the H-calibration and H-consistency of adversarial surrogate losses.   It shows that some common used losses for adversarial training are not H-calibrated.    Some theoretical results on the characterization of H-calibration are established.  The paper also proves that some surrogate losses are indeed H-calibrated.  Some additional theoretical results on H-consistency are established too.