An Analytic Framework for Robust Training of Differentiable Hypothesis
Authors: Ramin Barati
Reza Safabakhsh
Mohammad Rahmati
Venue: Submitted to ICLR 2023 (2023)

Abstract: The reliability of a learning model is key to the successful deployment of machine learning in various industries. Creating a robust model, particularly one unaffected by adversarial attacks, requires a comprehensive understanding of the adversarial examples phenomenon. However, it is difficult to describe the phenomenon due to the complicated nature of the problems in machine learning. Consequently, many studies investigate the phenomenon by proposing a simplified model of how adversarial examples occur and validate it by predicting some aspect of the phenomenon. While these studies cover many different characteristics of the adversarial examples, they have not reached a holistic approach to the geometric and analytic modeling of the phenomenon. We observe the phenomenon in many applications of machine learning, and its effects seems to be independent of the choice of the hypothesis class. In this paper, we propose a formalization of robustness in learning theoretic terms and give a geometrical description of the phenomenon in analytic classifiers. We then utilize the proposal to devise a robust classification learning rule for differentiable hypothesis classes and showcase our framework on synthetic and real-world data.

Under review as a conference paper at ICLR 2023
AN ANALYTIC FRAMEWORK FOR ROBUST TRAINING OF DIFFERENTIABLE HYPOTHESES
A Anonymous authors
Paper under double-blind review
ABSTRACT
The reliability of a learning model is key to the successful deployment of machine learning in various industries. Creating a robust model, particularly one unaffected by adversarial attacks, requires comprehensive understanding of the adversarial examples phenomenon. However, is difficult to describe the phenomenon due to the complicated nature of the problems in machine learning. Consequently. many studies investigate the phenomenon by proposing a simplified model of how adversarial examples occur and validate it by predicting some aspect of the phe- nomenon. While these studies cover many different characteristics sarial examples, they have not reached holistic approach to the geometric and analytic modeling of the phenomenon. Furthermore, the phenomenon have been observed in many applications of machine learning, and its effects seems be independent of the choice of the hypothesis class. In this paper, we propose a formalization of robustness in learning theoretic terms and give a geometrical de- scription of the phenomenon in analytic classifiers. We then utilize the proposal to devise a robust classification learning rule for differentiable hypothesis classes and showcase our proposal on synthetic and real-world data.
the adver-
INTRODUCTION
The ofate-of-theearr machine learning models are shown to suffer from the phenomenon of adver- sarial examples, where trained model is fooled return an undesirable output on particular inputs that an adversary carefully crafts. While there is no consensus on the reasons behind the emergence of these examples, many facets of the phenomenon have been revealed. [Szegedy et al. (2014) show that adversarial perturbations are not random and they generalize to other models. Goodffllow et al.) (2015) indicate that linear approximations of the model around a test sample is an effective surrogate for the model in the generation of adversarial examples, Tanay & Griffin 2016) show that adver- sarial examples will appear in linear classifiers when the decision boundary is tilted towards the manifold of natural samples. Ilyas al.] (2019) reveal that the distribution of training samples and robustness of the trained model are related. Demontis et al. (2019) have proposed three metrics for measuring transferability between target and surrogate model based on the similarity of the loss landscape and the derivatives of the models. ei al. (2020) infer that the cause of the phenomenon probably geometrical and that statistical defects are amplifying its effects. [aratti et al. (2021) find an example that shows pointwise convergence of the trained model to the optimal hypothesis is enough for the phenomenon to emerge. Shamir et al. (202T) explore the interaction of the decision boundary and the manifold of the samples in non-linear hypotheses.
However, there are some issues with the current proposals in the literature. The geometrical and computational descriptions of the phenomenon does not always agree in their predictions (Moosavi- Dezfooli al. 2019. Akhtar et al. 2202T) }. Even though geometrical perspectives have the advantage of being applicable to all hypothesis classes, they are not verifiable without computational descrip- tion. On the other hand, computational approaches are mostly coupled with a particular construction of hypothesis and in turn need a geometric description be applicable to different scenarios. The current defence methods does not appear to be very effective (Machado et al. 2021) and a need for novel ideas is felt (Bai et al. 2021).
Our aim in this paper is to devise a framework for the analysis of the adversarial examples phe- nomenon that

---

Under review as a conference paper at ICLR 2023
1. is decoupled from the underlying representation of the hypothesis.
2. provides the means for visualization of the phenomenon.
3. models the known characteristics of the phenomenon as much as possible.
To this end, we first describe necessary condition for robustness that derive from the first principles of learning theory and lay out the groundwork for the analysis of the phenomenon from the perspective of learning rules in section Next, we will extend the framework with the necessary definitions so that it would be open to geometrical interpretations in section 3 Finally, we put the proposed framework to use and verify its predictions for small scale synthetic and real-world problems. We provide summary of the framework in appendix A for the interested reader.
2 PRELIMINARIES
In learning theory we are interested to study how machines learn (Shalev-Shwartz & Ben-David 2014). We will base our analysis on the framework of probably approximately correct (PAC) learn- ing. The basic objects of study in learning theory are hypothesis classes and learning rules. We are interested in determining the necessary condition for learning rule A to be robust with respect to nonuniform learnable hypothesis class H. We assume that the training samples are labeled by the true labeling function and that samples come from a compactly supported distribution throughout the paper.
Definition 2.1 (perplexity). Consider universally consistent learning rule A and training sets S X. The perplexity of h A(S) with respect to h' AASS is
| h/loc sup 1h' (x) - h(x))]-
(1)
x
We expect that the perplexity of the output of a learning rule E H. to decrease as we add more natural samples the training set. In contrast, adding an adversarial sample would be perplexing for h. we find some sample x E X' that does not perplex but is not correctly labeled by h, then we assume that H is agnostic to the pattern of x. In other words, if adversarial training cannot improve the robustness of h, then h is as robust as it gets for hypotheses in H.
Definition 2.2 (robust learning rule). Consider learning rule AA and a sequence (d, [dm of random variables that almost surely converge to random variable 2> that is uniformly distributed on X. A is robust if for every c > 0, there exists a natural number N such that for all m, n 2 N we have that
||A(d..)) A(d,) S.
This definition of a robust learning rule could be interpreted as the characteristic that when A ob- serves enough natural samples, adding more samples would not be consequential to the output of A, independent from the generative process of the samples. The definition is equivalent with Cauchy's criterion for uniform convergence of (A(dn)) to the optimal hypothesis A(D).
The largest hypothesis class that we consider here is (x2) The main characteristic of functions in L (X')) is that they are square-integrable Formally, for function f E L²()).
|Vll ( (V())))((())) <x.
(3)
Theorem 2.3. (X) is nonuniform learnable.
We assume that a hypothesis h E H. has series or an integral representation,
M(x) Σ (x),
(4)
h(x) = /
(5)
The series representation is customary in machine learning. A series representation is adequate if we have a discreet set of features { e.g. polynomials. We argue that an integral representation is more adequate for analysis when there is continuum of features to choose from, e.g. neuron in an artificial neural network (ANN). Informally, the integral representation would abstract away the complexity of finding good features by incorporating every feature possible.
2

---

Under review as a conference paper at ICLR 2023
Definition 2.4 (SVC learning rule). Consider training set S {(zn E X, t,, and
hypothesis h E (x(). The support vector classifier (SVC) learner solves the following program,
arg min a
|all?
arg min V
2 ||
(6)
(7)
subject to (nn(
subject to (n)((a) 21
Theorem 2.5. The SVC learning rule is not robust with respect (2), and the optimal solution is,
N 04 = Σ Antn)P((an),
N
(8)
v(w) = Σ (
(9)
11
in which (Am) are the Lagrange multipliers.
Proposition 2.6. The SVC learning rule would return the labeling function as the output in the infinite sample limil unless H is agnostic to I.
Based on proposition 2.6 one may suggest that SVC learners with respect to L2(X) are weak against black box attacks well. We formalize the conditions for transfer of adversarial examples as follows.
Definition 2.7 (transfer of adversarial examples). The adversarial examples of surrogate h H would probably approximately transfer to target h E H if some 6, 2 0 exist in which with probability we have that
l 111l0 Se,
(10)
Oh
Oh
1l S c' Oz.
(11)
Oz.
The idea behind this definition of transfer is that not only and probably approximate each other, they also vary in a similar manner in the neighborhood of a test sample. We introduce normal hy- pothesis classes formalize the conditions for the transfer of adversarial examples between different representations of a hypothesis class.
Definition 2.8 (normal hypothesis class). H is a normal hypothesis class if for every universally consistent learning rule A and all 2 0 and for all sequences {d, J $3 a number N E N exists where for all 2 N have that
- Se,
(12)
for a dense subset of X.
Theorem 2.9. If H and the class of its derivatives 0H are normal hypothesis classes, then adver- sarial examples of h E H would transfer between different representations of h.
Theorem 2.10. (x)
a normal hypothesis class.
Even though theorem 2.3 shows that it is possible to find robust learning rule for (2)),,, argue that this hypothesis class is not appropriate for the analysis in ANNs. Since it is not normal hypothesis class, the hypotheses in (x') not clustered together and does not model the transferability the adversarial examples between ANNs with different activation functions.
adversarial examples phenomenon
In this section we were focused on describing the phenomenon and the conditions for robustness and transfer in learning theory. Next, we will extend the framework with the tools and definitions needed for geometrical treatment the phenomenon.
THE SPACE OF HOLOMORPHIC HYPOTHESES
We need to come up with suitable frame and axis if we want to be able to visualize the phenomenon. In this paper, we only concerned with visualizing the phenomenon in binary classification tasks. We are interested in visualizing the submanifold of the natural samples S and to study its interactions with the submanifold of the decision boundary C.
3

---

Under review as a conference paper at ICLR 2023
Definition 3.1 (complex-valued) classifier). A complex- valued classifier h X + C is a function h(z)= = u(z)++ + iv(x) in which the real part R(h(x)] = u(z) = O encodes the geometrical position of the decision boundary and the imaginary part 3(h(z)) = 2zx) = 0 regresses through the geometrical position of the training samples.
The complex plane C provides us with a frame to visualize S with respect to C. The decision boundary is represented by the imaginary axis and h assigns a position in the complex plane to each r E X. Thus, the image of every path 7 : [0. 1] + X' would be a curve h(?) in C. If 7 crosses y in X, h(y) would cross h(r') in C as well. However, in general the geometrical interactions between h(7) and h(7²)) does not translate to r and 7/. In particular distance and angles measured in C may not reflect the true distance and angles in X. in order to overcome this obstacle, we will turn to special subset of L (X).
Definition 3.2 (the Bergman space), Consider a compact and simply connected domain set X' C Cd. The Bergman space A (2)) C (2) is reproducing kernel Hilbert space defined as
A²(x)= - ( o(x)) (sx ((t))))()))))) $ <oo..
(13)
Ox)) is the space of holomorphic functions on X. There are different equivalent ways char- acterize holomorphic functions. The holomorphic functions are the solutions to the homogeneous Cauchy-Rieman equations, or its counterpart in higher dimensions Ô (del-bar) equations. Equiva- lently, the holomorphic functions are the functions that are complex differentiable in each dimension of x E X. A third characterization of (x)) is that these functions are complex analytic and have a power series representation. ((Y) is also special because, unlike real analytic functions, it is closed under uniform convergence. In one complex dimension, holomorphic functions are also known as conformal maps. Conformal maps are those maps that preserve the angle between paths in X and their image in C. In other words, if y and ' cross each other at a right angle, h(7) and h(7') would cross each other at a right angle as well.
However, it could be shown that holomorphic functions can only be defined over the field of complex numbers. Nevertheless, we argue that the simplicity of analysis in (X),,, and its unique set of properties would justify the switch to complex numbers. We emphasize that encoding data using complex numbers could be as simple as + ir or exc We will replace æ with = to symbolize the transition from the real to the complex number system.
A domain X' that allows for the definition of holomorphic functions is called a domain of holomor- phy. Fortunately, most of the domains that we would normally face in applications are domains of holomorphy. A notable subset of domains of holomorphy are convex domains. We have provided short summary of the topic in appendix [E] with some examples on how to encode real data with complex numbers. Krantz (2001) is our main reference for the definitions and notation in function theory of several complex variables.
Definition 3.3 (the Bergman kernel). The Bergman kernel Kx(2, () of compact and simply con- nected domain X is the unique function with the reproducing property
f(z) S 5(9)Kxle,
(14)
The reproducing property of the Bergman kernel of X in conjunction with the fact that the optimal Bayes classifier achieves the minimum of the 0-1 loss function provides the means to define the infinite sample limit of any learning rule on (2'))) that is minimizing the complex 0-1 loss function,
losse(t, h) losso- (t, x, R(h)) + loss 2, (/h)),
(15)
independently from the details of the implementation or the training process.
Definition 3.4 (holomorphic optimal Bayes classifier). The holomorphic optimal Bayes classifier is the orthogonal projection of the optimal Bayes classifier fo X + R into A²
op(z) = S Fo(()Kxles))
(16)
Theorem 3.5. (2)) and (2)) are normal hypothesis classes.
4

---

Under review as a conference paper at ICLR 2023
Theorem 3.5
predicts that adversarial examples of nonrobust hypothesis h (2) transfer between different representations h.
Geometrical properties of holomorphic functions would enable to infer the geometrical relation between S and C' by studying their images in C. This property of the holomorphic hypotheses would prove to be key finding robust learning rule for A? (X)). Next, we will extend the SVC learning rule to accommodate for complex-values hypotheses.
Definition 3.6 (complex SVC learning rule). The complex SVC learner solves the following pro- gram,
N
arg min h subject to
2 | [1 + +C En
+cEs.
==1
En 2 0,
(17)
1, [R (zn)) 2 1 En::
5. 2 [fn))))))
3[f(zn)] 2 En
in which (5 slack variables introduced to allow for soft margins.
We now have the required tools and definitions to analyze the phenomenon from a geometrical perspective. In the next section, we will make use of the proposed framework to analyze the phe- nomenon in A (x) and to find a robust classification learning rule for A (X)).
ROBUST CLASSIFICATION FOR HOLOMORPHIC HYPOTHESES
In this section, we will develop a robust learning rule with respect (2') To do so, we first exam- ine toy problem to get an intuition for how adversarial examples occur in holomorphic hypotheses, and then continue introduce the proposed robust learning rule.
To start, we will try to classify the unit disk D into distinct halves in which
t(z) = sign (R[z))
2 E D,
(18)
is the labeling function. We will choose our training samples to be the set
S, = (2, = e 2
k = 0,
(19)
We will use the orthonormal polynomial basis of the unit disk as features,
+
(2)
(20)
We will visualize holomorphic function in three ways. First, and graph the hypotheses on DD. The hue of a color represent the angle, and the saturation represent the magnitude of a complex number. We will also plot the contours of the real and imaginary parts of the hypotheses in the same graph using white and black lines respectively. Second, we will graph the real and the imaginary parts of the hypotheses on the unit circle T ÔD. T is the in which all the training points of S, are sampled from. In other words S = T. Third, we will graph the image of T in the range space of the hypotheses.
domain coloring technique
We have visualized the analogue of holomorphic optimal Bayes classifier op in the left column of figure [] However, we have made use of the Szegö kernel project the labeling function instead of the Bergman projection of I. The middle column of figure [ depicts the output of applying the complex-vatee SVC learning rule S30 using the orthonormal basis of 2 as features. As we have demonstrated in figure [] the solution to program 17 is not robust with respect A (D). Nev- ertheless, due to the normality the holomorphic functionn, we can see that the learned hypothesis resembles op, even though they not learned through the same learning rule, make use of the same hypothesis class for that matter.
Looking figure ! points on and -2. With this observation in mind. is no wonder that approximating op is trouble- some for our learning rule. Furthermore, that the essential singular region of the nonrobust
that op is transcendental function and has two logarithmic branch
5

---

Under review as a conference paper at ICLR 2023
0p
orthonormal
harmonic
1.0
0.5
0.0
-0.5
-1.0
1.0
0.5
0.0
0.5
1.0
1.0
0.5
0.0
0.5
1.0
1.0
0.5
0.0
0.5
1.0
f2
A2
31
(a) graph of the complex-valued hypotheses on the unit disk DD.
Op
orthonormal
harmonic
2
][h]
J[h]
1
www.
wwwm
-1
kthh] 3(h]
-2
Lz
Lz
(b) graph of the complex-valued hypotheses the unit circle T.
orthonormal
harmonic
1
[[h]
-2
[[h]]
R[h]
Ji[h]
(c) image of S T under the complex-valus valuee hypotheses.
Figure 1: Visualizations of op and the optimal hypotheses of the hinge loss function for S30- We can see that even though the hypotheses are optimizing different loss function than the 0-1 loss. they show certain similarities with op.

---

Under review as a conference paper at ICLR 2023
hypothesis has advanced inside of D. This advancement has caused the learners output to be nonro- bust in a neighborhood of T. This observation is common to nonrobust learning rules with respect to (2)).
Theorem 4.1. Lei h E (2))) be the oulput of a nonrobust learning rule, then h is robust on dense open subset of X.
Theorem 4.1 shows that not only our choice of (2() as replacement for (²(x) models the trans- ferability of adversarial examples, it also correctly predicts the apparent paradox in the existence of the adversarial examples in ANNs, where the nonrobust hypothesis appears to be robust almost everywhere.
Figure Ic graphs the image of T in the range space of the hypotheses h(T). Due to the singularities of the holomorphic projection of OD(T) passes through the point at the infinity. Consequently, (TT) consists of two parallel lines; the trapezoidal shape in the figure is caused by the fact that we cannot in practice reach the point at the infinity. Looking at the nonrobust hypothesis in Figure Ic that the image of T passes through the decision boundary quite few times. The figure shows that (T) of the nonrobust hypothesis is longer than necessary. In other words, is possible to find a holomorphic hypothesis that achieves the same loss the training set with h h(T) not passing through the decision boundary so many times. We can repeat the same argument for any other curve inside ID. Thus, we argue that if the output h of A with respect (2)) minimizes the area covered by the image of X under h, then it is robust.
Theorem 4.2. A learning rule A with respect to (X) that minimizes the Dirichlet energy of its output,
ETh [Vb(3)]] (v),,
(21)
is robust.
Theorem 4.2 could be easily generalized to any differentiable hypothesis class. The reason is that the process of measuring the length of the image of path is the same for all differentiable hypotheses; whether they are complex-valued not.
Definition 4.3 (robust (complex) SVC learning rule). The robust (complex) SVC learning rule is the same as the (complex) SVC learning rule, but minimizes E[h] instead of [|x:l)
Definition 4.4 (harmonic features). A set of non-constant features { are harmonic if
J Voy(z)) Vipx(s)
{
j = k
(22)
j + k
Given the tuning matrix
Σis = / V2y(2) (V)(()dd(()))
(23)
we can transform any set of features to its harmonic counterpart,
Σ
(24)
We emphasize that E is positive definite by definition. Thus, unique square root of Σ exists and it invertible.
Theorem 4.5. @ regularization of a harmonic hypothesis minimizes its Dirichlet energy.
We have repeated the toy experiment using the harmonic basis functions of (2))),, and reported the results in the right column of [ We can see that the harmonic hypothesis robust as expected. Thus, we have succeeded in finding robust learning rule for A2').. The interested reader can find more examples and experiments in the supplementary material of the paper.
ROBUST TRAINING OF ANNS
In this section, will apply the results of section 4 to ANNs in limited manner demonstrate the feasibility and applicability of our approach. First, we put the proposed framework to use and describe how adversarial examples occur in ANNs.

---

Under review as a conference paper at ICLR 2023
Natural
Adversarial
0.36
0.95
orthonommal
hamonic
0.75
1.5
3i/1 2U-1
0.73
bassline orth: Cheb.
0.70
harm. Cheb.
0.3
5.48
800
2.65
0.93
baseine
arth Cheb.
0.63
-0.5
0.92
harm Cheb.
degiee
degrue
Figure 3: The result of performing one- step E² normalized gradient-based black-box attack on harmonic and orthonormal Cheby- shev polynomials for the UCI digits dataset. The baseline is a 64 x 40 x x 20 x 10 funny-con MLP that is trained on the same dataset.
Figure 2: The output of the robust (right) and nonrobust (left) SVC learning rules for an in- tegral representation with (D) and H.
As stated in section 2 we represent neural networks using an integral representation. If we assume that v E (S2). then we can repeat the process described in section 4 by replacing with its power series representation and follow similar path. We already know that the orthonormal basis for (12) would not be robust on the boundary of Ω. In other words, the learning rule would fail to find the robust coefficients of neurons on the boundary of Ω. When we use the harmonic bases of (S2) on the other hand, the region of convergence of ((w) would cover in and the output of the learning rule would be robust.
We have trained two neural networks which use the first 30 orthonormal and the harmonic bases represent v. Both networks use the Heaviside activation function (R[w]a + 3(wi) RR]]=+3[w]>>0 The interested reader can find the details of the experiment in the appendix D We have reported the results of the experiment in figure The figure suggests that the harmonic ANN is robust.
To showcase the applicability of the framework in a real-world scenario, we use MLP classifier with ReLU activation subset of the UCI digits dataset (Dua Graft 2017). We have reported the results in figure 3 The results show that the proposed robust learning rule is effective in mitigating the effects of the phenomenon, and supports the proposition that ANNs and polynomials are different representations of the same normal hypothesis class.
surrogate and attack two polynomial hypotheses that are trained on
Theorem 5.1. The oulput of the robust SVC learning rule with respect to a hypothesis h represented integral form satisfies the Poisson purtial differential equation (PDE)
-Av(w) = Σ Antno(Znii))
(25)
n=1
in which A is the Laplace operator.
Theorem 5.1 shows that training robust ANN is the same solving PDE. This observation suggests that robust classifiers are a normal family of functions, The fundamental solution & of the Laplace operator could be used to find function of (Nn 1.
(ww Aatn / T w))(Fn: dV
(26)
Definition 5.2 (harmonic activation function). A family of activation functions G is harmonic if they satisfy the Helmholtz equation with the natural Dirichlet or Neumann boundary condition
();) (x; 6(2).
(27)
8

---

Under review as a conference paper at ICLR 2023
Theorem 5.3. L regularization of v(w) of harmonic ANN is the same as minimizing its Dirichlet energy.
Theorem 5.3 is the final result of this paper. We have managed to find a robust learning rule for generalized notion of ANNs. Solving PDEs an involved and complicated process, and will not attempt to solve the derived PDEs in this paper. Nevertheless, both PDEs are very well-known and well-studied. and various methods and techniques are available in the literature which focuses on solving these PDFs.
6 CONCLUSION
In this paper we introduced general framework for training robust ANN classifiers. We proposed a formal definition for robustness and transfer in learning theoretic terms, and described how ad- versarial examples might emerge from the pointwise convergence of the trained hypothesis to the infinite sample limit of the learning rule. Since our proposal assumes that the convergence is point- wise, we need a separate explanation for the transfer of adversarial examples between hypotheses under pointwise convergence. To this end, we propose the normal hypothesis classes, and define these classes by adapting the definition of a normal family of functions. We also introduce integral representations as abstraction of ANNs that is easier to analyze in terms of convergence.
Next, we showed that under the proposed definitions, learning rules for ANNs that are converging to hypothesis in T,2 (2') does not explain the observation of transfer between different architectures of ANNs. As an alternative, we propose that transfer in ANNs is better modeled by functions in (x)) ((Y) is the set of holomorphic functions on X. We provide the necessary definitions to O(X) as hypothesis class, and take the first steps to enable the use of powerful tools of complex analysis in the study of the phenomenon.
Through holomorphicity, our framework provides a geometrical interpretation for the adversarial examples phenomenon. We conclude that a binary classifier with minimal Dirichlet energy is robust. In other words, replacing the L regularization term in the loss function with the Dirichlet energy of the hypothesis should result a robust classifier. Minimizing the Dirichlet energy might not be tractable in gradient descent as we need to compute the derivative of the Dirichlet energy to do so. To circumvent this problem, we introduce the harmonic features and activation functions. In summary, we first construct features or activation functions that satisfy condition, and then show that L regularization of these hypothesis classes is the same as minimizing their Dirichlet energy. Consequently, minimizing the Dirichlet energy for these hypotheses could be efficient as l² regularization of their parameters.
To the best of our knowledge, we have provided the first method that makes use of calculus of varia- tions and differential equations to tackle the challenge robust training of ANNs. Nevertheless, the analysis proved that training robust ANNs classifiers is not trivial, and need either implicitly or explicitly solve an intermediate PDE. There are multiple methods of doing so available in the relevant literature. As a result, we have left large-scale implementation of the proposed method to future, when an in depth understanding of the appropriate parameter domain sets and harmonic activation functions in ANNs is achieved.
REFERENCES
Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access, 9:155161-155196, 2021. doi: 10. 109/ ACCESS. SCCESS.2002.3111
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness. In Zhi-Hua Zhou (ed.), Proceedings of the Thirtieth International
Joint Conference on Artificial Intelligence, IJCAI 2021, Virtual Event / Montreal, Canada, 19- https:
27 August 2021, pp. 2312-4322 ijcai.org, 2021. doi: 00224633ijcai.2221/559 //doo.org/10...0. http://1...293/11aa.aaaa 2021/50219999
Ramin Barati, Reza Safabakhsh, and Mohammad Rahmati. Towards explaining adversarial exam- ples phenomenon in artificial neural networks. In 2020 25th International Conference on Pattern Recognition (ICPR), pp. 7036-7042, 2021. doi: 10.1 109/ICPR488062200 200.006...221...1266662 99112367.

---

Under review as a conference paper at ICLR 2023
Moulay A. Barkatou and Maximilian Jaroschek. Desingularization of first order linear difference systems with rational function coefficients. In Proceedings of the 2018 ACM International Sympo- sium on Symbolic and Algebraic Computation, ISSAC 18, pp. 39-46, New York,NY, USA. 2018. Association for Computing Machinery. ISBN 9781450355506. doi: 10.1 00.114555208996.3209999999
URL httpthtts://///t wwaddi..orgg// 100 11 005555/2277656 3208989
Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. Why do adversarial attacks transfer? explaining trans-
ferability of evasion and poisoning attacks. In 28th USENIX Security Symposium (USENIX Se-
curity 19), pp. 321-338, Santa Clara, CA, August 2019. USENIX Association. ISBN 978-1- 939133-06-9. URL http:///wwwiiiaacoooo..aoooaaaaa presentation demontis
/www
Dheeru Dua and Casey Graff. UCI machine learning repository, 2017. URL http:///tcch///
ics. www.wuuw.uu.cooo.mm..m edu/ml
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL pttt:://axxiv.org/abbb. 1412. 6572
Steven Heilman, Elchanan Mossel, and Joe Neeman. Standard simplices and pluralities are not the most noise stable. In Proceedings of the 2015 Conference Innovations in Theoretical Computer Science, ITCS '15, pp. 255, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 9781450333337.
doi: 10.1 00.1445/2688073.26688777
URL https://doi.
1t5./00.114//2688000 2688077
Matthias Hein and Maksym Andriushchenko. Formal guarantees on the robustness of a clas- sifier against adversarial manipulation. In Isabelle Guyon, Ulrike Luxburg, Samy Ben- gio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pp. 2266 2017. URL http::tt/ppcceeeeeteees Abst html
neur ips. /cc/paper/// /211//112 /011/hhhh//
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d' Alché-Buc, Emily B. Fox, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 32: Annual Conference on Neural Informa- tion Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 125- 136. 2019. URL https:://///cmm. http::::ss/ppppceeeeeeeo new.oceeeiinggs.eeiis.... nwwrinuurpp.... cwtpppppe//119/aaaeeeeee F2ec
82c4
Abst html
Nathan Inkawhich, Wei Wen, Hai Helen Li, and Yiran Chen. Feature space perturbations yield more transferable adversarial examples. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7059-7067, 2019. doi: 10. 10.10099.2.2001.000022
S.G. Krantz. Function Theory of Several Complex Variables. AMS Chelsea Publishing Series. American Mathematical Society, 2001. ISBN 9780821827246.
URL https://books.
google.
Steven G. Krantz. On limits of sequences of holomorphic functions. Rocky Mountain Journal of Mathematics, 43:273-288 283, 2010.
Honglin Li, Yifei Fan, Frieder Ganz, Anthony J. Yezzi, and Payam M. Barnaghi. Verifying the causes of adversarial examples. In 25th International Conference on Pattern Recognition, ICPR 2020, Virtual Event / Milan, Italy, January 10-15, 2021, pp. 6750 6757. IEEF, 2020. doi: 10.1109/ICPR48806..22 99112299. 941327
URI. httppp/:/oooooooggo...o///////o/
Gabriel Resende Machado, Eugênio Silva, and Ronaldo Ribeiro Goldschmidt. Adversarial machine learning in image classification: A survey toward the defender's 's perspective. ACM Computing Surveys (CSUR), 55(1):1-38, 2021.
10

---

Under review as a conference paper at ICLR 2023
Seyed-Mohsen Moosavi- Dezeooi,, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robust- ness via curvature regularization, and vice versa. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9078-9088 2019.
Mahsa Paknezhad, Cuong Phuc Ngo, Amadeus Aristo Winarto, Alistair Cheong. Chuen Yang Beh, Jiayang Wu, and Hwee Kuan Lee. Explaining adversarial vulnerability with data sparsity hypothesis. 2021. doi: 10.48550ARXXVV2103..00
URL ptttps://arxiv.oret
2103. 00778
Nicolas Papernot, Patrick D. McDaniel, and lan Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. CoRR, abs/1605.07277 2016. URL httt:://axxiiii org/ abs 0727777277
Andrew Slavin Ros and Finale Doshi Velez. Improving the adversarial robustness and interpretabil- ity deep neural networks by regularizing their input gradients. In Proceedings of the Thirty- Second AAAI Conference Artificial Intelligence and Thirtieth Innovative Applications of Arti- ficial Intelligence Conference and Eighth AAAI Symposium on Educational Advances in Artificial Intelligence, 1AAAI1//IAAI
18, AAAI Press, 2018. ISBN 978-1-57735-800--.
Sankar Das Sarma, Dong-Ling Deng, and Lu-Ming Duan. Machine learning meets quantum physics. Physics Today, 72(3):48-54 54, mar 2019. doi: 10. 10.1063/pt.3.4166
URL attps:://oo.....
10. 10.106342Fpt.. 41614
S. Shalev-Shwartz and S. Ben-David. Understanding Machine Learning: From Theory Algo- rithms. Understanding Machine Learning: From Theory to Algorithms, Cambridge University Press, 2014. ISBN 178100755733.. URL cittpss:/bboe google..ooooooooooooooooooooo. com/booksiid
EtJKAWAAQBAJ
Adi Shamir, Odelia Melamed, and Oriel BenShmuel. The dimpled manifold model of adversarial examples in machine learning. CoRR, abs/2106.1013 10151, 2021. URL https://araa org/
fos/2206.10155)
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings. 2014. URL http:
//arxiv.org/aa abss///ab////ae absaaasssl111 1122. 6199
Thomas Tanay and Lewis D. Griffin. A boundary tilting persepective on the phenomenon of ad- 2016. URL
versarial examples. CoRR,
07690
Zerui Wen. Fourier attack more efficient adversarial attack method. In The 6th International Conference on Control Engineering and Artificial Intelligence, CCEAI 2022, pp. 125-130, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450385916, doi: 10. 1145/3522749.3522077 http:////////////.../////.//////
A ROBUST TRAINING IN A NUTSHELL
The main text concerned with the theoretical aspects of the proposed framework. While the theoretical discussion is necessary, some readers might only be interested in the implementation of the framework. Here, we will describe the framework in a step-by-step manner from practical perspective.
The goal in our framework is to show that a learning rule A satisties the condition in definition 2.2 In other words, we want to guarantee that h. = A(d,)) converges uniformly to /: = A(D). For example, Barati et al. (2021) find a robust learning rule for polynomials by choosing a particular sequence of training points (the Chebyshev grid) that guarantee the uniform convergence of the sequence of hypotheses. However, finding optimal training sets in practice is not well-defined process. Ilyas al. (2019) need robust classifier in the first place generate optimal training
11

---

Under review as a conference paper at ICLR 2023
set and applying the proposal of Barati et al. (2021) to ANNs does not end up with a unique set of optimal training points as it did with polynomials.
In our framework, theorem 4.2 provides alternative to an optimal sequence of training points. In this case, ha : X - C would map X to a subset of C with minimal area. The area of h, (2²) is decided by d,, and it will be less than equal the area of h(x)). We exploit this fact to guarantee uniform convergence of ] for binary classifiers. could be taken for other applications of machine learning as well.
conceivable that a similar approach
In conclusion, implement the proposed framework in the following steps:
1. Check if A satisfies definition 2.2 it does, A is already robust. For example, Barati et al.
(202I) used Bernstein polynomials to uniformly approximate the optimal hypothesis.
2. Replace the regularization term of A with Dirichlet energy of the hypothesis E[ha].
3. Check if the updated A satisfies definition 2.2 To do so, consider an arbitrary path y
IR + X and prove that h is robust on y when length of h())) is minimal.
4. If computing [(h,]] is intractable, consider finding set of suitable harmonic features.
B COMPARISON WITH THE LITERATURE
The main point of distinction between the proposed framework and the competing proposals in the of complex analysis simplify the analysis. Even though analytic properties of the hypotheses has been exploited before in the literature to derive various methods defence and attack, e.g. Wen 2022)) the use of holomorphic functions and complex analysis in machine learning have been sparse Barkatou & Jaroschek (2018); [Hilman et al. (2015); Sarma et al. (2019). We believe the reason to be that applying complex analysis to machine learning an interdisciplinary effort by nature.
Goodfellow et al. (2015) were the first to show that nonrobust ANNs are weak to analytic attacks, and attributed the phenomenon to something that they called linearity. [Tnaay & Griffin (2016) refuted this claim by showing that linear classifiers could be robust. We answer the apparent paradox between linear and nonlinear nature of the phenomenon by proposing that both positions are some sense correct, and that the phenomenon would be better described by the analytic properties of the robust hypothesis.
Hein & Andriushchenko (017)) proposed certificate of robustness for differentiable classifiers. The same certificate could be used for analytic functions. The certificate might be improved by considering the Taylor series expansion of the classifier around test sample. The Abcl-Ruffini theorem might result in some complications in this process.
From a geometric point of view, proposal is very well aligned with the dimpled manifold model of (Shamir et al.) (202T). Regarding the boundary tilting perspective of Tanay & Griffin (2016), seems that the nonrobust classifier in figure ha has managed to cross the decision boundary at right angles, and there seems to be exceptions to the boundary tilting perspective in nonlinear cases. Paknezhad et al. (202T) hypothesises that the robust classifier would maximize the margin. We did not make an attempt to analyze the learning rule from the perspective of maximum margin classification. Nonetheless, the peculiar shape of the image T under the robust hypothesis in figure Ic suggests that the proposed robust SVC learning rule also maximizes the margin in some sense.
Our model for the transfer of adversarial examples is mostly similar to the proposal of Goodfellww al. (2015). in which the reason for the transfer of adversarial examples are deemed to that the models converge to the optimal linear hypothesis. Papernot et al. (2016) shows that existing machine learning approaches are in general vulnerable to systematic black-box attacks regardless of their structure, showing that transferable adversarial examples are common in machine learning models. Here, we have defined the holomorphic optimal Bayes classifier and given a formal definition of how transfer occurs. Ilyas al. (2019) moves the blame to hidden patterns in the input, which our proposal does not align with. Inkawhich et al. (2019) relates the transfer of the adversarial examples to the learned features as well.
There are multiple instances of the use of gradient information through out the literature Ros & Doshi- Velez 2018 Paknezhad et al. 2021). The main contrast between our proposal is that
12

---

Under review as a conference paper at ICLR 2023
manage relate gradient regularization with the geometry of f(X) and further reveal how gradient regularization is related with the Dirichlet energy of the hypothesis.
C PROOF OF THE THEOREMS
C.1 THEOREM
Proof. (2) would be nonuniform learnable and only if is a countable union of PAC Icarnable hypothesis classes (X)). Since (2) is Hilbert space, it has orthonormal basis {Pa ) a==0 Then, we can choose
Ha
axpx(r))a RR)
(28)
k=0
and the theorem would follow.
C.2 THEOREM
Proof. The Lagrangian of program 7is
1 - 2 / [(w) dV + Σ An - tn
ulu)o((nn (V
(29)
We can rearrange the Lagrangian into
N
L nn
/ [
[(]W|{= Σ
Aut (wtr (V(w) (w)++ + Σ An
(30)
n=l
L(W, Vv) dV
Σ A
(31)
n
By the Euler-Lagrange equations for function of several variables, the optimal must satisfy the following PDE
3 8L
Σ
0,
(32)
5v
dx.
5v,
j=1
in which V/ Jæ, and is the usual differentiation with the exception that it treats v/ like symbolic variable. Thus,
N
v(w) Σ
(ntno(
(33)
n=1
Similarly, the Lagrangian of program Gli
N In Σ (x.))
L Σ
Σ n=1
Am
(34)
1=0
The optimal a; is achieved when the derivative of the Lagrangian with respect to a; vanishes. Thus,
0
Antn)
(35)
To see that the learning rule is robust in general, consider the Dirac's delta, which could be constructed by taking the limit of a Normal probability distribution function with vanishing variance,
f00 otherwise
8(z;w) lim A(;, --+
(36)
13

---

Under review as a conference paper at ICLR 2023
We can that the output of the SVC learning rule,
h(x) / (W) = v(x),
(37)
(38)
would be the same the memoising learning rule, which is the text book example of consistent learner that not nonuniform. Thus, the sample complexity of the SVC learning rule dependent on the distribution of training samples. Our definition of robustness the same Cauchy's s criterion for uniform convergence of a sequence of functions. Since the sample complexity of the SVC learning rule depends on the distribution of training samples, {-A(d,) ]== cannot be uniformly converging to its limit in general.
C.3 PROPOSITION 2.6
Proof. Consider the integral representation
h(x) S v(w))(r;w)) dv = v(x).
(39)
According to theorem 2.5 in the infinite sample limit we would have
h(x)= / () {(x)t(x)).
(40)
(41)
Since the norm of should be minimal and h should satisfy (<>)((x) 2 we can deduce that X(x) = for all æ. We can ignore the samples on the decision boundary since they a degenerate subset of X. Consequently, if E H. then would remain feasible and would dominate all other h H. in terms of the training loss and the regularization score.
C.4 THEOREM 2.9
Proof. Since H is normal, we know that for large and diverse enough training sets it is true that
h il Sc c.
(42)
Moreover, since OH normal well, it true that
ah
ah 1l SC.
(43)
Dz.
dz.
Given both conditions, we can infer that a gradient based attack would follow a similar path for both and h and the label that would be assigned to the generated adversarial example would also be probably approximately equal.
C.5 THBOREM 2.10
Proof. It enough to find a learning rule A with respect to (x') that does not satisfy the condition for being normal. The SVC learning rule for the integral representation
h(x)) / v(w))(x:w) dV
(44)
such a learning rule. To see why, imagine set training points ~ d,. Then h = A(S) would be a point mass function. Consequently, cannot find dense set K X' for which
[|A(d,)) A(D) S e.
(45)
Thus, (22) is not normal hypothesis class.
n
14

---

Under review as a conference paper at ICLR 2023
C.6 THEOREM 3.5
Proof. First, assume that A is a nonuniform learner with respect to (2)). By the definition of nonuniform learnailityy, for any e, 6 0 a natural number N exists that for any training S larger than N and with probability 1- 8 we have that
2, c.
(46)
Then every (A(d,))m= is converging uniformly to A(D).
Proposition C.1. Suppose (fn)== C ((()) converges uniformly compact subsets of X to the function f : X + C. Then O(X) and for each a E N
lim fn 001 n-000
(47)
compactly X. 8 is shorthand notation for
glal
|a| = Σ
aj.
(48)
0z Ox ... 0x
jml
Thus, we can deduce that
0A(d.)) 0A(D) 0x,
1100 Se j j= 1, ,d
(49)
dz;
Equation 49 shows that (2)) and (x) are normal hypothesis classes with respect to nonuni- form learners.
Proposition C.2 (Krantz 2010)). Let (fa)e be a sequence of holomorphic functions domain X C Cd. Assume that the sequence converges pointwise to a limit function f on X. Then f is holomorphic dense open subset of X. Also the convergence is uniform on compact subsets of the dense open set.
Proposition C.2 shows that when A is consistent learner for (x') and {A(dx)) is converging pointwise to A(D), then the convergence is uniform on some dense open K C X and we have that
[(()),)) - AAD mm Se
(50)
0A(d,) 0A(DD) 1100 S é'
(51)
0x, dx,
on K. As result, A²(X) and (2) are normal hypothesis classes with respect to universally consistent learners.
C.7 THEOREM
Proof. Since A is not robust, (A(d,) ] is a pointwise converging sequence of holomorphic func-
tions. According to proposition C.2 A(D)
is holomorphic on a dense open subset K C X' and
[IA(D) opll20 Se
(52)
on K.
L
C.8 THEOREM
Proof. Consider smooth path 7 [0, X. The length of the image of y under h A2 is
[M(>)]] = [ (V)))()))) dt,
(53)
Hence, when A has minimized E[h). has minimized ||((T)]] for all yy Consequently. the image of all of the paths that start from training sample would stay close f(z) possible. It follows
15

---

Under review as a conference paper at ICLR 2023
that ((S) and the imaginary axis, which represents the decision boundary, would have the minimum number intersection points allowed by the training set S.
According definition 2.2 to show that A is robust, have to show that for any 2 0 non- negative integer N cxists for which the output of A for any two training set S, St DD larger than N would satisfy
||A(S) l S.
(54)
Without loss of generality, assume that A(D) partitions X' into M regions. Thus, long S is diverse enough so that we have at least one sample from each region, the number times that the image of any curve (7) intersect with the decision boundary would not change. Consequently, adding any more samples to the training set would only results into a more accurate estimation of the position of the decision boundary. In other words, it is always the case that after adding the required M support vectors to S,,, the position of the decision boundary would not make any drastic changes. As result, for big enough training sets, equation 54 would be satisfied.
Keep in mind that the same could not be said about a learning rule that does not minimize b[hh] since there no guarantee that A(d,)(7) and the decision boundary does intersect more than necessary.
C.9 THEOREM 4.5
Proof. h has representation
M(2) = Σ anito (2) a² x()))
(55)
az0
We can prove the theorem by simply calculating F(f).
[ [vh(z)] (z) = [ a" J(2)J())(adV())
(56)
[ J(z)J(2)) (2)a),
a In
(57)
n "Ea uaa,
(58)
in which J(2) the Jacobian of the feature vector p(2))
C.10
THEOREM
Proof. The Lagrangian for the real-valued robust SVC learning rule is
1
Σ Aa - in / u(w)o(sniw) dV
L= 2 [V(WW))
+
(59)
d
N
N
/ Σ
kj(w)
Σ
dV + Σ Az
(60)
j=1
n=1
n=
L(w, VV) +
Σ An-
(61)
By the Euler-Lagrange equations for function of several variables, v satisfies the following equa- tion
8L
a 8L
0.
(62)
8v
Jws du;
J=1
Consequently, must satisfy the following PDE
-Av(w)= = Σ Antn
(63)
n=
16

---

Under review as a conference paper at ICLR 2023
C.11
THEOREM 5.3
Proof. We know that
N v(w)= = Σ an
(64)
n=1
(w) = -sn(w)
(65)
Computing Elp], we would have
Fluj = / Vu(w). vV(w)d((w),
(66)
2
N
/ VSn(w) dV
agam
dV
(67)
n=1 m==1
Since 5 is twice differentiable, we may apply the divergence theorem to get
J v. (Sm(w)Vom(()) (w)
/ (sn(w) V (w) sn ( (w) ()) dV)
(68)
1 (n(w) (vsm (i) dS(w),
(69)
Jan
where á is the outward-pointee normal of the boundary of 52. When either satisfies the natural Newman or 5, satisfy the natural Dirichlet boundary conditions, the right hand side of equation 68 must vanish. Consequently,
J (sn(w) V (e (V) = S. 9n (w) (w) dV
(70)
By replacing the expression in Ely] we would have
Ely] || [2
ΣΣ Σ
amam J. sn (n(w)o (w) dV (w)..
(71)
m=1
D DETAILS OF THE EXPERIMENTS
D.1 SECTION 4
First, we will find op by projecting t(z) into (T) c LTT),,
(2 = [ (2)
(72)
HT( is the Hardy space T and its reproducing kernel is the Szegö kernel (T (). The theory of the Bergman and the Szegö kernels are identical as far as we are concerned. Consequently,
(x(2)
t(e10
dB.
(73)
2T 20-10)
-
sigu( (cos 0)
d0,
(74)
2T
20
-
da
d0)
(75)
2T
1 - ze ze-10
2c
i
(log( (- - i) - -log( - + +)).
(76)
17

---

Under review as a conference paper at ICLR 2023
The projection has two logarithmic branch points and computer algebra system chooses the branch cuts to be parallel to the real axis. We rotate them by 90 degrees in opposite directions so that the branch cuts perpendicular to T and fall outside of D. To rotate the branch cuts by an angle o, we have to multiply the expression inside the logarithms by e Thus, the projection of f(2) into (T) is
(D(2) [log(((=> - i)) - loo((-(-22) + i))),
(77)
log(1 -iz) log + +z)).
(78)
Next, will find non-robust hypothesis in (DD) As we have described in the paper, the or- thonormal bases for A² are
z
(2)
(79)
VTk
7kk
|a 2h
dv
π +
(80)
k:
We choose series representation for our hypothesis,
K
h(2) = b+ Σ (x)
(81)
then use a convex optimization library to solve program 17 for with S30 as the training set. Finally, we train robust hypothesis with the help of theorem 4.5 To do so, we need to find the harmonic bases for (TD).. The elements of the tuning matrix Sigk of the polynomial bases are
Ejk= = J d d
2 dV (z),
(82)
de
dz
jk. / 20-1)z((-))
dv
(83)
0 j k
(84)
kT
j= k
Consequently, the harmonic bases of (IB) are
z²
(85)
Vkz
The reader might find it interesting that the corresponding kernel for harmonic bases of A 2 the polylogarithm of order 1,
00
KB(2,))
(((2)
(86)
(2t)
(87)
k
k=
log(1 - =
(88)
D.2 SECTION 5
We train a single-layer perceptron in the first part of section 5 The training samples are a set equispaced points in [-1, 1] and are labeled by their sign. We choose integral representation for the network,
hxx) / H [R|w]x + 3(w)) dV We A2))).
(89)
18

---

Under review as a conference paper at ICLR 2023
In which (x) 1220 is the Heaviside step function. We need to choose representation for y to compute h. In this experiment we want to compare the performance of the orthonormal and harmonic bases of (D)). Replacing V with the corresponding representations we have
wh
h(x)
On
(M[W2 + 3(w)) dV (w),
(90)
VTR
k=
(x()))
ak
(91)
VTk
0=
Thus, the harmonic and orthonormal h have representations
k:
++1
h(z)=
(xx(x),
(92)
π
h²* (x) Σ
a
kT Vx(x).
(93)
k=0 0
Next, we will compute 4/x
(x(2)
wh HHH((( - i)] dV
(94)
w² [W),
(95)
R[w(o-1)]20
tan (x))+70
k rdrd0,
(96)
(xx)
tan (x))+ 2:00 d0, 1
(97)
+ 2)
Lan-!(())
ik( tan (x))
((-1)--1)
(98)
kik + 22
0
k even
exp (-th k(k+22
(99)
odd
Finally, we will train h and h* using the complex SVC learning rule. If the norm of i was too small and training was numerically unstable, multiplying all th with a constant would not change the results.
The second experiment compares the robustness of a MLP with the robustness of harmonic and orthonormal Chebyshev bases. The MLP size is 64 40 x 30 x 20 x 10 and all the neurons are ReLU activated. The MLP has minimized the cross entropy loss and is trained by the ADAM optimizer.
We will use the Chebyshev bases T, as polynomial features. However, it would be computationally intractable to to include all possible polynomial bases in the hypothesis. To see why, consider the count of all polynomial bases where each I; has a degree of at most one. This set has the same cardinality with a set that contains all possible subsets of {a i.e. the power set of (a, 141 Consequently, we have to decide which polynomial basis would be added to the hypothesis.
f==1-
To do so, we enumerate all the possible walks up to D steps on 8x8 lattice, and then map each walk to polynomial. A node in the lattice represents pixel, and the structure of the lattice represents the structure of 2D image. A walk with D steps would be mapped to a degree D polynomial. For example, the following walk
Foo + Toi + I11 + T10 - Too
(100)
would be mapped to
T2 (i
(To (3) (311)-
(101)
19

---

Under review as a conference paper at ICLR 2023
We add loop to every node in the lattice that monomials would be included in the set of features as well.
Next, we have to compute the clements of the tuning matrix Ea...
Eaß-
(TTa (21) Tool(Fos)) (TT, (21) TTo (x6a)) dV
(102)
111,1
64
d
Tag (1z)) day
Tay(1r) (Tz)
II
Tap
(x)),
(103)
[-1,1]a
dæz
==1
jif
64
II jzh
Tan Ta
( (v))..
(104)
1-1,1|64
We need the following formulas for computing the integrals,
2 2 72 oddd Tz(x))
for odd n. for even n,
(n(2)=
(105)
2 even j (T)())
-1
0
if n + m,
[ T2 (2) (m))
dr
v1 x2 if n = m = 0,
π
(106)
if n m # 0.
Finally, we compute the harmonic Chebyshev bases and train the polynomial hypotheses using the SVC learning rule. To test the robustness of the trained polynomials, we evaluate the performance of the polynomials on adversarial examples that are generated by attacking the MLP with a single-step le normalized gradient- based attack.
E DOMAINS OF HOLOMORPHY
In this section, we provide brief summary of domains of holomorphy and describe how such domains could be constructed for common applications of machine learning. In complex analysis, scalar E C. Domains of holomorphic
the main subject of study are holomorphic functions functions in this setting are simple objects that are described by the Riemann mapping theorem and its generalizations, which states that is a simply connected domain in C and is not C itself, then biholomorphic map between X' and the unit disk ID exists. One way to show that some domain is domain of holomorphy is by finding a biholomorphic map between that domain and another domain holomorphy. A biholomorphic map is map that is holomorphic and has holomorphic inverse. As we have shown in section unit disk a domain of holomorphy. Thus, all simply connected domains in C are domains of holomorphy.
However, an analogue for the Riemann mapping theorem does not exist for several complex vari- ables. Domains of holomorphy has geometrical property known as pseudoconvexity. The formal description of pseudoconvexity is very technical and we believe that the formal definition is not use- ful to the audience. Instead, we will present the reader with some domains of holomorphy, and then describe a method for constructing new domains of holomorphy from those building blocks.
We already know that the unit disk D C C is a domain of holomorphy, and how we can use bi- holomorphic mappings to find new ones. In higher dimensions, we can construct a domain of holo- morphy using a Cartesian product of other domains of holomorphy. As a special case, the Cartesian product of d disks is called polydisk Dd(c, r) centered on and with radius and is defined as
Dd(c,r) (= Cd1 ||2 - eg S Kr,Jj = 1,... .d).
(107)
The boundary of the polydisk (0, 1) could be used to encode [0, 1 To do so, map each real dimension to a complex variable with
2j kr,,
(108)
20

---

Under review as a conference paper at ICLR 2023
The complex exponential is periodic function that maps the real line to the unit circle. procedure could be used to complexify datasets like MNIST.
This
It is possible to find domains of holomorphy that cannot be constructed using Cartesian product of lower dimensional domains. One such domain is the ball ((c,7 r) centered on e with radius r
B(c,r) {a C |
cll r).
(109)
The boundary of the ball could be used to encode correlated dimensions that has a constant magni- tude such as one-hot encoded categorical data. The real data could be mapped to a complex variable as the case for polydisks, with the extra step of normalizing goes without saying that a Cartesian product of balls and polydisks is also a domain of holomorphy.
Cd to have the magnitude. It
F ARE COMPLEX NUMBERS NECESSARY?
One might imagine that we could have described the same framework without ever mentioning the complex numbers. In this section, we discuss how complex analysis helps us in our analysis, and why we think that complex analysis has much more to offer.
First, we know from various papers in the literature of adversarial examples phenomenon that the issue would occur in most applications of machine learning. Thus, if we want to describe the phe- nomenon, we have to analyse in a context that is free from the choice of the hypothesis class. In opinion, analysis based on learning theory has the best chance of fulfilling this requirement.
However, we want to apply learning theory, we need to describe the phenomenon in learning the- ory terms as well. Consequently, need to come up with definitions that conform to how learning theory defines its objects of study; the language of PAC learnability and uniform convergence.
The first obstacle the would face is that real differentiable functions not closed under uniform convergence. In other words, it is possible to find a sequence of real differentiable functions {fn ) that is uniformly converging f. and yet dealing with the output of learning rule A, we cannot assume that the output is not ill-behaved in its derivatives. We recommend that the reader take a look at the Weierstrass function to get a picture of how ill- behaved the derivatives could become. This is big issue for our analysis given that most of the definitions in the literature around the context of adversarial examples requires differentiation in one way or the other.
nowhere differentiable. Consequently, when we are
To guarantee that the pointwise limit of sequence of differentiable functions differentiable, the sequence needs to be pointwise converging in its value and uniformly converging in its derivatives. According to PAC learnability, to achieve uniform convergence in derivatives, we need to train the derivatives of the hypothesis. But, how would we generate a training set for the gradient of the label "dog" with respect to the pixels in an image? We cannot ask a human to generate the derivatives! On its face, this is likely impossible feat, and it seems that adversarial examples phenomenon is out of the reach of learning theory.
This is where complex numbers show their true potential. It is known that sequences of complex differentiable (holomorphic) functions are closed under uniform convergence; proposition C. is a testament to this fact. In other words, if {f sequence is compactly converging to a function f. we know that f is holomorphic. As we have stated in the main article, only complex-valuee functions of a complex variable can be holomorphic. As result, moving away from the complex number system to the real number system would be huge step for some the proofs in this paper. Nevertheless, while it would be more involved, is probably possible to find similar theorems for real-valued hypotheses with the help of distributional derivatives.
sequence of holomorphic functions and the
Apart from the ease of analysis of sequences of holomorphic functions, these functions are also unique in their geometrical properties. In the main article, we freely talk about the angles and lengths in the domain and the range space of complex-valued hypothesis. We would not be able to do so if it was not for the holomorphicity of the hypothesis. The boundary tilting perspective of to be taken for setting up a framework for rigorous study of the phenomenon in a geometrical sense. As demonstrated by Tanay & Griffin (001)), coming up with alternative formal definitions for the real and the imaginary axis in
Tanay & Griffin (2016) is good example of the steps needed
21

---

Under review as a conference paper at ICLR 2023
proposal is not walk in the park. Moreover, when Tanay & Grithi 2016 managed do so, proved to be too difficult to apply the geometrical intuition to a nonlinear hypothesis. In contrast, the geometrical interpretability of holomorphic functions enable circumvent these problems, and to translate our geometrical intuition to formal mathematical expressions with ease.
In conclusion argue that while it is possible recreate framework without ever mentioning the complex number system, doing so would need even more exotic mathematical objects, and a much more involved discussion.
G NOTATION AND SYMBOLS
Symbol
Meaning
A
learning rule the domain of the hypothesis
X
H
hypothesis space the uniform norm
ax
the boundary of the domain X
OH
the class of derivatives of H. set training samples with size n distribution
S,S,
d
D
a uniform distribution on X' the space of square- inttre-itteeealee functions feature parameterized by discreet variable
I?
feature parameterized by continuous variable harmonic feature parameterized by discreet variable harmonic feature parameterized by continuous variable the submanifold of natural samples
""*
S
the submanifold the decision boundary the space of holomorphic functions the Bergman space the Bergman kernel of X' the optimal Bayes classifier
O
2
Kx
fo
OD
the holomorphic optimal Bayes classifier the unit disk the unit circle the Szegö kernel of 0.X' the norm induced by 7. the Dirichlet energy of h the gradient operator the Laplacian operator the I Lagrangian the ramp function the Heaviside step function
IB
T
Sax
E[h]
V
A
L
ReLU
H
(.)
a sequence with indices ranging from j to k
22


Reviews:
[{"review_id": "Ec8yeGvMtn", "reviewer": "Reviewer_eViJ", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work provides a formal definition for robustness based on learning theoretical terms. Specifically, holomorphicity enables complexity analysis tool to investigate the phenomenon of adversarial examples. In addition, the analysis provides a geometrical interpretation for these phenomena.", "summary_of_the_review": "In general, I think this paper is not ready for publication because of the concerns above.\n\nAs I am not familiar with differentiable hypothesis, I welcome the authors clear my concerns and make me better understand the technical contribution of this paper during the discussion.", "strength_and_weaknesses": "Strength:\n\nIt is novel to study the phenomenon of adversarial examples from the aspect of differentiable hypothesis, a new aspect as far as what I know.\n\nWeakness and Questions:\n\n1. The settings are a bit restricted: all theorems are based on binary classification. In addition, many theorems are based on support vector classifier (SVC), which is a linear model and much simpler from the ones used in practice.\n\n2. Numerical results are not very strong: a simple MLP model on a single and simple dataset. The attack to evaluate the adversarial accuracy should be stronger than one-step black-box attack (Figure 3). Probably, more experiments are needed.\n\n3. Presentation needs improvement (See the next section)", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "DuYR9iLKxE", "reviewer": "Reviewer_vhPa", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a geometric and analytic modeling perspective for robust training. They first propose a formalization of robustness in learning theoretic term, then give a geometrical description of the phenomenon for simple classifiers. Experiments are conducted on synthetic and real-world data to verify their idea. ", "summary_of_the_review": "I would vote for reject since the writing does not meet the bar. Even though the paper may contain interesting ideas, it probably should go through another review round after a major revision. ", "strength_and_weaknesses": "Strength:\nThe paper tries to provide a general framework for robust learning and the goal is plausible. \n\nWeaknesses: \nThe writing is weak and as a result I can only barely judge the other aspects of the paper.  \nAside from the obvious LaTex compiling error, the paper spends quite a few pages to include new definitions, which are only explained in later sections. When reading the paper following each section, the reader may get confused about why this definition is included -- very oftenly the definition just appear without any motivating sentences. For example, there is no explanation for why SVC is needed before Definition 2.4 and why complex-value classifier is needed before Definition 3.1. \nThe writing also fails to clearly identify Assumptions that should be made for this analytical framework, e.g., \"If we find some sample x that does not perplex h but is not correctly labeled by h, then we assume that H is agnostic to the pattern f x.\" appears in a paragraph, but I think this should be an assumption that needs to get highlighted. \nAlso in terms of clarity, when the paper mentions \"integral representation is more adequate for analysis when there is a continuum of features to choose from, e.g. ANN\" -- the paper does not define what 'feature' is in ANN so one can only guess what the meaning is. \nThere are clarity issues in the main results section (Section 4) as well. Theorem should be self-explanatory as much as possible, whereas in Theorem 4.1, it is unclear what does f mean and there is no short proof provided (if one dives deeper, it points to Appendix C.7 then Proposition C.2 which seems to be from another paper.). \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "DIXEKDSGWgo", "reviewer": "Reviewer_2yAx", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper provides an analytical framework to understand adversarial example problems in a more formal way. Several hypothesis classes are discussed, especially $L^2$ (square-integrable functions) and $A^2$ (Bergman space, a subspace of holomorphic square-integrable functions). For their framework, the authors extended the space of classifiers so that it contains complex-valued functions as classifiers. Their main statement (Theorem 4.2) states that a learning rule minimizing Dirichlet energy would induce a robust classifier. A practical discussion on how to implement the main idea and an experimental exploration are provided.\n", "summary_of_the_review": "I consider the paper novel and valuable work. This paper contains novel insights into training robust classifiers. Especially the concept of complex-valued function as a classifier can provide further insights as it simultaneously encodes two geometric objects (the data manifold and the decision boundary). Though I could not check the whole proof, the suggested learning rule looks novel and interesting. The author also demonstrated that the proposed idea is also implementable and can be reduced to solving a PDE problem.\nRegarding some negative factors, the paper contains some LaTeX problems, including missing references, and lacks details about the experimental setup, raising a reproducibility issue. However, I believe these are amendable issues, and I’m willing to raise the score after they are fixed.\n", "strength_and_weaknesses": "[[Strengths]]\n1. The paper provides precious theoretical insights into robust classification.\n2. About implementing the authors’ learning rule (Theorem 4.2), the paper proposes a practical method based on a well-understood PDE problem. This reduction to the PDE problem would open up a new research direction.\n\n[[Weaknesses]]\n1. The paper has a few LaTeX issues. First, there are some missing references, e.g., ‘section ??’ in Section 5, ‘lemma ??’ in Appendix C.4, and ‘definition ??’ in Appendix C.8. Since those missing references appear in the main body (or even in the proof), the authors should fix these missing references. Also, please fix the Appendix sectioning so that the material starts from Appendix A. (Currently, Appendix A is just an empty section with the title ‘Appendix’)\n2. About the experimental details, the authors mentioned that “The interested reader can find the details of the experiment in the supplementary materials.”, but the supplementary materials only contain iPython notebooks that the reader should run. This is submitted as an academic paper, and general readers (even those who are interested in experimental details) only read the written materials. Therefore, this raises a reproducibility issue. (the descriptions in the paper are not enough to reproduce the result.) I suggest the authors 1. write an additional section (in the Appendix) about experimental details (e.g., network structure, hyperparameters, etc.) and 2. put your code on a code repository and add the link to the repository in the camera-ready version. (Because this is a blind review, you should not add the repository link during the review process.)\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ANRXx69-hg", "reviewer": "Reviewer_od7j", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, the authors introduced a general framework for training robust models. The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. Some theoretical analysis is given.", "summary_of_the_review": "In summary, this is a solid paper with novel ideas. The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. However, This paper is not very well written. Also, more theoretical results on more complicated models should be included. ", "strength_and_weaknesses": "Strength: The idea of using calculus of variations and differential equations to tackle the robust training of neural network models is novel and interesting. The theoretical results seem solid.\n\nWeaknesses: 1. This paper is not well written since there are many typos. For example, see \"Section ??\" on Page 8, \"Lemma ??\" on Page 13, and \"Definition ??\" on Page 15.\n2. Many theoretical results are about SVC. More theoretical results on more complicated models should be included.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject