Title: The Adversarial Consistency of Surrogate Risks for Binary Classification
Venue: NeurIPS 2023
Accepted: yes
Keywords: Adversarial learning

surrogate risks

optimal transport
Abstract: We study the consistency of surrogate risks for robust binary classification.
	It is common to learn robust classifiers by adversarial training, which seeks to minimize the expected $0$-$1$ loss when each example can be maliciously corrupted within a small ball.
	We give a simple and complete characterization of the set of surrogate loss functions that are \emph{consistent}, i.e., that can replace the $0$-$1$ loss without affecting the minimizing sequences of the original adversarial risk, for any data distribution.
	We also prove a quantitative version of adversarial consistency for the $\rho$-margin loss.
	Our results reveal that the class of adversarially consistent surrogates is substantially smaller than in the standard setting, where many common surrogates are known to be consistent.

The Adversarial Consistency of Surrogate Risks for Binary Classification

Abstract

We study the consistency of surrogate risks for robust binary classification. It is common to learn robust classifiers by adversarial training, which seeks to minimize the expected 0 -1 loss when each example can be maliciously corrupted within a small ball. We give a simple and complete characterization of the set of surrogate loss functions that are consistent , i.e., that can replace the 0 -1 loss without affecting the minimizing sequences of the original adversarial risk, for any data distribution. We also prove a quantitative version of adversarial consistency for the ρ -margin loss. Our results reveal that the class of adversarially consistent surrogates is substantially smaller than in the standard setting, where many common surrogates are known to be consistent.

1 Introduction

A central issue in the study of neural nets is their susceptibility to adversarial perturbationsperturbations imperceptible to the human eye can cause a neural net to misclassify an image [Szegedy et al., 2013, Biggio et al., 2013]. The same phenomenon appears in other types of data such as speech and text. As deep nets are used in applications such as self-driving cars and medical imaging [Paschali et al., 2018, Li et al., 2021], training classifiers robust to adversarial perturbations is a central question in machine learning.

The foundational theory of surrogates for classication in well understood. In the standard classification setting, one seeks to minimize the classification risk- the proportion of incorrectly classified data. Since minimizing the classification risk is typically computationally intractable [Ben-David et al., 2003], a common approach is to instead minimize a better-behaved alternative called the surrogate risk . However, one must verify that classifiers with low surrogate risk also achieve low classification risk. If for every data distribution, a sequence of functions minimizing the surrogate also minimizes the classification risk, the surrogate risk is called consistent . Many classic papers study the consistency of surrogate risks in the standard classification setting [Bartlett et al., 2006, Lin, 2004, Steinwart, 2007, Philip M. Long, 2013, Mingyuan Zhang, 2020].

Unlike the standard case, however, little is known about the consistency of surrogate risks in the context of adversarial training, which involves risks that compute the supremum of a surrogate loss function over an ϵ -ball. Though this question has been partially studied in the literature [Awasthi et al., 2021a,c, Meunier et al., 2022], a general theory is lacking. Existing results reveal, however, that the situation is substantially different from the standard case: for instance, [Meunier et al., 2022] show that no convex surrogate can be adversarially consistent. To our knowledge, no adversarially consistent risks are known.

In this work, we give a complete characterization of adversarial consistency for surrogate losses.

Our Contributions:

In Section 4 we give a surprisingly simple necessary and sufficient condition for adversarial consistency:

Informal Theorem. Under reasonable assumptions on the surrogate loss ϕ , the supremumbased ϕ -risk is adversarially consistent if and only if inf α ϕ ( α ) / 2 + ϕ ( -α ) / 2 < ϕ (0) .

In particular, this result proves consistency for any loss function that is not midpoint convex at the origin.

In Section 5, we specialize to the case of the ρ -margin loss, where we obtain a quantitative proof of adversarial consistency by explicitly bounding the excess adversarial risk.

To the best of the authors' knowledge, this paper is the first to prove that a loss-based learning procedure is consistent for a wide range of distributions in the adversarial setting. As mentioned above, the ρ -margin loss ϕ ρ ( α ) = min(1 , max(1 -α/ρ, 0)) satisfies the conditions of Informal Theorem above, as does the shifted sigmoid loss ϕ τ ( α ) = 1 / (1 + exp( α -τ )) with τ > 0 , which confirms a conjecture of Meunier et al. [2022]. By contrast, all convex losses satisfy inf α ϕ ( α ) / 2 + ϕ ( -α ) / 2 = ϕ (0) , and are therefore not adversarially consistent.

In addition to consistency, one would hope to obtain a quantitative comparison between the adversarial surrogate risk and the adversarial classification risk. Our bound in Section 5 shows that the excess error of the adversarial ρ -margin loss is a linear upper bound on the adversarial classification error, which implies that minimizing the adversarial ρ -margin loss is an effective procedure for minimizing the adversarial classification error. Extending the bound in Section 5 to further losses remains an open question.

2 Related Works

Many previous works have studied the consistency of surrogate risks [Bartlett et al., 2006, Lin, 2004, Steinwart, 2007, Philip M. Long, 2013, Mingyuan Zhang, 2020]. The classic papers by [Bartlett et al., 2006, Lin, 2004, Zhang, 2004] explore the consistency of surrogate risks over all measurable functions. The works [Philip M. Long, 2013, Mingyuan Zhang, 2020, Awasthi et al., 2022] study H -consistency, which is consistency restricted to a smaller set of functions. Steinwart [2007] generalizes some of these results into a framework referred to as calibration . Awasthi et al. [2021a], Bao et al. [2021], Awasthi et al. [2021c], Meunier et al. [2022] then use this framework to analyze the calibration of adversarial surrogate losses. Furthermore Meunier et al. [2022] relate calibration to consistency for adversarial losses in certain cases - they show that no convex loss is adversarially consistent. They also conjecture that a class of surrogate losses called the odd shifted losses are adversarially consistent. Meunier et al. [2022] also show that in a restricted setting, surrogates are consistent for 'optimal attacks'. The proof of our result formalizes this intuition. Simultaneous work [Mao et al., 2023] shows that the ρ -margin loss is adversarially H -consistent for typical function classes. Lastly, Bhattacharjee and Chaudhuri [2020, 2021] use a different set of techniques to study the consistency of non-parametric methods in adversarial scenarios.

Our results rely on recent works establishing the properties of minimizers to surrogate adversarial risks. [Awasthi et al., 2021b, Pydi and Jog, 2021, Bungert et al., 2021] all proved the existence of minimizers to the adversarial risk and [Pydi and Jog, 2021] proved a minimax theorem for the zero-one loss. Building on the work of [Pydi and Jog, 2021], [Frank and Niles-Weed, 2023] later proved similar existence and minimax statements for arbitrary surrogate losses. Trillos et al. [2022, 2023] extend some of these results to the multiclass case. Lastly, [Trillos and Murray, 2020] study further properties of the minimizers to the adversarial classification loss.

3 Problem Setup

This section contains the necessary background for our results. Section 3.1 gives precise definitions for the main concepts, and Section 3.2 describes the minimax theorems that are at the heart of our proof.

3.1 Surrogate Risks

This paper studies binary classification on R d . Explicitly, labels are {-1 , +1 } and the data is distributed according to a distribution D on the set R d ×{-1 , +1 } . The measures P 1 , P 0 define the relative probabilities of finding points with a given label in a region of R d . Formally, define measures on R d by

The classification risk R ( f ) is then the probability of misclassifying a point under D :

A classifier can be obtained by minimizing either R or R ϕ over the set of all measurable functions. A point x is then classified according to sign f . There are many possible choices for ϕ -typically one chooses a loss that is easy to optimize. In this paper, we assume that

Assumption 1. ϕ is non-increasing, non-negative, continuous, and lim α →∞ ϕ ( α ) = 0 .

Most surrogate losses in machine learning satisfy this assumption. Learning algorithms typically optimize the risk in (2) using an iterative procedure, which produces a sequence of functions that minimizes R ϕ . We call R ϕ a consistent risk and ϕ a consistent loss if for all distributions, every minimizing sequence of R ϕ is also a minimizing sequence of R . 1 Alternatively, the risks R , R ϕ can be expressed in terms of the quantities P = P 0 + P 1 and η = d P 1 /d P . For all η ∈ [0 , 1] , define

For more on the definitions of R,R ϕ , C, C ϕ , see [Bartlett et al., 2006] or Sections 3.1 and 3.2 of [Frank and Niles-Weed, 2023]. Using these definitions, R ( f ) = ∫ C ( η ( x ) , f ( x )) d P and

This alternative view of the risks R and R ϕ provides a 'pointwise' criterion for consistency- if the function f ( x ) minimizes C ϕ ( η ( x ) , · ) at each point, then it also minimizes R ϕ . However, minimizers to C ϕ ( η, · ) over R do not always exist- consider for instance η = 1 for the exponential loss ϕ ( α ) = e -α . In general, for minimizers of C ϕ ( η, · ) to exist, one must work over the extended real numbers R = R ∪ {-∞ , + ∞} . The following proposition proved in Appendix A implies that 'pointwise' considerations also extends to minimizing sequences of functions.

Proposition 1. The following are equivalent:

ϕ is consistent

Every minimizing sequence of C ϕ ( η, · ) is also a minimizing sequence of C ( η, · )

Every R -valued minimizer of R ϕ is a minimizer of R

This result is well-known in prior literature; in particular the equivalence between 2) and 3) is closely related to the equivalence between calibration and consistency in the non-adversarial setting [Steinwart, 2007]. Most importantly, the equivalence between 1) and 3) reduces studying minimizing sequences of functionals to studying minimizers of functions. We will show that the equivalence

The surrogate to R is

between 1) and 2) has an analog in the adversarial scenario, but the equivalence between 1) and 3) does not.

In the adversarial classification setting, every x -value is perturbed by a malicious adversary before undergoing classification by f . We assume that these perturbations are bounded by ϵ in some norm ∥ · ∥ and furthermore, the adversary knows both our classifier f and the true label of the point x . In other words, f misclassifies ( x , y ) when there is a point x ′ ∈ B ϵ ( x ) for which 1 f ( x ′ ) ≤ 0 = 1 for y = +1 and 1 f ( x ′ ) > 0 = 1 for y = -1 . Conveniently, this criterion can be expressed in terms of suprema. For any function g , we define

A point x with label +1 is misclassified when S ϵ ( 1 f ≤ 0 )( x ) = 1 and a point x with label -1 is misclassified when S ϵ ( 1 f> 0 )( x ) = 1 . Hence the expected fraction of errors under the adversarial attack is

which is called the adversarial classification risk 2 . Again, optimizing the empirical version of (6) is computationally intractable so instead one minimizes a surrogate of the form

Due to the supremum in this expression, we refer to such a risk as a supremum-based surrogate . We define adversarial consistency as

Definition 1. The risk R ϵ ϕ is adversarially consistent if for every data distribution, every sequence f n which minimizes R ϵ ϕ over all Borel measurable functions also minimizes R ϵ . We say that the loss ϕ is adversarially consistent if the risk R ϵ ϕ is adversarially consistent.

Many convex and non-convex losses are consistent in standard classification [Bartlett et al., 2006, Zhang, 2004, Steinwart, 2007, Reid and Williamson, 2009, Lin, 2004]. By contrast, adversarial consistency often fails. For instance, Meunier et al. [2022] show that convex losses are not adversarially consistent. Furthermore, their example shows that the equivalence between 1) and 3) in Proposition 1 does not hold in the adversarial context. Thus, to understand adversarial consistency, it does not suffice to compare minimizers of R ϵ ϕ and R ϵ . To illustrate this distinction, we show the following result, adapted from [Meunier et al., 2022].

Proposition 2. Assume that inf α ϕ ( α ) / 2 + ϕ ( -α ) / 2 = ϕ (0) . Then ϕ is not adversarially consistent.

Proof. Let P 0 = P 1 be the the uniform distribution on the ball B R ( 0 ) and let ϵ = 2 R . Let ϕ be a loss function for which inf α ϕ ( α ) / 2 + ϕ ( -α ) / 2 = C ∗ ϕ (1 / 2) = ϕ (0) . Notice that inf f R ϵ ( f ) ≥ inf f R ( f ) and inf f R ϵ ϕ ( f ) ≥ inf f R ϕ ( f ) . Since P 0 = P 1 , the optimal non-adversarial risk is inf f R ( f ) = 1 / 2 . Moreover, as C ∗ ϕ (1 / 2) = ϕ (0) , the optimal non-adversarial surrogate risk is inf f R ϕ ( f ) = C ∗ ϕ (1 / 2) = ϕ (0) . Thus, for the function f ∗ ≡ 0 , R ϵ ( f ∗ ) = inf f R ( f ) = 1 / 2 and R ϵ ϕ ( f ∗ ) = inf f R ϕ ( f ) = ϕ (0) . Therefore f ∗ minimizes both R ϵ ϕ and R ϵ . Now consider the sequence of functions

̸

Because ϵ = 2 R , every point in the support of the distribution can be perturbed to every other point. Thus S ϵ ( ϕ ◦ f n )( x ) = ϕ ( -1 /n ) and S ϵ ( ϕ ◦ -f n )( x ) = ϕ ( -1 /n ) . However, S ϵ ( 1 f ≤ 0 ) = 1 and S ϵ ( 1 f> 0 ) = 1 . Therefore, R ϵ ϕ ( f n ) = ϕ ( -1 /n ) while R ϵ ( f n ) = 1 for all n . As ϕ is continuous, lim n →∞ R ϵ ϕ ( f n ) = ϕ (0) . Thus f n is a minimizing sequence of R ϵ ϕ but not of R ϵ , so ϕ is not adversarially consistent.

This example shows that if C ∗ ϕ (1 / 2) = ϕ (0) , then ϕ is not adversarially consistent. The main result of this paper is that this is the only obstruction to adversarial consistency: ϕ is adversarially consistent if and only if C ∗ ϕ (1 / 2) < ϕ (0) .

We begin by showing that this condition suffices for consistency in the non-adversarial setting. Surprisingly, despite the wealth of work on this topic, this condition does not appear to be known.

Proposition 3. If C ∗ ϕ (1 / 2) < ϕ (0) , then ϕ is consistent.

See Appendix C for a proof.

Again, some losses that satisfy this property are the ρ -margin loss ϕ ρ ( α ) = min(1 , max(1 -α/ρ, 0)) and the the shifted sigmoid loss proposed by Meunier et al. [2022], ϕ ( α ) = 1 / (1 + exp( α -τ )) , τ > 0 . (In fact, one can show that the class of shifted odd losses proposed by Meunier et al. [2022] satisfy C ∗ ϕ (1 / 2) < ϕ (0) .)

Notice that all convex losses satisfy C ∗ ϕ (1 / 2) = ϕ (0) :

The opposite inequality follows from the observation that C ∗ ϕ (1 / 2) ≤ C ϕ (1 / 2 , 0) = ϕ (0) . In contrast, recall that a convex loss ϕ with ϕ ′ (0) < 0 is consistent [Bartlett et al., 2006].

As conjectured by prior work Bao et al. [2021], Meunier et al. [2022], the fundamental reason losses with C ∗ ϕ (1 / 2) < ϕ (0) are adversarially consistent is that minimizers of C ϕ ( η, · ) are uniformly bounded away from 0 for all η :

Lemma 1. The loss ϕ satisfies C ∗ ϕ (1 / 2) < ϕ (0) iff there is an a > 0 for which any minimizer α ∗ of C ϕ ( η, · ) satisfies | α | ≥ a .

See C for a proof. Concretely, one can show that for the ρ -margin loss ϕ ρ , a minimizer α ∗ of C ϕ ρ ( η, · ) must satisfy | α ∗ | ≥ ρ . Similarly, a minimizer α ∗ of C ϕ τ ( η, · ) of the shifted sigmoid loss ϕ τ = 1 / (1 + exp( α -τ )) , τ > 0 is always either -∞ or + ∞ . In 4, we use this property to show that minimizing sequences of R ϵ ϕ must be uniformly bounded away from zero, thus ruling out the counterexample presented in Proposition 2.

3.2 Minimax Theorems for Adversarial Risks

We study the consistency of ϕ by by comparing minimizing sequences of R ϵ ϕ with those of R ϵ . In the next section, in order to compare these minimizing sequences, we will attempt to re-write the adversarial loss in a 'pointwise' manner similar to Proposition 1. In order to achieve this representation of the adversarial loss, we apply minimax and complimentary slackness theorems from [Pydi and Jog, 2021, Frank and Niles-Weed, 2023].

Before presenting these results, we introduce the ∞ -Wasserstein metric from optimal transport. For two finite probability measures Q , Q ′ satisfying Q ( R d ) = Q ′ ( R d ) , let Π( Q , Q ′ ) be the set of couplings between Q and Q ′ :

The distance between Q ′ and Q in the Wasserstein ∞ -metric W ∞ is defined as

The W ∞ distance is in fact a metric on the space of measures. We denote the ∞ -Wasserstein ball around a measure Q by

Informally, the measure Q ′ is in B ∞ ϵ ( Q ) if perturbing points by at most ϵ under the measure Q can produce Q ′ . As a result, Wasserstein ∞ -balls are fairly useful for modeling adversarial attacks. Specifically, one can show:

Lemma2. For any function g and measures Q ′ , Q with W ∞ ( Q ′ , Q ) ≤ ϵ , the inequality ∫ S ϵ ( g ) d Q ≥ ∫ gd Q ′ holds.

See Appendix D for a proof.

Minimax theorems from prior work use this framework to introduce dual problems to the adversarial classification risks (6) and (7). Let P ′ 0 , P ′ 1 be finite Borel measures and define

where C ∗ is defined by (3). The next theorem states that maximizing ¯ R over W ∞ balls is in fact a dual problem to minimizing R ϵ .

Theorem 1. Let ¯ R be defined by (8) .

and furthermore equality is attained for some Borel measurable ˆ f and ˆ P 1 , ˆ P 0 with W ∞ ( ˆ P 0 , P 0 ) ≤ ϵ and W ∞ ( ˆ P 1 , P 1 ) ≤ ϵ .

The first to show such a theorem was Pydi and Jog [2021]. In comparison to their Theorem 8, Theorem 1 removes the assumption that P 0 , P 1 are absolutely continuous with respect to Lebesgue measure and shows that the minimizer ˆ f is in fact Borel. We prove this theorem in Appendix E. Frank and Niles-Weed [2023] prove a similar statement for the surrogate risk R ϵ ϕ . This time, the dual objective is

with C ∗ ϕ defined by (4).

Theorem 2. Assume that Assumption 1 holds, and define ¯ R ϕ by (10) . Then

and furthermore equality in the dual problem is attained for some P ∗ 1 , P ∗ 0 with W ∞ ( P ∗ 0 , P 0 ) ≤ ϵ and W ∞ ( P ∗ 1 , P 1 ) ≤ ϵ .

Frank and Niles-Weed [2023] proved this statement in Theorem 6 but with the infimum taken over R -valued functions. To extend the result to R -valued functions as in Theorem 2, we show that inf f Borel ,f R -valued R ϵ ϕ ( f ) = inf f Borel ,f R -valued R ϵ ϕ ( f ) in Appendix B.

4 Adversarially Consistent Losses

This section contains our main results on adversarial consistency. In light of Proposition 2, our main task is to show that a loss satisfying C ∗ ϕ (1 / 2) < ϕ (0) is adversarially consistent.

At a high level, we will show that every minimizing sequence of R ϵ ϕ must also minimize R ϵ . However, directly analyzing minimizing sequences { f n } of R ϵ ϕ and R ϵ is challenging due to the supremums in the definitions of the adversarial risks. We therefore develop alternate characterizations of minimizing sequences to both functionals, based on complimentary slackness conditions derived from the convex duality results of Section 3.2. However, unlike standard complementary slackness conditions well known from convex optimization, these theorems allow us to characterize minimizing sequences as well as minimizers.

4.1 Approximate Complimentary Slackness

We first state this slackness result for the surrogate case, due to Frank and Niles-Weed [2023, Lemmas 16 and 26] and Theorem 2.

Proposition 4. Let ( P ∗ 0 , P ∗ 1 ) be any maximizers of ¯ R ϕ over B ∞ ϵ ( P i ) . Define P ∗ = P ∗ 0 + P ∗ 1 , η ∗ = d P ∗ 1 /d P ∗ . If f n is a minimizing sequence for R ϵ ϕ , then the following hold:

Proof. Let R ϵ ϕ, ∗ be the minimal value of R ϵ ϕ and choose a δ > 0 . Then for sufficiently large N , n ≥ N implies that R ϵ ϕ ( f n ) ≤ R ϵ ϕ, ∗ + δ . Lemma 2 and the definition of C ∗ ϕ in (4) further imply that

As R ϵ ϕ, ∗ = ∫ C ∗ ϕ ( η ∗ ) d P ∗ , this relation immediately implies (12).

Next, Lemma 2 again implies that

while (14) implies that

Therefore, subtracting ∫ ϕ ◦ f n d P ∗ 1 + ∫ ϕ ◦ -f n d P ∗ 0 from (14) results in δ ≥ (∫ S ϵ ( ϕ ◦ f n ) d P 1 -∫ ϕ ◦ f n d P ∗ 1 ) + (∫ S ϵ ( ϕ ◦ -f n ) d P 0 -∫ ϕ ◦ -f n d P ∗ 0 ) ≥ 0 . (16)

Again, (15) implies that the quantities on parentheses are both positive which implies (13).

Proposition 4 shows that minimizing sequences of R ϵ ϕ satisfy two properties: 1) The sequence { f n } must minimize the standard ϕ -risk R ϕ with measures P ∗ 0 , P ∗ 1 in place of P 0 , P 1 , 2) At the limit, the measures P ∗ 0 , P ∗ 1 are best adversarial attacks on ϕ ◦ f n , ϕ ◦ -f n . In fact, one can show that { f n } is a minimizing sequence of R ϵ ϕ if and only if it satisfies these properties. Crucially, a very similar characterization holds for minimizers of the adversarial classification loss. We state and prove the 'only if' direction of this characterization in Proposition 5.

Proposition 5. Let f n be a sequence and let P ∗ 0 , P ∗ 1 be measures in B ∞ ϵ ( P i ) . Define P ∗ = P ∗ 0 + P ∗ 1 , η ∗ = d P ∗ 1 /d P ∗ . If the following two conditions hold:

lim n →∞ ∫ S ϵ ( 1 f n ≤ 0 ) d P 1 -∫ 1 f n ≤ 0 d P ∗ 1 = 0 , lim n →∞ ∫ S ϵ ( 1 f n > 0 ) d P 0 -∫ 1 f n > 0 d P ∗ 0 = 0 , (18) then f n is a minimizing sequence of R ϵ .

Proof. Equation 17 implies that the limit lim n →∞ C ( η ∗ , f n ) d P ∗ exists. Thus (17) and (18) imply that

Therefore, Strong duality (Theorem 1) then implies that

and therefore, f n is a minimizing sequence.

We end this section by comparing the different criteria for consistency presented in Proposition 1 with Propositions 4 and 5. Together, Propositions 4 and 5 will allow us to compare minimizing sequences of R ϵ ϕ to those of R ϵ by showing that any sequence satisfying (12)-(13) must also satisfy (17)-(18). This statement is the analog to 2) of Proposition 1. Indeed, because C ϕ ( η ∗ , f n ) ≥ C ∗ ϕ ( η ∗ ) , (12) is actually equivalent to to C ϕ ( η ∗ , f n ) → C ∗ ϕ ( η ∗ ) in L 1 ( P ∗ ) . However, the extra criterion (18) implies an additional constraint on the structure of the minimizing sequence. This additional constraint is the reason 3) of Proposition 1 is false in the adversarial setting. In the restricted situation where ¯ R ϕ = ¯ R , Meunier et al. [2022] show that (12) implies (17) (Proposition 4.2). However, this observation does not suffice to conclude consistency.

4.2 Adversarial Consistency

We are now in a position to prove consistency. Before presenting the full proof, we pause to discuss the overall strategy. Consistency will follow from three considerations. First, every minimizing sequence of R ϵ ϕ satisfies conditions (12) and (13). Second, conditions (12) and (13) imply the very similar conditions (17) and (18). Finally, any function sequence satisfying (17) and (18) must be a minimizing sequence to R ϵ . The first and last steps are the content of Propositions 4 and 5, so it remains to justify the middle step.

Verifying that (12) implies (17) is straightforward. The relation (12) actually states that f n minimizes the standard surrogate risk with respect to the distribution given by P ∗ 0 , P ∗ 1 . Therefore (12) implies (17) so long as ϕ is consistent.

The main difficulty is verifying (18), due to the discontinuity of 1 α< 0 , 1 α ≥ 0 at 0. Due to this discontinuity, one cannot directly argue that (13) implies (18): to simplify the discussion, assume that ϕ is strictly decreasing on a neighborhood of the origin, in which case 1 α< 0 = 1 ϕ ( α ) >ϕ (0) and 1 α ≥ 0 = 1 ϕ ( -α ) ≥ ϕ (0) . Recall that according to (13), in the limit n → ∞ , P ∗ 0 , P ∗ 1 are the strongest attack in B ∞ ϵ ( P 0 ) × B ∞ ϵ ( P 1 ) , or informally, S ϵ ( ϕ ◦ f n )( x ) approaches ϕ ( f n ( x ′ )) for an optimal perturbation x ′ w.h.p., with a similar condition for ϕ ◦ -f n . However, due to the discontinuity of 1 ϕ ( -α ) ≥ ϕ (0) at ϕ (0) , if f n ( x ′ ) → 0 as n →∞ , this relation does not imply that 1 S ϵ ( ϕ ◦-f n )( x ) ≥ ϕ (0) approaches 1 ϕ ◦-f n ( x ′ ) ≥ 0 .

Lemma 1 says that if C ∗ ϕ (1 / 2) < ϕ (0) , minimizers of C ϕ ( η, · ) are uniformly bounded away from 0 . This fact suggests that minimizing sequences will also be bounded away from the origin, which will allow us to avoid the discontinuity there. Concretely, we show:

Lemma 3. Let C ∗ ϕ (1 / 2) < ϕ (0) . Then there is a δ > 0 and a c > 0 with ϕ ( c ) < ϕ (0) for which α ∈ [ -c, c ] implies C ϕ ( η, α ) ≥ C ∗ ϕ ( η ) + δ , uniformly in η . Furthermore, for this value of c , if α > c then ϕ ( α ) < ϕ ( c ) .

We prove this lemma in Appendix C. Because C ϕ ( η ∗ , f n ) → C ∗ ϕ ( η ∗ ) in L 1 ( P ∗ ) , Lemma 3 implies that

This relation is the key fact that allows us to show that (13) implies (18). The condition C ∗ ϕ (1 / 2) < ϕ (0) is essential for this step of the argument.

Lastly, Lemma 2 implies that ∫ S ϵ ( 1 f n ≥ 0 ) d P 1 ≥ ∫ 1 f n ≥ 0 d P ∗ 1 and thus to validate (18), it suffices to verify the opposite inequality in the limit n →∞ .

Lemma 4. Let f n be a sequence of functions and let P ∗ 0 ∈ B ∞ ϵ ( P 0 ) , P ∗ 1 ∈ B ∞ ϵ ( P 1 ) . The equation

implies the first relation of (18) and

implies the second relation of (18) .

See Appendix F for a proof. These considerations suffice to prove the main result of this paper:

Theorem 3. The loss ϕ is adversarially consistent if and only if C ∗ ϕ (1 / 2) < ϕ (0) .

Proof. The 'only if' portion of the statement is Proposition 2.

To show the 'if' statement, recall the standard analysis fact: lim n →∞ a n = a iff for all subsequences { a n j } of { a n } , there is a further subsequence a n j k for which lim k →∞ a n j k = a . This result implies that to prove R ϵ ϕ is consistent, it suffices to show that every minimizing sequence f n of R ϵ ϕ has a subsequence f n j that minimizes R ϵ .

Let f n be a minimizing sequence of R ϵ ϕ . For convenience, pick a subsequence f n j for which the limits lim j →∞ ∫ S ϵ ( 1 f n j < 0 ) d P 0 , lim j →∞ ∫ S ϵ ( 1 f n j ≥ 0 ) d P 1 both exist. For notational clarity, we drop the j subscript and denote this sequence as f n .

By Proposition 4, the equations (12) and (13) hold. We will argue that f n is in fact a minimizing sequence of R ϵ by verifying the conditions of Proposition 5.

First, the relation (12) states that the sequence f n minimizes the standard ϕ -risk for the distribution given by P ∗ 0 and P ∗ 1 . As the loss ϕ is consistent by Proposition 3, the sequence f n must minimize the standard classification risk for the distribution P ∗ 0 , P ∗ 1 . This statement implies (17). Next we will argue that (18) holds.

Let c, δ be as in Lemma 3. Because C ϕ ( η ∗ , f n ) ≥ C ∗ ϕ ( η ∗ ) , (12) implies that C ϕ ( η ∗ , f n ) converges to C ∗ ϕ ( η ∗ ) in L 1 . However, L 1 convergence implies convergence in measure (see for instance Proposition 2.29 of [Folland, 1999]), and therefore lim n →∞ P ∗ ( C ϕ ( η ∗ , f n ) > C ∗ ϕ ( η ∗ ) + δ ) = 0 . Lemma 3 then implies that for i = 0 , 1

Next, because ϕ is non-increasing, f ≤ 0 implies ϕ ( f ) ≥ ϕ (0) and thus 1 f ≤ 0 ≤ 1 ϕ ◦ f ≥ ϕ (0) . Furthermore, as the function α ↦→ 1 α ≥ 0 is monotone and upper semi-continuous,

Let γ i be a coupling between P i and P ∗ i for which ess sup ( x , y ) ∼ γ i ∥ x -y ∥ ≤ ϵ . Then the measure γ i is supported on ∆ ϵ = { ( x , y ): ∥ x -y ∥ ≤ ϵ } . Furthermore, as S ϵ ( ϕ ◦ f n )( x ) ≥ ϕ ◦ f n ( x ′ ) everywhere on ∆ ϵ , the relation S ϵ ( ϕ ◦ f n )( x ) ≥ ϕ ◦ f n ( x ′ ) actually holds γ 1 -a.e. Therefore, (13) actually implies that S ϵ ( ϕ ◦ f n )( x ) -ϕ ◦ f n ( x ′ ) converges in γ 1 -measure to 0. In particular, since ϕ ( c ) < ϕ (0) , lim n →∞ γ 1 ( S ϵ ( ϕ ◦ f n )( x ) -ϕ ( f n ( x ′ )) ≥ ϕ (0) -ϕ ( c ) ) = 0 and thus lim n →∞ γ 1 ( S ϵ ( ϕ ◦ f n )( x ) ≥ ϕ (0) ∩ ϕ ◦ f n ( x ′ ) < ϕ ( c )) = 0 . Therefore,

This calculation implies

The last inequality follows because Lemma 3 states that α > c implies ϕ ( α ) < ϕ ( c ) and therefore 1 ϕ ◦ f n ≥ ϕ ( c ) ≤ 1 f n ≤ c . Equation 22 then implies

Recall that the sequence f n was chosen so that the limit lim n →∞ ∫ S ϵ ( 1 f n ≤ 0 ) d P 1 exists. Combining this fact with (23), (24), and (25) results in

The first relation of (18) then follows from (26) together with Lemma 4.

A similar argument implies the second relation of (18). Because 1 f> 0 = 1 -f< 0 ≤ 1 -f ≤ 0 , the same chain of inequalities as (23), (24), and (25) implies that

As c > 0 , it follows that lim sup n →∞ ∫ S ϵ ( 1 f n > 0 ) d P 0 ≤ lim inf n →∞ ∫ 1 f n > 0 d P ∗ 0 . Once again, the second expression of (18) follows from this relation and Lemma 4.

5 Quantitative Bounds for the ρ -Margin Loss

As discussed in the introduction, statistical consistency is not the only property one would want from a surrogate. Hopefully, minimizing a surrogate will also efficiently minimize the classification loss. Bartlett et al. [2006], Steinwart [2007], Reid and Williamson [2009] prove bounds of the form R ( f ) -R ∗ ≤ G ϕ ( R ∗ ϕ ( f ) -R ϕ, ∗ ) for a function G ϕ and R ∗ = inf f R ( f ) , R ϕ, ∗ = inf f R ϕ ( f ) . The function G ϕ is an upper bound on the rate of convergence of the classification risk in terms of the rate of convergence of the surrogate risk. One would hope that G ϕ is not logarithmic, as such a bound could imply that reducing R ( f ) -R ∗ by a quantity ∆ could require an exponential change of e ∆ in R ϕ ( f ) -R ϕ, ∗ . Bartlett et al. [2006] compute such G ϕ for several popular losses in the standard classification setting. For example, they show the bounds G ϕ ( θ ) = θ for the hinge loss ϕ ( α ) = (1 -α ) + and G ϕ ( θ ) = √ θ for the squared hinge loss ϕ ( α ) = (1 -α ) 2 + . On can prove an analogous bound for the ρ -margin loss in the adversarial setting:

Theorem 4. Let ϕ ρ = min(1 , max(1 -α/ρ, 0)) be the ρ -margin loss, R ϵ ∗ = inf f R ϵ ( f ) , and R ϵ ϕ ρ , ∗ ( f ) = inf f R ϵ ϕ ρ ( f ) . Then

Notice that this theorem immediately implies that the ρ -margin loss is in fact adversarially consistent. The proof below is completely independent of the argument in Section 4.

Proof. Notice that for the ρ -margin loss, C ∗ ϕ ρ = C ∗ and therefore, the optimal ϕ ρ -risk R ϵ ϕ ρ , ∗ equals the optimal adversarial classification risk R ϵ ∗ . However, since ϕ ρ ( α ) ≥ 1 α ≤ 0 and ϕ ρ ( -α ) ≥ 1 α> 0 for any α , one can conclude that R ϵ ( f ) ≤ R ϵ ϕ ρ ( f ) . Therefore,

This bound implies that reducing the excess adversarial ρ -margin loss by ∆ also reduces an upper bound on the excess adversarial classification loss by ∆ . Thus, one would expect that minimizing the adversarial ρ -margin risk would be an effective procedure for minimizing the adversarial classification risk.

Extending Theorem 4 to other losses remains an open problem. In the non-adversarial scenario, many prior works develop techniques for computing such bounds. These include the Ψ -transform of [Bartlett et al., 2006], calibration analysis in [Steinwart, 2007], and special techniques for proper losses in [Reid and Williamson, 2009].

Contemporary work [Mao et al., 2023] derives an H -consistency surrogate risk bound for a variant of the adversarial ρ -margin loss.

6 Conclusion

In conclusion, we proved that the adversarial training procedure is consistent for perturbations in an ϵ -ball if an only if C ∗ ϕ (1 / 2) < ϕ (0) . The technique that proved consistency extends to perturbation sets which satisfy existence and minimax theorems analogous to Theorems 1 and 2. Furthermore, we showed a quantitative excess risk bound for the adversarial ρ -margin loss. Finding such bounds for other losses remains an open problem. We hope that insights to consistency and the structure of adversarial learning will lead to the design of better adversarial learning algorithms.

Acknowledgments and Disclosure of Funding

Natalie Frank was supported in part by the Research Training Group in Modeling and Simulation funded by the National Science Foundation via grant RTG/DMS - 1646339. Jonathan Niles-Weed was supported in part by a Sloan Research Fellowship.

References

Awasthi, N. Frank, A. Mao, M. Mohri, and Y. Zhong. Calibration and consistency of adversarial surrogate losses. NeurIps , 2021a.

Awasthi, N. S. Frank, and M. Mohri. On the existence of the adversarial bayes classifier (extended version). arxiv , 2021b.

Awasthi, A. Mao, M. Mohri, and Y. Zhong. A finer calibration analysis for adversarial robustness. arxiv , 2021c.

Awasthi, A. Mao, M. Mohri, and Y. Zhong. H-consistency bounds for surrogate loss minimizers. In Proceedings of the 39th International Conference on Machine Learning . PMLR, 2022.

Bao, C. Scott, and M. Sugiyama. Calibrated surrogate losses for adversarially robust classification. arxiv , 2021.

L. Bartlett, M. I. Jordan, and J. D. McAuliffe. Convexity, classification, and risk bounds. Journal of the American Statistical Association , 101(473), 2006.

Ben-David, N. Eiron, and P. M. Long. On the difficulty of approximately maximizing agreements. Journal of Computer System Sciences , 2003.

Bhattacharjee and K. Chaudhuri. When are non-parametric methods robust? PMLR , 2020.

Bhattacharjee and K. Chaudhuri. Consistent non-parametric methods for maximizing robustness. NeurIps , 2021.

Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndi´ c, P. Laskov, G. Giacinto, and F. Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases , pages 387-402. Springer, 2013.

Bungert, N. G. Trillos, and R. Murray. The geometry of adversarial training in binary classification. arxiv , 2021.

B. Folland. Real analysis: modern techniques and their applications , volume 40. John Wiley & Sons, 1999.

S. Frank and J. Niles-Weed. Existence and minimax theorems for adversarial surrogate risks in binary classification. arXiv , 2023.

Li, X. Xu, J. Xiao, S. Li, and H. T. Shen. Adaptive square attack: Fooling autonomous cars with adversarial traffic signs. IEEE Internet of Things Journal , 8(8), 2021.

Lin. A note on margin-based loss functions in classification. Statistics & Probability Letters , 68 (1):73-82, 2004.

Mao, M. Mohri, and Y. Zhong. Cross-entropy loss functions: Theoretical analysis and applications, 2023.

Meunier, R. Ettedgui, R. Pinot, Y. Chevaleyre, and J. Atif. Towards consistency in adversarial classification. arXiv , 2022.

A. Mingyuan Zhang. Consistency vs. h-consistency: The interplay between surrogate loss functions and the scoring function class. NeurIps , 2020.

Paschali, S. Conjeti, F. Navarro, and N. Navab. Generalizability vs. robustness: Adversarial examples for medical imaging. Springer , 2018.

A. S. Philip M. Long. Consistency versus realizable h-consistency for multiclass classification. ICML , 2013.

S. Pydi and V. Jog. The many faces of adversarial risk. Neural Information Processing Systems , 2021.

D. Reid and R. C. Williamson. Surrogate regret bounds for proper losses. In Proceedings of the 26th Annual International Conference on Machine Learning , New York, NY, USA, 2009. Association for Computing Machinery.

Steinwart. How to compare different loss functions and their risks. Constructive Approximation , 2007.

Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

G. Trillos and R. Murray. Adversarial classification: Necessary conditions and geometric flows. arxiv , 2020.

G. Trillos, M. Jacobs, and J. Kim. The multimarginal optimal transport formulation of adversarial multiclass classification. arXiv , 2022.

G. Trillos, M. Jacobs, and J. Kim. On the existence of solutions to adversarial training in multiclass classification, 2023.

Zhang. Statistical behavior and consistency of classification methods based on convex risk minimization. The Annals of Statistics , 2004.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proves the necessary and sufficient condition for a loss function to be adversarially consistent.\nIn the previous literature, either adversarial consistency for restricted hypothesis spaces or negative results for adversarial consistency has been known.\nThis paper follows this research line to provide a general condition to characterize loss functions.\nThe condition only requires $C\\_\\\\phi^\\*(1/2) < \\\\phi(0)$, which is quite simple to check.\nThis even holds for nonconvex loss functions.\nThe proof technique relies on the strong duality and complementary slackness results between adversarial surrogate loss minimization and the optimal coupling between benign and adversarial distributions.\n\nSTRENGTHS:\n- Very general condition to characterize adversarially consistent losses: Unlike previous results of adversarial $\\\\mathcal{H}$-consistency (Awasthi et al. (2021)) and negative results for adversarial consistency (Meunier et al. (2022)), this work contributes to show the necessary and sufficient condition for a loss function to be adversarially consistent. This is a new insight into the community and may help design loss functions in adversarial training.\n- The condition applies even to nonconvex losses: Traditionally, the theory of calibrated losses mainly concerns convex losses, such as Bartlett et al. (2006) because their proof technique essentially relies on the first-order optimality condition when characterizing loss minimizers. This is a transparent proof technique yet excludes nonconvex losses. In contrast, the proof technique of this paper first translates the optimality of the adversarial loss into the optimal coupling (Propositions 4 and 5) and then deals with the standard consistency analysis for the adversarial distribution $\\\\mathbb{P}^\\*$ (by leveraging Lemma 1).\n\nWEAKNESSES:\nOverall, I do not see any concerns about this paper.\nThere are a few minor comments and questions, which are mentioned in the following \"Questions.\"\n\nQUESTIONS:\n- (Comment) In the introduction, you may consider emphasizing the main result shown in this paper is related to consistency for all measurable functions, not $\\\\mathcal{H}$-consistency, to clarify how the result differs from the previous works.\n- (Question) Regarding Proposition 2: The counterexample $\\\\mathbb{P}\\_0 = \\\\mathbb{P}\\_1$ seems very malicious and rarely happens in practice. Are there any other counterexamples for which the corresponding loss function is not adversarially consistent?\n- (Comment) In the definition of $W\\_\\\\infty$, it is better to explain what $(x,y) \\\\sim \\\\gamma$ does mean.\n- (Typo) In l.233 \"fo\" -> \"of\"\n- (Typo) In l.260 $R$ -> $R^\\\\epsilon$\n- (Comment) In l.275, it seems better to discuss the existence of the coupling $\\\\gamma\\_i$.\n- (Comment) In l.307, I don't think Theorem 4 immediately implies adversarial consistency because it is unclear whether the inequality is tight for any distributions.\n\nLIMITATIONS:\nThe authors mention the limitations in conclusion: The extension of the convergence rate for general loss functions is left open.\n\nThis is theoretical work, and potential negative societal concerns are not applicable.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-16"}

comments: SUMMARY:
The paper provides a sufficient and necessary condition for surrogate loss to be adversarial consistency, and provide $\rho$-margin loss that satisfies the proposed condition so that it can replace 0-1 loss.

STRENGTHS:
Understanding the consistency of loss in the adversarial setting is a rather ongoing topic and hasn’t been addressed yet. The paper studies the consistency of surrogate loss for robust binary classification and presents some examples of loss function that satisfies the calibration condition, which has a good contribution to the community. Past work shows no convex loss (which people often use in practice) is adversarially consistent. This paper further provides sufficient and necessary conditions regarding what kind of surrogate loss is adversarially consistent. The presentation is clear and easy to follow.

WEAKNESSES:
It shouldn’t be surprising that $\rho$-margin loss can be a good surrogate loss for adversarial training, as when $\rho$ is extremely small the loss is approximately 0-1 loss. Yet such loss is non-differentiable and therefore hard to use in practice.

QUESTIONS:
In the paper, the author also presents another shifted sigmoid loss that satisfies the consistency property. I wonder if the author can shed any light on the performance of such loss function used in adversarial training on some simple dataset like MNIST.

LIMITATIONS:
N/A
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-04

comments: SUMMARY:
The paper analyzes the consistency of surrogate losses in the case where there is an adversary that perturbs the sample data. Unlike in empirical risk minimization, where many convex surrogate losses have been proven to be consistent, the authors show that no convex surrogate losses are adversarially consistent. The authors provide a theoretical analysis to back up the claim. In addition, the authors design a non-convex surrogate loss that is adversarially consistent.

STRENGTHS:
- The paper presents an important analysis of the consistency of surrogate losses under adversarial examples setting. 
- The authors provide a thorough theoretical analysis of the property of surrogate losses under adversarial examples setting.
- The authors propose a surrogate loss that is adversarially consistent.

WEAKNESSES:
- The presentation of the paper is a bit hard to parse. For example, some of the notations are used before they are defined, like in the last few paragraphs of the introduction.
- To improve the clarity of the presentations, I suggest the authors incorporate some figures to illustrate the difference of consistency property in adversarial vs regular cases.
- It will be good to also show the benefit of the adversarially consistent surrogate loss empirically. It could be experiments on real-world data or even some synthetic data to demonstrate the effect of having adversarially consistent surrogate loss in practice

QUESTIONS:
Please answer my concerns in the previous section.

LIMITATIONS:
No concern.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-08

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nthis paper tackles the problem of consistency in adversarial classification. Consistent losses are losses whose minimization lead to the minimization of the 0/1 loss. Although consistent losses are known for a long time in standard classification, they were not known in the adversarial setting. This paper show a simple necessary and sufficient condition for a loss to be adversarially consistent.\n\nSTRENGTHS:\nThe existence of consistent losses in adversarial classification is a very important problem, and this paper solves it in some way.\nUp to section 3, the paper is very well written and easy to understand.\nAlso, section 5 provides very useful bounds on margin losses, which are the counterpart of what was published in the non-adversarial setting by Bartlett, Zhang, and others.\n\nWEAKNESSES:\nsection 4 is much harder to understand. For example, to understand propositions in that section, reading [Frank and Niles-Weed] helps a lot. In my opinion, authors should work on improving the clarity of this section.\n\ndetails:\n- Proposition 2, Line 139: a unit ball is of radius 1. But here, radius is R=epsilon/2\n- Proposition 3, Line 211: recall that the inequality holds thanks to assumption 1, to make things clearer.\n- Why put the proof of proposition 2 in the paper ? The proof is exactly the same as Meunier’s proof of the same result. Removing the proof would release space to improve clarity of section 4.\n\nQUESTIONS:\n1. It seems like thm1 is already known. In particular, points (1) and (2) boil down to the equivalence between calibration and consistency in the non adversarial setting, isn’t it right ?\n\n2. In Proposition 4: aren’t \\mathbb{P}*_0 and \\mathbb{P}*_1 maximizers of \\bar{R}_\\phi instead of \\bar{R} ? I don’t see the logic here.\nMake explicit that there exists a pair \\mathbb{P}*_0 and \\mathbb{P}*_1 maximizing both \\bar{R} and \\bar{R}_\\phi. I also don't see how it is related to the reference [Frank and Niles-Weed]. Please make this clearer.\n\nLIMITATIONS:\nlimitations have been addressed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-10"}