Title: Characterizing the Optimal $0-1$ Loss for Multi-class Classification with a Test-time Attacker
Venue: NeurIPS 2023
Accepted: yes
Keywords: adversarial robustness

graph theory

fundamental bounds
Abstract: Finding classifiers robust to adversarial examples is critical for their safe
deployment. Determining the robustness of the best possible classifier under a
given threat model for a fixed data distribution and comparing it to that
achieved by state-of-the-art training methods is thus an important diagnostic
tool. In this paper, we find achievable information-theoretic lower bounds on
robust loss in the presence of a test-time attacker for *multi-class
classifiers on any discrete dataset*. We provide a general framework for finding
the optimal $0-1$ loss that revolves around the construction of a conflict
hypergraph from the data and adversarial constraints. The prohibitive cost of
this formulation in practice leads us to formulate other variants of the attacker-classifier
game that more efficiently determine the range of the optimal loss. Our
valuation shows, for the first time, an analysis of the gap to optimal
robustness for classifiers in the multi-class setting on benchmark datasets.

Characterizing the Optimal 0 -1 Loss for Multi-class Classification with a Test-time Attacker

Abstract

Finding classifiers robust to adversarial examples is critical for their safe deployment. Determining the robustness of the best possible classifier under a given threat model for a fixed data distribution and comparing it to that achieved by state-ofthe-art training methods is thus an important diagnostic tool. In this paper, we find achievable information-theoretic lower bounds on robust loss in the presence of a test-time attacker for multi-class classifiers on any discrete dataset . We provide a general framework for finding the optimal 0 -1 loss that revolves around the construction of a conflict hypergraph from the data and adversarial constraints. The prohibitive cost of this formulation in practice leads us to formulate other variants of the attacker-classifier game that more efficiently determine the range of the optimal loss. Our valuation shows, for the first time, an analysis of the gap to optimal robustness for classifiers in the multi-class setting on benchmark datasets.

1 Introduction

Developing a theoretical understanding of the vulnerability of classifiers to adversarial examples (27; 12; 8; 4) generated by a test-time attacker is critical to their safe deployment. Past work has largely taken one of two approaches. The first has focused on generalization bounds on learning in the presence of adversarial examples, by trying to determine the sample complexity of robust learning (10; 25; 21). The second has been to characterize the lowest possible loss achievable within a specific hypothesis class (22; 5; 6) for binary classification for a specified data distribution and attacker. The hypothesis class of choice is often the set of all possible classification functions. The optimal loss thus determined is a lower bound on robustness for classifiers used in practice, allowing practitioners to measure progress for defenses and step away from the attack-defense arms race (19; 31; 9).

In this paper, we take on the second approach and propose methods to find the lowest possible loss attainable by any measurable classifier in the presence of a test-time attacker in the multi-class setting. The loss thus obtained is referred to as the optimal loss and the corresponding classifier, the optimal classifier . We extend previous work (5; 6) which was restricted to the binary setting, allowing us to compare the robustness of multi-class classifiers used in practice to the optimal loss. Our first contribution is thus extending the conflict-graph framework for computing lower bounds on robustness to the multi-class setting. In this framework, given a dataset and attacker, we construct a conflict hypergraph which contains vertices representing training examples in the dataset, and hyperedges representing overlaps between adversarial neighborhoods around each training example. Using this hypergraph, we construct a linear program whose optimal value is a lower bound on the 0 -1 loss for all classifiers and whose solution is the optimal classifier. The lower bound on robustness is thus achievable.

In practice, however, we find that the full multi-class formulation of the lower bound, although exact, can lead to prohibitively large optimization problems. Thus, we vary the information available to either the attacker or classifier to find alternative lower bounds that are quicker to compute. Our second contribution is the development and analysis of more efficient methods to determine the range of loss obtained by the optimal classifier. (see Table 1). We also interpret these methods as classifier-attacker games. In particular, we find lower bounds on the optimal loss by aggregating the set of all binary classifier-only lower bounds as well as by using truncated hypergraphs (hypergraphs with a restriction on the maximum hyperedge degree). We also upper bound the optimal loss with a generalization of the Caro-Wei bound (1) on a graph's independent set size. The gap between the lower and upper bounds on the optimal loss allows us to determine the range within which the optimal loss lies.

To analyze the performance of classifiers obtained from adversarial training (19; 31), we compare the loss obtained through adversarial training to that of the optimal classifier. We find a loss differential that is greatly exacerbated compared to the binary case (5; 22). In addition, we also determine the cases where, in practice, the bounds obtained from game variants are close to the optimal. We find that while the aggregation of binary classifier-only bounds leads to a very loose lower bound, the use of truncated hypergraphs can significantly speed up computation while achieving a loss value close to optimal. This is validated using the Caro-Wei upper bound, with the lower and upper bounds on the optimal loss closely matching for adversarial budgets used in practice. Thus, our final contribution is an extensive empirical analysis of the behavior of the optimal loss for a given attacker, along with its lower and upper bounds. This enables practitioners to utilize our methods even when the optimal loss is computationally challenging to determine.

The rest of the paper is organized as follows: §2 provides the characterization of the optimal loss; §3 proposes several upper and lower bounds on the optimal loss; §4 computes and compares the optimal loss to these bounds, as well as the performance of robustly trained classifiers and §5 concludes with a discussion of limitations and future work.

2 Characterizing Optimal 0-1 Loss

In this section, we characterize the optimal 0 -1 loss for any discrete distribution ( e.g. training set) in the presence of a test-time attacker. This loss can be computed as the solution of a linear program (LP), which is defined based on a hypergraph constructed from the classification problem and attacker constraint specification. The solution to the LP can be used to construct a classifier achieving the optimal loss, and lower bounds the loss attainable by any particular learned classifier.

2.1 Problem Formulation

Notation. We consider a classification problem where inputs are sampled from input space X , and labels belong to K classes: y ∈ Y = [ K ] = { 1 , ..., K } . Let P be the joint probability over X × Y . Let H soft denote the space of all soft classifiers; i.e. specifically, for all h ∈ H soft we have that h : X → [0 , 1] K and ∑ K i =1 h ( x ) i = 1 for all x ∈ X . Here, h ( x ) i represents the probability that the input x belongs to the i th class. We use the natural extension of 0 -1 loss to soft classifiers as our loss function: ℓ ( h, ( x, y )) = 1 -h ( x ) y . This reduces to 0 -1 loss when h ( x ) ∈ { 0 , 1 } K . 1

The adversarial classification game. We are interested in the setting where there exists a test-time attacker that can modify any data point x to generate an adversarial example ˜ x from the neighborhood N ( x ) of x . An instance of the game is specified by a discrete probability distribution P , 2 hypothesis class H ⊆ H soft, and neighborhood function N . We require that for all x ∈ X , N ( x ) always contains x . The goal of the classifier player is to minimize expected classification loss and the goal of the

̸

attacker is to maximize it. The optimal loss is

Alternative hypothesis classes. In general, for H ′ ⊆ H , we have L ∗ ( P, N, H ) ≤ L ∗ ( P, N, H ′ ) . Two particular cases of this are relevant. First, the class of hard-decision classifiers is a subset of the class of soft classifiers ( H soft ). Second, for any fixed model parameterization (ie. fixed NN architecture), the class of functions represented by that parameterization is another subset. Thus, optimal loss over H soft provides a lower bound on loss for these settings.

2.2 Optimal loss for distributions with finite support

Since we would like to compute the optimal loss for distributions P with finite support , we can rewrite the expectation in Equation 1 as an inner product. Let V be the support of P , i.e. the set of points ( x, y ) ∈ X × Y that have positive probability in P . Let p ∈ [0 , 1] V be the probability mass vector for P : p v = P ( { v } ) . For a soft classifier h , let q N ( h ) ∈ R V be the vector of robustly correct classification probabilities for vertices v = ( x, y ) ∈ V , i.e. q N ( h ) v := inf ˜ x ∈ N ( x ) h (˜ x ) y . Rewriting (1) with our new notation, we have 1 -L ∗ ( P, H soft , N ) = sup h ∈H soft p T q N ( h ) . This is the maximization of a linear function over all possible vectors q N ( h ) . In fact, the convex hull of all correct classification probability vectors is a polytope and this optimization problem is a linear program, as described next.

Definition 1. For a soft classifier h , the correct-classification probability achieved on an example v = ( x, y ) in the presence of an adversary with constraint N is q N ( h ) v = inf ˜ x ∈ N ( x ) h (˜ x ) y .

The space of achievable correct classification probabilities is P V ,N, H ⊆ [0 , 1] V , defined as

In other words we say that q ′ ∈ [0 , 1] V is achievable when there exists h ∈ H such that q ′ ≤ q N ( h ) . The inequality appears because we will always take nonnegative linear combinations of correct classification probabilities.

Characterizing P V ,N, H allows the minimum adversarial loss achievable to be expressed as an optimization problem with a linear objective: 3

(6) characterized P V ,N, H soft in the two-class case and demonstrated that this space can be captured by linear inequalities. We now demonstrate that this also holds for the multi-class setting.

2.3 Linear Program to obtain Optimal Loss

In order to characterize P V ,N, H soft , we represent the structure of the classification problem with a conflict hypergraph G V ,N = ( V , E ) , which records intersections between neighborhoods of points in X . The set of vertices V of G V ,N is the support of P . E denotes the set of hyperedges of the graph. For a set S ⊆ V , S ∈ E (i.e. S is a hyperedge in G V ,N ) if all vertices in S belong to different classes and the neighborhoods of all vertices in S overlap: ⋂ ( x,y ) ∈ S N ( x ) = ∅ . Thus, the size of each hyperedge is at most K , E is downward-closed (meaning if e ∈ E and e ′ ⊂ e , then e ′ ⊂ E ), and every v ∈ V is a degree 1 hyperedge.

Using the conflict hypergraph G V ,N , we can now describe P V ,N, H soft .

Theorem 1 (Feasible output probabilities (Adapted from (6))) . The set of correct classification probability vectors for support points V , adversarial constraint N , and hypothesis class H soft is

where B ∈ R E×V is the hyperedge incidence matrix of the conflict hypergraph G V ,N .

̸

See Supplementary §A for proof. This characterization of P V ,N, H soft allows us to express optimal loss as a linear program for any dataset and attacker using Eq. 2 4 .

Corollary 1 (Optimal loss as an LP) . For any distribution P with finite support,

Duality and adversarial strategies. The dual linear program is

Feasible points in the dual linear program are fractional coverings of the vertices by the hyperedges (24). (See Section 3.4 and Supplementary §B for more discussion of fractional packings and coverings.) An adversarial strategy can be constructed from a feasible point z as follows. For each hyperedge e , chose an example ˜ x ( e ) such that ˜ x ( e ) ∈ N ( x ) for all ( x, y ) ∈ e . From the definition of the conflict hypergraph, a choice is always available. A randomized adversarial strategy consists of conditional distributions for the adversarial example ˜ x given the natural example x . When the adversary samples the natural example ( x, y ) , the adversary can select ˜ x ( e ) with probability at least B e,v z e p v . Note that B e,v z e is the amount of coverage of v coming from e . This is nonzero only for e that contain ( x, y ) . A conditional distribution satisfying these inequalities exists because ∑ e B e,v z e = ( B T z ) v ≥ p v .

Thus for a vertex v such that ( B T z ) v = p v , there is only one choice for this distribution. For a vertex v that is over-covered, i.e. ( B T z ) v > p v , the adversary has some flexibility. If v is over-covered in some minimal cost covering, by complementary slackness q v = 0 in every optimal q , so the optimal classifiers do not attempt to classify v correctly.

Three-class minimal examples. Corollary 1 demonstrates that the optimal loss for the multiclass problem is influenced by hyperedges between vertices which reflect higher order interactions between examples. Figure 1 shows an important distinction between two types of threeway interactions of examples.

We have 1 -L ( P, H soft , N ) = max( p u , p v , p w , 1 2 ) while 1 -L ∗ ( P ′ , H soft , N ) = max( p ′ u , p ′ v , p ′ w ) . The presence or absence of the size-three hyperedge affects the optimal loss if and only if the example probabilities are close to balanced, i.e. all at most 1 2 .

It is instructive to consider the optimal classifiers and adversarial strategies in the two cases. For

V

, when

1

2 (1 , 0 , 0) is optimal. One such classifier is the constant classifier h ( x ) = (1 , 0 , 0) . The optimal cover satisfies z { u,v } + z { u,w } = p u , z { u,v } ≥ p v , z { u,w } ≥ p w , z { v,w } = 0 . Thus when the adversary

p

u

, the classifier

h

with

q

N

(

h

) =

V

u

v

w

V

′

u

′

v

′

w

′

samples v or w , it always produces an adversarial example that could be confused for u . When max( p u , p v , p w ) ≤ 1 2 , any classifier h with q N ( h ) = ( 1 2 , 1 2 , 1 2 ) is optimal. To achieve these correct classification probabilities, we need h (˜ x ) = ( 1 2 , 1 2 , 0) for ˜ x ∈ N ( u ) ∩ N ( v ) , h (˜ x ) = ( 1 2 , 0 , 1 2 ) for ˜ x ∈ N ( u ) ∩ N ( w ) , etc.. The cover z { u,v } = p u + p v -1 2 , z { u,w } = p u + p w -1 2 , and z { v,w } = p v + p w -1 2 is optimal and has cost 1 2 . The adversary produces examples associated with all three edges.

For V ′ , things are simpler. The cover z { u,v,w } = max( p u , p v , p w ) is always optimal. When p u ≥ max( p v , p w ) , the classifier that returns (1 , 0 , 0) everywhere is optimal.

3 Bounding the Optimal 0-1 Loss

While Corollary 1 characterizes the optimal loss, it may be computationally expensive to construct conflict hypergraphs in practice for a given dataset and to solve the linear program. Thus, we discuss several methods of bounding the optimal loss from the LP in Corollary 1, which are computationally faster in practice (§4.2).

3.1 Lower bounds on multiclass optimal loss via truncated hypergraphs

The edge set of the hypergraph G can be very large: there are ∏ i ∈ [ K ] (1 + | V i | ) vertex sets that are potential hyperedges. Even when the size of the edge set is reasonable, it is not clear that higher order hyperedges can be computed from V efficiently. To work around these issues, we consider hypergraphs with bounded size hyperedges: G ≤ m = ( V , E ≤ m ) where E ≤ m = { e ∈ E : | e | ≤ m } . We refer to these hypergraphs as truncated hypergraphs . In the corresponding relaxation of (4), B is replaced by B ≤ m , the incidence matrix for E ≤ m . Since E ≤ m ⊆ E , this relaxation provides a lower bound on L ∗ ( P, N, H soft ) .

Classification with side-information. This relaxation has an interpretation as the optimal loss in a variation of the classification game with side information.

Definition 2. In the example-dependent side information game with list length m , the adversary samples ( x, y ) ∼ P , then selects ˜ x and C ⊆ Y such that y ∈ C and | C | = m . We call C the side information. The classifier receives both ˜ x and C , so the classifier is a function h : X× ( Y m ) → [0 , 1] K , where ( Y m ) is the set of m -element subsets of Y . Let

be the minimum loss in this game.

To illustrate this, consider the distribution P ′ from Figure 1 with m = 2 . The adversary can select some ˜ x ∈ N ( u ′ ) ∩ N ( v ′ ) ∩ N ( w ′ ) , but the classifier will use the side-information to eliminate one of the three classes. The classifier is in the same situation it would be if the distribution were P and the size-three hyperedge was absent.

Definition 3. For classifiers using class list side-information, the correct-classification probability is defined as follows: q m,N ( h ) ( x,y ) = inf ˜ x ∈ N ( x ) min C ∈ ( [ K ] m ) : y ∈ C h (˜ x, C ) y . The set of achievable correct-classification probabilities is P m, V ,N, H = ⋃ h ∈H ∏ v ∈V [0 , q m,N ( h ) v ] .

When m = K , the minimization over C is trivial and q m,N ( h ) reduces to q N ( h ) .

Theorem 2 (Feasible output probabilities in the side-information game) . The set of correct classification probability vectors for side-information of size m , support points V , adversarial constraint N , and hypothesis class H soft is

where B ≤ m ∈ R E×V is the hyperedge incidence matrix of the conflict hypergraph G ≤ m V ,N .

The proof can be found in Supplementary §A.

Using the feasible correct classification probabilities in Theorem 2, we can now write the LP for obtaining the optimal loss for classification with side-information:

Corollary 2 (Optimal loss for classification with side information / truncation lower bound) .

3.2 Lower bounds on multiclass optimal loss via lower bounds for binary classification

For large training datasets and large perturbation sizes, it may still be computationally expensive to compute lower bounds via LP even when using truncated hypergraphs due to the large number of edge constraints. Prior works (5; 6) proposed methods of computing lower bounds for 0 -1 loss for binary classification problems and demonstrate that their algorithm is more efficient than generic LP solvers. We now ask the question: Can we use lower bounds for binary classification problems to efficiently compute a lower bound for multi-class classification?

Consider the setting where we obtain the optimal 0 -1 loss for all one-versus-one binary classification tasks. Specifically, for each C ∈ ( [ K ] 2 ) , the binary classification task for that class pair uses example distribution P | Y ∈ C and the corresponding optimal loss is L ∗ (( P | Y ∈ C ) , N, H soft ) . What can we say about L ∗ ( P, N, H soft ) given these ( K 2 ) numbers?

This question turns about to be related to another variation of classification with side information. Definition 4. In the class-only side-information game, the adversary samples y ∼ P y , then selects C ∈ ( [ K ] m ) , then samples x ∼ P x | y and selects ˜ x ∈ N ( x ) . Let L ∗ co ( m,P, H , N ) be the minimum loss in this game.

In the example-dependent side-information game from Section 3.1, the adversary's choice of C can depend on both x and y . In the class-only variation it can only depend on y . For the class only game, we will focus on the m = 2 case.

To make the connection to the binary games, we need to add one more restriction on the adversary's choice of side information: for all y, y ′ Pr[ C = { y, y ′ }| Y = y ] = Pr[ C = { y, y ′ }| Y = y ′ ] . This ensures that the classifier's posterior for Y given C is Pr[ Y = y | C ] = Pr[ Y = y ] / Pr[ Y ∈ C ] .

Theorem 3. The optimal loss in the class-only side-information game is L ∗ co (2 , P, N, H ) = max s ∑ i,j Pr [ Y = i ] a i,j s i,j where a i,j = L ∗ ( P | ( y ∈ { i, j } ) , H , N ) and s ∈ R [ K ] × [ K ] is a symmetric doubly stochastic matrix: s ≥ 0 , s = s T , s 1 = 1 .

The proof in is Supplementary §A. The variable s represents the attacker's strategy for selecting the class side information. When the classes are equally likely, we have a maximum weight coupling problem: because the weights a are symmetric, the constraint that s be symmetric becomes irrelevant.

3.3 Relationships between games and bounds

The side information games provide a collection of lower bounds on L ∗ ( P, N, H soft ) . When m = 1 , the side infomation game becomes trivial: C = { y } and the side information contains the answer to the classification problem. Thus L ∗ (1 , H soft ) = L ∗ co (1 , H soft ) = 0 . When m = K , C = Y and both the example-dependent and class-only side information games are equivalent to the original game, so L ∗ ( P, N, H ) = L ∗ ( K,P,N, H ) = L ∗ co ( K,P,N, H ) . For each variation of the side-information game, the game becomes more favorable for the adversary as m increases: L ∗ ( m,P,n, H ) ≤ L ∗ ( m +1 , P, N, H ) and L ∗ co ( m,P,N, H ) ≤ L ∗ co ( m +1 , P, N, H ) . For each m , it is more favorable for the adversary to see x before selecting C , i.e. L ∗ co ( m,P,N, H ) ≤ L ∗ ( m,P,N, H ) .

3.4 Optimal Loss for Hard Classifiers

Since H hard ⊂ H soft , L ∗ ( m,P,N, H soft ) ≤ L ∗ ( P, N, H hard ) . The optimal loss over hard classifiers is interesting both as a bound on the optimal loss over soft classifiers and as an independent quantity. Upper bounds on L ∗ ( P, N, H hard ) can be combined with lower bounds from §3.1 and §3.2 using small values of m to pin down L ∗ ( m,P,N, H soft ) and establish that larger choices of m would not provide much additional information.

A hard classifier h : X → { 0 , 1 } [ K ] has 0 , 1 -valued correct classification probabilities. When we apply the classifier construction procedure from the proof of Theorem 1 using an integer-valued

q vector, we obtain a hard classifier. Thus the possible correct classification probabilities for hard classifiers are P V ,N, H soft ∩ { 0 , 1 } [ K ] . These are exactly the indicator vectors for the independent sets in G ≤ 2 : the vertices included in the independent set are classified correctly and the remainder are not. Formally, we can express hard classifier loss as:

Finding the maximum weight independent set is an NP hard problem, which makes it computationally inefficient to compute optimal hard classifier loss.

Two-class versus Multi-class hard classification There are a number of related but distinct polytopes associated with the vertices of a hypergraph (24). The distinctions between these concepts explain some key differences between two-class and multi-class adversarial classification. See Supplementary §B for full definitions of these polytopes.

When K = 2 , the conflict hypergraph is a bipartite graph. For bipartite graphs, the fractional vertex packing polytope, which has a constraint ∑ i ∈ e q i ≤ 1 for each edge e , coincides with the independent set polytope, which is the convex hull of the independent set indicators. Due to this, in the two class setting, P V ,N, H soft is the convex hull of P V ,N, H hard , hard classifiers achieve the optimal loss, and optimal hard classifiers can be found efficiently.

As seen in Theorem 1, for all K the fractional vertex packing polytope characterizes performance in soft classification problem. However, for K > 2 , it becomes distinct from the independent set polytope. An independent set in a hypergraph is a subset of vertices that induces no hyperedges. In other words, in each hyperedge of size m , at most m -1 vertices can be included in any independent set. Because the edge set of the conflict hypergraph is downward-closed, only the size-two hyperedges provide binding constraints: the independent sets in G are the same as the independent sets in G ≤ 2 . Thus the concept of a hypergraph independent set is not truly relevant for our application.

There is a third related polytope: the fractional independent set polytope of G ≤ 2 , which has a constraint ∑ i ∈ S q i ≤ 1 for each clique S in G ≤ 2 . The fractional independent set polytope of G ≤ 2 is contained in the fractional vertex packing polytope of G : every hyperedge in G produces a clique in G ≤ 2 but not the reverse. This inclusion could be used to find an upper bound on optimal soft classification loss.

Furthermore, when K > 2 the fractional vertex packing polytope of the conflict hypergraph, i.e. P V ,N, H soft , can have non-integral extreme points and thus can be strictly larger than the independent set polytope. The first configuration in Figure 1 illustrates this. Thus the soft and hard classification problems involve optimization over different spaces of correct classification probabilities. Furthermore, maximum weight or even approximately maximum weight independent sets cannot be efficiently found in general graphs: the independent set polytope is not easy to optimize over.

In Section 3.5, we will use an efficiently computable lower bound on graph independence number.

3.5 Upper bounds on hard classifier loss via Caro-Wei bound on independent set probability

In §3.1 and 3.2, we discussed 2 ways of obtaining lower bounds for the loss of soft classifiers for the multi-class classification problem. In this section, we provide an upper bound on the loss of the optimal hard classifier (we note that this is also an upper bound for optimal loss for soft classifiers). In §3.4, we discussed the relationship between optimal loss achievable by hard classifiers and independent set size. We upper bound the optimal loss of hard classifiers by providing a lower bound on the probability of independent set in the conflict graph.

The following theorem is a generalization of the Caro-Wei theorem (1) and gives a lower bound on the weight of the maximum weight independent set.

Theorem 4. Let G be a graph on V with adjacency matrix A ∈ { 0 , 1 } V×V and let P be a probability distribution on V . For any w ∈ R V , w ≥ 0 , there is some independent set S ⊆ V with

The proof is in Supplementary §A.

0-1 loss

0.8

0.6

0.4

0.2

0.0

2.0

L

*

(2)

L

*

(3)

AT

2.5

3.0

3.5

4.0

(a) MNIST (1,4,7)

3.0

3.5

4.0

4.5

5.0

5.5

6.0

6.5

7.0

0.0

0.2

0.4

0.6

0.8

0-1 loss

L

*

(2)

L

*

(3)

AT

(b) CIFAR-10 (0,2,8)

For comparison, the standard version of the Caro-Wei theorem is a simple lower bound on the independence number of a graph. It states that G contains an independent set S with | S | ≥ ∑ v ∈V 1 / ( d v +1) where d v is the degree of vertex v .

Note that if w is the indicator vector for an independent set S ′ , the bound becomes p T w = P ( S ′ ) . In general, the proof of Theorem 4 can be thought of as a randomized procedure for rounding an arbitrary vector into an independent set indicator vector. Vectors w that are nearly independent set indicators yield better bounds.

Theorem 4 provides a lower bound on the size of the maximum independent set in G ≤ 2 and thus an upper bound on L ∗ ( P, n, H hard ) , which we call L CW = 1 -P ( S ) .

4 Empirical Results

In this section, we compute optimal losses in the presence of an ℓ 2 -constrained attacker (12) at various strengths ϵ for benchmark computer vision datasets like MNIST and CIFAR-10 in a 3 -class setting. We compare these optimal losses to those obtained by state-of-the-art adversarially trained classifiers, showing a large gap. We then compare the optimal loss in the 10 -class setting to its upper and lower bounds (§3.3), showing matching bounds at lower ϵ . In the Supplementary, §C describes hyperedge finding in practice, §D details the experimental setup and §E contains additional results.

4.1 Optimal loss for 3-class problems

Corollary 1 allows us to compute the optimal loss given any dataset (and its corresponding conflict hypergraph). We compute the optimal loss for 3-way classification, due to the computational complexity of finding higher order hyperedges (see §D.4 of the Supp.). In Figure 2, we plot the optimal loss L ∗ (3) computed via the LP in Corollary 1 against the loss obtained through TRADES (31) for 3-class MNIST (classes '1', '4', '7') and 3-class CIFAR-10 ('plane', 'bird' and 'ship' classes) with 1000 samples per class 5 . For MNIST, we train a 3 layer CNN for 20 epochs with TRADES regularization strength β = 1 , and for CIFAR-10, we train a WRN-28-10 model for 100 epochs with β = 6 . We evaluate models using APGD-CE from AutoAttack (9).

From Figure 2, we observe that this gap is quite large even at lower values of ϵ . This indicates that there is considerable progress to be made for current robust training methods, and this gap may be due to either the expressiveness of the hypothesis class or problems with optimization. We find that for CIFAR-10, TRADES is unable to achieve loss much better than 0.6 at an ϵ for which the optimal loss is near 0. This gap is much larger than observed by prior work (5; 6) for binary classification, suggesting that current robust training techniques struggle more to fit training data with more classes. In §D.8 of the Supp., we ablate over larger architectures, finding only small improvements at lower values of ϵ and none at higher.

4.5

5.0

L

*

(2)

L

*

(3)

L

*

(4)

L

*

co

(2)

LCW

AT

2.0

2.5

3.0

3.5

4.0

4.5

5.0

0.00

0.25

0.50

0.75

1.00

0-1 loss

(a) MNIST

2.0

2.5

3.0

3.5

4.0

4.5

5.0

5.5

6.0

0.00

0.25

0.50

0.75

1.00

0-1 loss

(b) CIFAR-10

4.2 Bounds on optimal loss for 10-class problems

As the number of classes and dataset size increases, the difficulty of solving the LP in Corollary 1 increases to the point of computational infeasibility (see §D.4 of the Supp.). We use the methods discussed in Section 3 to bound the optimal loss for 10-class problems on MNIST and CIFAR-10 datasets on the full training dataset. We present results for each approximation in Figure 3, with the limitation that for some methods, we are only able to obtain results for smaller values of ϵ due to runtime blowup. We provide truncated hypergraph bounds for CIFAR-100 in §D.2 of the Supp.

Lower bounding the optimal loss using truncated hypergraphs (§3.1): In Figure 3, we plot the loss lower bound obtained via by truncating the hypergraph to consider only edges ( L ∗ (2) ), up to degree 3 hyperedges ( L ∗ (3) ), and up to degree 4 hyperedges ( L ∗ (4) ). Computing the optimal loss would require computing degree 10 hyperedges. However, we find at small values of ϵ , there is little difference in these bounds despite the presence of many higher degree hyperedges. This indicates that the use of use of higher degree hyperedges may not be critical to get a reasonable estimate of the optimal loss. For example, for CIFAR-10 at ϵ = 3 , we observe 3M degree 3 hyperedges and 10M degree 4 hyperedges, but these constraints have no impact on the computed lower bound. To understand the impact of hyperedges, we provide the count of hyperedges for each value of ϵ and plots of the distribution of optimal classification probabilities per vertex in §D.3 of the Supp. From Figure 2, we find that the difference L ∗ (2) and L ∗ (3) does not occur until the loss reaches above 0.4 for the 3-class problem.

Takeaway: In practice, we do not lose information from computing lower bounds with only edges in the conflict hypergraph .

Lower bounding the optimal loss using the 1 v 1 binary classification problems (§3.2): We can use the algorithm from Bhagoji et al.(6) to efficiently compute 1 v 1 pairwise optimal losses to find a lower bound on the 10-class optimal loss ( L ∗ CO (2) ). From Theorem 3, we use maximum weight coupling over these optimal losses to find a lower bound. Optimal loss heatmaps for each pair of classes in MNIST and CIFAR-10 are in §D.5 of the Supp. The efficiency of the 1 v 1 computation allows us to compute lower bounds at larger values of ϵ in Figure 3.

Takeaway: From Figure 3, we find that while this lower bound is the most efficient to compute, the obtained bound is much looser compared to that from truncated hypergraphs. This arises from the weak attacker assumed while computing this bound.

Upper bounding optimal loss via Caro-Wei approximation (§3.5): In Figure 3, we also plot the upper bound on 0 -1 loss for hard classifiers (denoted by L CW ) obtained via applying Theorem 4 with vertex weights obtained from the solution to L ∗ (2) . When ϵ becomes large ( ϵ ≥ 3 . 0 for MNIST and ϵ ≥ 4 . 5 for CIFAR-10), the loss upper bound increases sharply. This indicates the lower bound on the independent set size becomes looser as the number of edges increases, due to the importance of higher-order interactions that are not captured by the approximation. At the small values of ϵ used in practice however, the lower bounds obtained through truncated hypergraphs ( L ∗ (2) , L ∗ (3) , and L ∗ (4) ) are close to the value of this upper bound .

Takeaways: (i) We do not lose much information from not including all hyperedges at small ϵ values as the upper and lower bounds are almost tight ; (ii) At these small values of ϵ , we do not expect much difference in performance between hard classifiers and soft classifiers.

Comparing loss of trained classifiers to optimal: In Figure 3, we also compare the loss obtained by a robustly trained classifier (AT) to our bounds on optimal loss. For both datasets, we see a large gap between the performance of adversarial training and our bounds (including the upper bound from the Caro-Wei approximation L CW ), even at small values of ϵ . This suggests that current robust training techniques are currently unable to optimally fit the training data in multiclass classification tasks of interest. In addition, we also checked the performance of state-of-the-art verifiably robust models on these two datasets from a leaderboard (18). For MNIST, the best certifiably robust model has a 0 -1 loss of 0 . 27 at a budget of 1 . 52 and 0 . 44 at a budget of 2 . 0 , while for CIFAR-10, the best certifiably robust model has a 0 -1 loss of 0 . 6 at a budget of 1 . 0 and 0 . 8 at a budget of 2 . 0 . These are much higher than the optimal lower bound that is achievable for these datasets which is 0 in all these cases.

Takeaway: Performance of state-of-the-art robust models, both empirical and verifiable, exhibit a large gap from the range of values predicted by our bounds on optimal 0 -1 loss, even when ϵ is small. Future research focusing on developing algorithms to decrease this gap while maintaining generalization capabilities may lead to improvements in model robustness.

5 Discussion and Related Work

Related Work: When the data distribution satisfies certain properties, Dohmatob (11) and Mahloujifar et al. (20) use the 'blowup' property to determine bounds on the robust loss, given some level of loss on benign data. We note that these papers use a different loss function that depends on the original classification output on benign data, thus their bounds are not comparable. Bhagoji et al. (5; 6), and Pydi et al. (22) provide lower bounds on robust loss when the set of classifiers under consideration is all measurable functions. These works only provide bounds in the binary classification setting . Work on verifying robustness (7; 28; 13; 18) provides bounds on the robustness of specific classifiers. Yang et al. (30) independently introduced the concept of a 'conflict graph' to obtain robust nonparametric classifiers via an adversarial pruning defense. The closest related work to ours is Trillos et al. (29), which uses optimal transport theory to find lower bounds on multi-class classification that are applicable for both continuous and discrete distributions. While their theoretical bounds are exact and more general than ours, accounting for distributional adversaries, their numerically computed bounds via the Sinkhorn algorithm are approximate and converge to the true value only as the entropy regularization decreases. In contrast, we provide methods to directly compute the optimal loss for discrete distributions, along with efficient methods for determining its range to overcome the computational bottlenecks encountered.

Discussion and Limitations: Our work in this paper firmly establishes for the multi-class case what was known only in the binary setting before: there exists a large gap in the performance of current robust classifiers and the optimal classifier . It also provides methods to bound the loss efficiently in practice, giving practitioners quick means to determine the gap. The question then arises: why does this gap arise and how can we improve training to decrease this gap? This paper, however, does not tackle the problem of actually closing this gap. Possible methods include increasing the architecture size (26), using additional data (15) and using soft-labels (6). A surprising finding from our experiments was that the addition of hyperedges to the multi-way conflict graph did not change the lower bounds much, indicating we are in a regime where multi-way intersections minimally impact optimal probabilities. One major limitation of our work is the computational expense at larger budgets, sample sizes and class sizes. We suspect this is due to the general-purpose nature of the solvers we use and future work should look into developing custom algorithms to speed up the determination of lower bounds.

Acknowledgments and Disclosure of Funding

ANB, WD and BYZ were supported in part by NSF grants CNS-2241303, CNS-1949650, and the DARPA GARD program. SD was supported in part by the National Science Foundation Graduate Research Fellowship under Grant No. DGE-2039656. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect

the views of the National Science Foundation. SD and PM were supported in part by the National Science Foundation under grant CNS-2131938, the ARL's Army Artificial Intelligence Innovation Institute (A2I2), Schmidt DataX award, and Princeton E-ffiliates Award.

References

N. Alon and J. H. Spencer. The probabilistic method . John Wiley & Sons, 2016.

M. S. Andersen, J. Dahl, and L. Vandenberghe. Cvxopt: Python software for convex optimization, 2013.

M. ApS. MOSEK Optimizer API for Python 10.0.22 , 2019. URL https://docs.mosek.com/ 10.0/pythonapi/index.html .

A. N. Bhagoji, W. He, B. Li, and D. Song. Exploring the space of black-box attacks on deep neural networks. arXiv preprint arXiv:1712.09491 , 2017.

A. N. Bhagoji, D. Cullina, and P. Mittal. Lower bounds on adversarial robustness from optimal transport. In Advances in Neural Information Processing Systems , pages 7496-7508, 2019.

A. N. Bhagoji, D. Cullina, V. Sehwag, and P. Mittal. Lower bounds on cross-entropy loss in the presence of test-time adversaries. In Proceedings of the 38th International Conference on Machine Learning , 2021.

R. Bunel, I. Turkaslan, P. H. Torr, P. Kohli, and M. P. Kumar. A unified view of piecewise linear neural network verification. arXiv preprint arXiv:1711.00455 , 2017.

N. Carlini and D. A. Wagner. Towards evaluating the robustness of neural networks. CoRR , abs/1608.04644, 2016. URL http://arxiv.org/abs/1608.04644 .

F. Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning , pages 2206-2216. PMLR, 2020.

D. Cullina, A. N. Bhagoji, and P. Mittal. Pac-learning in the presence of adversaries. In Advances in Neural Information Processing Systems , pages 230-241, 2018.

E. Dohmatob. Generalized no free lunch theorem for adversarial robustness. In Proceedings of the 36th International Conference on Machine Learning , pages 1646-1654, 2019.

I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations , 2015.

S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, T. Mann, and P. Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715 , 2018.

S. Gowal, C. Qin, J. Uesato, T. Mann, and P. Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 , 2020.

S. Gowal, S. Rebuffi, O. Wiles, F. Stimberg, D. A. Calian, and T. A. Mann. Improving robustness using generated data. In M. Ranzato, A. Beygelzimer, Y. N. Dauphin, P. Liang, and J. W. Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual , pages 4218-4233, 2021. URL https://proceedings.neurips.cc/paper/ 2021/hash/21ca6d0cf2f25c4dbb35d8dc0b679c3f-Abstract.html .

A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. 2009.

Y. LeCun and C. Cortes. The MNIST database of handwritten digits. 1998.

L. Li, T. Xie, and B. Li. Sok: Certified robustness for deep neural networks. In 2023 IEEE Symposium on Security and Privacy (SP) , pages 1289-1310. IEEE, 2023.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR , 2018.

S. Mahloujifar, D. I. Diochnos, and M. Mahmoody. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 4536-4543, 2019.

O. Montasser, S. Hanneke, and N. Srebro. Vc classes are adversarially robustly learnable, but only improperly. arXiv preprint arXiv:1902.04217 , 2019.

M. S. Pydi and V. Jog. Adversarial risk via optimal transport and optimal couplings. In Proceedings of the 37th International Conference on Machine Learning , pages 7814-7823, 2020.

M. S. Pydi and V. Jog. The Many Faces of Adversarial Risk, Jan. 2022. URL http://arxiv. org/abs/2201.08956 . arXiv:2201.08956 [cs, math, stat].

E. R. Scheinerman and D. H. Ullman. Fractional Graph Theory: A Rational Approach to the Theory of Graphs . Wiley, Sept. 1997. ISBN 978-0-471-17864-4. Google-Books-ID: KujuAAAAMAAJ.

L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, and A. Madry. Adversarially robust generalization requires more data. arXiv preprint arXiv:1804.11285 , 2018.

V. Sehwag, S. Mahloujifar, T. Handina, S. Dai, C. Xiang, M. Chiang, and P. Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022 . OpenReview.net, 2022. URL https://openreview.net/forum?id= WVX0NNVBBkV .

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

V. Tjeng, K. Y. Xiao, and R. Tedrake. Evaluating robustness of neural networks with mixed integer programming. In ICLR , 2019.

N. G. Trillos, M. Jacobs, and J. Kim. The multimarginal optimal transport formulation of adversarial multiclass classification. Journal of Machine Learning Research , 24(45):1-56, 2023.

Y.-Y. Yang, C. Rashtchian, Y. Wang, and K. Chaudhuri. Robustness for non-parametric classification: A generic attack and defense. In International Conference on Artificial Intelligence and Statistics , pages 941-951. PMLR, 2020.

H. Zhang, Y. Yu, J. Jiao, E. P. Xing, L. E. Ghaoui, and M. I. Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv:1901.08573 , 2019.

This Supplementary Material accompanies paper: Characterizing the Optimal 0 -1 Loss for Multiclass Classification with a Test-time Attacker to NeurIPS 2023.

We first present proofs for theorems from the main body in §A. We then explain fractional packing and covering in §B. We present our algorithm for hyperedge finding in §C. §D contains further details about the experimental setup with all additional experimental results in §E.

A Proofs

Proof of Theorem 1. This follows immediately from Theorem 2 with m = K .

Proof of Theorem 2. Recall that the definition of the correct-classification probabilities is

and the set of achievable correct-classification probabilities is

First, we will show P m, V ,N, H soft ⊆ { q ∈ R V : q ≥ 0 , B ≤ m q ≤ 1 } . The constraint h ∈ H soft , 0 ≤ q m,N ( h ) ≤ 1 holds because classification probabilities h (˜ x, C ) y must lie in the range [0 , 1] .

We will now demonstrate that the constraint B ≤ m q ≤ 1 must also hold. Let e = (( x 1 , y 1 ) , ..., ( x ℓ , y ℓ )) be a sizeℓ hyperedge in E ( ≤ m ) . By construction of E ( ≤ m ) , there exists some ˜ x ∈ ⋂ ℓ i =1 N ( x i ) . Let S ∈ ( [ K ] m ) be some superset of { y 1 , . . . , y ℓ } , which exists because ℓ ≤ m . From the definition of q m,N ( h ) , we have that q m,N ( h ) ( x i ,y i ) ≤ h (˜ x, S ) y i for each 1 ≤ i ≤ ℓ . Thus,

This gives ( B ≤ m q ) e ≤ 1 .

Now we will show P m, V ,N, H soft ⊇ { q ∈ R V : q ≥ 0 , B ≤ m q ≤ 1 } .

For any vector q in the polytope, we have a classifier h : X× ( [ K ] m ) → R [ K ] that achieves at least those correct classification probabilities. This mean that h has the following properties. First, h (˜ x, L ) y ≥ 0 and ∑ y ∈ [ K ] h (˜ x, L ) y = 1 . Second, for all ( x, y ) ∈ V , all ˜ x ∈ N ( x ) , and all L ∈ ( [ K ] m ) such that y ∈ L , we have h (˜ x, L ) y ≥ q ( x,y ) .

To get h , first define the function g : X × ( [ K ] m ) → R [ K ] so g (˜ x, L ) y = 0 for i ̸∈ L and g (˜ x, L ) y = max(0 , sup { q ( x y ,y ) : x y ∈ V y , ˜ x ∈ N ( x y ) } ) . Let L ′ ⊆ L be the set of indices where g (˜ x, L ) y > 0 . Then any list of vertices e = ( x y : y ∈ L ′ , x y ∈ V y , ˜ x ∈ N ( x y )) forms a hyperedge of size | L ′ | ≤ m . Thus

To produce h , allocate the remaining probability ( 1 -∑ g (˜ x, L ) ) to an arbitrary class.

y y

Proof of Theorem 3. The first part of this proof applies for any side-information size m . The adversarial strategy for selecting C is a specified by a conditional p.m.f. p C | y ( C | y ) . Thus p y | C ( y | C ) = p C | y ( C | y ) p y ( y ) / ∑ y ′ p C | y ( C | y ′ ) p y ( y ′ ) .

The optimal loss of the classifier against a particular adversarial strategy is just a mixture of the optimal losses for each class list: ∑ C p C | y ( C | y ) Pr[ p y ( y ) L ∗ ( P | ( y ∈ { i, j } ) , N, H ) .

If p C | y ( C | y ) = p C | y ( C | y ′ ) for all y, y ′ ∈ C , then p y | C ( y | C ) = p y ( y ) / ∑ y ′ ∈ C p y ( y ′ ) and the adversary has not provided the classifier with extra information beyond the fact that y ∈ C . Thus P x | y P y | C = P | ( y ∈ C ) .

Now we can spcialize to the m = 2 case. Any stochastic matrix s with zeros on the diagonal specifies an adversarial strategy for selecting C with p C | y ( { i, j }| i ) = s i,j . Furthermore, if s is also symmetric, p C | y ( { i, j }| i ) = p C | y ( { i, j }| j ) and p y | C ( i |{ i, j } ) = p y | C ( j |{ i, j } ) . Then the optimal classifier for the side-information game uses the ( K 2 ) optimal classifiers for the two-class games and incurs loss ∑ i,j Pr [ Y = i ] a i,j s i,j where a i,j = L ∗ ( P | ( y ∈ { i, j } ) , H , N ) . Because the diagonal entries of a are all zero, there is always a maximizing choice of s with a zero diagonal. Thus it is not necessary to include that constraint on s when specifying the optimization.

Proof of Theorem 4. If w = 0 , then the lower bound is zero and holds trivially. Otherwise, 1 1 T w w forms a probability distribution over the vertices. Let X ∈ V N be a sequence of i.i.d. random vertices with this distribution. From this sequence, we define a random independent set as follows. Include v in the set if it appears in the sequence X before any of its neighbors in G . If v and v ′ are adjacent, at most one of them can be included, so this procedure does in fact construct an independent set. The probability that X i = v is w i 1 T w and the probability that X i is v or is adjacent to v is (( A + I ) w ) v 1 T w . The first time that the latter event occurs, v is either included in the set or ruled out. If w i > 0 , the probability that v is included in the set is w v (( A + I ) w ) v and otherwise it is zero. Thus the quantity P ( S in Theorem 4 is the expected size of the random independent set and G must contain some independent set at least that large.

B Fractional packing and covering

In this section, we record some standard definition in fractional graph and hypergraph theory (24).

Let G = ( V , E ) be hypergraph and let B ∈ R E×V be its edge-vertex incidence matrix. That is, B e,v = 1 if v ∈ e and B e,v = 0 otherwise. Let p ∈ R V be a vector of nonnegative vertex weights. Let 0 be the vector of all zeros and let 1 be the vector of all ones (of whichever dimensions are required).

A fractional vertex packing in G is a vector q ∈ R V in the polytope

The minimum weight fractional vertex packing linear program is

A fractional hyperedge covering in G for weights p is a vector z ∈ R V in the polytope

The minimum weight fractional hyperedge covering linear program is

These linear programs form a dual pair.

The independent set polytope for G is the convex hull of the independent set indicator vectors.

Let G ′ be a graph on the vertex set V . A clique in G ′ is a subset of vertices in which every pair are adjacent. Let C be the set of cliques of G ′ and let C ∈ R C×V be the clique vertex incidence matrix. (In fact this construction can be interpreted as another hypergraph on V .) A fractional clique cover in G ′ for vertex weights p is a vector z ∈ R C in the polytope

Somewhat confusingly, the dual concept is called a fractional independent set in G ′ . This is a vector q ∈ R V in the polytope

C Hyperedge Finding

One challenge in computing lower bounds for 0 -1 loss in the multi-class setting is that we need to find hyperedges in the conflict hypergraph. In this section, we will consider an ℓ 2 adversary: N ( x ) = { x ′ ∈ X| || x ′ -x || 2 ≤ ϵ } and describe an algorithm for finding hyperedges within the conflict graph.

We first note that for an n -way hyperedge to exist between n inputs { x i } n i =1 , { x i } n i =1 must all lie on the interior of an n -1 -dimensional hypersphere of radius ϵ .

Given input x 1 , ..., x n where x i ∈ R d , we first show that distance between any two points in the affine subspace spanned by the inputs can be represented by a distance matrix whose entries are the squared distance between inputs. This allows us to compute the circumradius using the distance information only, not requiring a coordinate system in high dimension. Then we find the circumradius using the properties that the center of the circumsphere is in the affine subspace spanned by the inputs and has equal distance to all inputs.

We construct matrix X ∈ R d × n whose i th column is input x i . Let D ∈ R n × n be the matrix of squared distances between the inputs, i.e., D i,j = ∥ x i -x j ∥ 2 .

We first notice that D can be represented by X and a vector in R n whose i th entry is the squared norm of x i . Let ∆ ∈ R n be such vector such that ∆ i = ∥ x i ∥ 2 = ( X T X ) i,i . Then given that D i,j is the squared distance between x i and x j , we have

Let α, β ∈ R n be vectors of affine weights: 1 T α = 1 T β = 1 . Then Xα and Xβ are two points in the affine subspace spanned by the columns of X . The distance between Xα and Xβ is -( α -β ) T D ( α -β ) 2 , shown as below:

Now we compute the circumradius using the squared distance matrix D . The circumcenter is in the affine subspace spanned by the inputs so we let Xα to be the circumcenter where 1 T α = 1 . Let e ( i ) ∈ R n be the i th standard basis vector. The distance between the circumcenter and x i is ∥ Xα -Xe ( i ) ∥ 2 . From previous computation, we know that ∥ Xα -Xe ( i ) ∥ 2 = -( α -e ( i ) ) T D ( α -e ( i ) ) 2 . Since the circumcenter has equal distance to all inputs, we have

Note that the quadratic term in α is identical in each of these expressions. In addition, e ( i ) T De ( i ) = 0 for all i . So equation 7 simplifies to the linear system

for some constant c . Since 1 T α = 1 , we have

which implies that

assuming that D is invertible. The square of the circumradius, r 2 , which is the squared distance between the circumcenter and x 1 , is

Therefore, assuming matrix D is invertible, the circumradius is 1 √ 2 1 T D -1 1 .

The inverse of D can be computed as det D adj D . Since α = cD -1 1 , we have α = c det D adj D 1 . As r 2 = c 2 , constant c is non-negative. Therefore, α ∝ det D adj D 1 .

When all entries of α are non-negative, the circumcenter is a convex combination of the all inputs and the circumsphere is the minimum sphere in R n -1 that contains all inputs. Otherwise, the circumsphere of { x i | α i > 0 } is the minimum sphere contains all inputs.

After finding the radius of the minimum sphere that contains all inputs, we compare the radius with the budget ϵ . If the radius is no larger than ϵ , then there is a hyperedge of degree n among the inputs.

D Experimental Setup

In this section, we describe our experimental setup. Our code for computing bounds is also available at https://github.com/inspire-group/multiclass_robust_lb .

Datasets: We compute lower bounds for MNIST (17), CIFAR-10, and CIFAR-100 (16). Since we do not know the true distribution of these datasets, we compute lower bounds based on the empirical distribution of the training set for each dataset.

Attacker: We will consider an ℓ 2 adversary: N ( x ) = { x ′ ∈ X| || x ′ -x || 2 ≤ ϵ } . This has been used in most prior work (5; 22; 29).

LP solver: For solving the LP in Equation (4), we primarily use the Mosek LP solver (3). When the Mosek solver did not converge, we default to using CVXOpt's LP solver (2).

Computing infrastructure. In order to compute lower bounds, we perform computations across 10 2.4 GHz Intel Broadwell CPUs. For adversarial training, we train on a single A100 GPU.

Training Details For MNIST, we use 40-step optimization to find adversarial examples during training and use step size ϵ 30 and train all models for 20 epochs. For CIFAR-10 and CIFAR-100, we use 10 step optimization to find adversarial examples and step size ϵ 7 and train models for 100 epochs. For MNIST TRADES training, we use β = 1 and for CIFAR-10 and CIFAR-100, we use β = 6 . Additionally, for CIFAR-10 and CIFAR-100, we optimize the model using SGD with learning rate and learning rate scheduling from (14). For MNIST, we use learning rate 0.01.

Architectures used: For CIFAR-10 and CIFAR-100, we report results from training a WRN-28-10 architecture. For MNIST, we train a small CNN architecture consisting of 2 convolutional layers, each followed by batch normalization, ReLU, and 2 by 2 max pooling. The first convolutional layer uses a 5 by 5 convolutional kernel and has 20 output channels. The second convolutional layer also uses a 5 by 5 kernel and has 50 output channels. After the set of 2 convolutional layers with batch normalization, ReLU, and pooling, the network has a fully connected layer with 500 output channels followed by a fully connected classifier (10 output channels). In §E.8, we consider the impact of architecture on closing the gap to the optimal loss.

E Additional Experimental Results

In this Section, we provide additional experimental results to complement those from the main body of the paper. We organize it as follows:

§E.1: We analyze a toy problem on 2D Gaussian data to get a better understanding of the impact of hyperedges on the optimal loss computation.

§E.2: We investigate why higher degree hyperedges dp not have a large impact on lower bounds at lower values of ϵ .

§E.3: We show the runtime explosion at higher values of ϵ that makes it challenging for us to report optimal loss values.

§E.4: Classwise L2 distance statistics and heatmaps for pairwise losses used to compute class-only lower bounds in main paper.

§E.5: We provide results with standard PGD-based adversarial training, and show it is outperformed by Trades.

§E.6: We provide results on the CIFAR-100 dataset.

§E.7: We show lower bounds for a different set of 3 classes than the one considered in the main body. Main takeaways remain the same.

§E.8: We ablate across larger neural networks to check if increasing capacity reduces the gap to optimal.

§E.9: We attempt dropping examples from the training set that even the optimal clasifier cannot classify correctly in order to improve convergence.

§E.10: We compute lower bounds on the test set for MNIST 3-class classification

E.1 Results for Gaussian data

4

3

2

1

0

1

2

3

4

4

3

2

1

0

1

2

3

4

We begin with a 3-way classification problem on 2D Gaussian data. To generate our Gaussian dataset, we sample 1000 points per class from 3 spherical Gaussians with means at distance 3 away from from the origin (a sample is shown in Figure 4). We compute multiclass lower bounds via the LP in Theorem 1 on robust accuracy at various ℓ 2 budget ϵ and display these values in Figure 5 as L ∗ (3) . Additionally, we compare to a deterministic 3 way classifier. This classifier is the best performing out of the 2 strategies: 1) constantly predict a single class (thus achieving 2 3 loss) or 2) is the classifier in black in Figure 4 which classifies incorrectly when a sample lies over the edge of the nearest ϵ margin of the classifier.

We observe that at smaller values of ϵ , the loss achieved by the 3-way classifier matches optimal loss ( L ∗ (3) ); however, after ϵ = 2 . 5 for σ 2 = 0 . 05 and ϵ = 2 . 3 for σ 2 = 0 . 5 , we find the classifier no longer achieves optimal loss. This suggests that there is a more optimal classification strategy at these larger values of ϵ . In Figures 6 and 7, we visualize the distribution of correct classification probabilities obtained through solving the LP with and without considering hyperedges. These figures are generated by taking a fresh sample of 1000 points from each class and coloring the point based on the correct classification probability q v assigned to its nearest neighbor that was used in the conflict

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8

0.0

0.2

0.4

0.6

0.8

0-1 loss

L

*

(2)

L

*

(3)

Classifier loss

(a)

σ

2

= 0

.

05

1.5 1.6 1.7 1.8 1.9 2.0 2.1 2.2 2.3 2.4 2.5 2.6

0.0

0.2

0.4

0.6

0.8

0-1 loss

L

*

(2)

L

*

(3)

Classifier loss

(b)

σ

2

= 0

.

5

hypergraph when computing the lower bound. We observe from Figure 6, for all classes, the data are mostly assigned classification probabilities around 0.5. In Figure 7, we can see that when we consider hyperedges, we some of these 0.5 assignments are reassigned values close to 2 3 and 1 3 . Interestingly, we notice that when we do not consider hyperedges, our solver finds an asymmetric solution to the problem (strategies for class 0, 1, and 2 differ) while when considering hyperedges this solution becomes symmetric.

4

3

2

1

0

1

2

3

2

1

0

1

2

3

4

(a) Class 0

2

1

0

1

2

3

4

3

2

1

0

1

2

3

4

(b) Class 1

4

3

2

1

0

1

2

3

4

4

3

2

1

0

1

2

(c) Class 2

0.0

0.2

0.4

0.6

0.8

1.0

4

3

2

1

0

1

2

3

2

1

0

1

2

3

4

(a) Class 0

2

1

0

1

2

3

4

3

2

1

0

1

2

3

4

(b) Class 1

4

3

2

1

0

1

2

3

4

4

3

2

1

0

1

2

(c) Class 2

0.0

0.2

0.4

0.6

0.8

1.0

E.2 Impact of hyperedges

In Figure 8, we show the count of edges, degree 3 hyperedges, and degree 4 hyperedges found in the conflict hypergraphs of the MNIST, CIFAR-10, and CIFAR-100 train sets. We note that we did

not observe any increase in loss when considering degree 4 hyperedges at the ϵ with a data point for number of degree 4 hyperedges in Figure 8. We find that the relative number of edges and hyperedges is not reflective of whether we expect to see an increase in loss after considering hyperedges. For example in CIFAR-10, at ϵ = 4 . 0 , we there are about 100 times more hyperedges than edges, but we see no noticeable increase in the 0 -1 loss lower bound when incorporating these hyperedge constraints.

Edges

Degree 3 hyperedges

Degree 4 hyperedges

1.5

2.0

2.5

3.0

3.5

10 1

10 3

10 5

10 7

count

MNIST

(a) MNIST

2.0

2.5

3.0

3.5

4.0

4.5

5.0

10 3

10 5

10 7

count

CIFAR-10

(b) CIFAR-10

2.0

2.5

3.0

3.5

4.0

4.5

5.0

10 2

10 4

10 6

10 8

count

CIFAR-100

(c) CIFAR-100

To understand why including more information about hyperedges does not influence the computed lower bound much, we examine the distribution of q v obtained from solutions to the LP with ( L ∗ (3) ) and without degree 3 hyperedges ( L ∗ (2) ). Fig. 9 contains a histogram of the distributions of q v for MNIST. For small ϵ , there is no change in the distribution of q v , the distribution of q v is almost identical between L ∗ (2) and L ∗ (3) . At larger values of ϵ , in L ∗ (2) , a significant fraction of vertices are assigned q v near 0.5. While these shift with the addition of hyperedges, very few of them were in triangles of G ≤ 2 that were replaced by a hyperedge in G ≤ 3 . This leads to the loss value changing minimally.

Similar to Figure 9, we plot the distribution of vertex weights q v obtained through solving the LP for L ∗ (2) and L ∗ (3) for CIFAR-10 in Figure 10. Similar to trends for MNIST, we find that the gap between L ∗ (2) and L ∗ (3) only occurs when the frequency of 0.5 weights is higher.

L

*

(2)

L

*

(3)

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

0.8

1.0

frequency

Distribution of

qv

for  =2.5

(a)

ϵ

= 2

.

5

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

0.8

1.0

frequency

Distribution of

qv

for  =3.0

(b)

ϵ

= 3

.

0

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

0.8

1.0

frequency

Distribution of

qv

for  =3.5

(c)

ϵ

= 3

.

5

E.3 Computational complexity of computing lower bounds

Our experiments of L ∗ (3) and L ∗ (4) at higher ϵ are limited due to computation constraints. Figure 11 we see that the time taken to compute the L ∗ (3) grows rapidly with ϵ . We also report timings for all bounds for CIFAR-10 at ϵ = 4 in Table 2. In future work, we are seeking algorithmic optimization to achieve more results at high ϵ .

L

*

(2)

L

*

(3)

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

0.8

frequency

Distribution of

qv

for  =3.5

(a)

ϵ

= 3

.

5

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

0.8

frequency

Distribution of

qv

for  =4.0

(b)

ϵ

= 4

.

0

0.00

0.25

0.50

0.75

1.00

qv

0.0

0.2

0.4

0.6

frequency

Distribution of

qv

for  =4.5

(c)

ϵ

= 4

.

5

2.0

2.5

3.0

3.5

4.0

10 1

10 3

10 5

time (s)

MNIST

(a) MNIST

L

*

(2)

L

*

(3)

2.0

2.5

3.0

3.5

4.0

4.5

5.0

5.5

6.0

10 0

10 1

10 2

10 3

10 4

time (s)

CIFAR-10

(b) CIFAR-10

E.4 Classwise statistics and pairwise losses

In order to have a better understanding of the difficulty of the classification task under the presence of an ℓ 2 bounded adversary, we report the average ℓ 2 to the nearest neighbor of another class for each class in the MNIST and CIFAR-10 datasets in Table 3.

Another way of understanding the relative difficulty of classifying between classes is by computing the optimal loss for all 1v1 binary classification tasks. We note that these values are used in Section 4.2 to compute a lower bound on the optimal loss in the 10-class case from maximum weight coupling over optimal losses for 1 v 1 binary classification problems. In Figure 12, we show the heat maps for optimal losses for each pair of 1v1 classification problems for ϵ = 3 on MNIST and ϵ = 4 on CIFAR-10. We find that for both datasets only a few pairs of classes have high losses. Specifically, for MNIST, we find that the class pairs 4-9 and 7-9 have significantly higher loss than all other pairs of classes. For CIFAR-10, we find that 2-4 has the highest loss compared to other pairs, and 2-6 and 6-4 are also quite high.

E.5 Additional adversarial training results

In Figure 13, we also add the loss achieved by PGD adversarial training. We find that this approach generally performs worse on MNIST compared to TRADES and is also unable to fit to CIFAR-10 data at the ϵ values tested.

E.6 Truncated hypergraph lower bounds for CIFAR-100

We provide results for truncated hypergraph lower bounds for the CIFAR-100 train set. We observe that similar to MNIST and CIFAR-10, including more hyperedge constraints does not influence the computed lower bound.

E.7 Computed bounds for a different set of 3-classes

In Figure 15, we plot 3-class lower bounds via truncated hypergraphs ( L ∗ (2) and L ∗ (3) ) for a different set of 3 classes as shown in the main body. These classes generally have less similarity than the classes shown in the main body of the paper causing the loss bound to increase more slowly as epsilon increases. However, we find that patterns observed for the 3 classes present in the main body of the paper are also present here: the gap between L ∗ (2) and L ∗ (3) is only visible at large values of 0-1 loss (ie. loss of 0.4).

E.8 Impact of architecture size

Previously, we saw that adversarial training with larger values of ϵ generally fails to converge (leading to losses matching random guessing across 3 classes). We now investigate whether increasing model capacity can resolve this convergence issue. In Figure 16, we plot the training losses of 3 WRN architectures commonly used in adversarial ML research across attack strength ϵ for the 3-class CIFAR-10 (classes 0, 2, 8) problem. All models are trained with TRADES adversarial training. Interestingly, we find that the benefit of larger architecture size only appears for the smallest value of epsilon plotted ( ϵ = 1 ) at which the optimal classifier can theoretically obtain 0 loss. At larger values of epsilon, the improvement in using larger architecture generally disappears.

E.9 Impact of dropping "hard" examples

From our experiments involving adversarial training, we found that training with large values of ϵ generally fails to converge. A potential way of trying to improve convergence using the results from our LP is to drop examples with optimal classification probability less than 1 and train with the remaining examples. Since even the optimal classifier cannot classify these examples correctly, these examples can be considered "hard" to learn. We find that in practice this does not lead to lower training loss; specifically, training without "hard" examples leads to a loss of 0.64 for CIFAR-10 with ϵ = 3 while training with "hard" examples leads to a loss 0.57. We note that this loss is computed over the entire training dataset (including "hard" examples) for both settings.

E.10 Lower bounds on test set

In the main text, we computer lower bounds on the train set as this would measure how well existing training algorithms are able to fit to the training data. In Table 4, we compute lower bounds on the test set (which contains 1000 samples per class) for MNIST 3-class classification between classes 1, 4, and 7. We find that the computed loss is similar to what is computed on a subset of the train set which contains the same number of samples per class.

0

1

2

3

4

5

6

7

8

9

Class

0

1

2

3

4

5

6

7

8

9

Class

MNIST pairwise loss when  =3

0.00

0.05

0.10

0.15

0.20

0.25

0.30

(a) MNIST (

ϵ

= 3

)

0

1

2

3

4

5

6

7

8

9

Class

0

1

2

3

4

5

6

7

8

9

Class

CIFAR-10 pairwise loss when  =4

0.000

0.025

0.050

0.075

0.100

0.125

0.150

0.175

0.200

(b) CIFAR-10 (

ϵ

= 4

)

2.0

2.5

3.0

3.5

4.0

4.5

5.0

0.0

0.2

0.4

0.6

0.8

0-1 loss

L

*

(2)

L

*

(3)

TRADES-AT

PGD-AT

(a) MNIST (1, 7, 9)

3.0

3.5

4.0

4.5

5.0

5.5

6.0

6.5

7.0

0.0

0.2

0.4

0.6

0.8

0-1 loss

L

*

(2)

L

*

(3)

TRADES-AT

PGD-AT

(b) CIFAR-10 (0, 2, 8)

2.0

2.5

3.0

3.5

4.0

4.5

5.0

5.5

6.0

6.5

0.0

0.2

0.4

0.6

0-1 loss

L

*

(2)

L

*

(3)

L

*

(4)

2.0

2.5

3.0

3.5

4.0

4.5

5.0

0.0

0.2

0.4

0.6

0-1 loss

MNIST Class 2, 5, 8

L

*

(2)

L

*

(3)

(a) MNIST (2, 5, 8)

3.0

3.5

4.0

4.5

5.0

5.5

6.0

6.5

7.0

0.0

0.2

0.4

0.6

0-1 loss

CIFAR-10 Class 1, 4, 9

L

*

(2)

L

*

(3)

(b) CIFAR-10 (1, 4, 9)

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

0.0

0.2

0.4

0.6

0.8

1.0

0-1 loss

L

*

(3)

WRN-28-10

WRN-34-10

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper generalizes lower bounds on the adversarially robust error on a finite dataset from binary to multi-class classification.\n\nSTRENGTHS:\n1. The paper is well presented and easy to read, which is no mean feat for the amount of theory that is introduced and developed.\n2. The formalization and assumptions are clearly stated, well arranged, and do not contain unnecessary complications.\n3. The developed theory is correct as far as I can tell.\n4. The experimental evaluations make sense for the discussed topic, regard standard baselines and are easy to understand. They are shown even while they don't support the necessity of the multi-class theory, which is nice to see.\n5. The fact that calculating the bounds based on binary l2-ball intersections makes no difference in practice doesn't mean that the theory is not helpful for estimations that are in principle more correct.\n6. Limitations are discussed honestly.\n7. The code looks nice, but I haven't tested it.\n\nWEAKNESSES:\n1. While they are no clear weaknesses, there are some points unclear to me which I list below in the Questions section and I would much appreciate to see answered and in some cases discussed in the paper.\n2. A substantial part of the formalization, theory and experimental design are not completely newly developed, but carried over from the previous paper \"Lower Bounds on Cross-Entropy Loss in the Presence of Test-time Adversaries\" which deals with the same problem in the more special case of binary classification. This is why I'm rating this submission currently as a standard \"accept\".\n\nQUESTIONS:\n1. While Equation (1) is true, I think it is not trivial, but a theorem that depends on some assumptions (which appear to be fulfilled by the considered hypothesis classes). It was proven in (Pydi,Jog 2022: \"The Many Faces of Adversarial Risk\")[https://arxiv.org/abs/2201.08956], but there might be earlier, more well known versions of the theorem. I think the intuition why (1) is true should be given.\n2. l. 89 I think it should better read \"the vector of _robustly_ correct classification\"\n3. l. 97 Should \"feasible\" read \"achievable\" here to stay consistent?\n4. l. 97 Do the nonnegative linear combinations need to have factors that sum to less than 1?\n5. Is L without * correct in Eq. (2)? If so, it wasn't defined.\n6. l. 122 missing word\n7. l. 124 extra (\n8. Is the construction of the full hypergraph indeed computationally expensive for an l2 threat model? Intutitively, the geometry might make incidence matrix very sparse and its computation quite straightforward. Or is it rather an issue with the LP solver?\n9. Would it make sense to regard the reverse truncation where if we find a triple of pairs with overlap (as in Fig. 1 left), we assume that there is also a point that generates the degree 3 hyperedge (and so on for higher degrees)? this might maybe yield an upper bound on $L^*(K)$.\n10. l. 296 whether and in which sense the hypothesis class is much smaller is not obvious, and it is not clear if insufficient fitting within the class might be responsible for a large part of the gap.\n11. In Figure 3, an empirical model evaluation as in Figure 2 should be included. ($L_{CW}$ is a bit confusing at first look, since many papers use that for Carlini-Wagner l2 attacks.)\n12. Why not use the full AutoAttack?\n13. The statistics on number of hyperedges should be included for all datasets, and a few values of epsilon (including 2 and 2.5), since they quantify the importance of regarding multi-class overlaps.\n14. Also statistics like the average distance of an image to the closest one from another class would be nice to understand the geometry of the neighborhood overlaps.\n15. It would be great if the authors could find a type of dataset and threat model where multi-class neighborhood overlap plays a bigger role than with MNIST and CIFAR. Maybe even a toy example would be illustrative.\n16. Since the paper talks about optimal errors for finite distributions, it would make sense to show evaluations both on training and test sets.\n17. A more concrete comparison to Trillos et al.[21], if applicable with evaluation numbers, would be helpful.\n18. A discussion of the limitation to distributions with finite support and whether one can expect this assumption to be softened in future works building on this one would be interesting.\n\nLIMITATIONS:\nThe limitations are discussed in detail.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-06-20"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nDeep learning techniques achieve state-of-the art performance on various classification tasks, but alarmingly, they are highly susceptible to adversarial perturbations. It is currently unknown whether there even exist classifiers that achieve low adversarial training risk on standard datasets. This paper aims to close this gap. The authors restate the adversarial learning problem over all classifiers as a linear program which can then be solved using standard LP techniques. This LP is stated in terms of the hyperedges of a hypergraph. As the resulting LP is computationally intractable, the authors then propose several ways to truncate this LP. The paper concludes with an experimental section in which they use the paper's techniques to upper bound the minimal possible adversarial loss for MNIST and CIFAR-10.\n\nSTRENGTHS:\n- It is currently unknown if finding robust classifiers to real-world datasets is possible. This paper presents a strong argument that such classifiers exist\n- Using linear programming to attack this problem is very creative!\n\nWEAKNESSES:\n- I have some concerns about the correctness of this paper. Here are some specific issues\n1. $q$ in line 20 of the supplementary material is not defined. This makes it quite hard to evaluate the correctness of the proof of Lemmas 1 and 2\n2. I suspect Lemma 1 is false. Lower bounds on the adversarial risk computed in this paper rely on this lemma, so if Lemma 1 is false, these bounds would be invalidated. \n\nConsider the following example: Consider 3 vertices with the incidence hypergraph of the left picture in Figure 1. Specifically, $\\mathcal N(u)= \\{u,v\\},\\mathcal N(v)=\\{v,w\\}, \\mathcal N(w)=\\{w,v\\}$.  Then the incidence matrix $B$ is\n|               |$u$|$v$|$w$|\n|------------|-----|----|----|\n|$e_{wu}$| 1   | 0   |1 |\n|$e_{uv}$|1    | 1    |0|\n|$e_{vw}$| 0    | 1   |1 |\n|$e_{u}$  |1     | 0  |0 |\n|$e_{v}$  |0     |0     |1 |\n|$e_{w}$ |0     |1     |0|\n\n\n\n\nConsider the vector $b= [0.5, 0.3, 0.2]$ (with vertices in order $u$, $v$, $w$). This vector clearly satisfies $b\\geq 0$ and $Bb \\leq \\mathbf 1$.\nWe will now show that this vector is not in $\\mathcal P_{\\mathcal V, N,\\mathcal H}$, as defined in line 96 of the paper.  For contradiction, assume that there is an $h$ for which $q_N(h)$ satisfies $0\\leq b_i\\leq q_N(h)_i$ for $i\\in \\{u,v,w\\}$. By definition, $q_N(h)_v=\\inf$ { $h(x): x\\in N(v)$}. \nThus $h(u)\\geq .5$ and $h(v)\\geq .5$. As $h$ is a probability vector, it follows that $h=(.5, .5, 0)$ and $q_N(h)=(.5,0,0)$. This is a contradiction as $h(v)\\leq b(v)=.3$. \n\n\n3. In definition 2, h is defined to be $\\cY$-valued but the expression $1-h(\\tilde x,c)_y$ assumes that this function is $\\mathbb R$ valued. As this definition is central to section 3, the correctness of this section is hard to evaluate\n- The paper does not introduce central mathematical concepts or introduces them poorly. For instance, \n1. line 82: \"architecture\" is discussed before neural nets are introduced\n2. what is 'downwards-closed' in line 110?\n3. The phrase \"correct probability vectors\" in Lemma 1 is misleading because the q's typically don't sum to 1\n4. What does 'fractional coverings' mean in line 119?\n5. lines 241-246: an argument is presented involving the fractional vertex packing polytope and the independent set polytope but these are only introduced very briefly\n\nQUESTIONS:\n- Can you explain the issues with Lemma 1 pointed in in the first bullet under weaknesses? Resolving this issue would convince me to change the review score\n- Problems in optimal transport frequently need to solve linear programs in $\\mathbf q$  with the constraint $\\mathbf q\\geq 0$. For computational expediency, the sinkhorn algorithm uses entropic regularization to deal with this constraint. Could you possibly make use of this technique?\n- It seems that in the matrix inequality $Bq\\leq 1$ in Lemma 1, many rows may be linearly dependent. Have you tried getting rid of such rows?\n\nLIMITATIONS:\nOne central limitation of this work is that it studies the minimal possible adversarial risk over all possible (soft) classifiers rather than a particular function class. \nThis limitation is discussed in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes to theoretically evaluate the robustness of a multi-class classifier by setting the lower and upper bounds of the optimal loss, i,e, the lowest loss achievable for a given hypothesis family. The lower bound is established by extending the conflict graph-based framework previously applied to the binary classification setting. The upper bound is built by generalizing the Caro-Wei bound. Beyond theoretical analysis, this work also focuses on computable methods to estimate the bounds, i.e. using the lower bounds of binary classification problems to compute that for the multi-class problem.\n\nSTRENGTHS:\nIt is an important contribution to set up an upper and lower bound for the lowest achievable classification loss under the testing-time perturbation. These two bounds help to narrow down the possible range of the classification loss facing input noise, which measures accurately the robustness of a classifier.  Furthermore, this work provides the link between the optimal loss bound of binary classification tasks and that for multi-class tasks. This contribution enables efficient computation of the bound estimates when the number of classes increases.\n\nWEAKNESSES:\nI have to admit that I am not familiar with this theory. It takes me quite some time to read the contexts before I can figure out how this framework can be integrated into the investigated problem. I think for any readers / reviewers without the background information, offering even a brief introduction could be very helpful to evaluate the contribution.\n\nQUESTIONS:\nHow tight are the upper and lower bound ?  Especially for the upper bound, this is established based the Caro-Wei bound, which is different from the conflict hypergraph framework. It is not clear how accurate the upper bound could be.\n\nLIMITATIONS:\nNone", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to analyze the optimal 0/1 loss under the most strongest test time attack. The study commences by formulating the problem of obtaining the optimal classifier (based on 0/1 loss) as a linear program on a graph. Subsequently, the authors address the high computational complexity of calculating the optimal 0/1 loss by proposing a reduction technique through graph truncation. This reduction enables the computation of a lower bound of the 0/1 loss in a feasible timeframe. Ultimately, the authors present empirical evidence comparing their bound with the empirical defense method on real-world data. Notably, they discover that the widely-used baseline (adversarial training) still offers significant potential for improvement.\n\nSTRENGTHS:\n- The paper is written clearly and easy to follow.\n- This paper extents the analysis on the optimal classifier under test time attack to multi-class classification setting. It seems to be a decent extension/contribution to the theoretical side of the field of adversarial robustness.\n- Usually for this kind of problem, the computation complexity is one of the main challenge. However, they are able to find a way to speed it up. The idea of reducing it to a graph and then truncate the complex edges to reduce the computation needed for getting the bounds is interesting. In addition, they also show that empirically, such relaxation does not lose much information.\n\nWEAKNESSES:\n- Although it is mentioned in the related work that this is different from verifying robustness. I think it would be a valuable information to include bounds for verified classifiers in the empirical section. It would be interesting to see how close the existing verified classifiers are to the optimal bound. \n- A related work titled \"Robustness for non-parametric classification: A generic attack and defense.\" published in International Conference on Artificial Intelligence and Statistics, 2020 can be added. This work also utilize the idea of creating graph with the vertices being each example and edges being conflicting examples pairs. They tried to approach the optimal 0/1 by removing minimum number of edges. Although they did not compute specific bounds on the optimal 0/1 loss, I think it is still worth being discussed.\n- This is a work with solid technical contribution. However, as mentioned in the limitation, the lack of implication on how to close the gap between the current robust classifiers and the optimal classifier limits the impact of this work to a moderate-to-high impact paper.\n- Although a method for speeding up the algorithm through truncating the graph is proposed, the applicability of the proposed algorithm in practice seems to be still limited in practice due to heavy computational cost (in the experiment, only three class classification problems are run).\n\nQUESTIONS:\nAre there any of my review comments that misunderstood the paper? If so, please point them out. I am happy to adjust accordingly.\n\nLIMITATIONS:\nThe authors do properly addressed the limitation of this work, which includes the lack of scalability of their algorithm and the lack of implications on how to close the gap between the current robust classifiers and the optimal classifier.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-25"}