Towards Consistency in Adversarial Classiﬁcation
Abstract
In this paper, we study the problem of consistency in the context of adversarial examples.
Speciﬁcally, we tackle the following question:
Can surrogate losses still be used as a proxy for minimizing the 0 / 1 loss in the presence of an adversary that alters the inputs at test-time?
Different from the standard classiﬁcation task, this question cannot be reduced to a point-wise minimization problem, and calibration needs not to be sufﬁcient to ensure consistency.
In this paper, we expose some pathological behaviors speciﬁc to the adversarial problem, and show that no convex surrogate loss can be consistent or calibrated in this context.
It is therefore necessary to design another class of surrogate functions that can be used to solve the adversarial consistency issue.
As a ﬁrst step towards designing such a class, we identify sufﬁcient and necessary conditions for a surrogate loss to be calibrated in both the adversarial and standard settings.
Finally, we give some directions for building a class of losses that could be consistent in the adversarial framework.
Introduction
State-of-the-art machine learning classiﬁers are known to be vulnerable to adversarial example attacks [9, 18], i e., perturbation of the input data at test time that, while imperceptible, can signiﬁcantly inﬂuence the classiﬁer’s output.
This can have extreme consequences in real-life scenarios such as autonomous cars [19].
Therefore, it is necessary to design robust classiﬁers that present worst-case guarantees against a range of possible perturbations.
To account for the possibility of an adversary manipulating the inputs at test time, we need to revisit the standard risk minimization problem by penalizing any classiﬁcation model that might change its decision when the point of interest is slightly changed.
Essentially, this is done by replacing the standard (pointwise) 0 / 1 loss with an adversarial version that mimics its behavior locally but also penalizes any error in a given region around the point on which it is evaluated.
Yet, just like the 0 / 1 loss, its adversarial counterpart is not convex, which renders the risk minimization difﬁcult.
To circumvent this limitation, we take inspiration from the standard learning theory approach which consists in solving a simpler optimization problem where the non-convex loss function is replaced by a convex surrogate.
In general, the surrogate loss is chosen to have a property called consistency [20, 6, 17], which essentially guarantees that any sequence of classiﬁers that minimizes the surrogate objective must also be a sequence that minimizes the Bayes risk.
In the context of standard classiﬁcation, a large family of convex losses, called classiﬁer-consistent , exhibits this property.
This class notoriously includes the hinge loss, the logistic loss and the square loss.
However, the adversarial version of these surrogate losses need not to exhibit the same consistency properties with respect to the adversarial 0 / 1 loss.
In fact, most existing results in the standard 36th Conference on Neural Information Processing Systems (NeurIPS 2022).
framework rely on a reduction of the global consistency problem to a point-wise problem, called calibration .
However, this approach is not feasible in the adversarial setting, because the new losses are by nature non-point-wise: the optimum for a given input may depend on yet a whole other set of inputs [1, 3].
Studying the concepts of calibration and consistency in an adversarial context remains an open and understudied issue.
Furthermore, this is a complex and technical area of research, that requires a rigorous analysis, since small tweaks in deﬁnitions can quickly make results meaningless or inaccurate.
This difﬁculty is illustrated in the literature, where articles published in high proﬁle conferences tend to contradict or refute each other [4, 1, 3].
Objective & Contributions.
The objective of our work is to try and identify possible sources of confusion that may hinder the understanding of the concepts of calibration and consistency in the adversarial setting.
In particular, we ﬁrst come back in Section 2 on the problem of consistency and calibration in the standard setting and carefully deﬁne their adversarial counterpart.
In doing so, we note that previous papers studying adversarial surrogate losses [4, 1, 3] did not use the same 0 / 1 -loss as the one used in seminal papers on consistency [20, 6, 17].
This difference might be crucial since it may lead to inaccurate results (see Section 5).
We then study in Section 3, the problem of calibration in the adversarial setting and provide both necessary and sufﬁcient conditions for a loss to be calibrated in this setting.
It also worth noting that our results are easily extendable to H -calibration (see Appendix L).
One on the main takeaway of our analysis is that no convex surrogate loss can be calibrated in the adversarial setting.
We however characterize a set of non-convex loss functions, namely shifted odd functions that solve the calibration problem in the adversarial setting.
Finally, we focus on the problem of consistency in the adversarial setting in Section 4.
Based on min-max arguments, we provide insights that might help paving a way to prove consistency of shifted odd functions in the adversarial setting.
Speciﬁcally, we prove strong duality results for these losses and show tight links with the 0 / 1 -loss.
From these insights, we are able to provide a close but weaker property to consistency.
Notions of Calibration and Consistency
Let us consider a classiﬁcation task with input space X and output space Y = {  1 , +1 } .
Let ( X , d ) be a proper Polish (i.e. completely separable) metric space representing the inputs space.
For all x 2 X and  > 0 , we denote B  ( x ) the closed ball of radius  and center x .
We also assume that for all x 2 X and  > 0 , B  ( x ) contains at least two points 1 .
Let us also endow Y with the trivial metric d 0 ( y, y 0 )
= 1 y 6 = y 0 .
Then the space ( X ⇥ Y , d  d 0 ) is a proper Polish space.
For any Polish space Z , we denote M 1+ ( Z ) the Polish space of Borel probability measures on Z .
We will denote F ( Z ) the space of real valued Borel measurable functions on Z .
Finally, we denote ¯ R :=
R [ { 1 , + 1 } .
2.1 Notations and Preliminaries
The 0 / 1 -loss is both non-continuous and non-convex, and its direct minimization is a difﬁcult problem.
The concepts of calibration and consistency aim at identifying the properties that a loss must satisfy in order to be a good surrogate for the minimization of the 0 / 1 -loss.
In this section, we deﬁne these two concepts and explain the difference between them.
First of all, we need to give a general deﬁnition of a loss function.
Deﬁnition 2.1 (Loss function) .
A loss function is a function L : X ⇥ Y ⇥ F ( X ) !
R such that L ( · , · , f ) is measurable for all f 2 F ( X ) .
Note that this deﬁnition is not speciﬁc to the standard or adversarial case.
In general, the loss at point ( x, y ) can either depend only on f ( x ) , or on other points related to x (e.g. the set of points within a distance " of x ).
We now recall the deﬁnition of the risk associated with a loss L and a distribution P .
Deﬁnition 2.2 ( L -risk of a classiﬁer) .
For a given loss function L , and a Borel probability distribution P over X ⇥ Y we deﬁne the risk of a classiﬁer f associated with the loss L and a distribution P as
[Equation]
We also deﬁne the optimal risk associated with the loss L as
[Equation]
Essentially, the risk of a classiﬁer is deﬁned as the average loss over the distribution P .
When the loss L is difﬁcult to optimize in practice (e.g when it is non-convex or non-differentiable), it is often preferred to optimize a surrogate loss function instead.
In the literature [20, 6, 17], the notion of surrogate losses has been studied as a consistency problem.
In a nutshell, a surrogate loss is said to be consistent if any minimizing sequence of classiﬁers for the risk associated with the surrogate loss is also one for the risk associated with L .
Formally, the notion of consistency is as follows.
Deﬁnition 2.3 (Consistency) .
Let L 1 and L 2 be two loss functions.
For a given P 2 M +1 ( X ⇥ Y ) ,
L 2 is said to be consistent for P with respect to L 1 if for all sequences ( f n ) n 2 F ( X ) N :
[Equation]
Furthermore, L 2 is said consistent with respect to a loss L 1 the above holds for any distribution P .
Consistency is in general a difﬁcult problem to study because of its high dependency on the distribution P at hand.
Accordingly, several previous works [20, 5, 17] introduced a weaker notion to study a pointwise version consistency.
This simpliﬁed notion is called calibration and corresponds to consistency when P is a combination of Dirac distributions.
The main building block in the analysis of the calibration problem is the calibration function, deﬁned as follows.
Deﬁnition 2.4 (Calibration function) .
Let L be a loss function.
The calibration function C L is
[Equation]
for any ⌘ 2 [0 , 1] , x 2 X and f 2 F ( X ) .
We also deﬁne the optimal calibration function as
[Equation]
Note that for any x 2 X and ⌘ 2 [0 , 1] , when P = ⌘ ( x, +1)
+ (1  ⌘ )  ( x,  1) , we C L ( x, ⌘ , f ) =
R L, P ( f ) with The calibration function thus corresponds then to a pointwise notion of the risk, evaluated at point x . ⌘ corresponds in this case to the conditional probability of y = 1 given x .
We now deﬁne the calibration property of a surrogate loss.
Deﬁnition 2.5 (Calibration) .
Let L 1 and L 2 be two loss functions.
We say that L 2 is calibrated with regards to L 1 if for every ⇠ > 0 , ⌘ 2 [0 , 1] and x 2 X , there exists  > 0 such that for all f 2 F ( X ) ,
[Equation]
Furthermore, we say that L 2 is uniformly calibrated with regards to L 1 if for every ⇠ > 0 , there exists  > 0 such that for all ⌘ 2 [0 , 1] , x 2 X and f 2 F ( X ) we have
[Equation]
Connection between calibration and consistency.
It is always true that calibration is a necessary condition for consistency.
Yet there is no reason, in general, for the converse to be true.
However, in the speciﬁc context usually studied in the literature (i.e., the standard classiﬁcation with a well-deﬁned 0 / 1 -loss), the notions of consistency and calibration have been shown to be equivalent.
In the next section, we come back on existing results regarding calibration and consistency in this speciﬁc (standard) classiﬁcation setting.
2.2 Existing Results in the Standard Classiﬁcation Setting
Classiﬁcation is a standard task in machine learning that consists in ﬁnding a classiﬁcation function h : X ! Y that maps an input x to a label y .
In binary classiﬁcation, h is often deﬁned as the sign of a real valued function f 2 F ( X ) .
The loss usually used to characterize classiﬁcation tasks corresponds to the accuracy of the classiﬁer h .
When h is deﬁned as above, this loss is deﬁned as follows.
Deﬁnition 2.6 ( 0 / 1 loss) .
Let f 2 F ( X ) .
We deﬁne the 0 / 1 loss as follows
[Equation]
with a convention for the sign, e.g. sign (0) = 1 .
We will denote R P ( f ) :
= R l 0 / 1 , P ( f ) , R ? P :=
R ? l 0 / 1 , P , C ( x, ⌘ , f ) :
= C l 0 / 1 ( x, ⌘ , f ) and C ? ( x, ⌘ ) :
= C ? l 0 / 1 ( x, ⌘ ) .
Note that this 0 / 1 -loss is different from the one introduced by Bao et al.
[4], Awasthi et al.
[1, 3]: they used 1 y ⇥ f ( x )  0 which is a usual 0 / 1 loss but unadapted to consistency and calibrated study (see Section 5 for details).
Some of the most prominent works [20, 6, 17] among them focus on the concept of margin losses, as deﬁned below.
Deﬁnition 2.7 (Margin loss) .
A loss L  is said to be a margin loss if there exists a measurable function  : R ! R + such that:
[Equation]
For simplicity, we will say that  is a margin loss function and we will denote R  and C  the risk associated with the margin loss  .
Notably, it has been demonstrated in several previous works [20, 6, 17] that, for a margin loss  , we have always have C ?  ( x, ⌘ ) =
inf ↵ 2 R ⌘ ( ↵ ) + (1  ⌘ )  (  ↵ ) .
This is in particular one of the main observation allowing to show the following strong result about the connection between consistency and calibration.
Theorem 2.1 (Zhang [20], Bartlett et al.
[6], Steinwart [17]) .
Let  : R ! R + be a continuous margin loss.
Then the three following assertions are equivalent: (i)  is calibrated with regards to l 0 / 1 , (ii)  is uniformly calibrated l 0 / 1 , (iii)  is consistent with regards to l 0 / 1 .
Moreover, if  is convex and differentiable at 0 , then  is calibrated if and only  0 (0) < 0 .
The Hinge loss  ( t ) = {+max(
 +} t, 0) and the logistic loss  ( t ) =
log(1 + e  t ) are classical examples of convex consistent losses.
Convexity is a desirable property for faster optimization of the loss, but there exist other non-convex losses that are calibrated as the ramp loss (  ( t ) =
12 (max(1  t, 0) + max(  1  t, 0)) ) or the sigmoid loss (  ( t ) =
(1 + e t )  1 ).
These losses are plotted on the left in Figure 1.
In the next section, we present the adversarial classiﬁcation setting for which Theorem 2.1 may not hold anymore.
Remark 1.
The equivalence between calibration and consistency is a consequence from the fact that, over the large space of measurable functions, minimizing the loss pointwisely in the input by desintegrating with regards to x is equivalent to minimize the whole risk over measurable functions.
This result is very powerful and simplify the study of calibration in the standard setting.
2.3 Calibration and Consistency in the Adversarial Setting.
We now consider the adversarial classiﬁcation setting where an adversary tries to manipulate the inputs at test time.
Given " > 0 , they can move each point x ⇠ P to another point x 0 which is at distance at most " from x 2 .
The goal of this adversary is to maximize the 0 / 1 risk the shifted points from P .
Formally, the loss associated to adversarial classiﬁcation is deﬁned as follows.
Deﬁnition 2.8 (Adversarial 0 / 1 loss) .
Let "  0 .
We deﬁne the adversarial 0 / 1 loss of level " as:
[Equation]
We will denote R " , P ( f ) :
=
R l 0 / 1 , " , P ( f ) , R ?"
, P := R ? l 0 / 1 , " , P , C " ( x, ⌘ , f ) :
= C l 0 / 1 , " ( x, ⌘ , f ) and
C ?" ( x, ⌘ ) :
= C ?
l 0 / 1 , " ( x, ⌘ ) for every P , x , f and ⌘ .
Speciﬁcity of the adversarial case The adversarial risk minimization problem is much more challenging than its standard counterpart because an inner supremum is added to the optimization objective.
With this inner supremum, it is no longer possible to reduce the distributional problem to a pointwise minimization as it is usually done in the standard classiﬁcation framework.
In fact, the notions of consistency and calibration are signiﬁcantly different in the adversarial setting.
This means that the results obtained in the standard classiﬁcation may no longer be valid in the adversarial setting (e.g., the calibration need not be sufﬁcient for consistency), which makes the study of consistency much more complicated.
As a ﬁrst step towards analyzing the adversarial classiﬁcation problem, we now adapt the notion of margin loss to the adversarial setting.
Deﬁnition 2.9 (Adversarial margin loss) .
Let  : R ! R + be a margin loss and "  0 .
We deﬁne the adversarial loss of level " associated with  as:
[Equation]
We say that  is adversarially calibrated (resp.
uniformly calibrated, resp.
consistent) at level " if  " is calibrated (resp.
uniformly calibrated, resp.
consistent)
wrt l 0 / 1 , " .
Note that a ﬁrst important sanity check to make is verify that  " and l 0 / 1 , " are indeed measurable and well deﬁned.
The arguments are not trivial since it uses advanced arguments from measure theory, but it is necessary to establish measurability before going further on.
Proposition 2.1 states the measurability of  " and l 0 / 1 , " .
We prove this result in Appendix B.
Proposition 2.1.
Let  : R ⇥ Y !
R be a measurable function and "  0 .
For every f 2 F ( X ) , ( x, y ) 7!  " ( x, y, f ) and ( x, y ) 7!
l 0 / 1 , " ( x, y, f ) are universally measurable.
Now that, we proved that the adversarial setting is properly deﬁned, we can make a ﬁrst observation: the calibration functions for  and  " are actually equal.
This property might seem counter-intuitive at ﬁrst sight as the adversarial risk is most of the time strictly larger than its standard counterpart.
However, the calibration functions are only pointwise dependent, hence having the same prediction for any element of the ball B " ( x ) sufﬁces to reach the optimal calibration C ?  ( x, ⌘ ) .
Proposition 2.2.
Let " > 0 .
Let  be a continuous classiﬁcation margin loss.
For all x 2 X and ⌘ 2 [0 , 1] , we have
[Equation]
The last equality also holds for the adversarial 0 / 1 loss.
The proof of this result is available in Appendix C
Solving Adversarial Calibration
In this section, we study the calibration of adversarial margin losses with regard to the adversarial 0 /loss.
We ﬁrst provide necessary and sufﬁcient conditions under which margin losses are adversarially calibrated.
We then show that a wide range of surrogate losses that are calibrated in the standard setting are not calibrated in the adversarial setting.
Finally we propose a class of losses that are calibrated in the adversarial setting, namely the shifted odd losses .
3.1 Necessary and Sufﬁcient Conditions for Calibration
One of our main contributions is to ﬁnd necessary and sufﬁcient conditions for calibration in the adversarial setting.
In a brief, we identify that for studying calibration it is central to understand the case where there might be indecision for classiﬁers (i.e. ⌘ = 1 / 2 ).
Indeed, in this case, either labelling positively or negatively the input x would lead the same loss for x .
Next result provides a necessary condition for calibration.
Theorem 3.1 (Necessary condition for Calibration) .
Let  be a continuous margin loss and " > 0 .
If  is adversarially calibrated at level " , then  is calibrated in the standard classiﬁcation setting and {+
+}
[Equation] We proof this theorem in Appendix D. While the condition of calibration in the standard classiﬁcation setting seems natural, we need to understand why 0 62 argmin ↵ 2 ¯ R 12  ( ↵ ) + 12  (  ↵ ) .
The intuition behind this result is that a sequence of functions simply converging towards 0 in the ball of radius " around some x can take positive and negative values thus leading to suboptimal 0 / 1 adversarial risk.
It turns out that, given an additional mild assumption, this condition is actually sufﬁcient to ensure calibration.
Theorem 3.2 (Sufﬁcient condition for Calibration) .
Let  be a continuous margin loss and " > 0 .
If  is decreasing and strictly decreasing in a neighbourhood of 0 and calibrated in the standard setting and 0 62 argmin ↵ 2 ¯ R 12  ( ↵ ) + 12  (  ↵ ) , then  is adversarially uniformly calibrated at level " .
The proof of this theorem is available in Appendix E.
Remark 2 (Decreasing hypothesis) .
For the reciprocal, the additional assumption that  is decreasing and strictly decreasing in a neighborhood of 0 is not restrictive for usual losses.
In Theorem 2.1, this assumption is stated as a necessary and sufﬁcient condition for convex losses to be calibrated.
3.2 Negative results
Thanks to Theorem 3.1, we can present two notable corollaries invalidating the use of two important classes of surrogate losses in the standard setting.
The ﬁrst class of losses are convex margin losses.
These losses are maybe the most widely used in modern day machine learning as they comprise the logistic loss or the margin loss that are the building block of most classiﬁcation algorithms.
We illustrate such losses in Figure 1.
Corollary 3.1.
Let " > 0 .
Then no convex margin loss can be adversarially calibrated at level " .
A convex loss satisﬁes 12  ( ↵ ) + 12  (  ↵ )   (0) , hence 0 2 argmin ↵ 2 R  ( ↵ ) +  (  ↵ ) .
From
Theorem 3.1, we deduce the result.
Then,  is not adversarially calibrated at level " .
This result seems counter-intuitive and highlights the difﬁculty of optimizing and understanding the adversarial risk.
Since convex losses are not adversarially calibrated, one may hope to rely on famous non-convex losses such as sigmoid and ramp losses.
But, unfortunately, such losses are not calibrated either as illusrtated in Figure 1.
Corollary 3.2.
Let " > 0 .
Let  2 R and be a lower-bounded odd function such that for all ↵ 2 R , >   .
We deﬁne as  ( ↵ ) =
+ ( ↵ ) .
Then  is not adversarially calibrated at level " .
Indeed, 12  ( ↵ ) + 12  (  ↵ ) =
, so that argmin ↵ 2 R 12  ( ↵ ) + 12  (  ↵ ) =
R .
Thanks to Theorem 3.1,  is not adversarially calibrated at level " .
3.3 Positive results
Theorem 3.2 also gives sufﬁcient conditions for  to be adversarially calibrated.
Leveraging this result, we devise a class of margin losses that are indeed calibrated in the adversarial settings.
We call this class shifted odd losses , and we deﬁne it as follows.
Deﬁnition 3.1 (Shifted odd losses) .
We say that  is a shifted odd margin loss if there exists   0 , ⌧ > 0 , and a continuous lower bounded decreasing odd function that is strictly decreasing in a neighborhood of 0 such that for all ↵ 2 R , ( ↵ )    and  ( ↵ ) =
+ ( ↵  ⌧ ) .
The key difference between a standard odd margin loss and a shifted odd margin loss is the variations of the function ↵ 7! 12  ( ↵ ) + 12  (  ↵ ) .
The primary difference is that, in the standard case the optima of this function are located at 0 while they are located in 1 and + 1 in the adversarial setting.
Let us give some examples of margin shifted odd losses below.
Example (Shifted odd losses) .
For every " > 0 and every ⌧ > 0 , the shifted logistic loss, deﬁned as follows, is adversarially calibrated at level " :  : ↵ 7!
(1 + exp ( ↵  ⌧ ))  1 This loss is plotted on left in Figure 2.
We also plotted on right in Figure 2 ↵ 7! 1 2  ( ↵ ) + 1 2  (  ↵ ) to justify that 0 62 argmin ↵ 2 ¯ R 12  ( ↵ ) + 12  (  ↵ ) .
Also note that the shifted ramp loss also satisﬁes the same properties.
A consequence of Theorem 3.2 is that shifted odd losses are adversarially calibrated, as demonstrated in Proposition 3.1 stated below.
Proposition 3.1.
Let  be a shifted odd margin loss.
For every " > 0 ,  is adversarially calibrated at level " .
We proof this proposition in Appendix F.
Towards Adversarial Consistency
We focus our study now on the problem of adversarial consistency.
In a ﬁrst part, taking inspiration from Long and Servedio [11], Awasthi et al.
[1], we study the " -realisable case, i.e. the case where the adversarial risk at level " equals zero.
In a second part, we analyze the behavior of a candidate class of losses, namely the 0 / 1 -like margin losses .
4.1 The Realizable Case
The realizable case is important since there are no possible adversaries for the Bayes optimal classiﬁer.
Formally, this means that the adversarial risk equals 0 , as stated in the following deﬁnition.
Deﬁnition 4.1 ( " -realisability) .
Let P be a Borel probability distribution on X ⇥ Y and "  0 .
We say that P is " -realisable if [Equation]
In the case of realizable probability distribution, calibrated (and consequently consistent) margin losses in the standard classiﬁcation setting are also calibrated and consistent in the adversarial case.
Proposition 4.1.
Let " > 0 .
Let P be an " -realisable distribution and  be a calibrated margin loss in the standard setting.
Then  is adversarially consistent at level " .
We give a proof of this result in Appendix G.
The intuition behind this result is that if a probability distribution is " -realisable, the marginal distributions are sufﬁciently separated, so that there are no possible adversarial attacks, each point in the " -neighbourhood of the support of the distribution can be classiﬁed independently of each other.
4.2 Towards the General Case
In this section, we seek to pave the way towards proving the consistency of shifted odd losses.
We will observe that their behavior is actually very similar to that of the 0 / 1 loss, which makes them good candidates to be consistent losses.
To this end, we ﬁrst add an extra hypothesis to the odd shifted losses in order to simplify our technical analysis.
Deﬁnition 4.2 ( 0 / 1 -like margin losses) .
is a 0 / 1 -like margin loss if there exists   0 , ⌧  0 , and a continuous lower bounded strictly decreasing odd function in a neighbourhood of 0 such that for all ↵ 2 R , ( ↵ )    and  ( ↵ ) =
+ ( ↵  ⌧ ) and
[Equation]
Note here that the losses here are not necessarily shifted because ⌧ might equal 0 , making this condition weaker.
Consequently, we cannot hope that such losses are consistent neither calibrated, but they might help in ﬁnding the path towards consistency.
Note also that if  is an odd or shifted odd loss, one can always ﬁnd a rescaling of  such that  becomes a 0 / 1 -like margin loss.
Note also that such a rescaling does neither change the notion of consistency and calibration for  nor for its rescaled version.
Based on min-max arguments, we provide below some results better characterizing 0 / 1 -like margin loss functions in the adversarial setting.
Let us ﬁrst recall the notions of midpoint property and adversarial distributions set that will be useful from now on as well as an important existing result from Pydi and Jog [16].
Deﬁnition 4.3.
Let ( X , d ) be a proper Polish metric space.
We say that X satisfy the midpoint property if for all x 1 , x 2 2 X there exist x 2 X such that d ( x, x 1 ) =
d ( x, x 2 ) =
d ( x 1 ,x 2 ).
We recall also the set A " ( P ) of adversarial distributions introduced in [13].
Deﬁnition 4.4.
Let P be a Borel probability distribution and " > 0 .
We deﬁne the set of adversarial distributions
A " ( P ) as:
[Equation]
where ⇧ i denotes the projection on the i -th component.
Note that in this deﬁnition, ( x, y ) denotes an input-label pair drawn from the original distribution P and ( x 0 , y 0 ) denotes the input-label pair from the perturbed distribution Q (after attack)
Theorem 4.1 (Pydi and Jog [16]) .
Let X be a Polish space satisfying the midpoint property.
Then strong duality holds:
[Equation]
Moreover the supremum of the right-hand term is attained.
Note that in the original version of the theorem, Pydi and Jog [16] did not prove that the supremum is attained.
We add a proof of this in Appendix H.
Connections between 0 / 1 -like margin loss and 0 / 1 loss: a min-max viewpoint.
Thanks the the above concepts, we can now present some results identifying the similarity and the differences between the 0 / 1 loss and 0 / 1 -like margin losses.
We ﬁrst show that for a given ﬁxed probability distribution P , the adversarial optimal risk associated with a 0 / 1 -like margin loss and the 0 / 1 loss are equal.
The proof of this result is available in Appendix I
Theorem 4.2.
Let X be a Polish space satisfying the midpoint property.
Let "  0 , P be a Borel probability distribution over X ⇥ Y , and  be a 0 / 1 -like margin loss.
Then, we have:
[Equation]
In particular, we note that this property holds true for the standard risk.
From this result, we can derive two interesting corollaries about 0 / 1 -like margin losses.
First, strong duality holds for the risk associated with  .
Corollary 4.1 (Strong duality for  ) .
Let us assume that X is a Polish space satisfying the midpoint property.
Let "  0 , P be a Borel probability distribution over X ⇥ Y , and  be a 0 / 1 -like margin loss.
Then, we have:
[Equation]
Moreover the supremum is attained.
Note that there is no reason that the inﬁmum is attained.
A second interesting corollary is the equality of the set of optimal attacks, i.e. distributions of A " ( P ) that maximize the dual problem: an optimal attack for the 0 / 1 loss is also an optimal attack for a 0 / 1 -like margin, and vice versa.
Corollary 4.2 (Optimal attacks) .
Let assume that X be a Polish space satisfying the midpoint property.
Let "  0 and P be a Borel probability distribution over X ⇥ Y .
Then, an optimal attack Q ? of level " exists for both the 0 / 1 loss and  .
Moreover, for Q 2 A " ( P ) .
Q is an optimal attack for the loss  if and only if it is an optimal attack for the 0 / 1 loss.
The proof of these two corollaries is available in Appendix J.
A step towards consistency.
From the previous results, we are able to prove a ﬁrst result toward the demonstration of consistency.
This result is much weaker than consistency result, but it guarantees that if a sequence minimizes the adversarial risk, then it minimizes the risk for optimal attacks, i.e. in a game where the attacker plays before the classiﬁer.
The proof of this result is in Appendix K
Proposition 4.2.
Let us assume that X be a Polish space satisfying the midpoint property.
Let " and P be a Borel probability distribution over X ⇥ Y .
Let Q ? be an optimal attack of level " .
Let ( f n ) n 2 N be a sequence of F ( X ) such that R  " , P ( f n ) ! R ?  " , P .
Then R Q ? ( f n ) ! R ?" , P .
We hope this result and its proof may lead to a full proof of consistency.
This result is signiﬁcantly weaker than consistency as stated in the following remark.
In the proof of the previous results, we did not use the assumptions that losses are shifted.
In our opinion, it is the key element that we miss and that we need to use to conclude on the consistency of this family of losses.
The shift in the loss would force the classiﬁer to goes to ± 1 on a " neighborhood support of the distribution of P and then the risk would equal the adversarial 0 / 1 -loss risk.
However, we did not succeed in showing the appropriate result: we believe this question is complicated and is left as further work.
Related Work and Discussions
We now explain the differences between our approach and the one proposed by Bao et al.
[4], Awasthi et al.
The two main differences are the choice of the 0 / 1 loss and the studied notion of consistency and calibration.
Alternative 0 / 1 loss
An alternative 0 / 1 loss would the following: l  ( f ( x ) , y )
= 1 yf ( x )  0 .
This loss penalizes indecision: i.e. predicting 0 would lead to a pointwise risk of 1 for y = 1 and y =
while the 0 / 1 loss l 0 / 1 returns 1 for y = 1 and 0 for y =  1 .
This deﬁnition was used by Bao et al.
[4], Awasthi et al.
[1, 3] to prove their calibration and consistency results.
While Bartlett et al.
[6] was not explicit on the choice for the 0 / 1 loss, Steinwart [17] explicitly mentions that the 0 / 1 loss is not a margin loss.
The use of this loss is not suited for studying consistency and leads to inaccurate results as shown in the following counterexample.
On X =
R , let P deﬁned as[-P = 
-]
P = 12 (  x =0 [-, y =
-],y =1 +  x =0 ,y =  1 ) and  : R ! R be a margin based loss.
The  -risk minimization problem writes inf ↵ 12 (  ( ↵ ) +  (  ↵ )) .
For any convex functional  the optimum is attained for ↵ = 0 .
f n : x 7! 0 is a minimizing sequence for the  -risk.
However R l  ( f n ) = 1 for all n and
R ⇤ l  = 12 .
Then we deduce that no convex margin based loss is consistent wrt l  .
Consequently, the 0 / 1 loss to be used in adversarial consistency needs to be l 0 / 1 , " ( x, y, f ) =
sup x 0 2 B " ( x ) 1 y sign ( f ( x ))  0 , otherwise the obtained results might be innacurate.
H -consistency and H -calibration Bao et al.
[4], Awasthi et al.
[1, 3] proposed to study Hcalibration and H -consistency in the adversarial setting, i.e. calibration and consistency when minimizing sequences are in H .
However, even in the standard classiﬁcation setting, the link between both notions in this extended setting is not clear at all since a pointwise minimization of the risk cannot be done.
To our knowledge, there is only one research paper [11] that focuses on this notion in standard setting.
They do it in the restricted case of realisability, i.e. when the standard optimal risk associated with the 0 / 1 loss equals 0 .
We believe that studying H -consistency and H -calibration in the adversarial setting is a bit anticipated.
For these reasons, we focus only on calibration and consistency on the space of measurable functions F ( X ) .
However, note that many of our results can be adapted to H -calibration: we propose, in Appendix L, conditions on classes H
so that Theorems 3.
and 3.2 still holds.
About the Adversarial Bayes Risk and Game Theory.
A recent trend of work has focused on analyzing the adversarial risk from multiple point of views.
Bhagoji et al.
[8] as well as Pydi and Jog [15, 16] showed that the adversarial optimal Bayes classiﬁer can be written as optimal transport for a well chosen cost.
Another line of work [14, 13, 16] have focused on a game theoretic approach for analyzing the adversarial risk having interest in the nature of equilibria between the classiﬁer and the attacker.
Recently, some researchers [2, 10] proved encouraging results on the existence of an optimal Bayes classiﬁer in the adversarial setting under mild assumptions.
Conclusion and Perspectives
In this paper, we set some solid theoretical foundations for the study of adversarial consistency.
We highlighted the importance of the deﬁnition of the 0 / 1 loss, as well as the nuance between calibration and consistency that is speciﬁc to the adversarial setting.
Furthermore, we solved the adversarial calibration problem, by giving a necessary and sufﬁcient condition for decreasing, continuous margin losses to be adversarially calibrated.
Since this is a necessary condition for consistency, an important consequence of this result is that no convex margin loss can be consistent.
This rules out most of the commonly used surrogates, and spurs the need for new families of consistent, yet differentiable families of losses.
We provide ﬁrst insights into which losses may be consistent, by showing that translations of odd loss functions are calibrated.
Nonetheless, we believe that our work could have a concrete practical impact in the near future, especially when considering adversarial training [12].
When implementing this defense, we are essentially optimizing a surrogate adversarial loss.
As our results show, these losses are not consistent when chosen with standard consistency theory, which can lead to a large optimality gap when using these techniques.
We believe that using adversarially calibrated losses as the shifted odd losses could circumvent this problem, which would give important practical signiﬁcance to our work.
Acknowledgement
Rafael is partly supported by an Ecocloud postdoctoral fellowship.
[-< 
-]
[-Then C ε ( x, η, f ) = 
-]
[-Since P is ε -realisable, we have R (cid:63)ε, P = 
-]
[-φ ( a ) 1 ysign ( f ( x )) > 
-]
[-Let us assume that H contains all constant functions and that there exists x ∈ X and ( f n ) n ∈ H N such that f n ( u ) → 0 for all u ∈ B ε ( x ) and for all n ∈ N , sup u ∈ B ε ( x ) f n ( u ) >and inf u ∈ B ε ( x ) f n ( u ) < 
-]