Adversarial Consistency and the Uniqueness of the Adversarial Bayes Classifier

Abstract

Minimizing an adversarial surrogate risk is a common technique for learning robust classifiers. Prior work showed that convex surrogate losses are not statistically consistent in the adversarial context -- or in other words, a minimizing sequence of the adversarial surrogate risk will not necessarily minimize the adversarial classification error. We connect the consistency of adversarial surrogate losses to properties of minimizers to the adversarial classification risk, known as adversarial Bayes classifiers. Specifically, under reasonable distributional assumptions, a convex surrogate loss is statistically consistent for adversarial learning iff the adversarial Bayes classifier satisfies a certain notion of uniqueness.

arXiv comment2 figures, 20 pages, v2: fixed typos, v3: improved organization of paper and added figures

References in corpus (14)

• Evasion Attacks against Machine Learning at Test Time
• Generalizability vs. Robustness: Adversarial Examples for Medical Imaging
• Lower Bounds on Adversarial Robustness from Optimal Transport
• The Multimarginal Optimal Transport Formulation of Adversarial Multiclass Classification
• The Geometry of Adversarial Training in Binary Classification
• Calibration and Consistency of Adversarial Surrogate Losses
• Adversarial Training Should Be Cast as a Non-Zero-Sum Game
• ATRO: Adversarial Training with a Rejection Option
• Existence and Minimax Theorems for Adversarial Surrogate Risks in Binary Classification
• On the Role of Randomization in Adversarially Robust Classification
• Towards Consistency in Adversarial Classification
• On Achieving Optimal Adversarial Test Error
• Stratified Adversarial Robustness with Rejection
• Towards Calibrated Losses for Adversarial Robust Reject Option Classification