Consistent Adversarially Robust Linear Classification: Non-Parametric Setting

Elvis Dohmatob
Proceedings of the 41st International Conference on Machine Learning, PMLR 235:11149-11164, 2024.

Abstract

For binary classification in d dimensions, it is known that with a sample size of n, an excess adversarial risk of O(d/n) is achievable under strong parametric assumptions about the underlying data distribution (e.g., assuming a Gaussian mixture model). In the case of well-separated distributions, this rate can be further refined to O(1/n). Our work studies the non-parametric setting, where very little is known. With only mild regularity conditions on the conditional distribution of the features, we examine adversarial attacks with respect to arbitrary norms and introduce a straightforward yet effective estimator with provable consistency w.r.t adversarial risk. Our estimator is given by minimizing a series of smoothed versions of the robust 0/1 loss, with a smoothing bandwidth that adapts to both n and d. Furthermore, we demonstrate that our estimator can achieve the minimax excess adversarial risk of ˜O(√d/n) for linear classifiers, at the cost of solving possibly rougher optimization problems.

Cite this Paper

BibTeX
@InProceedings{pmlr-v235-dohmatob24a, title = {Consistent Adversarially Robust Linear Classification: Non-Parametric Setting}, author = {Dohmatob, Elvis}, booktitle = {Proceedings of the 41st International Conference on Machine Learning}, pages = {11149--11164}, year = {2024}, editor = {Salakhutdinov, Ruslan and Kolter, Zico and Heller, Katherine and Weller, Adrian and Oliver, Nuria and Scarlett, Jonathan and Berkenkamp, Felix}, volume = {235}, series = {Proceedings of Machine Learning Research}, month = {21--27 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v235/main/assets/dohmatob24a/dohmatob24a.pdf}, url = {https://proceedings.mlr.press/v235/dohmatob24a.html}, abstract = {For binary classification in $d$ dimensions, it is known that with a sample size of $n$, an excess adversarial risk of $O(d/n)$ is achievable under strong parametric assumptions about the underlying data distribution (e.g., assuming a Gaussian mixture model). In the case of well-separated distributions, this rate can be further refined to $O(1/n)$. Our work studies the non-parametric setting, where very little is known. With only mild regularity conditions on the conditional distribution of the features, we examine adversarial attacks with respect to arbitrary norms and introduce a straightforward yet effective estimator with provable consistency w.r.t adversarial risk. Our estimator is given by minimizing a series of smoothed versions of the robust 0/1 loss, with a smoothing bandwidth that adapts to both $n$ and $d$. Furthermore, we demonstrate that our estimator can achieve the minimax excess adversarial risk of $\widetilde O(\sqrt{d/n})$ for linear classifiers, at the cost of solving possibly rougher optimization problems.} }
Endnote
%0 Conference Paper %T Consistent Adversarially Robust Linear Classification: Non-Parametric Setting %A Elvis Dohmatob %B Proceedings of the 41st International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2024 %E Ruslan Salakhutdinov %E Zico Kolter %E Katherine Heller %E Adrian Weller %E Nuria Oliver %E Jonathan Scarlett %E Felix Berkenkamp %F pmlr-v235-dohmatob24a %I PMLR %P 11149--11164 %U https://proceedings.mlr.press/v235/dohmatob24a.html %V 235 %X For binary classification in $d$ dimensions, it is known that with a sample size of $n$, an excess adversarial risk of $O(d/n)$ is achievable under strong parametric assumptions about the underlying data distribution (e.g., assuming a Gaussian mixture model). In the case of well-separated distributions, this rate can be further refined to $O(1/n)$. Our work studies the non-parametric setting, where very little is known. With only mild regularity conditions on the conditional distribution of the features, we examine adversarial attacks with respect to arbitrary norms and introduce a straightforward yet effective estimator with provable consistency w.r.t adversarial risk. Our estimator is given by minimizing a series of smoothed versions of the robust 0/1 loss, with a smoothing bandwidth that adapts to both $n$ and $d$. Furthermore, we demonstrate that our estimator can achieve the minimax excess adversarial risk of $\widetilde O(\sqrt{d/n})$ for linear classifiers, at the cost of solving possibly rougher optimization problems.
APA
Dohmatob, E.. (2024). Consistent Adversarially Robust Linear Classification: Non-Parametric Setting. Proceedings of the 41st International Conference on Machine Learning, in Proceedings of Machine Learning Research 235:11149-11164 Available from https://proceedings.mlr.press/v235/dohmatob24a.html.

Related Material