Adversarial Risk and Robustness: General Definitions and Implications for the Uniform Distribution
We study adversarial perturbations when the instances are uniformly distributed over {0, 1}
n . We study both "inherent" bounds that apply to any problem and any classifier for such a problem as well as bounds that apply to specific problems and specific hypothesis classes. As the current literature contains multiple definitions of adversarial risk and robustness, we start by giving a taxonomy for these definitions based on their direct goals; we identify one of them as the one guaranteeing misclassification by pushing the instances to the error region. We then study some classic algorithms for learning monotone conjunctions and compare their adversarial robustness under different definitions by attacking the hypotheses using instances drawn from the uniform distribution. We observe that sometimes these definitions lead to significantly different bounds. Thus, this study advocates for the use of the error-region definition, even though other definitions, in other contexts with context-dependent assumptions, may coincide with the error-region definition. Using the error-region definition of adversarial perturbations, we then study inherent bounds on risk and robustness of any classifier for any classification problem whose instances are uniformly distributed over {0, 1}
n . Using the isoperimetric inequality for the Boolean hypercube, we show that for initial error 0.01, there always exists an adversarial perturbation that changes O( √ n) bits of the instances to increase the risk to 0.5, making classifier's decisions meaningless. Furthermore, by also using the central limit theorem we show that when n → ∞, at most c · √ n bits of perturbations, for a universal constant c < 1.17, suffice for increasing the risk to 0.5, and the same c √ n bits of perturbations on average suffice to increase the risk to 1, hence bounding the robustness by c · √ n.
The paper studies the adversarial examples phenomenon from the theoretical perspective with a focus on discrete distributions. The authors make two main contributions:  1. They introduce a new robustness measure called "error region robustness" and compare it to other definitions of robustness (the proposed measure is not specific to discrete distributions). The main difference to prior work is that the proposed definition does not count an example as robustly misclassified if the small perturbation actually changes the correct class.  2. They study learning problems under the uniform distribution on the hypercube and show that *any* classifier with a given standard risk will have a certain amount of adversarial / robust risk. The argument is based on isoperimetry results for the hypercube.  I think both points are relevant and the theoretical arguments in the main paper seem correct. Compared to prior work, the novelty is somewhat limited however:  - While their error region robustness is indeed interesting, it only differs from prior definitions of robustness when small changes to an example can change the correct class. In adversarial examples, the focus is typically on small perturbations that do not change the correct class. In this regime, the proposed definition and the definition in prior work coincide.  - At a high level, the isoperimetry argument relating standard accuracy to robust accuracy is similar to the work of Gilmer et al. (cited by the authors) for a continuous distribution. The authors mention twice that they give the first results on adversarial robustness for a discrete distribution. It seems however that the work of Schmidt et al. (also cited) already establishes robustness results for a distribution on the hypercube. It would be helpful if the authors could comment on this in the rebuttal. But it is worth noting that as far as I know, the hypercube isoperimetry argument for the uniform distribution has not appeared before in the context of adversarial examples.  Another area of improvement is that the authors could discuss in more detail what their results mean for the image classification setting that is common in the adversarial examples literature. For instance, it is not clear how restrictive the assumption of a uniform distribution on the hypercube is (in terms of images, this would correspond to fully random images). As far as I can tell, the theoretical results crucially rely on working with a uniform distribution. While simple models are certainly a good starting point for theoretical studies, it would be good to discuss the connections to empirical phenomena.  Finally, it seems that the error region notion of robustness might have counter-intuitive behavior in regimes where the Bayes error is strictly greater than 0. In that case, the error-region risk of the Bayes-optimal classifier will be 0 while the "standard" risk is non-zero (i.e., the robust risk is less than the "standard" risk). The prior notions of robust risk do not have this shortcoming. It would be helpful if the authors could comment on this in their rebuttal and potentially include a discussion about this in their paper.  Overall, my current assessment is a weak accept since the two main points are important and there is currently a lack of theoretical results regarding adversarial robustness.     Minor comments:  - There are some formatting issues. The abstract is too long and the paper was submitted using the "preprint" option of the NIPS LaTeX package.  - On Page 3, it would be helpful to remind the reader what a monotone conjunction is.  - The second paragraph from the bottom of Page 3 seems out of context as it mentions several terms that are not defined yet (OT, PC, h, c, etc.).  - The abstract contains two sentences that seem ungrammatical:      * "Our experimental calculations point for range of [...]"      * "[...] previously proposed definitions have risk and robustness e.g., by pushing [...]"  - Near the bottom of Page 2, should the bound 2.15 sqrt(n) depend on mu from the previous sentence? Or is it for a specific mu?  - Page 4: "We did not state the loss function explicitly [...]" is missing a "." at the end.  - In Definition 3.6, would it be easier to use |A| (cardinality of A) instead of V(A) since we are working with a uniform distribution over the hypercube? The paper uses |A| in other places such as Lemmas 3.7 and 3.8.  - What is p_i in the proof of Lemma 3.9? In particular, it is not clear what the index i refers to.  - In Equation (2) on Page 8, should it be (2^w + 2^u - 1)?  - The sentence before Theorem 3.10 refers to a discussion in Section D of the appendix, but the section seems to contain only proofs. Is this intentional?  - Appendix B is empty.  - Appendix D.7 mentions "10,00" random examples. The use of "," here is non-standard.