Adversarial Risk Bounds via Function Transformation

TL;DR

This paper introduces a novel method for bounding adversarial risk in classifiers by transforming functions to relate adversarial risk to standard risk, enabling the use of classical learning theory techniques.

Contribution

It proposes a new class of function transformations that upper-bound adversarial risk, simplifying the derivation of risk bounds for robust classifiers.

Findings

Derived bounds on Rademacher complexities of transformed classes

Error rates comparable to standard generalization bounds

Algorithms for optimizing adversarial risk in linear models

Abstract

We derive bounds for a notion of adversarial risk, designed to characterize the robustness of linear and neural network classifiers to adversarial perturbations. Specifically, we introduce a new class of function transformations with the property that the risk of the transformed functions upper-bounds the adversarial risk of the original functions. This reduces the problem of deriving bounds on the adversarial risk to the problem of deriving risk bounds using standard learning-theoretic techniques. We then derive bounds on the Rademacher complexities of the transformed function classes, obtaining error rates on the same order as the generalization error of the original function classes. We also discuss extensions of our theory to multiclass classification and regression. Finally, we provide two algorithms for optimizing the adversarial risk bounds in the linear case, and discuss connections to regularization and distributional robustness.