The Adversarial Consistency of Surrogate Risks for Binary Classification

TL;DR

This paper characterizes which surrogate loss functions are consistent for robust binary classification under adversarial training, revealing a smaller class of suitable surrogates compared to standard settings.

Contribution

It provides a complete characterization of adversarially consistent surrogate losses and introduces a quantitative analysis for the $ ho$-margin loss.

Findings

Identifies the set of surrogate losses consistent with adversarial robustness.

Shows the class of adversarially consistent surrogates is smaller than in standard classification.

Provides a quantitative version of adversarial consistency for the $ ho$-margin loss.

Abstract

We study the consistency of surrogate risks for robust binary classification. It is common to learn robust classifiers by adversarial training, which seeks to minimize the expected $0$-$1$ loss when each example can be maliciously corrupted within a small ball. We give a simple and complete characterization of the set of surrogate loss functions that are \emph{consistent}, i.e., that can replace the $0$-$1$ loss without affecting the minimizing sequences of the original adversarial risk, for any data distribution. We also prove a quantitative version of adversarial consistency for the $\rho$-margin loss. Our results reveal that the class of adversarially consistent surrogates is substantially smaller than in the standard setting, where many common surrogates are known to be consistent.