Learning classifiers that are robust to adversarial examples has received a great deal of recent attention. A major drawback of the standard robust learning framework is there is an artificial robustness radius $r$ that applies to all inputs. This ignores the fact that data may be highly heterogeneous, in which case it is plausible that robustness regions should be larger in some regions of data, and smaller in others. In this paper, we address this limitation by proposing a new limit classifier, called the neighborhood optimal classifier, that extends the Bayes optimal classifier outside its support by using the label of the closest in-support point. We then argue that this classifier maximizes the size of its robustness regions subject to the constraint of having accuracy equal to the Bayes optimal. We then present sufficient conditions under which general non-parametric methods that can be represented as weight functions converge towards this limit, and show that both nearest neighbors and kernel classifiers satisfy them under certain conditions.
翻译:与对抗性实例相比强健的学习分类者最近受到了很多关注。 标准强健学习框架的一大缺点是存在适用于所有投入的人工稳健半径美元。 这忽略了数据可能非常多样化的事实, 也就是说, 在某些数据区域, 稳健区域应该更大, 而在另一些区域, 强健区域应该较小。 在本文件中, 我们通过提出一个新的限值分类者来应对这一限制, 称为邻居最佳分类者, 利用最接近支持点的标签, 将贝斯最佳分类者扩展到其支持之外。 然后, 我们争论说, 该分类者最大限度地扩大了其稳健区域的规模, 但须受与贝斯最佳的准确度相同的限制。 我们然后提出了足够的条件, 使一般的非参数方法能够作为重量函数向这一限度集中, 并表明最近的邻居和内核分类者在某些条件下都满足了这些限制。