[Paper Review] Lower Bounds on Adversarial Robustness from Optimal Transport

Arjun Nitin Bhagoji, Daniel Cullina+1 more|arXiv (Cornell University)|Sep 26, 2019

Adversarial Robustness in Machine LearningComputer Science34 citations

TL;DR

This paper connects adversarial robustness to optimal transport to derive lower bounds on 0-1 loss under test-time evasion, and provides Gaussian-case optimality and sample complexity results, plus empirical bounds on MNIST, Fashion-MNIST, and CIFAR-10.

ABSTRACT

While progress has been made in understanding the robustness of machine learning classifiers to test-time adversaries (evasion attacks), fundamental questions remain unresolved. In this paper, we use optimal transport to characterize the minimum possible loss in an adversarial classification scenario. In this setting, an adversary receives a random labeled example from one of two classes, perturbs the example subject to a neighborhood constraint, and presents the modified example to the classifier. We define an appropriate cost function such that the minimum transportation cost between the distributions of the two classes determines the minimum $0-1$ loss for any classifier. When the classifier comes from a restricted hypothesis class, the optimal transportation cost provides a lower bound. We apply our framework to the case of Gaussian data with norm-bounded adversaries and explicitly show matching bounds for the classification and transport problems as well as the optimality of linear classifiers. We also characterize the sample complexity of learning in this setting, deriving and extending previously known results as a special case. Finally, we use our framework to study the gap between the optimal classification performance possible and that currently achieved by state-of-the-art robustly trained neural networks for datasets of interest, namely, MNIST, Fashion MNIST and CIFAR-10.

Motivation & Objective

• Motivate understanding of the fundamental limits of adversarial robustness in evasion settings.
• Define a framework that links adversarial classification to optimal transport via suitable cost functions.
• Derive lower bounds on the minimum achievable 0-1 loss for classifiers under adversarial perturbations.
• Characterize Gaussian-data cases and establish the optimality of linear classifiers under norm-bounded adversaries.
• Evaluate bounds on real datasets (MNIST, Fashion-MNIST, CIFAR-10) and compare to robustly trained models.

Proposed method

• Define an adversarial cost c_N that encodes neighborhood constraints of the perturbations.
• Relate adversarial robustness to the optimal transport cost C_N∘C_N^⊤ between class distributions.
• Prove that the minimum achievable 0-1 loss equals (1−2 inf_h L(N,h,P)) = (C_N∘C_N^⊤)(P_X1,P_X−1).
• Show that for Gaussian data with mean-separated classes, linear classifiers are optimal and derive a convex program (equation 4) whose solution gives the robustness bound.
• Provide explicit Gaussian-case results (Theorem 2) via the alpha*(β,μ) optimization and connect to Q-function.
• Derive a sample complexity bound in the Gaussian setting (Theorem 3).
• Empirically compute transportation-based lower bounds for MNIST, Fashion-MNIST, and CIFAR-10 and compare to robust models.

Experimental results

Research questions

• RQ1 What is the minimum possible 0-1 loss for adversarially perturbed data under a given perturbation budget?
• RQ2 How can optimal transport theory bound adversarial robustness across arbitrary distributions?
• RQ3 In Gaussian settings, are linear classifiers optimal for adversarial robustness and how does the budget affect the optimal classifier?
• RQ4 What is the sample complexity to learn robust classifiers under Gaussian assumptions?
• RQ5 How do transportation-based lower bounds compare to robustly trained models on standard datasets (MNIST, Fashion-MNIST, CIFAR-10)?

Key findings

• The minimum adversarial risk equals one minus twice the optimal transport cost between class-conditional distributions under the adversarial constraint.
• For Gaussian data with norm-bounded perturbations, linear classifiers are optimal and yield matching upper and lower bounds for robustness.
• An explicit convex program (involving alpha*, beta, mu) characterizes the robustness bound with the Q-function, and alpha* governs the matching of primal and dual solutions.
• When data and adversary norms match (e.g., Sigma-norm and B-norm), the optimal classifier remains the same across budgets, revealing a trade-off between benign accuracy and robustness when norms differ.
• The paper derives and extends sample complexity results (via a Bayesian/Gaussian prior on means) that align with or extend prior bounds.
• Empirical bounds on MNIST, Fashion-MNIST, and CIFAR-10 show a gap between current robust models and the theoretical lower bounds, growing with adversarial budget.