{"type":"ScholarlyArticle","title":"Sample Complexity Bounds for Robustly Learning Decision Lists against Evasion Attacks","authors":[{"name":"Pascale Gourdeau","slug":"pascale-gourdeau","given":"Pascale","family":"Gourdeau","affiliation":"University of Oxford"},{"name":"Varun Kanade","slug":"varun-kanade","given":"Varun","family":"Kanade","affiliation":"University of Oxford"},{"name":"Marta Kwiatkowska","slug":"marta-kwiatkowska","given":"Marta","family":"Kwiatkowska","affiliation":"University of Oxford"},{"name":"James Worrell","slug":"james-worrell","given":"James","family":"Worrell","affiliation":"University of Oxford"}],"abstract":"A fundamental problem in adversarial machine learning is to quantify how much training data is needed in the presence of evasion attacks. In this paper we address this issue within the framework of PAC learning, focusing on the class of decision lists. Given that distributional assumptions are essential in the adversarial setting, we work with probability distributions on the input data that satisfy a Lipschitz condition: nearby points have similar probability. Our key results illustrate that the adversary's budget (that is, the number of bits it can perturb on each input) is a fundamental quantity in determining the sample complexity of robust learning. Our first main result is a sample-complexity lower bound: the class of monotone conjunctions (essentially the simplest non-trivial hypothesis class on the Boolean hypercube) and any superclass  has sample complexity at least exponential in the adversary's budget. Our second main result is a corresponding upper bound: for every fixed k the class of k-decision lists has polynomial sample complexity against a log(n)-bounded adversary. This sheds further light on the question of whether an efficient PAC learning algorithm can always be used as an efficient log(n)-robust learning algorithm under the uniform distribution.","doi":"10.24963/ijcai.2022/419","url":"https://ijcai.org/proceedings/2022/419","pdf":"https://ijcai.org/proceedings/2022/0419.pdf","markdown":"https://ijcai.org/proceedings/2022/419.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/419","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Machine Learning","track":"Main Track","number":419,"pages":{"first":3022,"last":3028},"keywords":["Machine Learning: Classification","Machine Learning: Robustness","Machine Learning: Learning Theory","Machine Learning: Adversarial Machine Learning"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38987045","length_sec":83,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985188","length_sec":651,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Awasthi et al., 2013] Pranjal Awasthi, Vitaly Feldman, and Varun Kanade. Learning using local membership queries. In COLT, volume 30, pages 1-34, 2013.","title":"Learning using local membership queries","authors":"Pranjal Awasthi, Vitaly Feldman, Varun Kanade","year":"2013","venue":"COLT","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bhagoji et al., 2019] Arjun Nitin Bhagoji, Daniel Cul- lina, and Prateek Mittal. Lower bounds on adversar- ial robustness from optimal transport. arXiv preprint arXiv:1909.12272, 2019.","title":"Lower bounds on adversarial robustness from optimal transport","authors":"Nitin Arjun, Daniel Bhagoji, Prateek Cullina, Mittal","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Biggio and Roli, 2017] Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial ma- chine learning. arXiv preprint arXiv:1712.03141, 2017.","title":"Wild patterns: Ten years after the rise of adversarial machine learning","authors":"Roli Biggio, Battista Biggio, Fabio Roli","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Biggio et al., 2013] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European con- ference on machine learning and knowledge discovery in databases, pages 387-402. Springer, 2013.","title":"Evasion attacks against machine learning at test time","authors":"Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, Fabio Roli","year":"2013","venue":"Joint European conference on machine learning and knowledge discovery in databases","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Bubeck et al., 2019] Sebastien Bubeck, Yin Tat Lee, Eric Price, and Ilya Razenshteyn. Adversarial examples from computational constraints. In Proceedings of the 36th In- ternational Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 831-840, Long Beach, California, USA, 09-15 Jun 2019.","title":"Adversarial examples from computational constraints","authors":"Sebastien Bubeck, Yin Tat Lee, Eric Price, Ilya Razenshteyn","year":"2019","venue":"Proceedings of the 36th International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"PMLR.","title":null,"authors":"Pmlr","year":null,"venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dalvi et al., 2004] Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma, et al. Adversarial classifica- tion. In Proceedings of the tenth ACM SIGKDD interna- tional conference on Knowledge discovery and data min- ing, pages 99-108. ACM, 2004.","title":"Adversarial classification","authors":"Nilesh Dalvi, Pedro Domingos, Sumit Sanghai, Deepak Verma","year":"2004","venue":"Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Diochnos et al., 2018] Dimitrios Diochnos, Saeed Mahlou- jifar, and Mohammad Mahmoody. Adversarial risk and robustness: General definitions and implications for the uniform distribution. In Advances in Neural Information Processing Systems, 2018.","title":"Adversarial risk and robustness: General definitions and implications for the uniform distribution","authors":"Dimitrios Diochnos, Saeed Mahloujifar, Mohammad Mahmoody","year":"2018","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Diochnos et al., 2019] Dimitrios I Diochnos, Saeed Mahloujifar, and Mohammad Mahmoody. Lower bounds for adversarially robust pac learning. arXiv preprint arXiv:1906.05815, 2019.","title":"Lower bounds for adversarially robust pac learning","authors":"Saeed Dimitrios I Diochnos, Mohammad Mahloujifar, Mahmoody","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Diochnos et al., 2020] Dimitrios I. Diochnos, Saeed Mahloujifar, and Mohammad Mahmoody. Lower bounds for adversarially robust PAC learning under evasion and hybrid attacks. In 2020 19th IEEE International Confer- ence on Machine Learning and Applications (ICMLA), pages 717-722, 2020.","title":"Lower bounds for adversarially robust PAC learning under evasion and hybrid attacks","authors":"Dimitrios I Diochnos, Saeed Mahloujifar, Mohammad Mahmoody","year":"2020","venue":"19th IEEE International Conference on Machine Learning and Applications (ICMLA)","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Dreossi et al., 2019] Tommaso Dreossi, Shromona Ghosh, Alberto Sangiovanni-Vincentelli, and Sanjit A Seshia. A formalization of robustness for deep neural networks. arXiv preprint arXiv:1903.10033, 2019.","title":"A formalization of robustness for deep neural networks","authors":"Tommaso Dreossi, Shromona Ghosh, Alberto Sangiovanni-Vincentelli, Sanjit A Seshia","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Fawzi et al., 2016] Alhussein Fawzi, Seyed-Mohsen Moosavi-Dezfooli, and Pascal Frossard. Robustness of classifiers: from adversarial to random noise. In Advances in Neural Information Processing Systems, pages 1632-1640, 2016.","title":"Robustness of classifiers: from adversarial to random noise","authors":"Fawzi","year":"2016","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Fawzi et al., 2018a] Alhussein Fawzi, Hamza Fawzi, and Omar Fawzi. Adversarial vulnerability for any classifier. arXiv preprint arXiv:1802.08686, 2018.","title":"Adversarial vulnerability for any classifier","authors":"Fawzi","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Fawzi et al., 2018b] Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of classifiers? robustness to adversarial perturbations. Machine Learning, 107(3):481- 508, 2018.","title":"Analysis of classifiers? robustness to adversarial perturbations","authors":"Fawzi","year":"2018","venue":"Machine Learning","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Feige et al., 2015] Uriel Feige, Yishay Mansour, and Robert Schapire. Learning and inference in the presence of cor- rupted inputs. In Conference on Learning Theory, pages 637-657, 2015.","title":"Learning and inference in the presence of corrupted inputs","authors":"Uriel Feige, Yishay Mansour, Robert Schapire","year":"2015","venue":"Conference on Learning Theory","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Gilmer et al., 2018] Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. Adversarial spheres. arXiv preprint arXiv:1801.02774, 2018.","title":"Adversarial spheres","authors":"Justin Gilmer, Luke Metz, Fartash Faghri, Maithra Samuel S Schoenholz, Martin Raghu, Ian Wattenberg, Goodfellow","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Gourdeau et al., 2019] Pascale Gourdeau, Varun Kanade, Marta Kwiatkowska, and James Worrell. On the hardness of robust classification. In Advances in Neural Information Processing Systems, pages 7444-7453, 2019.","title":"On the hardness of robust classification","authors":"Pascale Gourdeau, Varun Kanade, Marta Kwiatkowska, James Worrell","year":"2019","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Gourdeau et al., 2021] Pascale Gourdeau, Varun Kanade, Marta Kwiatkowska, and James Worrell. On the hardness of robust classification. Journal of Machine Learning Re- search, 22, 2021.","title":"On the hardness of robust classification","authors":"Pascale Gourdeau, Varun Kanade, Marta Kwiatkowska, James Worrell","year":"2021","venue":"Journal of Machine Learning Research","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Ilyas et al., 2019] Andrew Ilyas, Shibani Santurkar, Dim- itris Tsipras, Logan Engstrom, Brandon Tran, and Alek- sander Madry. Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175, 2019.","title":"Adversarial examples are not bugs, they are features","authors":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, Aleksander Madry","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Lowd and Meek, 2005a] Daniel Lowd and Christopher Meek. Adversarial learning. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining, pages 641-647. ACM, 2005.","title":"Adversarial learning","authors":"Meek Lowd, Daniel Lowd, Christopher Meek","year":"2005","venue":"Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Lowd and Meek, 2005b] Daniel Lowd and Christopher Meek. Good word attacks on statistical spam filters. In CEAS, volume 2005, 2005.","title":"Good word attacks on statistical spam filters","authors":"Meek Lowd, Daniel Lowd, Christopher Meek","year":"2005","venue":"CEAS","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Mahloujifar and Mahmoody, 2019] Saeed Mahloujifar and Mohammad Mahmoody. Can adversarially robust learning leveragecomputational hardness? In Algorithmic Learning Theory, pages 581-609. PMLR, 2019.","title":"Can adversarially robust learning leveragecomputational hardness?","authors":"Saeed Mahloujifar, Mohammad Mahmoody","year":"2019","venue":"Algorithmic Learning Theory","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Mahloujifar et al., 2019] Saeed Mahloujifar, Dimitrios I Diochnos, and Mohammad Mahmoody. The curse of con- centration in robust learning: Evasion and poisoning at- tacks from concentration of measure. AAAI Conference on Artificial Intelligence, 2019.","title":"The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure","authors":"Saeed Mahloujifar, Dimitrios I Diochnos, Mohammad Mahmoody","year":"2019","venue":"AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Montasser et al., 2019] Omar Montasser, Steve Hanneke, and Nathan Srebro. Vc classes are adversarially robustly learnable, but only improperly. In Conference on Learning Theory, pages 2512-2530. PMLR, 2019.","title":"Vc classes are adversarially robustly learnable, but only improperly","authors":"Omar Montasser, Steve Hanneke, Nathan Srebro","year":"2019","venue":"Conference on Learning Theory","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Rivest, 1987] Ronald L Rivest. Learning decision lists. Ma- chine learning, 2(3):229-246, 1987.","title":"Learning decision lists","authors":"L Ronald, Rivest","year":"1987","venue":"Machine learning","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Shafahi et al., 2018] Ali Shafahi, W Ronny Huang, Christoph Studer, Soheil Feizi, and Tom Goldstein. Are adversarial examples inevitable? arXiv preprint arXiv:1809.02104, 2018.","title":"Are adversarial examples inevitable?","authors":"Ali Shafahi, Ronny Huang, Christoph Studer, Soheil Feizi, Tom Goldstein","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Tsipras et al., 2019] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In Inter- national Conference on Learning Representations, 2019.","title":"Robustness may be at odds with accuracy","authors":"Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, Aleksander Madry","year":"2019","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Valiant, 1984] Leslie G Valiant. A theory of the learnable. In Proceedings of the sixteenth annual ACM symposium on Theory of computing, pages 436-445. ACM, 1984.","title":"A theory of the learnable","authors":"G Leslie, Valiant","year":"1984","venue":"Proceedings of the sixteenth annual ACM symposium on Theory of computing","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}