Robust Hypothesis Testing with Abstention

TL;DR

This work develops a rigorous information-theoretic framework for robust binary hypothesis testing with abstention under adversarial contamination. By modeling three contamination regimes—memoryless ingress, fixed-weight uniform ingress, and strong contamination—the authors characterize the optimal trade-offs between four error exponents (two non-adversarial, two adversarial) through KL-divergence and total-variation based constraints. A central result is that the non-adversarial error exponents obey the standard KL-ball disjointness condition, while the adversarial exponents are bounded by worst-case divergence terms to mixtures induced by the contamination model. The findings provide fundamental limits and practical detectors for abstention-enabled robust hypothesis testing with applications to out-of-distribution rejection in safety-critical systems.

Abstract

We study the binary hypothesis testing problem where an adversary may potentially corrupt a fraction of the samples. The detector is, however, permitted to abstain from making a decision if (and only if) the adversary is present. We consider a few natural "contamination models" and characterize for them the trade-off between the error exponents of the four types of errors -- errors of deciding in favour of the incorrect hypothesis when the adversary is present and errors of abstaining or deciding in favour of the wrong hypothesis when the adversary is absent, under the two hypotheses.

Figures (5)

• Figure 1: Memoryless ingress contamination: The detector declares 0 in the red region, declares 1 in the blue region, and abstains in the white region. The black oval represents $\{(1-\varepsilon)P_0+\varepsilon u:u\in\Delta\}$ which is the set of possible distributions of $Y^n$ when the adversary chooses the replacement samples $\sim u$ i.i.d. and $q^*=(1-\varepsilon)P_0+\varepsilon u^*$, where $(u^*,p^*)$ is the minimiser of (\ref{['eq:Bernoulli-1|0']}).
• Figure 2: Fixed weight uniform ingress contamination: The black oval represents the set of types $q$ of uncorrupted samples ($X^n|_{\overline{Z^n}})$ for which an adversary can induce $P_{Y^n}=p^*$ (for which the detector declares 1). The distribution $p^*=(1-\varepsilon)q^*+\varepsilon u^*$, where $(q^*,u^*)$ is the minimiser of (\ref{['eq:Uniform-1|0']}). Under $\mathcal{H}_0$, $P_{X^n|_{\overline{Z^n}}} =q^*$ happens with probability $\approx\exp(-n(1-\varepsilon)D(q^*\|P_0))$.
• Figure 3: Strong contamination: $p^*,q^*$ are minimisers of (\ref{['eq:SC|0']}). The black rhombus represents $B_{\mathrm{TV}}(p^*,\varepsilon)$, which is the set of types $q$ of the original samples $X^n$, which an adversary can attack to induce $P_{Y^n}=p^*$ (for which the detector declares 1). The probability of $P_{X^n}=q^*$ under $\mathcal{H}_0$ is $\approx\exp(-nD(q^*\|P_0))$.
• Figure 4: Example of the achievability region. Here, $\mathcal{X}=\{0,1\}$. The top right plot gives the trade-off between the two non-adversarial exponents (note that it is the same for all three adversarial models). For any point $(\lambda_{0\perp|1}, \lambda_{1\perp|0})$ under the blue curve, we can find points $(\lambda_{0|1}^\mathsf{adv},\lambda_{1\perp|0})$ and $(\lambda_{0\perp|1},\lambda_{1|0}^\mathsf{adv})$ on the curves in the top left and bottom right plots respectively. These give a quadruple on the boundary of the achievable region.
• Figure 5: Plot of $\lambda^{\mathsf{adv}}_{1|0}$ against $\varepsilon$ for fixed $\lambda_{0\perp|1}=0.1$. Here, $P_0 = \mathrm{Ber}(0.1)$ and $P_1 = \mathrm{Ber}(0.9)$. The exponent for Strong Contamination is smaller than that for Fixed Weight Uniform Ingress by the problem definition. Remark \ref{['rem:comparison']} explains why the exponent for Memoryless Ingress is smaller than that for Fixed Weight Uniform Ingress. Strong Contamination is not comparable with Memoryless Ingress.

Theorems & Definitions (25)

• Theorem 1
• Claim 1
• Claim 2
• Remark 1
• Theorem 2
• Remark 2
• Claim 3
• Claim 4
• Theorem 3
• Claim 5