Risk Analysis and Design Against Adversarial Actions

TL;DR

The paper tackles deployment-time adversarial actions in predictive modeling by introducing a principled, distribution-free framework based on SVR that quantifies robustness through adversarial regions. It defines adversarial risk and introduces adversarial complexity computed from training data to derive high-confidence bounds on risk, which hold without assumptions on the unknown data distribution. The framework extends to learning via relaxed optimization and kernelized lifting, providing generalization to broader domains and enabling out-of-distribution risk evaluation via Wasserstein bounds. Through synthetic and engineering examples, the authors illustrate how robust designs trade predictor width for reduced adversarial risk and demonstrate practical risk estimation without extra data. Collectively, the work provides a rigorous, data-efficient toolkit for designing and evaluating robust predictors under foreseen adversarial actions and distribution shifts.

Abstract

Learning models capable of providing reliable predictions in the face of adversarial actions has become a central focus of the machine learning community in recent years. This challenge arises from observing that data encountered at deployment time often deviate from the conditions under which the model was trained. In this paper, we address deployment-time adversarial actions and propose a versatile, well-principled framework to evaluate the model's robustness against attacks of diverse types and intensities. While we initially focus on Support Vector Regression (SVR), the proposed approach extends naturally to the broad domain of learning via relaxed optimization techniques. Our results enable an assessment of the model vulnerability without requiring additional test data and operate in a distribution-free setup. These results not only provide a tool to enhance trust in the model's applicability but also aid in selecting among competing alternatives. Later in the paper, we show that our findings also offer useful insights for establishing new results within the out-of-distribution framework.

Figures (13)

• Figure 1: Some choices of $\widehat{A}$ for a ball-shaped adversarial region $A$ (grey area): a) $\widehat{A}$ is in the interior of $A$, which returns less conservative solutions; b) $\widehat{A}$ is tuned to $A$; c) $\widehat{A}$ is a more dense finite set tuned to $A$.
• Figure 2: (a) The data set ${\mathcal{D}}=\left \{ (u_i,y_i) \right \}_{i=1}^{N}$. (b) The adversarial regions $A_{(u_i,y_i)}$ (yellow disks) along with the finite sets $\widehat{A}_{(u_i,y_i)}$ when $\widehat{A}_{(u_i,y_i)} \subseteq A_{(u_i,y_i)}$ (red crosses $\times$) and $\widehat{A}_{(u_i,y_i)} \not\subseteq A_{(u_i,y_i)}$ (blue pluses $+$).
• Figure 3: $\mathcal{P}({\color{red} \theta_1^\ast})$ (dashed-dotted-red line) and $\mathcal{P}({\color{blue} \theta_2^\ast})$ (solid-blue line). The data points outside $\mathcal{P}({\color{blue} \theta_2^\ast})$ are marked with a blue circle ($\circ$), no data points are outside $\mathcal{P}({\color{red} \theta_1^\ast})$.
• Figure 4: Maximal sets corresponding to $\mathcal{P}($$\theta_1^\ast$) and all the $(u_i,y_i)$, $i=1,\ldots,N$.
• Figure 5: Robust predictors $\mathcal{P}(\theta^\ast_3)$ (dashed-black line), $\mathcal{P}($$\theta_4^\ast$$)$ (dotted-cyan line) and $\mathcal{P}($$\theta_5^\ast$$)$ (solid-circled-magenta line) along with the adversarial regions $A_{(u_i,y_i)}$, $i=1,\ldots,N$.

Theorems & Definitions (33)

• Definition 1: Misprediction and Risk
• Remark 1: lifting into a feature space
• Remark 2: about the structure of regions $A_{(u,y)}$
• Definition 2: Adversarial misprediction and Adversarial risk
• Remark 3: follow-up on Remark \ref{['rmk:kernel_trick']} about lifting the data into a feature space
• Definition 3: Adversarial complexity
• Definition 4: Risk-bounding functions $\overline{\varepsilon}(k)$ and $\underline{\varepsilon}(k)$
• Theorem 1
• proof
• Remark 4: deployment-time and training-time risk