Adversarially Robust Generalization Requires More Data 2: A Robust-Error Lower Bound for Linear Classifiers in the Bernoulli ModelResearch Paper
Motivation
Classifiers trained by standard methods reach high accuracy on image benchmarks and yet change their prediction under perturbations of each pixel that are invisible to a human. Training against such perturbations (adversarial training) improves robustness, but on CIFAR10 and SVHN the robust test accuracy stays far below the robust training accuracy: robust models overfit. Schmidt, Santurkar, Tsipras, Talwar and Mądry (arXiv:1804.11285, 2018) asked whether this gap is a failure of current methods or an information-theoretic fact about the number of samples needed. They introduced two simple data models in which a single sample suffices for standard accuracy and proved that robust accuracy needs many more samples.
This mission formalizes their lower bound for the second model, the Bernoulli model on the hypercube, which was designed to resemble MNIST (whose images are close to binary). In this model the lower bound holds for linear classifiers, and the paper shows separately that a non-linear classifier (thresholding followed by a linear rule) escapes it. The result therefore isolates a concrete way in which the model class, not only the amount of data, governs robust generalization.
Setting
Let and . Points are , labels . For a parameter , the -Bernoulli model draws uniformly from and then, independently for every coordinate , sets with probability and with probability (Definition 7). The two classes are noisy copies of the opposite vertices .
The adversary may move a test point anywhere in the ball
leaving the hypercube. The -robust classification error of a classifier is (Definition 3)
A linear classifier is for . A linear-classifier learning algorithm is any function from labelled samples to a weight vector .
The lower bound is Bayesian: is drawn uniformly from , the learner receives independent samples from the -model, outputs , and is charged the robust error of on a fresh sample, averaged over and . The posterior mean measures how much the learner can know about coordinate .
Formalization targets
Goal: Theorem 31 (p. 35)
For , , and every linear learner : if
then
Milestones
- Eqs. (4)–(5), p. 33: in one dimension the posterior odds of equal .
- Lemma 29, p. 33: for and , with probability ,
- Proof of Theorem 31, p. 36: with probability , for all .
- §4, p. 10: , so robustly classifies iff .
- Proof of Theorem 31, p. 37: when has independent coordinates with means bounded by in absolute value, a fresh sample satisfies with probability at least .
The goal keeps the paper's explicit constants (, , ) because Theorem 31 is itself the explicit form of the paper's asymptotic Theorem 9.
Significance
With a single sample already yields a linear classifier with small standard error (Theorem 8 of the paper), while Theorem 31 shows that for of order every linear learner needs on the order of samples to get expected robust error below against an adversary (the paper's Theorem 9 states this as for ). The companion upper bound (Theorem 10) shows that thresholding the input first makes one sample enough for any . Together these give a rigorous example in which robust generalization is polynomially harder than standard generalization for a model class, and in which a change of model class removes the gap.
The theorem and its proof are published and not in doubt. The platform holds no statement of this lower bound, of Lemma 29, or of the ℓ∞/ℓ1 robustness criterion for linear classifiers (searched 2026-09-26). The mission produces a checked statement of the result with every hypothesis explicit, including the tie convention and the domain of that the printed statement leaves implicit, and a finite, measure-free encoding of a Bayesian learning lower bound that other hypercube models can reuse.
Difficulty
The obvious attempt bounds the robust error of the best classifier the learner could output, but the learner is arbitrary: it may output any , including ones that use the samples in unusual ways. The argument must therefore hold for every function of the samples, which is why is random and why the error is averaged over it; for a fixed the learner is robust and the statement is false. The technical difficulty is to pass from "the posterior of every coordinate is nearly uniform" (a statement about separate one-dimensional problems) to a bound on the margin relative to that holds for every at once, uniformly in how spreads its weight across coordinates. Concentration of is not available for a general (a single heavy coordinate defeats it), so only a weak, constant-probability tail bound survives, which is why the final error is rather than close to .
Formalization scope
Everything is finite. Hypercube points are sign vectors Fin d → Bool, labels are Bool with true ↦ , and every probability is an explicit finite sum of weights; no measure theory is involved. is EuclideanSpace ℝ (Fin d). Committed conventions:
- The coordinates of are sampled independently (the reading of "sampling each coordinate" that the paper's proofs use).
- and are written coordinatewise; the adversary's ball is the ball, not the Euclidean one.
- when (the paper's is not in ).
- The robust error is Definition 3's event , not the margin criterion; the equivalence is milestone 4.
- Added hypotheses: in the goal (for the ball is empty and the printed statement fails at ), and in Lemma 29 (at Lean's makes it false). Posteriors are defined by Bayes' rule as ratios of joint weights.
The learner is any function of the samples to ; restricting to a specific learner, fixing , letting the learner output an arbitrary classifier (for which the theorem is false), or bounding only the standard error () would each trivialize or falsify the target and are excluded. Useful infrastructure: Hoeffding's inequality for sums of independent variables, Markov's inequality over finite sums, and the ℓ∞/ℓ1 duality on EuclideanSpace. Related platform work: the other three missions of this series (the Gaussian lower bound, the Gaussian robust upper bound, and the Bernoulli thresholding upper bound). Contributions of general lemmas on finite product measures over the hypercube are welcome.
Selected references
- L. Schmidt, S. Santurkar, D. Tsipras, K. Talwar, A. Mądry, Adversarially Robust Generalization Requires More Data, arXiv:1804.11285v2, 2018; NeurIPS 2018. https://arxiv.org/abs/1804.11285
- I. Goodfellow, J. Shlens, C. Szegedy, Explaining and Harnessing Adversarial Examples, ICLR 2015. https://arxiv.org/abs/1412.6572
- A. Mądry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards Deep Learning Models Resistant to Adversarial Attacks, ICLR 2018. https://arxiv.org/abs/1706.06083
- S. Boucheron, G. Lugosi, P. Massart, Concentration Inequalities: A Nonasymptotic Theory of Independence, Oxford University Press, 2013. https://doi.org/10.1093/acprof:oso/9780199535255.001.0001