在对抗性注入下的可靠回避：紧的下界和新的上界
Reliable Abstention under Adversarial Injections: Tight Lower Bounds and New Upper Bounds
AI总结：
本文研究了对抗性注入下的可靠回避问题，证明了VC维为1时的下界，并引入了基于鲁棒见证者的框架，首次为半空间类提供了分布无关的误差界。
摘要：
我们研究了在Goel等人2017年引入的对抗性注入模型中的在线学习，其中一个标记示例流主要从未知分布D中独立同分布地抽取，但可能夹杂着由对手选择的实例，而学习者并不知道哪些轮次是对抗性的。关键的是，标签始终与一个固定的目标概念（干净标签设置）一致。学习者还被允许回避预测，总误差计算了当学习者决定预测时的错误以及当其在独立同分布轮次中回避时的错误。出人意料的是，先前的工作显示，通过底层分布的oracle访问可以得到VC维为d的O(d² log T)的综合误差，而分布无关算法只能在受限类中达到O(√T)的误差，留下开放的问题：这个差距是否是根本性的。我们通过证明VC维为1时的匹配Ω(√T)下界，建立了两种信息制度之间的明确分离。在算法方面，我们引入了一个基于势函数的框架，由鲁棒见证者驱动，即小的标记示例子集，可以证明预测的同时保持对对抗性污染的韧性。我们通过两个组合维度实例化这一框架：（1）推理维度，产生推理维度为k的类的综合误差O(T^{1-1/k})，（2）证书维度，我们引入的新放松。作为应用，我们证明了R²中的半空间具有证书维度3，从而获得该类别的首个分布无关界O(T^{2/3})。这值得注意的是，Blum等人2021年显示，在没有回避的情况下，半空间在干净标签攻击下无法鲁棒地学习。
英文摘要：
We study online learning in the adversarial injection model introduced by [Goel et al. 2017], where a stream of labeled examples is predominantly drawn i.i.d.\ from an unknown distribution $\mathcal{D}$, but may be interspersed with adversarially chosen instances without the learner knowing which rounds are adversarial. Crucially, labels are always consistent with a fixed target concept (the clean-label setting). The learner is additionally allowed to abstain from predicting, and the total error counts the mistakes whenever the learner decides to predict and incorrect abstentions when it abstains on i.i.d.\ rounds. Perhaps surprisingly, prior work shows that oracle access to the underlying distribution yields $O(d^2 \log T)$ combined error for VC dimension $d$, while distribution-agnostic algorithms achieve only $\tilde{O}(\sqrt{T})$ for restricted classes, leaving open whether this gap is fundamental. We resolve this question by proving a matching $Ω(\sqrt{T})$ lower bound for VC dimension $1$, establishing a sharp separation between the two information regimes. On the algorithmic side, we introduce a potential-based framework driven by \emph{robust witnesses}, small subsets of labeled examples that certify predictions while remaining resilient to adversarial contamination. We instantiate this framework using two combinatorial dimensions: (1) \emph{inference dimension}, yielding combined error $\tilde{O}(T^{1-1/k})$ for classes of inference dimension $k$, and (2) \emph{certificate dimension}, a new relaxation we introduce. As an application, we show that halfspaces in $\mathbb{R}^2$ have certificate dimension $3$, obtaining the first distribution-agnostic bound of $\tilde{O}(T^{2/3})$ for this class. This is notable since [Blum et al. 2021] showed halfspaces are not robustly learnable under clean-label attacks without abstention.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
