In this talk, I will present the recent progress of understanding adversarial multiclass classification problems, motivated by the empirical observation of the sensitivity of neural networks by small adversarial attacks. Based on 'distributional robust optimization' framework, we obtain reformulations of adversarial training problem: 'generalized barycenter problem' and a family of multimarginal optimal transport problems. These new theoretical results reveal a rich geometric structure of adversarial training problems in multiclass classification and extend recent results restricted to the binary classification setting. From this optimal transport perspective understanding, we prove the existence of robust classifiers by using the duality of the reformulations without so-called 'universal sigma algebra'. Furthermore, based on these optimal transport reformulations, we provide two efficient approximate methods which provide a lower bound of the optimal adversarial risk. The basic idea is the truncation of effective interactions between classes: with small adversarial budget, high-order interactions(high-order barycenters) disappear, which helps consider only lower order tensor computations.
|
