Agnostic Learning under Targeted Poisoning: Optimal Rates and the Role of Randomness

2025-06-03

AI Summary

This work studies the robustness of agnostic learning under instance-targeted poisoning attacks: specifically, what is the optimal excess error rate of a learner when an adversary may corrupt a small fraction η of the training samples to attack a particular test point? Leveraging VC-dimension analysis, probabilistic methods, constructive adversarial distributions, randomized learner design, and strong lower-bound techniques, we establish for the first time that the optimal excess error rate in this setting is Θ̃(√(dη)), which is tight and resolves an open problem posed by Hanneke et al. A key insight is that deterministic learners necessarily fail under such attacks; in contrast, appropriate randomization is not only necessary but also sufficient to ensure robustness—even when the adversary observes the learner’s random bits.

Technology Category

Machine Learning: Adversarial Learning & RobustnessComputer Vision: Adversarial Attacks & RobustnessIntelligent Robots: Learning & Optimization for ROB

Application Category

User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systemsSearch and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for rankingGraph Algorithms and Modeling for the Web: Algorithms and analysis for incomplete, noisy, or partially observed Web-related graphs

Abstract

We study the problem of learning in the presence of an adversary that can corrupt an $eta$ fraction of the training examples with the goal of causing failure on a specific test point. In the realizable setting, prior work established that the optimal error under such instance-targeted poisoning attacks scales as $Theta(deta)$, where $d$ is the VC dimension of the hypothesis class arXiv:2210.02713. In this work, we resolve the corresponding question in the agnostic setting. We show that the optimal excess error is $ ilde{Theta}(sqrt{deta})$, answering one of the main open problems left by Hanneke et al. To achieve this rate, it is necessary to use randomized learners: Hanneke et al. showed that deterministic learners can be forced to suffer error close to 1, even under small amounts of poisoning. Perhaps surprisingly, our upper bound remains valid even when the learner's random bits are fully visible to the adversary . In the other direction, our lower bound is stronger than standard PAC-style bounds: instead of tailoring a hard distribution separately for each sample size, we exhibit a single fixed distribution under which the adversary can enforce an excess error of $Omega(sqrt{deta})$ infinitely often.

Problem

• Study agnostic learning under targeted poisoning attacks
• Determine optimal excess error rates for adversarial corruption
• Analyze role of randomness in defending against poisoning

Innovation

• Optimal error rate under targeted poisoning
• Randomized learners resist adversarial corruption
• Single fixed distribution enforces lower bound