1/ Strong No Free Lunch Theorem for adversarial robustness arxiv.org/pdf/1810.04065…. As the size eps of the perturbations is slightly increased, a point is reached eps_* is eventually reached beyond which accuracy decreases exponentially fast. A few typos in there.
Please RT.
Please RT.
2/ Moreover, eps_* is comparable to the natural noise level on the problem, with a modulation factor which varies only logarithmic as a function of the particular classifier ==> adversarial robustness / non-robustness is more a property of data than of some magical classifier
3/ These results hold on a large range of class-conditional data distributions, including those listed below. This are distributions which satisfy Talagrand's W_2 transportation-cost inequality (see paper for def.). Our restults generalize Fawzi et al 2018 and Tsipras 2018
Special thanks to @albertobietti and @albertcthomas for proof-reading and giving useful feedback.
