Adversarial training tends to result in models that are less accurate on
natural (unperturbed) examples compared to standard models. This can be
attributed to either an algorithmic shortcoming or a fundamental property of
the training data distribution, which admits different solutions for optimal
standard and adversarial classifiers. In this work, we focus on the latter case
under a binary Gaussian mixture classification problem. Unlike earlier work, we
aim to derive the natural accuracy gap between the optimal Bayes and
adversarial classifiers, and study the effect of different distributional
parameters, namely separation between class centroids, class proportions, and
the covariance matrix, on the derived gap. We show that under certain
conditions, the natural error of the optimal adversarial classifier, as well as
the gap, are locally minimized when classes are balanced, contradicting the
performance of the Bayes classifier where perfect balance induces the worst
accuracy. Moreover, we show that with an $\ell_\infty$ bounded perturbation and
an adversarial budget of $\epsilon$, this gap is $\Theta(\epsilon^2)$ for the
worst-case parameters, which for suitably small $\epsilon$ indicates the
theoretical possibility of achieving robust classifiers with near-perfect
accuracy, which is rarely reflected in practical algorithms.

本文研究了在对抗训练中通过二元高斯混合分类问题的分析，得到最优贝叶斯分类器和最优对抗分类器之间的区别，并研究了不同分布参数（类别中心之间的距离、类别比例和协方差矩阵）对精度差异的影响，提出在一定条件下，平衡类别可以实现对抗分类器的自然误差和精度差距的局部最优化，并证明在最坏情况下精度差距为 Theta（epsilon^2），这在理论上表明了实现近乎完美精度的强健分类器的可能性，这在实际算法中很少体现。