We investigate adversarial robustness of Gaussian Process Classification
(GPC) models. Given a compact subset of the input space $T\subseteq
\mathbb{R}^d$ enclosing a test point $x^*$ and a GPC trained on a dataset
$\mathcal{D}$, we aim to compute the minimum and the maximum classification
probability for the GPC over all the points in $T$. In order to do so, we show
how functions lower- and upper-bounding the GPC output in $T$ can be derived,
and implement those in a branch and bound optimisation algorithm. For any error
threshold $\epsilon > 0$ selected a priori, we show that our algorithm is
guaranteed to reach values $\epsilon$-close to the actual values in finitely
many iterations. We apply our method to investigate the robustness of GPC
models on a 2D synthetic dataset, the SPAM dataset and a subset of the MNIST
dataset, providing comparisons of different GPC training techniques, and show
how our method can be used for interpretability analysis. Our empirical
analysis suggests that GPC robustness increases with more accurate posterior
estimation.

本文研究了高斯过程分类模型的对抗鲁棒性，提出了一种计算 GPC 在输入空间中最小和最大分类概率的算法，并应用于 2D 合成数据集、SPAM 数据集和 MNIST 数据集的验证，表明我们的方法可用于 GPC 的可解释性分析和提高模型鲁棒性。