Adversarial examples pose a security threat to many critical systems built on
neural networks. Given that deterministic robustness often comes with
significantly reduced accuracy, probabilistic robustness (i.e., the probability
of having the same label with a vicinity is $\ge 1-\kappa$) has been proposed
as a promising way of achieving robustness whilst maintaining accuracy.
However, existing training methods for probabilistic robustness still
experience non-trivial accuracy loss. It is unclear whether there is an upper
bound on the accuracy when optimising towards probabilistic robustness, and
whether there is a certain relationship between $\kappa$ and this bound. This
work studies these problems from a Bayes error perspective. We find that while
Bayes uncertainty does affect probabilistic robustness, its impact is smaller
than that on deterministic robustness. This reduced Bayes uncertainty allows a
higher upper bound on probabilistic robust accuracy than that on deterministic
robust accuracy. Further, we prove that with optimal probabilistic robustness,
each probabilistically robust input is also deterministically robust in a
smaller vicinity. We also show that voting within the vicinity always improves
probabilistic robust accuracy and the upper bound of probabilistic robust
accuracy monotonically increases as $\kappa$ grows. Our empirical findings also
align with our results.

对于建立在神经网络上的许多关键系统来说，对抗性例子构成了一种安全威胁。尽管确定性鲁棒性通常会导致显著的准确性下降，但已提出概率鲁棒性（即在给定区域内具有相同标签的概率≥1-κ）是实现鲁棒性同时保持准确性的一种有前景的方法。然而，现有的用于概率鲁棒性的训练方法仍然存在着不可忽视的准确性损失。目前尚不清楚在优化概率鲁棒性时是否存在准确性的上界以及 κ 与此上界之间是否存在某种关系。本研究从贝叶斯误差的角度研究了这些问题。我们发现，尽管贝叶斯不确定性确实影响了概率鲁棒性，但其对确定性鲁棒性的影响要小。这种减小的贝叶斯不确定性允许在概率鲁棒性准确性上具有更高的上界，而这个上界要高于确定性鲁棒性的上界。此外，我们证明了在最佳概率鲁棒性下，每个具有概率鲁棒性的输入在一个较小的邻域内也是具有确定性鲁棒性的。我们还表明，在邻域内进行投票总是提高概率鲁棒性准确性，并且随着 κ 的增加，概率鲁棒性准确性的上界也单调增加。我们的实证结果也与我们的结论一致。