Machine learning algorithms are often used in environments which are not
captured accurately even by the most carefully obtained training data, either
due to the possibility of `adversarial' test-time attacks, or on account of
`natural' distribution shift. For test-time attacks, we introduce and analyze a
novel robust reliability guarantee, which requires a learner to output
predictions along with a reliability radius $\eta$, with the meaning that its
prediction is guaranteed to be correct as long as the adversary has not
perturbed the test point farther than a distance $\eta$. We provide learners
that are optimal in the sense that they always output the best possible
reliability radius on any test point, and we characterize the reliable region,
i.e. the set of points where a given reliability radius is attainable. We
additionally analyze reliable learners under distribution shift, where the test
points may come from an arbitrary distribution Q different from the training
distribution P. For both cases, we bound the probability mass of the reliable
region for several interesting examples, for linear separators under nearly
log-concave and s-concave distributions, as well as for smooth boundary
classifiers under smooth probability distributions.

本文讨论机器学习算法在环境未完全准确的情况下的应用，尤其是面对对抗攻击和分布变化的情况下，引入新的鲁棒性可靠性保证，并提供优秀的学习方案，分析了可靠性区域，同时分别分析了近似对数凹分布和平滑概率分布下的线性分类器和光滑边界分类器的可靠性区域中可靠性区域的概率质量上界。

针对测试时攻击与分布偏移的可靠学习

Reliable Learning for Test-time Attacks and Distribution Shift

Recent developments have established the vulnerability of deep Reinforcement
Learning (RL) to policy manipulation attacks via adversarial perturbations. In
this paper, we investigate the robustness and resilience of deep RL to
training-time and test-time attacks. Through experimental results, we
demonstrate that under noncontiguous training-time attacks, Deep Q-Network
(DQN) agents can recover and adapt to the adversarial conditions by reactively
adjusting the policy. Our results also show that policies learned under
adversarial perturbations are more robust to test-time attacks. Furthermore, we
compare the performance of $\epsilon$-greedy and parameter-space noise
exploration methods in terms of robustness and resilience against adversarial
perturbations.

本文调查了深度强化学习网络在训练时间和测试时间的对抗攻击中的鲁棒性，结果显示在非连续的训练时间攻击中，通过调整策略，Deep Q-Network (DQN) 代理能够恢复和适应对抗条件，相比较 ε- 贪婪和参数空间噪声探索方法，本文还对鲁棒性和抗干扰性进行了比较。

深度强化学习：不死之身的秘诀

Whatever Does Not Kill Deep Reinforcement Learning, Makes It Stronger

Motivated by safety-critical applications, test-time attacks on classifiers
via adversarial examples has recently received a great deal of attention.
However, there is a general lack of understanding on why adversarial examples
arise; whether they originate due to inherent properties of data or due to lack
of training samples remains ill-understood. In this work, we introduce a
theoretical framework analogous to bias-variance theory for understanding these
effects.
We use our framework to analyze the robustness of a canonical non-parametric
classifier - the k-nearest neighbors. Our analysis shows that its robustness
properties depend critically on the value of k - the classifier may be
inherently non-robust for small k, but its robustness approaches that of the
Bayes Optimal classifier for fast-growing k. We propose a novel modified
1-nearest neighbor classifier, and guarantee its robustness in the large sample
limit. Our experiments suggest that this classifier may have good robustness
properties even for reasonable data set sizes.

本文针对分类器的测试攻击问题，引入了一种理论框架，类似于偏差 - 方差理论，并使用该框架对一种典型的非参数分类器 - k 最近邻分类器的鲁棒性进行了分析，并提出了一种新的修改的 1 最近邻分类器，其在大样本极限下具有良好的鲁棒性。