It begins with a boundary: A geometric view on probabilistically robust learning

¹ Institute of Mathematics & Center for Artifical Intelligence and Data Science (CAIDAS), University of Würzburg, Emil-Fischer-Str. 40, 97074, Würzburg, Germany
² Department of Statistics, University of Wisconsin-Madison, 1300 University Avenue, Madison, WI 53706, USA
³ Department of Mathematics, University of California Santa Barbara, South Hall, Room 6607, Santa Barbara, CA 93106-3080, USA
⁴ Department of Applied Mathematics and Statistics, Colorado School of Mines, 1500 Illinois Street, Golden, CO 80401, USA
⁵ Department of Mathematics and Statistics, Lederle Graduate Research Tower, 1654, University of Massachusetts Amherst, 710 N. Pleasant Street, Amherst, MA 01003-9305, USA
⁶ Halıcıoğlu Data Science Institute, University of California San Diego, 3234 Matthews Lane, La Jolla, CA 92093, USA

^* Corresponding author: This email address is being protected from spambots. You need JavaScript enabled to view it.

Received: 24 November 2024
Accepted: 14 May 2026

Abstract

Although deep neural networks have achieved super-human performance on many classification tasks, they often exhibit a worrying lack of robustness towards adversarially generated examples. Thus, considerable effort has been invested into reformulating standard Risk Minimization (RM) into an adversarially robust framework. Recently, attention has shifted towards approaches which interpolate between the robustness offered by adversarial training and the higher clean accuracy and faster training times of RM. In this paper, we take a fresh and geometric view on one such method – Probabilistically Robust Learning (PRL) [A. Robey et al. International Conference on Machine Learning. PMLR (2022) 18667–18686]. We propose a mathematical framework for understanding PRL, which allows us to identify geometric pathologies in its original formulation and to introduce a family of probabilistic nonlocal perimeter functionals to rectify them. We prove existence of solutions to the original and modified problems using relaxation methods in the calculus of variations and also study properties, as well as local limits, of the introduced perimeters. We also clarify, through a suitable Γ-convergence analysis, the way in which the original and modified PRL models interpolate between risk minimization and adversarial training.