Thecorpusconsistsof 16 categories:advertisement, budget, email, file_folder, form, handwritten, invoice, letter, memo, news_article, presentation, questionnaire, resume, scientific_publication, scientific_report, and specification. Category Count budget 58 email 33 form 70 handwritten 176 invoice 57 letter 152 memo 47 news_article 86 questionnaire 39 resume 184 scientific_pub.

This is achieved through a game where we learn features that are both predictive and robust (insensitive to adversarial attacks), i.e. cannot beused todiscriminate between natural andadversarial data.

In most applications,E " Y to begin with (ally are potential maximizer for some vector of costs, otherwise theyare not included in the set), and all points inY havepositive mass. Ittherefore also satisfies this property. We recall that we assume thatθ yields a unique maximum to the linear program onC. As a consequence, all convergent subsequences ofyn converge to the same limity pθq: it is the unique accumulation point of this sequence.Itfollowsdirectlythat yn convergesto y pθq,asitlivesinacompactset,whichyieldsthe desired result. Using different reference vectorsv yield different perturbed operations, andv " p1,2,...,dq is commonlyused.