Thus, we did not create new threats to society. Moreover, our work provides a new perspective on backdoor defense, as it is the first to address the certification of backdoor detection. This assumption holds in general in practice. In our setting, this is reflected by a small samplewise local probability for the labeled class for most samples used for computing LDP, which may easily lead to a large LDP . In the following, we show that a larger deviation of the learned decision boundary of a binary Bayesian classifier will affect its LDP .

Backdoor attack is a common threat to deep neural networks.

Ensemble learning is a popular technique for enhancing the performance of machine learning algorithms. It is used to capture a complex model space with simple hypotheses which are often significantly easier to learn, or to increase the accuracy of an otherwise unstable procedure [see 14,27,29,andreferencestherein].

Whereas Perdomo et al. care only about predictive accuracy, we care also about the quality of the actual outcomes10 associated with decisions, and study the tradeoff between decision improvement and predictive accuracy. Consider,forexample, mortgage13 buyers, ICU patients, orfirst-time medical consultation (e.g., oncology,cardiology,psychiatry,screening tests). Thisisacausalproblem,and18 as such, requires assumptions that ensure causal validity (in our work this comes in through our use of propensity19 scoresforreweightingevidence). Undesired outcomes, as in the policing example, are the result of30 sample bias indata (missing observations) andoftheinappropriate useofpredictivetools fordecision making.

Thissettingfrequently arisesinpractice because it is often straightforward to perform feature-engineering and produce a large number of potentially useful features in many machine learning problems. For example, in a typical equity forecasting model,n is around 3,000 (i.e., using 10 years of market data), whereas the number of potentially relevant features can be in the order of thousands [36, 24, 26, 12].

We consider the "large feature size" setting, in which the number of features