A Equivalence between Adversarial Robustness Models

We show that the perturbation set and perturbation function models are equivalent. U ( x): = { g ( x): g 2G }, which completes the proof of this direction. B.1 Proper -Probabilistically Robust PAC Learning for finite G We show that if G is finite then VC classes are -probabilistically robustly learnable. Since A ( S) 2H, by construction of H, there are at least m points in C where A is not probabilistically robustly correct. Using a variant of Markov's inequality, gives We now use the same reasoning in Montasser et al. [2019], to show that no proper learning rule works.