In this section, we show the proofs of the results in the main body. Eq. (1) satisfies the triangle inequality, i.e., for any scoring functions For the second inequality, we prove it similarly. Before we present the proof of the theorem, we first provide some lemmas. By applying Lemma A.2, the following holds with probability at least 1 α: null R F). Thus we have: null R A.1, we can get that the margin loss satisfies the triangle inequality. By Lemma A.4, we have R By Theorem 4.4, the following holds for any Based on Theorem A.6, the following standard error bound for gradual AST can be derived similarly to Corollary 4.6.

It is not clear, however, whether these theoretical results apply to actual distributions such as images.

However, these works face some limitations and challenges.

Neural Information Processing Systems http://nips.cc/

There is no universally agreed upon definition of adversarial risk.

Neural networks are known to be vulnerable toadversarial attacks, which are imperceptible perturbations to input data that maximize loss [38, 15, 5].