On the Power of Abstention and Data-Driven Decision Making for
  Adversarial Robustness
  We formally define a feature-space attack where the adversary can perturb
datapoints by arbitrary amounts but in restricted directions. By restricting
the attack to a small random subspace, our model provides a clean abstraction
for non-Lipschitz networks which map small input movements to large feature
movements. We prove that classifiers with the ability to abstain are provably
more powerful than those that cannot in this setting. Specifically, we show
that no matter how well-behaved the natural data is, any classifier that cannot
abstain will be defeated by such an adversary. However, by allowing abstention,
we give a parameterized algorithm with provably good performance against such
an adversary when classes are reasonably well-separated in feature space and
the dimension of the feature space is high. We further use a data-driven method
to set our algorithm parameters to optimize over the accuracy vs. abstention
trade-off with strong theoretical guarantees. Our theory has direct
applications to the technique of contrastive learning, where we empirically
demonstrate the ability of our algorithms to obtain high robust accuracy with
only small amounts of abstention in both supervised and self-supervised
settings. Our results provide a first formal abstention-based gap, and a first
provable optimization for the induced trade-off in an adversarial defense
setting.
