The geometry of adversarial training in binary classification

Abstract We establish an equivalence between a family of adversarial training problems for non-parametric binary classification and regularized risk minimization where the regularizer is nonlocal perimeter functional. The resulting admit exact convex relaxations type $L^1+\text{(nonlocal)}\operatorname{TV}$, form frequently studied in image analysis graph-based learning. A rich geometric structure revealed by this reformulation which turn allows us to series properties optimal solutions original problem, including existence minimal maximal (interpreted suitable sense) regular (also interpreted sense). In addition, we highlight how connection provides novel, directly interpretable, statistical motivation involving perimeter/total variation. majority our theoretical results are independent distance used define attacks.