# How to beat a Bayesian adversary

Zihan DingaaaDepartment of Electrical and Computer Engineering, Princeton
University, USA<EMAIL_ADDRESS>Kexin JinbbbDepartment of Mathematics,
Princeton University, USA<EMAIL_ADDRESS>Jonas LatzcccDepartment
of Mathematics, University of Manchester, UK<EMAIL_ADDRESS>Chenguang LiudddDelft Institute of Applied Mathematics, Technische
Universiteit Delft, The Netherlands<EMAIL_ADDRESS>
###### Abstract

Deep neural networks and other modern machine learning models are often
susceptible to adversarial attacks. Indeed, an adversary may often be able to
change a model’s prediction through a small, directed perturbation of the
model’s input – an issue in safety-critical applications. Adversarially robust
machine learning is usually based on a minmax optimisation problem that
minimises the machine learning loss under maximisation-based adversarial
attacks.

In this work, we study adversaries that determine their attack using a
Bayesian statistical approach rather than maximisation. The resulting Bayesian
adversarial robustness problem is a relaxation of the usual minmax problem. To
solve this problem, we propose Abram – a continuous-time particle system that
shall approximate the gradient flow corresponding to the underlying learning
problem. We show that Abram approximates a McKean-Vlasov process and justify
the use of Abram by giving assumptions under which the McKean-Vlasov process
finds the minimiser of the Bayesian adversarial robustness problem. We discuss
two ways to discretise Abram and show its suitability in benchmark adversarial
deep learning experiments.

Keywords: Machine learning, adversarial robustness, stochastic differential
equations, McKean-Vlasov process, particle system

MSC(2020): 90C15, 65C35, 68T07

##  1 Introduction

Machine learning and artificial intelligence play a major role in today’s
society: self-driving cars (e.g., Bachute and Subhedar (2021)), automated
medical diagnoses (e.g., Rajkomar et al. (2019)), and security systems based
on face recognition (e.g., Sharma et al. (2020)), for instance, are often
based on certain machine learning models, such as deep neural networks (DNNs).
DNNs are often discontinuous with respect to their input (Szegedy et al.,
2014) making them susceptible to so-called _adversarial attacks_. In an
adversarial attack, an adversary aims to change the prediction of a DNN
through a directed, but small perturbation to the input. We refer to
Goodfellow et al. (2015) for an example showing the weakness of DNNs towards
adversarial attacks. Especially when employing DNNs in safety-critical
applications, the training of machine learning models in a way that is robust
to adversarial attacks has become a vital task.

Machine learning models are usually trained by minimising an associated loss
function. In adversarially robust learning, this loss function is considered
to be subject to adversarial attacks. The adversarial attack is usually given
by a perturbation of the input data that is chosen to maximise the loss
function. Thus, adversarial robust learning is formulated as a minmax
optimisation problem. In practice, the inner maximisation problem needs to be
approximated: Goodfellow et al. (2015) proposed the Fast Gradient Sign Method
(FGSM) which perturbs the input data to maximise the loss function with a
single step. Improvements of FGSM were proposed by, e.g., Tramèr et al.
(2018); Kurakin et al. (2017a); Wong et al. (2020). Another popular
methodology is Projected Gradient Descent (PGD) (Madry et al., 2018) and its
variants, see, for example, Dong et al. (2018); Yang et al. (2019); Mosbach et
al. (2019); Tramer and Boneh (2019); Maini et al. (2020); Croce and Hein
(2020). Similar to FGSM, PGD considers the minmax optimisation problem but
uses multi-step gradient ascent to approximate the inner maximisation problem.
Notably, Wong et al. (2020) showed that FGSM with random initialization is as
effective as PGD.

Other defense methods include preprocessing (e.g. Xu et al. 2018; Song et al.
2018; Guo et al. 2018; Yun et al. 2019) and detection (e.g. Carlini and Wagner
2017a; Metzen et al. 2017; Liu et al. 2022; Xu et al. 2023), as well as
provable defenses (e.g. Wong and Kolter 2018; Gowal et al. 2019;
Sheikholeslami et al. 2021; Jia et al. 2022). Various attack methods have also
been proposed, see, for instance, Carlini and Wagner (2017b); Wong et al.
(2019); Ghiasi et al. (2020); Croce and Hein (2020). More recently, there is
an increased focus on using generative models to improve adversarial accuracy,
see for example Nie et al. (2022); Wang et al. (2023); Xue et al. (2023).

In the present work, we study the case of an adversary that finds their attack
following a Bayesian statistical methodology. The Bayesian adversary does not
find the attack through optimisation, but by sampling a probability
distribution that can be derived using Bayes’ Theorem. Importantly, we study
the setting in which the adversary uses a Bayesian strategy, but the machine
learner/defender trains the model using optimisation, which is in contrast to
Ye and Zhu (2018). The associated Bayesian adversarial robustness problem can
be interpreted as a stochastic relaxation of the classical minmax problem that
replaces the inner maximisation problem with an integral. After establishing
this connection, we

  * •

propose _Abram_ (short for _Adversarial Bayesian Particle Sampler_), a
particle-based continuous-time dynamical system that simultaneously
approximates the behaviour of the Bayesian adversary and trains the model via
gradient descent.

Particle systems of this form have been used previously to solve such
optimisation problems in the context of maximum marginal likelihood
estimation, see, e.g., Akyildiz et al. (2023) and Kuntz et al. (2023). In
order to justify the use Abram in this situation, we

  * •

show that Abram converges to a McKean–Vlasov stochastic differential equation
as the number of particles goes to infinity, and

  * •

give assumptions under which the McKean-Vlasov SDE converges to the minimiser
of the Bayesian adversarial robustness problem with an exponential rate.

Additional complexity arises here compared to earlier work as the dynamical
system and its limiting McKean-Vlasov SDE have to be considered under
reflecting boundary conditions. After the analysis of the continuous-time
system, we briefly explain its discretisation. Then, we

  * •

compare Abram to the state-of-the-art in adversarially robust classificaton of
the MNIST and the CIFAR-10 datasets under various kinds of attacks.

This work is organised as follows. We introduce the (Bayesian) adversarial
robustness problem in Section 2 and the Abram method in Section 3. We analyse
Abram in Sections 4 (large particle limit) and 5 (longtime behaviour). We
discuss different ways of employing Abram in practice in Section 6 and compare
it to the state-of-the-art in adversarially robust learning in Section 7. We
conclude in Section 8.

##  2 Adversarial robustness and its Bayesian relaxation

In the following, we consider a supervised machine learning problem of the
following form. We are given a _training dataset_
$\\{(y_{1},z_{1}),\ldots,(y_{K},z_{K})\\}$ of pairs of features
$y_{1},\ldots,y_{K}\in Y:=\mathbb{R}^{d_{Y}}$ and _labels_
$z_{1},\ldots,z_{K}\in Z$. Moreover, we are given a parametric model of the
form $g:X\times Y\rightarrow Z$, with $X:=\mathbb{R}^{d}$ denoting the
parameter space. Goal is now to find a parameter $\theta^{*}$, for which

$g(y_{k}|\theta^{*})\approx z_{k}\qquad(k=1,\ldots,K).$

In practice the function $g(\cdot|\theta^{*})$ shall then be used to predict
labels of features (especially such outside of training dataset).

The parameter $\theta^{*}$ is usually found through optimisation. Let
$\ell:Z\times Z\rightarrow\mathbb{R}$ denote a loss function – a function that
gives a reasonable way of comparing the output of $g$ with observed labels.
Then, we need to solve the following optimisation problem:

$\displaystyle\min_{\theta\in X}$
$\displaystyle\frac{1}{K}\sum_{k=1}^{K}\Phi(y_{k},z_{k}|\theta)$ (2.1)

where $\Phi(y,z|\theta):=\ell(g(y|\theta),z)$.

Machine learning models $g$ that are trained in this form are often
susceptible to adversarial attacks. That means, for a given feature vector
$y$, we can find a ‘small’ $\xi\in Y$ for which $g(y+\xi|\theta^{*})\neq
g(y|\theta^{*})$. In this case, an adversary can change the model’s predicted
label by a very slight alteration of the input feature. Such a $\xi$ can
usually be found through optimisation on the input domain:

$\max_{\xi\in B(\varepsilon)}\Phi(y+\xi,z|\theta),$

where $B(\varepsilon)=\\{\xi:\|\xi\|\leq\varepsilon\\}$ denotes the
$\varepsilon$-ball centred at $0$ and $\varepsilon>0$ denotes the size of the
adversarial attack. Hence, the attacker tries to change the prediction of the
model whilst altering the model input only by a small value $\leq\varepsilon$.
Other kinds of attacks are possible, the attacker may, e.g., try to not only
change the predicted label to a _some_ other label, but actually change it to
a particular other label, see, e.g., Kurakin et al. (2017b).

In adversarially robust training, we replace the optimisation problem (2.1) by
the minmax optimisation problem below:

$\min_{\theta\in X}\frac{1}{K}\sum_{k=1}^{K}\max_{\xi_{k}\in
B(\varepsilon)}\Phi(y_{k}+\xi_{k},z_{k}|\theta).$ (2.2)

Thus, we now train the network by minimising the loss also with respect to
potential adversarial attacks. Finding the accurate solutions to such minmax
optimisation problems is difficult: there is no underlying saddlepoint
structure, e.g., $\Phi(y,z|\theta)$ is neither convex in $\theta$ nor concave
in $y$, $X$ and $Y$ tend to be very high-dimensional spaces, and the number of
datasets $K$ may prevent the accurate computation of gradients. However, good
heuristics have been established throughout the last decade – we have
mentioned some of them in Section 1.

In this work, we aim to study a relaxed version of the minmax problem, which
we refer to as the _Bayesian adversarial robustness problem_. This problem is
given by

$\min_{\theta\in
X}\frac{1}{K}\sum_{k=1}^{K}\int\Phi(y_{k}+\xi_{k},z_{k}|\theta)\pi^{\gamma,\varepsilon}_{k}(\mathrm{d}\xi_{k}|\theta),$
(2.3)

where the _Bayesian adversarial distribution_
$\pi^{\gamma,\varepsilon}_{k}(\cdot|\theta)$ has (Lebesgue) density

$\xi\mapsto\frac{\exp(\gamma\Phi(y_{k}+\xi,z_{k}|\theta))\mathbf{1}[\xi\in
B(\varepsilon)]}{\int_{B(\varepsilon)}\exp(\gamma\Phi(y_{k}+\xi^{\prime},z_{k}|\theta))\mathrm{d}\xi^{\prime}},$

where $\gamma>0$ is an _inverse temperature_ , $\varepsilon>0$ still denotes
the size of the adversarial attack, and $\mathbf{1}[\cdot]$ denotes the
indicator: $\mathbf{1}[\mathrm{true}]:=1$ and $\mathbf{1}[\mathrm{false}]:=0$.
The distribution $\pi^{\gamma,\varepsilon}_{k}(\cdot|\theta)$ is concentrated
on the $\varepsilon$-ball, $\varepsilon>0$ controls the range of the attack,
$\gamma>0$ controls its focus. We illustrate this behaviour in Figure 2.1.
Next, we comment on the mentioned relaxation and the Bayesian derivation of
this optimisation problem.

Figure 2.1: Plots of the Lebesgue density of
$\pi_{1}^{\gamma,\varepsilon}(\cdot|\theta_{0})$ for energy
$\Phi(y_{1}+\xi,z_{1}|\theta_{0})=(\xi-0.1)^{2}/2$, choosing parameters
$\varepsilon\in\\{0.025,0.1,0.4\\}$ and $\gamma\in\\{0.1,10,1000\\}$.

#### Relaxation.

Under certain assumptions on $\Phi$, one can show that

$\pi^{\gamma,\varepsilon}_{k}(\cdot|\theta)\rightarrow\mathrm{Unif}(\mathrm{argmax}_{\xi\in
Y}\Phi(y_{k}+\xi,z_{k}|\theta))$

weakly as $\gamma\rightarrow\infty$, see Hwang (1980). Indeed, the Bayesian
adversarial distribution converges to the uniform distribution over the global
maximisers computed with respect to the adversarial attack. This limiting
behaviour, that we can also see in Figure 2.1, forms the basis of simulated
annealing methods for global optimisation. Moreover, it implies that the
optimisation problems (2.2) and (2.3) for $\gamma=0$ are identical, since

$\frac{1}{K}\sum_{k=1}^{K}\int\Phi(y_{k}+\xi_{k},z_{k}|\theta)\pi^{0,\varepsilon}_{k}(\mathrm{d}\xi_{i}|\theta)=\frac{1}{K}\sum_{k=1}^{K}\int\Phi(y_{k}+\xi_{k},z_{k}|\theta)\mathrm{Unif}(\mathrm{argmax}_{\xi\in
Y}\Phi(y_{k}+\xi,z_{k}|\theta))(\mathrm{d}\xi_{i})$

and since $\xi_{k}\sim\mathrm{Unif}(\mathrm{argmax}_{\xi\in
Y}\Phi(y_{k}+\xi,z_{k}|\theta))$ implies
$\Phi(y_{k}+\xi_{k},z_{k}|\theta)=\max_{\xi\in
B(\varepsilon)}\Phi(y_{k}+\xi,z_{k}|\theta)$ for $k=1,\ldots,K$. A strictly
positive $\gamma$ on the other hand leads to a relaxed problem circumventing
the minmax optimisation. Cipriani et al. (2024) have also discussed this
relaxation of an adversarial robustness problem in the context of a finite set
of attacks, i.e. the $\varepsilon$-ball $B(\varepsilon)$ is replaced by a
finite set.

#### Bayesian.

We can understand the kind of attack that is implicitly employed in (2.3) as a
Bayesian attack. We now briefly introduce the Bayesian learning problem to
then explain its relation to this adversarial attack. In Bayesian learning, we
model $\theta$ as a random variable with a so-called _prior (distribution)_
$\pi_{\rm prior}$. The prior incorporates information about $\theta$. In
Bayesian learning, we now inform the prior about data
$\\{(y_{1},z_{1}),\ldots,(y_{K},z_{K})\\}$ by conditioning $\theta$ on that
data. Indeed, we train the model by finding the conditional distribution of
$\theta$ given that $g(z_{k}|\theta)\approx y_{k}$ ($k=1,\ldots,K)$. In the
Bayesian setting, we represent ‘$\approx$’ by a noise assumption consistent
with the loss function $\ell$. This is achieved by defining the so-called
_likelihood_ as $\exp(-\Phi)$. The conditional distribution describing
$\theta$ is called _posterior (distribution)_ $\pi_{\rm post}$ and can be
obtained through Bayes’ theorem, which states that

$\pi_{\rm
post}(A)=\frac{\int_{A}\exp\left(-\frac{1}{K}\sum_{k=1}^{K}\Phi(y_{k},z_{k}|\theta)\right)\pi_{\rm
prior}(\mathrm{d}\theta)}{\int_{X}\exp\left(-\frac{1}{K}\sum_{i=k}^{K}\Phi(y_{k},z_{k}|\theta^{\prime})\right)\pi_{\rm
prior}(\mathrm{d}\theta^{\prime})}$

for measurable $A\subseteq X$. A model prediction with respect to feature $z$
can then be given by the posterior mean of the output $g$, which is

$\int g(z|\theta)\pi_{\rm post}(\mathrm{d}\theta)$

The Bayesian attacker treats the attack $\xi_{k}$ in exactly such a Bayesian
way. They define a prior distribution for the attack, which is the uniform
distribution over the $\varepsilon$-ball:

$\mathrm{Unif}(B(\varepsilon))=\int_{B(\varepsilon)}\mathbf{1}[\xi_{k}\in\cdot]\mathrm{d}\xi_{k}.$

The adversarial likelihood is designed to essentially cancel out the
likelihood in the Bayesian learning problem, by defining a function that gives
small mass to the learnt prediction and large mass to anything that does not
agree with the learnt prediction:

$\exp(\gamma\Phi(y_{k}+\xi_{k},z_{k}|\theta)).$

Whilst this is not a usual likelihood corresponding to a particular noise
model, we could see this as a special case of _Bayesian forgetting_ (Fu et
al., 2021). In Bayesian forgetting, we would try to remove a single dataset
from a posterior distribution by altering the distribution of the parameter
$\theta$. In this case, we try to alter the knowledge we could have gained
about the feature vector by altering that feature vector to produce a
different prediction.

##  3 Adversarial Bayesian Particle Sampler

We now derive a particle-based method that shall solve (2.3). To simplify the
presentation in the following, we assume that $K=1$, i.e., there is only a
single data set. The derivation for multiple data sets is equivalent –
computational implications given by multiple datasets will be discussed in
Section 6. We also ignore the dependence of $\Phi$ on particular datasets and
note only the dependence on parameter and attack. Indeed, we write (2.3) now
as

$\min_{\theta\in
X}F(\theta):=\int\Phi(\xi,\theta)\pi^{\gamma,\varepsilon}(\mathrm{d}\xi|\theta).$

To solve this minimisation problem, we study the gradient flow corresponding
to the energy $F$, that is:
${\mathrm{d}\zeta_{t}}=-\nabla_{\zeta}F(\zeta_{t}){\mathrm{d}t}$. The gradient
flow is a continuous-time variant of the gradient descent algorithm. The
gradient flow can be shown to converge to a minimiser of $F$ in the longterm
limit if $F$ satisfies certain regularity assumptions. The gradient of $F$ has
a rather simple expression:

$\displaystyle\nabla_{\theta}F(\theta)$
$\displaystyle=\nabla_{\theta}\frac{\int_{B(\varepsilon)}\Phi(\xi,\theta)\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}}{\int_{B(\varepsilon)}\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}}$
$\displaystyle=\frac{\int_{B(\varepsilon)}\nabla_{\theta}\Phi(\xi,\theta)\cdot\exp(\gamma\Phi(\xi^{\prime},\theta))+\gamma\nabla_{\theta}\Phi(\xi,\theta)\cdot\Phi(\xi,\theta)\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}}{\int_{B(\varepsilon)}\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}}$
$\displaystyle\qquad-\frac{\left(\int_{B(\varepsilon)}\Phi(\xi,\theta)\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}\right)\left(\int_{\|\cdot\|\leq\varepsilon}\gamma\nabla_{\theta}\Phi(\xi,\theta)\cdot\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}\right)}{\left(\int_{B(\varepsilon)}\exp(\gamma\Phi(\xi^{\prime},\theta))\mathrm{d}\xi^{\prime}\right)^{2}}$
$\displaystyle=\int\nabla_{\theta}\Phi(\xi,\theta)\pi^{\gamma,\varepsilon}(\mathrm{d}\xi|\theta)+\gamma\mathrm{Cov}_{\pi^{\gamma,\varepsilon}(\cdot|\theta)}(\Phi(\cdot,\theta),\nabla_{\theta}\Phi(\cdot,\theta)),$

where we assume that $\Phi$ is continuously differentiable, bounded below, and
sufficient regularity to be allowed here to switch gradients and integrals. As
usual, we define the covariance of appropriate functions $f,g$ with respect to
a probability distribution $\pi$, by

$\mathrm{Cov}_{\pi}(f,g):=\int_{X}f(\theta)g(\theta)\pi(\mathrm{d}\theta)-\int_{X}f(\theta^{\prime})\pi(\mathrm{d}\theta^{\prime})\int_{X}g(\theta^{\prime\prime})\pi(\mathrm{d}\theta^{\prime\prime}).$

The structure of $\nabla_{\theta}F$ is surprisingly simple, requiring only
integrals of the target function and its gradient with respect to
$\pi^{\gamma,\varepsilon}$, but, e.g., not its normalising constant. In
practice, it is usually not possible to compute these integrals analytically
or to even sample independently from $\pi^{\gamma,\varepsilon}(\cdot|\theta)$,
which would be necessary for a stochastic gradient descent approach. The
latter approach first introduced by Robbins and Monro (1951) allows the
minimisation of expected values by replacing these expected values by sample
means; see also Jin et al. (2023) and Latz (2021) for continuous-time
variants. Instead, we use a particle system approach that has been studied for
a different problem by Akyildiz et al. (2023) and Kuntz et al. (2023). The
underlying idea is to approximate $\pi^{\gamma,\varepsilon}(\cdot|\theta)$ by
an overdamped Langevin dynamics which is restricted to the $\varepsilon$-Ball
$B(\varepsilon)$ with reflecting boundary conditions:

$\mathrm{d}\xi_{t}=\gamma\nabla_{\xi}\Phi(\xi_{t},\theta)\mathrm{d}t+\sqrt{2}\mathrm{d}W_{t},$

where $(W_{t})_{t\geq 0}$ denotes a standard Brownian motion on $Y$. Under
weak assumptions on $\Phi$, this Langevin dynamics converges to the
distribution $\pi^{\gamma,\varepsilon}(\cdot|\theta)$ as $t\rightarrow\infty$.
However, in practice, we are not able to simulate the longterm behaviour of
this dynamics for all fixed $\theta$ to produce samples of
$\pi^{\gamma,\varepsilon}(\cdot|\theta)$ as required for stochastic gradient
descent. Instead, we run a number $N$ of (seemingly independent) Langevin
dynamics $(\xi_{t}^{1,N})_{t\geq 0},\ldots,(\xi_{t}^{N,N})_{t\geq 0}$. We then
obtain an approximate gradient flow $(\theta_{t}^{N})_{t\geq 0}$ that uses the
ensemble of particles $(\xi_{t}^{1,N})_{t\geq 0},\ldots,(\xi_{t}^{N,N})_{t\geq
0}$ to approximate the expected values in the gradient $\nabla_{\theta}F$ and
then feed $(\theta_{t}^{N})_{t\geq 0}$ back into the drift of the
$(\xi_{t}^{1,N})_{t\geq 0},\ldots,(\xi_{t}^{N,N})_{t\geq 0}$. Hence, we
simultaneously approximate the gradient flow $(\zeta_{t})_{t\geq 0}$ by
$(\theta_{t})_{t\geq 0}$ and the Bayesian adversarial distribution
$(\pi^{\gamma,\varepsilon}(\cdot|\theta_{t}))_{t\geq 0}$ by
$(\xi_{t}^{1,N})_{t\geq 0},\ldots,(\xi_{t}^{N,N})_{t\geq 0}$. Overall, we
obtain the dynamical system

$\displaystyle\mathrm{d}\theta_{t}^{N}$
$\displaystyle=-\frac{1}{N}\sum_{n=1}^{N}\nabla_{\theta}\Phi(\xi_{t}^{n,N},\theta_{t}^{N})\mathrm{d}t-\gamma\widehat{\mathrm{Cov}}(\xi_{t}^{N})\mathrm{d}t$
$\displaystyle\mathrm{d}\xi_{t}^{i,N}$
$\displaystyle=\gamma\nabla_{\xi}\Phi(\xi_{t}^{i,N},\theta_{t})\mathrm{d}t+\sqrt{2}\mathrm{d}W_{t}^{i}\qquad(i=1,...,N).$

where $(W_{t}^{i})_{t\geq 0}$ are mutually independent Brownian motions on $Y$
for $i=1,...,N$. Again, the Langevin dynamics $(\xi_{t}^{1,N})_{t\geq
0},\ldots,(\xi_{t}^{N,N})_{t\geq 0}$ are defined on the ball $B(\varepsilon)$
with reflecting boundary conditions – we formalise this fact below. The
empirical covariance is given by

$\widehat{\mathrm{Cov}}(\xi_{t}^{N})=\frac{1}{N}\sum_{i=1}^{N}\Phi(\xi_{t}^{i,N},\theta_{t})\nabla_{\theta}\Phi(\xi_{t}^{i,N},\theta_{t})-\frac{1}{N^{2}}\sum_{i^{\prime}=1}^{K}\Phi(\xi_{t}^{i^{\prime},N},\theta_{t})\sum_{i^{\prime\prime}=1}^{K}\nabla_{\theta}\Phi(\xi_{t}^{i^{\prime\prime},N},\theta_{t}).$

We refer to the dynamical system
$(\theta^{N}_{t},\xi^{1,N}_{t},\ldots,\xi^{N,N}_{t})_{t\geq 0}$ as _Abram_. We
illustrate the dynamics of Abram in Figure 3.1, where we consider a simple
example.

Figure 3.1: Examples of the Abram method given
$\Phi(\xi,\theta)=\frac{1}{2}(\xi+\theta)^{2}$, $\varepsilon=1$, and different
combinations of $(\gamma,N)=(10,3)$ (top left), $(0.1,3)$ (top right),
$(10,50)$ (bottom left), $(0.1,50)$ (bottom right). In each of the four
quadrants, we show the simulated path $(\theta_{t}^{N})_{t\geq 0}$ (top), the
particle paths $(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})_{t\geq 0}$ (centre), and
the path of probability distributions
$(\pi^{\gamma,\varepsilon}(\cdot|\theta_{t}^{N}))_{t\geq 0}$ (bottom) that
shall be approximated by the particles. The larger $\gamma$ leads to a
concentration of $\pi^{\gamma,\varepsilon}$ at the boundary, whilst it is
closer to uniform if $\gamma$ is small. More particles lead to a more stable
path $(\theta^{N}_{t})_{t\geq 0}$. A combination of large $N$ and $\gamma$
leads to convergence to the minimiser $\theta_{*}=0$ of $F$.

We have motivated this particle system as an approximation to the underlying
gradient flow $(\zeta_{t})_{t\geq 0}$. As $N\rightarrow\infty$, the dynamics
$(\theta^{N}_{t})_{t\geq 0}$ does not necessarily convergence to the gradient
flow $(\zeta_{t})_{t\geq 0}$, but to a certain McKean–Vlasov Stochastic
Differential Equation (SDE), see McKean (1966). We study this convergence
behaviour in the following, as well as the convergence of the McKean–Vlasov
SDE to the minimiser of $F$ and, thus, justify Abram as a method for Bayesian
adversarial learning. First, we introduce the complete mathematical set-up and
give required assumptions.

###  3.1 Mean-field limit

In the following, we are interested in the mean field limit of Abram, i.e., we
analyse the limit of $(\theta^{N}_{t})_{t\geq 0}$ as $N\rightarrow\infty$.
Thus, we can certainly assume for now that $\gamma:=1$ and
$\varepsilon\in(0,1)$ being fixed. We write $B:=B(\varepsilon)$. Then, Abram
$(\theta^{N}_{t},\xi^{1,N}_{t},\ldots,\xi^{N,N}_{t})_{t\geq 0}$ satisfies

$\displaystyle\theta^{N}_{t}$
$\displaystyle=\theta_{0}-\int_{0}^{t}\mu_{c}^{N}(\nabla_{\theta}\Phi(\cdot,\theta^{N}_{s}))\mathrm{d}s-\int_{0}^{t}\mathrm{Cov}_{\mu_{c}^{N}}(\Phi(\cdot,\theta^{N}_{s}),\nabla_{\theta}\Phi(\cdot,\theta^{N}_{s}))\mathrm{d}s$
$\displaystyle\xi_{t}^{i,N}$
$\displaystyle=\xi^{i}_{0}+\int_{0}^{t}\nabla_{x}\Phi(\xi_{s}^{i,N},\theta^{N}_{s})\mathrm{d}s+\sqrt{2}W^{i}_{t}+\int_{0}^{t}n(\xi_{s}^{i,N})\mathrm{d}l^{i,N}_{s}\qquad(i=1,...,N).$
(3.1)

Here, $(W_{t}^{1})_{t\geq 0},\ldots,(W_{t}^{N})_{t\geq 0}$ are independent
Brownian motions on $Y$ and the initial particle values
$\xi^{1}_{0},\ldots,\xi^{N}_{0}$ are independent and identically distributed.
There and throughout the rest of this work, we denote the expectation of some
appropriate function $f$ with respect to a probability measure $\pi$ by
$\pi(f):=\int_{X}f(\theta)\pi(\mathrm{d}\theta).$ We use $\mu_{t}^{N}$ to
denote the empirical distribution of the particles
$(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})$ at time $t\geq 0$. That is
$\mu_{t}^{N}:=\frac{1}{N}\sum_{i=1}^{N}\delta(\cdot-{\xi_{t}^{i,N}})$, where
$\delta(\cdot-\xi)$ is the Dirac mass concentrated in $\xi\in B$. This implies
especially that we can write

$\displaystyle\mu_{t}^{N}(f)=\frac{1}{N}\sum_{i=1}^{N}f(\xi_{t}^{i,N}),\qquad\mathrm{Cov}_{\mu_{t}^{N}}(f,g)=\frac{1}{N}\sum_{i=1}^{N}f(\xi_{t}^{i,N}g(\xi_{t}^{i,N})-\frac{1}{N^{2}}\sum_{i=1}^{N}\sum_{j=1}^{N}f(\xi_{t}^{i,N})g(\xi_{t}^{j,N}),$

for appropriate functions $f$ and $g$. The particles are constrained in $B$ by
the last term in the equations of the
$(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})_{t\geq 0}$. Here,
$n(x)=-x/\left\|x\right\|$ for $x\in\partial B$ is the inner normal vector
field and $l^{i,N}$’s are a non-decreasing functions with $l^{i,N}(0)=0$ and
$\int_{0}^{t}\boldsymbol{1}[{\xi^{i,N}_{s}\notin\partial
B(\varepsilon)}]dl^{i,N}(s)=0$, see Pilipenko (2014) for details on reflecting
boundary conditions in diffusion processes. Additionally, it is convenient to
define

$\displaystyle
G(\theta,\nu)=\nabla_{\theta}\Big{[}\nu(\Phi(\cdot,\theta))+\mathrm{Var}_{\nu}[\Phi(\cdot,\theta)]/2\Big{]}=\nu(\nabla_{\theta}\Phi(\cdot,\theta))+\mathrm{Cov}_{\nu}(\Phi(\cdot,\theta),\nabla_{\theta}\Phi(\cdot,\theta)).$

for any probability measure $\nu$ on ${B}$ and $\theta\in X$.

We finish this background section by defining the limiting McKean–Vlasov SDE
with reflection

$\displaystyle\theta_{t}$
$\displaystyle=\theta_{0}-\int_{0}^{t}\mu_{s}(\nabla_{\theta}\Phi(\cdot,\theta_{s}))\mathrm{d}s-\int_{0}^{t}\mathrm{Cov}_{\mu_{s}}(\Phi(\cdot,\theta_{s}),\nabla_{\theta}\Phi(\cdot,\theta_{s}))\mathrm{d}s,$
$\displaystyle\xi_{t}$
$\displaystyle=\xi_{0}+\int_{0}^{t}\nabla_{x}\Phi(\xi_{s},\theta_{s})\mathrm{d}s+\sqrt{2}W_{t}+\int_{0}^{t}n(\xi_{s})\mathrm{d}l_{s},$
(3.2)

with $\mu_{t}$ denoting the law of $\xi_{t}$ at time $t\geq 0$. Goal of this
work is to show that the particle system (3.1) converges to this McKean-Vlasov
SDEs as $N\to\infty$ and to then show that the McKean-Vlasov SDE can find the
minimiser of $F$.

###  3.2 Assumptions

We now list assumptions that we consider throughout this work. We start with
the Lipschitz continuity of $\nabla\Phi$ and $G$.

######  Assumption 3.1 (Lipschitz)

The function $\nabla_{\xi}\Phi$ is Lipschitz continuous, i.e. there exists a
Lipschitz constant $L>1$ such that

$\displaystyle\left\|\nabla_{x}\Phi(x,\tilde{\theta})-\nabla_{x}\Phi(\tilde{x},\tilde{\theta})\right\|\leq
L\Big{(}\left\|x-\tilde{x}\right\|+\left\|\theta-\tilde{\theta}\right\|\Big{)}$

for any $\xi,\tilde{\xi}\in B$ and
$\theta,\tilde{\theta}\in{{\mathbb{R}}}^{n}$. Similarly, we assume that
$G(\theta,\mu)$ is Lipschitz in the following sense: there is an $L>1$ such
that

$\displaystyle\left\|G(\theta,\nu)-G(\tilde{\theta},\tilde{\nu})\right\|\leq
L\Big{(}\left\|\theta-\tilde{\theta}\right\|+{{\mathcal{W}}}_{1}(\nu,\tilde{\nu})\Big{)}$

for any probability measures $\nu$, $\tilde{\nu}$ on $B$ and $\theta,\
\tilde{\theta}\in{{\mathbb{R}}}^{n}.$

In Assumption 3.1 and throughout this work, ${{\mathcal{W}}}_{p}$ denotes the
_Wasserstein- $p$ distance_ given by

$\displaystyle{{\mathcal{W}}}^{p}_{p}(\nu,\nu^{\prime})=\inf\left\\{\int_{X\times
X}\left\|y-y^{\prime}\right\|^{p}\Gamma(\mathrm{d}y,\mathrm{d}y^{\prime}):\Gamma\text{
is a coupling of }\nu,\nu^{\prime}\right\\},$

for probability distributions $\nu,\nu^{\prime}$ on $(X,\mathcal{B}X)$ and
$p\geq 1$. In addition to the Wasserstein distance, we sometimes measure the
distance between probability distributions $\nu,\nu^{\prime}$ on
$(X,\mathcal{B}X)$ using the _total variation distance_ given by

$\|\nu-\nu^{\prime}\|_{{{\rm
TV}}}=\sup_{A\in\mathcal{B}X}|\nu(A)-\nu^{\prime}(A)|.$

The Lipschitz continuity of $G$ actually already implies the Lipschitz
continuity of $\nabla_{\theta}\Phi$. By setting $\nu=\delta(\cdot-x)$ and
$\tilde{\nu}=\delta(\cdot-{\tilde{x}})$, we have

$\displaystyle\left\|\nabla_{\theta}\Phi(x,\tilde{\theta})-\nabla_{\theta}\Phi(\tilde{x},\tilde{\theta})\right\|$
$\displaystyle=\left\|G(\theta,\delta(\cdot-x))-G(\tilde{\theta},\delta(\cdot-\tilde{x}))\right\|$
$\displaystyle\leq
L\Big{(}\left\|\theta-\tilde{\theta}\right\|+{{\mathcal{W}}}_{1}(\delta(\cdot-x),\delta(\cdot-\tilde{x}))\Big{)}=L\Big{(}\left\|x-\tilde{x}\right\|+\left\|\theta-\tilde{\theta}\right\|\Big{)}.$

We assume throughout that the constant $L>1$ to simplify the constants in the
Theorem 5.5. Finally, we note that Assumption 3.1 implies the well-posedness
of both (3.1) and (3.1), see Adams et al. (2022, Theorems 3.1, 3.2).

Next, we assume the strong convexity of $G$, which, as we note below, also
implies the strong convexity of $\Phi(x,\cdot)$ for any $x\in B$. This
assumption is not realistic in the context of deep learning (e.g., Choromanska
et al. (2015)), but not unusual when analysing learning techniques.

######  Assumption 3.2 (Strong convexity)

For any probability measure $\nu$ on $(B,\mathcal{B}B)$, $G(\cdot,\nu)$ is
$2\lambda$-strongly convex, i.e., for any
$\theta,\tilde{\theta}\in{{\mathbb{R}}}^{n}$, we have

$\displaystyle\left\langle
G(\theta,\nu)-G(\tilde{\theta},\nu),\theta-\tilde{\theta}\right\rangle\geq
2\lambda\left\|\theta-\tilde{\theta}\right\|^{2},$

for some $\lambda>0$.

By choosing $\nu=\delta(\cdot-\xi)$ in Assumption 3.2 for $\xi\in B,$ we have
$\mathrm{Cov}_{\nu}(\Phi(\cdot,\theta),\nabla_{\theta}\Phi(\cdot,\theta))=0$,
which implies that
$\left\langle\nabla_{\theta}\Phi(x,\theta)-\nabla_{\theta}\Phi(x,\theta^{\prime}),\theta-\theta^{\prime}\right\rangle\geq
2\lambda\left\|\theta-\theta^{\prime}\right\|^{2}$. Thus, the
$2\lambda$-strong convexity of $G$ in $\theta$ also implies the
$2\lambda$-strong convexity of $\Phi$ in $\theta$.

The assumptions collected in this sections are fairly strong, they are
satisfied in certain linear-quadratic problems on bounded domains. We
illustrate this in an example below.

###### Example 3.3

We consider a prototypical adversarial robustness problem based on the
potential $\Phi(\xi,\theta):=\left\|\xi-\theta\right\|^{2}$ with $\theta$ in a
bounded set $X^{\prime}\subseteq X$ – problems of this form appear, e.g., in
adversarially robust linear regression. Next, we are going to verify that this
problem satisfies Assumptions 3.1 and 3.2.

We have $\nabla_{\xi}\Phi(\xi,\theta)=2(\xi-\theta),$ which is Lipschitz in
both $\theta$ and $\xi$. Since

$\displaystyle\nabla_{\theta}\Phi(\xi,\theta)$ $\displaystyle=2(\xi-\theta),$
$\displaystyle\Phi(\xi,\theta)-\int_{B}\Phi(\xi,\theta)\nu(\mathrm{d}\xi)$
$\displaystyle=(\left\|\xi\right\|^{2}-\int_{B}\left\|\xi\right\|^{2}\nu(\mathrm{d}\xi))-2\theta\cdot(\xi-\int_{B}\xi\nu(\mathrm{d}\xi))$
$\displaystyle\nabla_{\theta}\Phi(\xi,\theta)-\int_{B}\nabla_{\theta}\Phi(\xi,\theta)\nu(\mathrm{d}\xi)$
$\displaystyle=-2(\xi-\int_{B}\xi\nu(\mathrm{d}\xi)),$

we have that

$\displaystyle
G(\theta,\nu)=2\theta-2{{\mathbb{E}}}_{\nu}[\xi]+4\theta\cdot\mathrm{Var}_{\nu}(\xi)-2\mathrm{Cov}_{\nu}(\left\|\xi\right\|^{2},\xi),$

where ${{\mathbb{E}}}_{\nu}[\xi]=\int_{B}\xi\nu(\mathrm{d}\xi)$ and
$\mathrm{Cov}_{\nu}(\left\|\xi\right\|^{2},\xi)=\int_{B}(\left\|\xi\right\|^{2}-{{\mathbb{E}}}_{\nu}[\left\|\xi\right\|^{2}])(\xi-{{\mathbb{E}}}_{\nu}[\xi])\nu(\mathrm{d}\xi)$.
Since the ${\varepsilon}$-ball and $\theta\in X^{\prime}$ are bounded, we have
that $G(\theta,\nu)$ is Lipschitz in both $\theta$ and $\nu$. Thus, it
satisfies Assumption 3.1. In order to make $G(\theta,\nu)$ satisfy Assumption
3.2, we choose ${\varepsilon}$ small enough such that the term
$4\theta\cdot\mathrm{Var}_{\nu}(\xi)$ is $1$-Lipschitz. In this case, we can
verify that $\left\langle
G(\theta,\nu)-G(\theta^{\prime},\nu),\theta-\theta^{\prime}\right\rangle\geq\left\|\theta-\theta^{\prime}\right\|^{2}$
and, thus, Assumption 3.2.

##  4 Propagation of chaos

We now study the large particle limit ($N\to\infty$) of the Abram dynamics
$\eqref{main}$. When considering a finite time interval $[0,T]$, we see that
the particle system $\eqref{main}$ approximates the McKean-Vlasov SDE (3.1) in
this limit. We note that we assume in the following that $0<\varepsilon<1$.
Moreover, we use the Wasserstein-$2$ distance instead of Wasserstein-$1$
distance in Assumption 3.1. We have
${{\mathcal{W}}}_{1}(\nu,\nu^{\prime})\leq{{\mathcal{W}}}_{2}(\nu,\nu^{\prime})$
for any probability measures $\nu,\nu^{\prime}$ for which the distances are
finite, see Villani (2009). Thus, convergence in ${{\mathcal{W}}}_{2}$ also
implies convergence in ${{\mathcal{W}}}_{1}$. We now state the main
convergence result.

###### Theorem 4.1

Let Assumption 3.1 hold. Then, there is a constant $C_{d,T}>0$ such that for
all $T\geq 0$ and $N\geq 1$ we have the following inequality

$\displaystyle\sup_{t\in[0,T]}{{\mathbb{E}}}\big{[}\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}+{{\mathcal{W}}}^{2}_{2}(\mu_{t}^{N},\mu_{t})\big{]}\leq
C_{d,T}N^{-\alpha_{d}},$

where $\alpha_{d}=2/d$ for $d>4$ and $\alpha_{d}=1/2$ for $d\leq 4.$

Hence, we obtain convergence of both the gradient flow approximation
$(\theta^{N}_{t})_{t\geq 0}$ and the particle approximation $(\mu_{t}^{N})$ to
the respective components in the McKean-Vlasov SDE. We prove this result by a
coupling method. To this end, we first collect a few auxiliary results:
studying the large sample limit of an auxiliary particle system and the
distance of the original particle system to the auxiliary system. To this end,
we sample $N$ trajectories of $(\xi_{t})_{t\geq 0}$ from equations (3.1) as

$\displaystyle\xi^{i}_{t}$
$\displaystyle=\xi^{i}_{0}+\int_{0}^{t}\nabla_{x}\Phi(\xi^{i}_{s},\theta_{s})\mathrm{d}s+\sqrt{2}W^{i}_{t}+\int_{0}^{t}n(\xi^{i}_{s})\mathrm{d}l^{i}_{s}\qquad(i=1,\ldots,N),$
(4.1)

where the Brownian motions $(W_{t}^{1},\dots,W_{t}^{N})_{t\geq 0}$ are the
ones from (3.1). Of course these sample paths
$(\xi_{t}^{1},\ldots,\xi_{t}^{N})_{t\geq 0}$ are different from the
$(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})_{t\geq 0}$ in equation (3.1): Here,
$(\theta_{t})_{t\geq 0}$ only depends on the law of $(\xi_{t})_{t\geq 0}$
whereas $(\theta_{t}^{N})_{t\geq 0}$ depends on position of the particles
$(\xi^{i,N}_{t})_{t\geq 0}$. As the $(\xi_{t}^{1})_{t\geq
0},\ldots,(\xi_{t}^{N})_{t\geq 0}$ are i.i.d., we can apply the empirical law
of large numbers from Fournier and Guillin (2015) and get the following
result.

###### Proposition 4.2

Let Assumption 3.1 hold. Then,

$\sup_{t\geq
0}{{\mathbb{E}}}\Big{[}{{\mathcal{W}}}^{2}_{2}\Big{(}N^{-1}\sum^{N}_{i=1}\delta_{\xi_{t}^{i}},\mu_{t}\Big{)}\Big{]}\leq
C_{d}N^{-\alpha_{d}}.$

For any $i=1,\ldots,N$, we are now computing bounds for the pairwise distances
between $\xi^{i}_{t}$ and $\xi_{t}^{i,N}$ for $t\geq 0$. We note again that
these paths are pairwise coupled through the associated Brownian motions
$(W_{t}^{i})_{t\geq 0}$, respectively.

###### Lemma 4.3

Let Assumption 3.1 hold. Then,

$\displaystyle\left\|\xi_{t}^{i,N}-\xi_{t}^{i}\right\|^{2}\leq
2L\int_{0}^{t}\Big{[}\left\|\xi_{s}^{i,N}-\xi_{s}^{i}\right\|^{2}+\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\Big{]}\mathrm{d}s\qquad(i=1,\ldots,N),$

for $t\in[0,T]$.

###### Proof.

We apply Itô’s formula to $\left\|\xi_{t}^{i,N}-\xi_{t}^{i}\right\|^{2}$,

$\displaystyle\left\|\xi_{t}^{i,N}-\xi_{t}^{i}\right\|^{2}=2\underbrace{\int_{0}^{t}\left\langle\xi_{s}^{i,N}-\xi_{s}^{i},\nabla_{x}\Phi(\xi^{i,N}_{s},\theta^{N}_{s})-\nabla_{x}\Phi(\xi^{i}_{s},\theta_{s})\right\rangle\mathrm{d}s}_{(I1)}$
$\displaystyle+\underbrace{2\int_{0}^{t}\left\langle
n(\xi^{i,N}_{s}),\xi_{s}^{i,N}-\xi_{s}^{i}\right\rangle\mathrm{d}l^{i,N}_{s}-2\int_{0}^{t}\left\langle
n(\xi^{i}_{s}),\xi_{s}^{i,N}-\xi_{s}^{i}\right\rangle\mathrm{d}l^{i}_{s}}_{(I2)}.$

We first argue that $(I2)\leq 0.$ Recall that $n(x)=-x/\left\|x\right\|$ and
that the processes $(\xi^{i,N}_{t})_{t\geq 0}$ and $(\xi^{i}_{t})_{t\geq 0}$
take values in the $\varepsilon$-ball $B$ with $\varepsilon<1$. Then, we have

$\displaystyle 2\int_{0}^{t}\left\langle
n(\xi^{i,N}_{s}),\xi_{s}^{i,N}-\xi_{s}^{i}\right\rangle\mathrm{d}l^{i,N}_{s}$
$\displaystyle=2\int_{0}^{t}\left\langle
n(\xi^{i,N}_{s}),\xi_{s}^{i,N}\right\rangle\mathrm{d}l^{i,N}_{s}-2\int_{0}^{t}\left\langle
n(\xi^{i,N}_{s}),\xi_{s}^{i}\right\rangle\mathrm{d}l^{i,N}_{s}$
$\displaystyle=-2{\varepsilon}l^{i,N}_{t}-2\int_{0}^{t}\left\langle
n(\xi^{i,N}_{s}),\xi_{s}^{i}\right\rangle\mathrm{d}l^{i,N}_{s}\leq-2{\varepsilon}l^{i,N}_{t}+2{\varepsilon}\int_{0}^{t}\mathrm{d}l^{i,N}_{s}=0.$

Similarly, we have

$\displaystyle-2\int_{0}^{t}\left\langle
n(\xi^{i}_{s}),\xi_{s}^{i,N}-\xi_{s}^{i}\right\rangle\mathrm{d}l^{i}_{s}=2\int_{0}^{t}\left\langle
n(\xi^{i}_{s}),\xi_{s}^{i}-\xi_{s}^{i,N}\right\rangle\mathrm{d}l^{i}_{s}\leq
0.$

Hence, we have $(I2)\leq 0.$

For $(I1)$, due to Assumption 3.1 and, again, due to the boundedness of $B,$
we have

$\displaystyle(I1)$ $\displaystyle\leq
L\int_{0}^{t}\left\|\xi_{s}^{i,N}-\xi_{s}^{i}\right\|\Big{[}\left\|\xi_{s}^{i,N}-\xi_{s}^{i}\right\|+\left\|\theta_{s}^{N}-\theta_{s}\right\|\Big{]}\mathrm{d}s\leq
2L\int_{0}^{t}\Big{[}\left\|\xi_{s}^{i,N}-\xi_{s}^{i}\right\|^{2}+\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\Big{]}\mathrm{d}s.$

∎

Finally, we study the distance between $\theta_{t}^{N}$ and $\theta_{t}$ for
$t\geq 0$.

###### Lemma 4.4

Let Assumption 3.1 hold. Then, we have

$\displaystyle\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}\leq
3L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\mathrm{d}s+\frac{2L}{N}\sum^{N}_{i=1}\int_{0}^{t}\left\|\xi^{i,N}_{s}-\xi_{s}^{i}\right\|^{2}\mathrm{d}s+2L\int_{0}^{t}{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})\mathrm{d}s,$

for $t\in[0,T].$

###### Proof.

Due to Assumption 3.1 and since
${{\mathcal{W}}}_{1}(\mu^{N}_{s},\mu_{s})\leq{{\mathcal{W}}}_{2}(\mu^{N}_{s},\mu_{s})$,
we have

$\displaystyle\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}=$
$\displaystyle-2\int_{0}^{t}\left\langle\theta_{s}^{N}-\theta_{s},G(\theta_{s}^{N},\mu^{N}_{s})-G(\theta_{s},\mu_{s})\right\rangle\mathrm{d}s$
$\displaystyle\leq
2L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|\Big{(}\left\|\theta_{s}^{N}-\theta_{s}\right\|+{{\mathcal{W}}}_{2}(\mu^{N}_{s},\mu_{s})\Big{)}\mathrm{d}s$
$\displaystyle\leq
2L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\mathrm{d}s+2L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|{{\mathcal{W}}}_{2}(\mu^{N}_{s},\mu_{s})\mathrm{d}s$
$\displaystyle\leq
3L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\mathrm{d}s+L\int_{0}^{t}{{\mathcal{W}}}^{2}_{2}(\mu^{N}_{s},\mu_{s})\mathrm{d}s.$
(4.2)

The triangle inequality implies that

$\displaystyle{{\mathcal{W}}}^{2}_{2}(\mu^{N}_{s},\mu_{s})\leq
2{{\mathcal{W}}}^{2}_{2}(\mu^{N}_{s},N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}})+2{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})$
$\displaystyle\leq\frac{2}{N}\sum^{N}_{i=1}\left\|\xi^{i,N}_{s}-\xi_{s}^{i}\right\|^{2}+2{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s}).$
(4.3)

Combining (4) and (4), we obtain

$\displaystyle\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}\leq
3L\int_{0}^{t}\left\|\theta_{s}^{N}-\theta_{s}\right\|^{2}\mathrm{d}s+\frac{2L}{N}\sum^{N}_{i=1}\int_{0}^{t}\left\|\xi^{i,N}_{s}-\xi_{s}^{i}\right\|^{2}\mathrm{d}s+2L\int_{0}^{t}{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})\mathrm{d}s.$

∎

We now proceed to the proof of Theorem 4.1.

  * Proof of Theorem 4.1.

We commence by constructing an upper bound for

$u_{t}^{N}:=N^{-1}\sum^{N}_{i=1}\left\|\xi^{i,N}_{t}-\xi_{t}^{i}\right\|^{2}+\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}.$

From Lemma 4.3 and Lemma 4.4, we have

$\displaystyle u_{t}^{N}$ $\displaystyle\leq
5L\int_{0}^{t}u_{s}^{N}\mathrm{d}s+2L\int_{0}^{t}{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})\mathrm{d}s.$

Grönwall’s inequality implies that

$\displaystyle u_{t}^{N}\leq
2Le^{5Lt}\int_{0}^{t}{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})\mathrm{d}s.$

According to Proposition 4.2, we have

$\displaystyle{{\mathbb{E}}}[u_{t}^{N}]\leq
2Le^{5Lt}\int_{0}^{t}{{\mathbb{E}}}[{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s})]\mathrm{d}s\leq
2C_{d}Le^{(1+5L)t}N^{-\alpha_{d}},$

whereas (4) implies

$\displaystyle\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}+{{\mathcal{W}}}^{2}_{2}(\mu^{N}_{s},\mu_{s})\leq
u_{t}^{N}+2{{\mathcal{W}}}^{2}_{2}(N^{-1}\sum^{N}_{i=1}\delta_{\xi_{s}^{i}},\mu_{s}).$

Therefore,

$\displaystyle\sup_{t\in[0,T]}{{\mathbb{E}}}\big{[}\left\|\theta_{t}^{N}-\theta_{t}\right\|^{2}+{{\mathcal{W}}}^{2}_{2}(\mu_{t}^{N},\mu_{t})\big{]}\leq\sup_{t\in[0,T]}{{\mathbb{E}}}[u_{t}^{N}]+\sup_{t\in[0,T]}{{\mathbb{E}}}\big{[}{{\mathcal{W}}}^{2}_{2}(\mu_{t}^{N},\mu_{t})\big{]}\leq
C_{d,T}N^{-\alpha_{d}},$

where $C_{d,T}=2C_{d}(1+Le^{(1+5L)t}).$

$\hfill\Box$

##  5 Longtime behaviour of the McKean-Vlasov process

Theorem 4.1 implies that the gradient flow approximation in Abram
$(\theta_{t}^{N})_{t\geq 0}$ converges to the corresponding part of the
McKean–Vlasov SDE $(\theta_{t})_{t\geq 0}$ given in (3.1). In this section, we
show that this McKean-Vlasov SDE is able to find the minimiser $\theta_{*}$ of
$F=\int\Phi(\xi,\cdot)\pi^{\gamma,\varepsilon}(\mathrm{d}\xi|\cdot).$ This,
thus, gives us a justification to use Abram to solve the Bayesian adversarial
robustness problem. We start by showing that $F$ admits a minimiser.

###### Proposition 5.1

Let Assumptions 3.1 and 3.2 hold. Then, $F$ admits at least one minimiser in
$X$.

###### Proof.

We first argue that $F$ is bounded below and obtains a minumum at some point
$\theta_{*}.$ From Subsection 3.2, we already know that $\Phi(0,\theta)$ is
$2\lambda$ strongly convex in $\theta$. Without loss of generality, we assume
$\Phi(0,0)=0$ and $\nabla_{\theta}\Phi(0,0)=0$, that is $\Phi(0,\theta)$
reaches its minimum $0$ at $\theta_{*}=0.$ Since $\Phi(\xi,\cdot)$ is
$2\lambda$ strongly convex for any $\xi\in B$, we have that

$\displaystyle\Phi(\xi,\theta)\geq\Phi(\xi,0)+\theta\cdot\nabla_{\theta}\Phi(\xi,0)+\lambda\left\|\theta\right\|^{2}.$
(5.1)

Assumption 3.1 implies that,

$\left\|\nabla_{\theta}\Phi(\xi,0)\right\|=\left\|\nabla_{\theta}\Phi(\xi,0)-\nabla_{\theta}\Phi(0,0)\right\|\leq
L\left\|\xi\right\|\leq L$

and

$\left|\Phi(\xi,0)\right|=\left|\Phi(\xi,0)-\Phi(0,0)\right|\leq\sup_{\zeta\in
B}\left\|\nabla_{\xi}\Phi(\zeta,0)\right\|\left\|\xi\right\|\leq(L+C_{0})\left\|\xi\right\|\leq
L+C_{0},$

where $C_{0}=\left\|\nabla_{\xi}\Phi(0,0)\right\|.$ Therefore, we have
$\Phi(\xi,\theta)\geq-L-
C_{0}-L\left\|\theta\right\|+\lambda\left\|\theta\right\|^{2},$ which is
bounded below by $-L-C_{0}-\frac{L^{2}}{4\lambda}.$ Thus, $F$ is bounded below
by the same value. We can always choose some $R_{0}=R_{0}(L,\lambda,C_{0})$,
such that for $\left\|\theta\right\|\geq R_{0},$ $\Phi(\xi,\theta)\geq
C_{0}+L$. Moreover, we already have $\Phi(\xi,0)\leq L+C_{0}.$ Thus,
$F(\theta)\geq C_{0}+L$ when $\left\|\theta\right\|\geq R_{0}$ and $F(0)\leq
C_{0}+L$. Hence $F$ attains its minimum on the $R_{0}$-ball $\\{\theta\in
X:\left\|\theta\right\|\leq R_{0}\\}.$ ∎

Before stating the main theorem of this section – the convergence of the
McKean-Vlasov SDE to the minimiser of $F$ – we need to introduce additional
assumptions.

######  Assumption 5.2 (Neumann Boundary Condition)

Let $\Phi(\cdot,\theta)$ satisfy a Neumann boundary condition on $\partial B,$

$\displaystyle\frac{\partial_{\xi}\Phi(\xi,\theta)}{\partial
n}=\nabla_{\xi}\Phi(\xi,\theta)\cdot n(\xi)=0,$

for any $\theta\in X.$

For a general function $\Phi$ defined on $B$, this assumption can be satisfied
by smoothly extending $\Phi$ on $B^{\prime}$ with radius $2{\varepsilon}$ such
that it vanishes near the boundary of $B^{\prime}$. We shall see that this
assumption guarantees the existence of the invariant measure of the auxiliary
dynamical system (5.3) that we introduce below.

######  Assumption 5.3 (Small-Lipschitz)

For any probability measures $\nu$, $\tilde{\nu}$ on $B$ and
$\theta\in{{\mathbb{R}}}^{n},$

$\displaystyle\left\|G(\theta,\nu)-G(\theta,\tilde{\nu})\right\|\leq\ell\left\|\nu-\tilde{\nu}\right\|_{{{\rm
TV}}},$

where
$\ell=(\frac{(\delta\land\lambda)\sqrt{\lambda}e^{-t_{0}}}{4\sqrt{2}CL})\land(\frac{\sqrt{\lambda}}{\sqrt{2}L})$
and $t_{0}=t_{0}(\delta,\lambda,C)=(\delta\land\lambda)^{-1}\log(4C)$. The
constants $\delta$ and $C$ appear in Proposition 5.6.

Equivalently, we may say this assumption requires $G$ to have a small enough
Lipschitz constant. If ${\varepsilon}$ (the radius of $B$) is very small, this
assumption is implied by Assumption 3.1, since
${{\mathcal{W}}}_{1}(\nu,\tilde{\nu})\leq{\varepsilon}^{d}\int_{B}\int_{B}\boldsymbol{1}_{x\neq
y}\pi(\mathrm{d}x,\mathrm{d}y)={\varepsilon}^{d}\left\|\nu-\tilde{\nu}\right\|_{{{\rm
TV}}}.$

We illustrate these assumptons again in the linear-quadratic problem that we
considered in Example 3.3 and show that Assumptions 5.2 and 5.3 can be
satisfied in this case.

######  Example 5.4 (Example 3.3 continued)

We consider again $\Phi(\xi,\theta)=\left\|\xi-\theta\right\|^{2}$ with
$\theta$ in a bounded $X^{\prime}\subseteq X$. Unfortunately, $\Phi$ does not
satisfy Assumption 5.2, since the term $(\xi-\theta)\cdot\xi$ is not necessary
to be $0$ on the boundary of $B$. Instead, we study a slightly larger ball by
considering $\widehat{\varepsilon}=2\varepsilon$ instead of $\varepsilon$ and
also replace $\Phi$ by
$\widehat{\Phi}(x,\theta)=\left\|m(\xi)-\theta\right\|^{2},$ where
$m:{{\mathbb{R}}}^{d}\to{{\mathbb{R}}}^{d}$ is smooth and equal to $\xi$ on
the ${\varepsilon}$-ball and vanishes near the boundary of the
$2{\varepsilon}$-ball. Since $m(x)$ varnishes near the boundary of
$2{\varepsilon}$-ball, $\widehat{\Phi}$ satisfies Assumption 5.2.

We note that
$\nabla_{\xi}\widehat{\Phi}(\xi,\theta)=2D_{\xi}m(\xi)(m(\xi)-\theta).$ Hence,
$\nabla_{\xi}\widehat{\Phi}$ is Lipschitz in both $\theta$ and $\xi$ which
directly follows from the boundedness and Lipschitz continuity of $m$,
$D_{\xi}m$. Analogously to Example 3.3, we have

$\displaystyle
G(\theta,\nu)=2\theta-2{{\mathbb{E}}}_{\nu}[m(\xi)]+4\theta\cdot\mathrm{Var}_{\nu}(m(\xi))-2\mathrm{Cov}_{\nu}(\left\|m(\xi)\right\|^{2},m(\xi))$

and also see that it still satisfies Assumptions 3.1, 3.2 when $\theta$ is
bounded and ${\varepsilon}$ is small. Finally, Assumption 5.3 is satisfied if
${\varepsilon}$ is chosen to be sufficiently small.

We are now able to state the main convergence theorem of this section.
Therein, we still consider $\theta_{*}$ to be a minimizer of function of $F$.

###### Theorem 5.5

Let Assumptions 3.1, 3.2, 5.2, and 5.3 hold and let
$(\theta_{t},\mu_{t})_{t\geq 0}$ be the solution to the McKean-Vlasov SDE
(3.1). Then, there are constants $\eta>0$ and $\tilde{C}>0$ with which we have

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}+\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\leq\tilde{C}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}e^{-\eta t}.$ (5.2)

We can see this result as both a statement about the convergence of
$(\theta_{t}^{N})_{t\geq 0}$ to the minimiser, but also as an ergodicity
statement about $(\theta_{t}^{N},\xi_{t})_{t\geq 0}$. The ergodicity of a
McKean-Vlasov SDE with reflection has also been subject of Theorem 3.1 in Wang
(2023). In their work, the process is required to have a non-degenerate
diffusion term. Hence, their result does not apply immediately, since the
marginal $(\theta_{t})_{t\geq 0}$ is deterministic (conditionally on
$(\xi_{t})_{t\geq 0}$). Our proof ideas, however, are still influenced by Wang
(2023).

We note additionally that Theorem 5.5 implies the uniqueness of the minimiser
$\theta_{*}$ – we had only shown existence in Proposition 5.1: If there exists
another minimizer $\theta_{*}^{\prime}$, then the dynamics (3.1) is invariant
at
$(\theta_{0},\xi_{0})\sim\delta_{\theta_{*}^{\prime}}\otimes\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}^{\prime}})$,
which means
$(\theta_{t},\xi_{t})\sim\delta_{\theta_{*}^{\prime}}\otimes\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}^{\prime}})$
for all $t\geq 0.$ Hence, we have
$\left\|\theta^{\prime}_{*}-\theta_{*}\right\|\leq\tilde{C}\left\|\theta^{\prime}_{*}-\theta_{*}\right\|e^{-\eta
t}$. The right-hand side vanishes as $t\to\infty,$ which implies
$\theta_{*}^{\prime}=\theta_{*}.$

In order to prove Theorem 5.5, we first consider the case where
$\theta_{t}\equiv\theta_{*}$, i.e.,

$\displaystyle\widehat{\xi}_{t}$
$\displaystyle=\xi_{0}+\int_{0}^{t}\nabla_{x}\Phi(\widehat{\xi}_{s},\theta_{*})\mathrm{d}s+\sqrt{2}W_{t}+\int_{0}^{t}\nu(\widehat{\xi}_{s})\mathrm{d}\widehat{l}_{s}.$
(5.3)

We denote the law of $\widehat{\xi}_{t}$ by $\widehat{\mu}_{t}$, $t\geq 0$.
Motivated by Wang (2023), we first show the exponential ergodicity for the
process $(\widehat{\xi}_{t})_{t\geq 0}$.

###### Proposition 5.6

Let Assumptions 3.1 and 5.2 hold. Then, $(\widehat{\xi}_{t})_{t\geq 0}$
defined in (5.3) is well-posed and admits an unique invariant measure
$\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}}).$ Moreover,
$(\widehat{\xi}_{t})_{t\geq 0}$ is exponentially ergodic. In particular, there
exist $C,\delta>0,$ such that

$\displaystyle\left\|\widehat{\mu}_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\leq
C\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}e^{-\delta t}.$

###### Proof.

The well-posedness and exponential ergodicity is a direct corollary of Wang
(2023, Theorem 2.3). We only need to verify that
$\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})$ is invariant under the dynamics
(5.3). We know that the probability distributions $(\widehat{\mu}_{t})_{t\geq
0}$ satisfies the following linear PDE with Neumann boundary condition

$\displaystyle\partial_{t}\widehat{\mu}_{t}=\Delta\widehat{\mu}_{t}-\mathrm{div}(\widehat{\mu}_{t}\nabla_{\xi}\Phi(\xi,\theta_{*})),\qquad\frac{\partial\widehat{\mu}_{t}}{\partial
n}\Big{|}_{\partial B}=0.$

So any invariant measure of the dynamics (5.3) is a probability distribution
that solves the following stationary PDE

$\displaystyle\Delta\widehat{\mu}-\mathrm{div}(\widehat{\mu}\nabla_{\xi}\Phi(\xi,\theta_{*}))=0,\qquad\frac{\partial\widehat{\mu}}{\partial
n}\Big{|}_{\partial B}=0.$

Now, $\widehat{\mu}=\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})$ is a basic
result in the theory of Langevin SDEs on with reflection, see, e.g., Sato et
al. (2024). ∎

Most of the time, we are not able to quantify the constants $C$ and $\delta$:
the Harris-like theorem from Wang (2023) is not quantitative. A special case
in which we can quantify $C$ and $\delta$ is when the potential separates in
the sense that
$\nabla_{\xi}\Phi(\xi,\theta_{*})=(f_{1}(\xi_{1},\theta_{*}),...,f_{d_{Y}}(\xi_{d_{Y}},\theta_{*}))$.
Then (5.3) can be viewed as $d_{Y}$ independent reflection SDEs. If we denote
their ergodicity constants as $C_{i}$ and $\delta_{i}$ for $i=1,...,d_{Y}$,
then Jin et al. (2023, Proof of Proposition 1) implies that we can choose
$C:=\sum_{i=1}^{d}C_{i}$ and $\delta:=\min_{i=1,...,d}\delta_{i}$.

Next, we bound the distance $\left\|\mu_{t}-\widehat{\mu}_{t}\right\|_{{{\rm
TV}}}$ by Girsanov’s theorem – a classical way to estimate the distance
between two SDEs with different drift terms. This is again motivated by Wang
(2023, proof of Lemma 3.2). There, the method is used to bound the distance
between two measure-dependent SDEs. In our case, it also involves the state
$\theta_{t}$, which depends on $t.$ Hence, the right-hand side depends on the
path of $(\theta_{s})_{0\leq s\leq t}.$

###### Lemma 5.7

Let Assumption 3.1 hold. Then, we have

$\displaystyle\left\|\mu_{t}-\widehat{\mu}_{t}\right\|^{2}_{{{\rm TV}}}\leq
L^{2}\int_{0}^{t}\left\|\theta_{s}-\theta_{*}\right\|^{2}\mathrm{d}s.$

###### Proof.

We follow the same idea as Wang (2023, proof of Lemma 3.2). In our case, we
need to choose

$\displaystyle
Z_{t}=\exp\Big{(}\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}W_{s}-\frac{1}{2}\int_{0}^{t}\left\|z(\theta_{*},\theta_{s},\xi_{s})\right\|^{2}\mathrm{d}s\Big{)},$

where
$z(\theta_{*},\theta,x)=(\nabla_{x}\Phi(x,\theta)-\nabla_{x}\Phi(x,\theta_{*}))/\sqrt{2}$.
(Le Gall, 2013, Proposition 5.6) implies that the process $(Z_{t})_{t\geq 0}$
is a martingale due to $z(\theta_{*},\theta_{s},\xi_{s})$ being bounded and
$\int_{0}^{t}\left\|z(\theta_{*},\theta_{s},\xi_{s})\right\|^{2}\mathrm{d}s$
being the quadratic variation process of
$\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}W_{s}$.

We define the probability measure $\mathbb{Q}_{t}:=Z_{t}{{\mathbb{P}}},$ i.e.
$\mathbb{Q}_{t}(A):={{\mathbb{E}}}[Z_{t}\boldsymbol{1}_{A}]$ for any
$\mathcal{F}_{t}$-measurable set $A$. And we notice that the quadratic
covariation between
$\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}W_{s}$ and $W_{t}$
is given by

$\displaystyle\left\langle\int_{0}^{.}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}W_{s},W_{.}\right\rangle_{t}=\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\mathrm{d}s.$

Hence by Girsanov’s theorem (see (Le Gall, 2013, Theorem 5.8, Conséquences
(c))),
$\tilde{W}_{t}:=W_{t}-\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\mathrm{d}s$
is a Brownian motion under $\mathbb{Q}_{t}$ with the same filtration
$\mathcal{F}_{t}$.

We rewrite (3.1) as

$\displaystyle\xi_{t}$
$\displaystyle=\xi_{0}+\int_{0}^{t}\nabla_{x}\Phi(\xi_{s},\theta_{*})\mathrm{d}s+\sqrt{2}\tilde{W}_{t}+\int_{0}^{t}n(\xi_{s})\mathrm{d}l_{s},$

which has the same distribution as $\widehat{\xi}_{t}$ under $\mathbb{Q}_{t}.$
Hence

$\displaystyle\left\|\mu_{t}-\widehat{\mu}_{t}\right\|_{{{\rm TV}}}=$
$\displaystyle\sup_{\left|f\right|\leq
1}\left|{{\mathbb{E}}}[f(\xi_{t})]-{{\mathbb{E}}}[f(\xi_{t})Z_{t}]\right|\leq{{\mathbb{E}}}[\left|Z_{t}-1\right|]$
$\displaystyle\leq$ $\displaystyle
2{{\mathbb{E}}}[R_{t}\log(R_{t})]^{\frac{1}{2}}=2{{\mathbb{E}}}_{Q_{t}}\Big{[}\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}W_{s}-\frac{1}{2}\int_{0}^{t}\left\|z(\theta_{*},\theta_{s},\xi_{s})\right\|^{2}\mathrm{d}s\Big{]}^{\frac{1}{2}}$
$\displaystyle=$ $\displaystyle
2{{\mathbb{E}}}_{Q_{t}}\Big{[}\int_{0}^{t}z(\theta_{*},\theta_{s},\xi_{s})\cdot\mathrm{d}\tilde{W}_{s}+\frac{1}{2}\int_{0}^{t}\left\|z(\theta_{*},\theta_{s},\xi_{s})\right\|^{2}\mathrm{d}s\Big{]}^{\frac{1}{2}}$
$\displaystyle=$
$\displaystyle\sqrt{2}{{\mathbb{E}}}_{Q_{t}}\Big{[}\int_{0}^{t}\left\|z(\theta_{*},\theta_{s},\xi_{s})\right\|^{2}\mathrm{d}s\Big{]}^{\frac{1}{2}}\leq
L\Big{(}\int_{0}^{t}\left\|\theta_{s}-\theta_{*}\right\|^{2}\mathrm{d}s\Big{)}^{\frac{1}{2}}$

where the first “$\leq$” is implied by Pinsker’s inequality. ∎

Using these auxiliary results, we can now formulate the proof of Theorem 5.5.

  * Proof of Theorem 5.5.

We take the time derivative of $\left\|\theta_{t}-\theta_{*}\right\|^{2},$

$\displaystyle\frac{\mathrm{d}\left\|\theta_{t}-\theta_{*}\right\|^{2}}{\mathrm{d}t}=$
$\displaystyle-\left\langle
G(\theta_{t},\mu_{t})-G(\theta_{*},\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})),\theta_{t}-\theta_{*}\right\rangle$
$\displaystyle\leq-2\lambda\left\|\theta_{t}-\theta_{*}\right\|^{2}+\ell\left\|\theta_{t}-\theta_{*}\right\|\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|_{{{\rm
TV}}}$
$\displaystyle\leq-\lambda\left\|\theta_{t}-\theta_{*}\right\|^{2}+\frac{\ell^{2}}{\lambda}\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}},$

where the first “$\leq$” is due to the $\varepsilon$-Young’s inequality. This
implies

$\frac{\mathrm{d}(e^{\lambda
t}\left\|\theta_{t}-\theta_{*}\right\|^{2})}{\mathrm{d}t}\leq\frac{\ell^{2}}{\lambda}e^{\lambda
t}\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}},$

Hence, we have

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}\leq e^{-\lambda
t}\left\|\theta_{0}-\theta_{*}\right\|^{2}+\frac{\ell^{2}}{\lambda}\int_{0}^{t}\left\|\mu_{s}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\mathrm{d}s.$ (5.4)

Then, using the triangle inequality, we see that

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}+m\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}$
$\displaystyle\leq\underbrace{\left\|\theta_{t}-\theta_{*}\right\|^{2}}_{\eqref{ineq:
theta-
theta}}+\underbrace{2m\left\|\mu_{t}-\widehat{\mu}_{t}\right\|^{2}_{{{\rm
TV}}}}_{\text{Lemma }\ref{lem:
hatmu}}+\underbrace{2m\left\|\widehat{\mu}_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}}_{\text{Proposition }\ref{prop: FY2}}$
$\displaystyle\leq\int_{0}^{t}\Big{(}\frac{\ell^{2}}{\lambda}\left\|\mu_{s}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}+2mL^{2}\left\|\theta_{s}-\theta_{*}\right\|^{2}\Big{)}\mathrm{d}s$
$\displaystyle\qquad+2C\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}e^{-(\delta\land\lambda)t}.$

Let $m=m(\ell,L,\lambda)=\frac{\ell}{L\sqrt{2\lambda}}$, we conclude from the
above inequality that

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}+m\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}$ $\displaystyle\leq
2mL^{2}\int_{0}^{t}\Big{(}m\left\|\mu_{s}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}+\left\|\theta_{s}-\theta_{*}\right\|^{2}\Big{)}\mathrm{d}s$
$\displaystyle\qquad+2C\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}e^{-(\delta\land\lambda)t}.$

Hence, by Grönwall’s inequality, we have

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}$
$\displaystyle+m\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}$ $\displaystyle\leq
C\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}\Big{(}2mL^{2}\int_{0}^{t}e^{2mL^{2}(t-s)}e^{-(\delta\land\lambda)s}\mathrm{d}s+e^{-(\delta\land\lambda)t}\Big{)}$
$\displaystyle=C\Big{(}\frac{2mL^{2}}{2mL^{2}+\delta\land\lambda}(e^{2mL^{2}t}-e^{-(\delta\land\lambda)t})+e^{-(\delta\land\lambda)t}\Big{)}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}$ $\displaystyle\leq
C\Big{(}\frac{2mL^{2}}{\delta\land\lambda}e^{2mL^{2}t}+e^{-(\delta\land\lambda)t}\Big{)}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}$ $\displaystyle\leq
C_{t,L,\ell,\lambda}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)},$ (5.5)

where
$C_{t,L,\ell,\lambda}=C\Big{(}\frac{2mL^{2}}{\delta\land\lambda}e^{2mL^{2}t}+e^{-(\delta\land\lambda)t}\Big{)}.$
According to Assumption 5.3, we know that $2mL^{2}=\frac{\ell
L\sqrt{2}}{\sqrt{\lambda}}\leq 1$. Next, we are going to show that
$0<C_{t_{0},L,\ell,\lambda}\leq 1/2$ for
$t_{0}=t_{0}(\delta,\lambda,C)=(\delta\land\lambda)^{-1}\log(4C).$ Again, from
Assumption 5.3, we know
$\frac{2mL^{2}}{\delta\land\lambda}e^{t_{0}}\leq\frac{1}{4C}$. Hence we
finally have,

$\displaystyle C_{t_{0},L,\ell,\lambda}\leq
C\frac{2mL^{2}}{\delta\land\lambda}e^{t_{0}}+Ce^{-(\delta\land\lambda)t_{0}}\leq\frac{1}{2}.$

For any $t\geq 0,$ we always have $[\frac{t}{t_{0}}]t_{0}\leq
t<[\frac{t}{t_{0}}]t_{0}+t_{0},$ where $[x]$ denotes the greatest integer
$\leq x.$ Hence,

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}+m\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}$ $\displaystyle\leq
2^{-[\frac{t}{t_{0}}]}\Big{(}\left\|\theta_{t-[\frac{t}{t_{0}}]t_{0}}-\theta_{*}\right\|^{2}+m\left\|\mu_{t-[\frac{t}{t_{0}}]t_{0}}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}$ $\displaystyle\leq 2^{-\frac{t}{t_{0}}+1}\sup_{0\leq s\leq
t_{0}}\Big{(}\left\|\theta_{s}-\theta_{*}\right\|^{2}+m\left\|\mu_{s}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}$ $\displaystyle\leq
2^{-\frac{t}{t_{0}}+1}C\Big{(}\frac{e^{t_{0}}}{\delta\land\lambda}+1\Big{)}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+m\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)},$

where the last inequality is from (Proof of Theorem 5.5.) and
$C_{s,L,\ell,\lambda}$ could be bounded by
$C(\frac{e^{t_{0}}}{\delta\land\lambda}+1)$ for $0\leq s\leq t_{0}$. And since
$m\leq\frac{1}{2L^{2}}<1,$ we conclude that

$\displaystyle\left\|\theta_{t}-\theta_{*}\right\|^{2}+\left\|\mu_{t}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}$ $\displaystyle\leq
m^{-1}2^{-\frac{t}{t_{0}}+1}C\Big{(}\frac{e^{t_{0}}}{\delta\land\lambda}+1\Big{)}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}$ $\displaystyle\leq
2L^{2}2^{-\frac{t}{t_{0}}+1}C\Big{(}\frac{e^{t_{0}}}{\delta\land\lambda}+1\Big{)}\Big{(}\left\|\theta_{0}-\theta_{*}\right\|^{2}+\left\|\mu_{0}-\pi^{\gamma,\varepsilon}(\cdot|{\theta_{*}})\right\|^{2}_{{{\rm
TV}}}\Big{)}.$

Finally, we choose the constants
$\eta=\eta(\delta,\lambda,C)=\log(2)t_{0}^{-1}=(\delta\land\lambda)\frac{\log(2)}{\log(4C)}$
and
$\tilde{C}=\tilde{C}(L,C,\delta,\lambda)=4CL^{2}\Big{(}\frac{e^{t_{0}}}{\delta\land\lambda}+1\Big{)}=4CL^{2}\Big{(}\frac{(4C)^{(\delta\land\lambda)^{-1}}}{\delta\land\lambda}+1\Big{)}.$
$\hfill\Box$

##  6 Algorithmic considerations

Throughout this work, we have considered Abram as a continuous-time dynamical
system. To employ it for practical adversarially robust machine learning, this
system needs to be discretised, i.e., we need to employ a time stepping scheme
to obtain a sequence
$(\theta^{N}_{k},\xi_{k}^{1,N},\ldots,\xi_{k}^{N,N})_{k=1}^{\infty}$ that
approximates Abram at discrete points in time. We now propose two discrete
schemes for Abram, before then discussing the simulation of Bayesian
adversarial attacks.

#### Discrete Abram.

We initialise the particles by sampling them from the uniform distribution in
the $\varepsilon$-ball. Then, we employ a projected Euler-Maruyama scheme to
discretise the particles $(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})_{t\geq 0}$. The
Euler-Maruyama scheme (see, e.g., Higham and Kloeden 2021) is a standard
technique for first order diffusion equations – we use a projected version to
adhere to the reflecting boundary condition inside the ball $B$. Projected
Euler-Maruyama schemes of this form have been studied in terms of almost sure
convergence (Słomiński, 1994) and, importantly, also in terms of their
longtime behaviour (Lamperski, 2021). The gradient flow part
$(\theta^{N}_{t})_{t\geq 0}$ is discretised using a forward Euler method –
turning the gradient flow into a gradient descent algorithm (Nocedal and
Wright, 1999). In applications, it is sometimes useful to allow multiple
iterations of the particle dynamics
$(\xi_{t}^{1,N},\ldots,\xi_{t}^{N,N})_{t\geq 0}$ per iteration of the gradient
flow $(\theta^{N}_{t})_{t\geq 0}$. This corresponds to a linear time rescaling
in the particle dynamics that should lead to a more accurate representation of
the respective adversarial distribution.

If the number of data sets $(y_{k},z_{k})_{k=1}^{K}$ is large, we may be
required to use a data subsampling technique. Indeed, we approximate
$\frac{1}{K}\sum_{k=1}^{K}\Phi(y_{k},z_{k}|\theta)\approx\Phi(y_{k^{\prime}},z_{k^{\prime}})$
with a $k^{\prime}\sim\mathrm{Unif}(\\{1,\ldots,K\\})$ being sampled
independently in every iteration of the algorithm. This gives us a stochastic
gradient descent-type approximation of the gradients in the algorithm, see
Robbins and Monro (1951). We note that we have not analysed data subsampling
within Abram – we expect that techniques from Jin et al. (2023); Latz (2021)
may be useful to do so. We summarise the method in Algorithm 1.

Algorithm 1 Abram

1: initialise learning rate $h$, $\theta_{0}$, $\gamma$, $\varepsilon$

2: for $j=1,2,\ldots,J$ do

3: pick a data point $(y_{j},z_{j})$ from training data

4: for $i=1,2,\ldots,N$ do

5: initialise $\xi_{0,j}^{i}=\xi_{T,j-1}^{i}$ if $j>1$ else
$\xi_{0,j}^{i}\sim\text{Unif}[-{\varepsilon},{\varepsilon}]$

6: for $\tau=1,2,\ldots,T$ do

7:
$\xi_{\tau,j}^{i}\leftarrow\mathrm{Proj}_{\|\cdot\|\leq\varepsilon}(\xi_{\tau-1,j}^{i}+h\nabla_{\xi}\Phi(y_{j}+\xi_{\tau-1,j}^{i},z_{j}|\theta_{j-1})+\gamma^{-1}\sqrt{2h}w_{\tau,j}^{i})\quad(w_{\tau,j}^{i}\sim\mathrm{N}(0,\mathrm{Id})\text{
iid.})$

8: end for

9: end for

10:
${\mu}_{j}^{N}\leftarrow\frac{1}{N}\sum_{i=1}^{N}\delta(\cdot-\xi_{T,j}^{i})$

11:
$\widehat{C}_{j}\leftarrow\mathrm{Cov}_{{\mu}_{j}^{N}}(\Phi(y_{j}+\cdot,z_{j}|\theta_{j-1}),\nabla_{\theta}\Phi(y_{j}+\cdot,z_{j}|\theta_{j-1}))$

12:
$\theta_{j}\leftarrow\theta_{j-1}-\frac{h}{N}\sum_{i=1}^{N}\nabla_{\theta}\Phi(y_{j}+\xi_{T,j}^{i},z_{j}|\theta_{j-1})-\gamma
h\widehat{C}_{j}$

13: end for

14: return $\theta_{J}$

#### Discrete Abram with mini-batching.

When subsampling in machine learning practice, it is usually advisable to
choose mini-batches of data points rather than single data points. Here, we
pick a mini-batch $\\{y_{k^{\prime}},z_{k^{\prime}}\\}_{k^{\prime}\in
K^{\prime}}\subseteq\\{y_{k},z_{k}\\}_{k=1}^{K}$, with $\\#K^{\prime}\ll K$
and perform the gradient step with all elements with index in $K^{\prime}$
rather than a single element in the whole data set
$\\{y_{k},z_{k}\\}_{k=1}^{K}$. Abram would then require a set of $N$ particles
for each of the elements in the batch, i.e., $NK^{\prime}$ particles in total.
In practice, $N$ and $K^{\prime}$ are both likely to be large, leading to
Abram becoming computationally infeasible. Based on an idea discussed in a
different context in Hanu et al. (2023), we propose the following method: in
every time step $j=1,\ldots,J$ we choose an identical number of particles
$(\xi^{i}_{T,j})_{i=1}^{N}$ and data sets $(y^{i}_{j},z^{i}_{j})_{i=1}^{N}$ in
the mini-batch, i.e. $\\#K^{\prime}=N$. Then, we employ the Abram dynamics,
but equip each particle $\xi^{i}_{T,j}$ with a different data point
$(y^{i}_{j},z^{i}_{j})$ $(i=1,\ldots,N)$. As opposed to Abram with separate
particles per data point, we here compute the sampling covariance throughout
all subsampled data points rather than separately for every data point. The
resulting dynamics are then only close to (3.1), if we assume that the
adversarial attacks for each data point are not too dissimilar of each other.
However, the dynamics may also be successful, if this is not the case. We
summarise the resulting method in Algorithm 2.

Algorithm 2 Mini-batching Abram

1: initialize learning rate $h$, $\theta_{0}$, $\gamma$, $\varepsilon$

2: for $j=1,2,\ldots,J$ do

3: for $i=1,2,\ldots,N$ do

4: initialize $\xi_{0,j}^{i}\leftarrow\xi_{T,j-1}^{i}$ if $j>1$ else
$\xi_{0,j}^{i}\sim\text{Unif}[-{\varepsilon},{\varepsilon}]$ iid.

5: pick $N$ data points $(y_{j}^{i},z_{j}^{i})_{i=1}^{N}$ from the training
data $(y_{k},z_{k})_{k=1}^{K}$

6: for $\tau=1,2,\ldots,T$ do

7:
$\xi_{\tau,j}^{i}\leftarrow\mathrm{Proj}_{\|\cdot\|\leq\varepsilon}(\xi_{\tau-1,j}^{i}+h\nabla_{\xi}\Phi(y_{j}^{i}+\xi_{\tau-1,j}^{i},z_{j}^{i}|\theta_{j-1})+\gamma^{-1}\sqrt{2h}w_{\tau,j}^{i})\qquad(w_{\tau,j}^{i}\sim\mathrm{N}(0,\mathrm{Id})\text{
iid.})$

8: end for

9: end for

10:
${\mu}_{j}^{N}\leftarrow\frac{1}{N}\sum_{i=1}^{N}\delta(\cdot-(y_{j}^{i}+\xi_{T,j}^{i}))$

11:
$\widehat{C}_{j}\leftarrow\mathrm{Cov}_{{\mu}_{j}^{N}}(\Phi(\cdot,z_{j}|\theta_{j-1}),\nabla_{\theta}\Phi(\cdot,z_{j}|\theta_{j-1}))$

12:
$\theta_{j}\leftarrow\theta_{j-1}-\frac{h}{N}\sum_{i=1}^{N}\nabla_{\theta}\Phi(y_{j}^{i}+\xi_{T,j}^{i},z_{j}|\theta_{j-1})-\gamma
h\widehat{C}_{j}$

13: end for

14: return $\theta_{J}$

#### Bayesian attacks.

The mechanism used to approximate the Bayesian adversary in Algorithm 1 can
naturally be used as a Bayesian attack. We propose two different attacks:

  1. 1.

We use the projected Euler-Maruyama method to sample from the Bayesian
adversarial distribution $\pi^{\gamma,\varepsilon}$ corresponding to an input
data set $y\in Y$ and model parameter $\theta^{*}$. We summarise this attack
in Algorithm 3.

  2. 2.

Instead of attacking with a sample from $\pi^{\gamma,\varepsilon}$, we can
attack with the mean of said distribution. From Proposition 5.6, we know that
the particle system $(\widehat{\xi}_{t})_{t\geq 0}$ that is based on a fixed
parameter $\theta_{*}$, is exponentially ergodic. Thus, we approximate the
mean of $\pi^{\gamma,\varepsilon}$, by sampling $(\widehat{\xi}_{t})_{t\geq
0}$ using projected Euler-Maruyama and approximate the mean by computing the
sample mean throughout the sampling path. We summarise this method in
Algorithm 4.

Algorithm 3 Bayesian sample attack

0: unperturbed input data set $y$

1: initialise $h$, $\gamma$, $\varepsilon$,
$\xi_{0}\sim\text{Unif}[-{\varepsilon},{\varepsilon}]$

2: for $j=1,2,\ldots,J$ do

3:
$\xi_{j}\leftarrow\mathrm{Proj}_{\|\cdot\|\leq\varepsilon}(\xi_{j-1}+h\nabla_{\xi}\Phi(x+\xi_{j-1},\theta)+\gamma^{-1}\sqrt{2h}w_{j})\qquad(w_{j}\sim\mathrm{N}(0,\mathrm{Id}))$

4: end for

5: return adversarially perturbed input data point $y+\xi_{J}$

Algorithm 4 Bayesian mean attack

0: unperturbed input data point $y$

1: initialise $h$, $\gamma$, $\varepsilon$,
$\xi_{0}\sim\text{Unif}[-{\varepsilon},{\varepsilon}]$

2: for $j=1,2,\ldots,J$ do

3:
$\xi_{j}\leftarrow\mathrm{Proj}_{\|\cdot\|\leq\varepsilon}(\xi_{j-1}+h\nabla_{\xi}\Phi(x+\xi_{j-1},\theta)+\gamma^{-1}\sqrt{2h}w_{j})\qquad(w_{j}\sim\mathrm{N}(0,\mathrm{Id}))$

4: end for

5: return adversarially perturbed input data point
$y+\frac{1}{J}\sum_{j=1}^{J}\xi_{j}$

##  7 Deep learning experiments

We now study the application of the Bayesian Adversary in deep learning. The
model parameter $\theta$ is updated for $J$ steps with batch size/number of
particles $N$. For each particle in the ensemble, the perturbation parameter
$\xi$ is updated for $T$ steps.

###  7.1 MNIST

We test Algorithm 1 and Algorithm 2 on the classification benchmark data set
MNIST (LeCun and Cortes, 2005) against different adversarial attacks and
compare the results with the results after an FGSM-based (Wong et al., 2020)
adversarial training. Each experimental run is conducted on a single Nvidia
A6000 GPU. We utilize the Adversarial Robustness Toolbox (ART) for the
experiments, see Nicolae et al. (2018) for more details. ART is a Python
library for adversarial robustness that provides various APIs for defence and
attack. We use a neural network with two convolution layers each followed by a
max pooling. In Algorithm 1, we set $\gamma=1,h=\varepsilon,\varepsilon=0.2$.
In Algorithm 2, we set $\gamma=1,h=10\varepsilon,\varepsilon=0.2$. We observe
that setting larger noise scale for the attack during training helps Abram’s
final evaluation performance. We train the neural network for 30 epochs (i.e.,
30 full iterations through the data set) for each method. The number of
particles (and batch size) is $N=128$ and the inner loop is trained for $T=10$
times. To better understand how Abram responds to different attacks, we test
against six attack methods: PGD (Madry et al., 2018), Auto-PGD (Croce and
Hein, 2020), Carlini and Wagner (Carlini and Wagner, 2017b), Wasserstein
Attack (Wong et al., 2019), as well as the Bayesian attacks introduced in this
paper – see Algorithms 3 and 4. We also test the method’s accuracy in the case
of benign (non-attacked) input data. For the Bayesian sample attack and
Bayesian mean attack, we set $\gamma=1000$. See Table 7.1 for the comparison.
The results are averaged over three random seeds. We observe that Abram
performs similarly to FGSM under Wasserstein, Bayesian sample, and Bayesian
mean attack. FGSM outperforms Abram under Auto-PGD, PGD, and Carlini & Wagner
attack. We conclude that Abram is as effective as FGSM under certain weaker
attacks, but can usually not outperform the conventional FGSM.

| Adversarial Attack ($\varepsilon=0.1$) | Abram | Mini-batching Abram |  FGSM |
---|---|---|---|---|---
| Benign Test | 92.41$\pm$0.05 | 99.28$\pm$0.04 |  99.44$\pm$0.05 |
| Auto-PGD | 78.18$\pm$0.20 | 95.86$\pm$0.18 |  98.84$\pm$0.05 |
| PGD | 78.24$\pm$0.17 | 95.86$\pm$0.17 |  98.85$\pm$0.04 |
| Wasserstein Attack | 86.27$\pm$0.12 | 96.51$\pm$0.13 |  96.97$\pm$0.04 |
| Carlini & Wagner Attack | 8.76$\pm$0.015 | 5.14$\pm$0.1 |  62.60$\pm$0.02 |
| Bayesian sample attack | 92.43$\pm$0.10 | 99.29$\pm$0.03 |  99.44$\pm$0.06 |
| Bayesian mean attack | 92.42$\pm$0.08 | 99.28$\pm$0.04 |  99.44$\pm$0.05 |
Table 7.1: Comparison of test accuracy (%) on MNIST with different adversarial
attack after Abram, mini-batching Abram, and FGSM (Wong et al., 2020)
adversarial training.

Another observation is that mini-batching Abram outperforms Abram
significantly. Recall that in Abram we used $128$ particles for each data
point which can be viewed as SGD with batch size $1$, whereas the mini-
batching Abram is similar to the mini-batching SGD. Mini-batching Abram has
the freedom to set the batch size which helps to reduce the variance in the
stochastic optimisation and, thus, gives more stable results. In particular,
with mini-batching Abram, gradients are approximated by multiple data points
instead of one data point which is the case in Abram. Having a larger batch
size also increases computation efficiency by doing matrix multiplication on
GPUs, which is important in modern machine learning applications as the
datasets can be expected to be large.

###  7.2 CIFAR10

Similarly, we test Algorithm 2 on the classification benchmark dataset CIFAR10
(Krizhevsky, 2009) by utilising ART. The dataset is pre-processed by random
crop and random horizontal flip following Krizhevsky (2009) for data
augmentation. The neural network uses the Pre-act ResNet-18 (He et al., 2016)
architecture. For Abram, we set $\gamma=1,h=\varepsilon,\varepsilon=16/255$.
Similar as in MNIST experiments, practically we find that setting larger noise
scale for attack in training Abram helps to obtain a better final evaluation
performance. The batch size $N=128$ and the inner loop is simulated for $T=10$
times. We train both mini-batching Abram and FGSM for 30 epochs. Due to its
worse performance for MNIST and the large size of CIFAR10, we have not used
the non-mini-batching version of Abram in this second problem. For the
Bayesian sample attack and the Bayesian mean attack, we set $\gamma=0.001$. We
present the results in Table 7.2. There, we observe that mini-batching Abram
outperforms FGSM under Wasserstein and the Bayesian attacks, but not in any of
the other cases.

| Adversarial Attack ($\varepsilon=8/255$) | Mini-batching Abram |  FGSM |
---|---|---|---|---
| Benign Test | 65.35$\pm$0.05 |  55.61$\pm$0.03 |
| Auto-PGD | 11.15$\pm$0.12 |  43.70$\pm$0.06 |
| PGD | 11.22$\pm$0.09 |  43.65$\pm$0.04 |
| Wasserstein Attack | 58.04$\pm$0.15 |  55.30$\pm$0.03 |
| Carlini & Wagner Attack | 19.01$\pm$0.12 |  62.60$\pm$0.02 |
| Bayesian sample attack | 62.52$\pm$0.03 |  55.83$\pm$0.05 |
| Bayesian mean attack | 63.72$\pm$0.06 |  55.81$\pm$0.05 |
Table 7.2: Comparison of test accuracy (%) on CIFAR10 with different
adversarial attack after mini-batching Abram and FGSM (Wong et al., 2020)
adversarial training.

##  8 Conclusions

We have introduced the Bayesian adversarial robustness problem. This problem
can be interpreted as either a relaxation of the usual minmax problem in
adversarial learning or as learning methodology that is able to counter
Bayesian adversarial attacks. To solve the Bayesian adversarial robustness
problem, we introduce Abram – the Adversarially Bayesian Particle Sampler. We
prove that Abram approximates a McKean-Vlasov SDE and that this McKean-Vlasov
SDE is able to find the minimiser of certain (simple) Bayesian adversarial
robustness problems. Thus, at least for a certain class of problems, we give a
mathematical justification for the use of Abram. We propose two ways to
discretise Abram: a direct Euler-Maruyama discretisation of the Abram dynamics
and an alternative method that is more suitable when training with respect to
large data sets. We apply Abram in two deep learning problems. There we see
that Abram can effectively prevent certain adversarial attacks (especially
Bayesian attacks), but is overall not as strong as classical optimisation-
based heuristics.

## References

  * Adams et al. (2022) D. Adams, G. dos Reis, R. Ravaille, W. Salkeld, and J. Tugaut.  Large deviations and exit-times for reflected McKean–Vlasov equations with self-stabilising terms and superlinear drifts.  _Stochastic Processes and their Applications_ , 146:264–310, 2022.
  * Akyildiz et al. (2023) Ö. D. Akyildiz, F. R. Crucinio, M. Girolami, T. Johnston, and S. Sabanis.  Interacting particle Langevin algorithm for maximum marginal likelihood estimation, 2023.  URL https://arxiv.org/abs/2303.13429.
  * Bachute and Subhedar (2021) M. R. Bachute and J. M. Subhedar.  Autonomous driving architectures: Insights of machine learning and deep learning algorithms.  _Machine Learning with Applications_ , 6:100164, 2021.  ISSN 2666-8270.  doi: https://doi.org/10.1016/j.mlwa.2021.100164.  URL https://www.sciencedirect.com/science/article/pii/S2666827021000827.
  * Carlini and Wagner (2017a) N. Carlini and D. Wagner.  Adversarial examples are not easily detected: Bypassing ten detection methods.  In _Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security_ , AISec ’17, page 3–14, New York, NY, USA, 2017a. Association for Computing Machinery.  ISBN 9781450352024.
  * Carlini and Wagner (2017b) N. Carlini and D. Wagner.  Towards evaluating the robustness of neural networks.  In _2017 IEEE Symposium on Security and Privacy (SP)_ , pages 39–57, Los Alamitos, CA, USA, 2017b. IEEE Computer Society.
  * Choromanska et al. (2015) A. Choromanska, M. Henaff, M. Mathieu, G. Ben Arous, and Y. LeCun.  The loss surfaces of multilayer networks.  In _Proceedings of the Eighteenth International Conference on Artificial Intelligence and Statistics_ , volume 38 of _Proceedings of Machine Learning Research_ , pages 192–204, San Diego, California, USA, 09–12 May 2015. PMLR.
  * Cipriani et al. (2024) C. Cipriani, A. Scagliotti, and T. Wöhrer.  A minimax optimal control approach for robust neural odes, 2024.  URL https://arxiv.org/abs/2310.17584.
  * Croce and Hein (2020) F. Croce and M. Hein.  Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.  In _Proceedings of the 37th International Conference on Machine Learning_ , volume 119 of _Proceedings of Machine Learning Research_ , pages 2206–2216. PMLR, 13–18 Jul 2020.
  * Dong et al. (2018) Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li.  Boosting adversarial attacks with momentum.  In _2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , pages 9185–9193, Los Alamitos, CA, USA, 2018. IEEE Computer Society.
  * Fournier and Guillin (2015) N. Fournier and A. Guillin.  On the rate of convergence in Wasserstein distance of the empirical measure.  _Probab. Theory Relat. Fields_ , 162:707–738, 2015.
  * Fu et al. (2021) S. Fu, F. He, Y. Xu, and D. Tao.  Bayesian inference forgetting.  _CoRR_ , abs/2101.06417, 2021.  URL https://arxiv.org/abs/2101.06417.
  * Ghiasi et al. (2020) A. Ghiasi, A. Shafahi, and T. Goldstein.  Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates.  In _International Conference on Learning Representations_ , 2020.
  * Goodfellow et al. (2015) I. J. Goodfellow, J. Shlens, and C. Szegedy.  Explaining and harnessing adversarial examples, 2015.  URL https://arxiv.org/abs/1412.6572.
  * Gowal et al. (2019) S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. A. Mann, and P. Kohli.  Scalable verified training for provably robust image classification.  In _2019 IEEE/CVF International Conference on Computer Vision (ICCV)_ , pages 4841–4850, 2019.
  * Guo et al. (2018) C. Guo, M. Rana, M. Cisse, and L. van der Maaten.  Countering adversarial images using input transformations.  In _International Conference on Learning Representations_ , 2018.
  * Hanu et al. (2023) M. Hanu, J. Latz, and C. Schillings.  Subsampling in ensemble kalman inversion.  _Inverse Problems_ , 39(9):094002, 2023.  doi: 10.1088/1361-6420/ace64b.  URL https://dx.doi.org/10.1088/1361-6420/ace64b.
  * He et al. (2016) K. He, X. Zhang, S. Ren, and J. Sun.  Identity mappings in deep residual networks.  In _Computer Vision – ECCV 2016_ , pages 630–645. Springer International Publishing, 2016.
  * Higham and Kloeden (2021) D. Higham and P. Kloeden.  _An introduction to the numerical simulation of stochastic differential equations_.  SIAM, 2021.
  * Hwang (1980) C.-R. Hwang.  Laplace’s method revisited: Weak convergence of probability measures.  _The Annals of Probability_ , 8(6):1177–1182, 1980.  ISSN 00911798, 2168894X.  URL http://www.jstor.org/stable/2243019.
  * Jia et al. (2022) J. Jia, W. Qu, and N. Z. Gong.  Multiguard: Provably robust multi-label classification against adversarial examples.  In _Advances in Neural Information Processing Systems_ , 2022.
  * Jin et al. (2023) K. Jin, J. Latz, C. Liu, and C.-B. Schönlieb.  A continuous-time stochastic gradient descent method for continuous data.  _Journal of Machine Learning Research_ , 24(274):1–48, 2023.
  * Krizhevsky (2009) A. Krizhevsky.  Learning multiple layers of features from tiny images.  In _https://www.cs.toronto.edu/ kriz/learning-features-2009-TR.pdf_ , 2009.
  * Kuntz et al. (2023) J. Kuntz, J. N. Lim, and A. M. Johansen.  Particle algorithms for maximum likelihood training of latent variable models.  In _Proceedings of The 26th International Conference on Artificial Intelligence and Statistics_ , volume 206 of _Proceedings of Machine Learning Research_ , pages 5134–5180. PMLR, 25–27 Apr 2023.
  * Kurakin et al. (2017a) A. Kurakin, I. Goodfellow, and S. Bengio.  Adversarial examples in the physical world, 2017a.
  * Kurakin et al. (2017b) A. Kurakin, I. J. Goodfellow, and S. Bengio.  Adversarial machine learning at scale.  In _International Conference on Learning Representations_ , 2017b.  URL https://openreview.net/forum?id=BJm4T4Kgx.
  * Lamperski (2021) A. Lamperski.  Projected stochastic gradient Langevin algorithms for constrained sampling and non-convex learning.  In M. Belkin and S. Kpotufe, editors, _Proceedings of Thirty Fourth Conference on Learning Theory_ , volume 134 of _Proceedings of Machine Learning Research_ , pages 2891–2937. PMLR, 15–19 Aug 2021.  URL https://proceedings.mlr.press/v134/lamperski21a.html.
  * Latz (2021) J. Latz.  Analysis of stochastic gradient descent in continuous time.  _Statistics and Computing_ , 31:39, 2021.  doi: https://doi.org/10.1007/s11222-021-10016-8.
  * Le Gall (2013) J.-F. Le Gall.  _Mouvement Brownien, martingales et calcul stochastique_.  Springer, 2013.
  * LeCun and Cortes (2005) Y. LeCun and C. Cortes.  The MNIST database of handwritten digits.  In _http://yann.lecun.com/exdb/mnist_ , 2005.
  * Liu et al. (2022) J. Liu, A. Levine, C. Lau, R. Chellappa, and S. Feizi.  Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection.  In _2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)_ , pages 14953–14962, Los Alamitos, CA, USA, 2022. IEEE Computer Society.
  * Madry et al. (2018) A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu.  Towards deep learning models resistant to adversarial attacks.  In _International Conference on Learning Representations_ , 2018.
  * Maini et al. (2020) P. Maini, E. Wong, and Z. Kolter.  Adversarial robustness against the union of multiple perturbation models.  In H. D. III and A. Singh, editors, _Proceedings of the 37th International Conference on Machine Learning_ , volume 119 of _Proceedings of Machine Learning Research_ , pages 6640–6650. PMLR, 13–18 Jul 2020.
  * McKean (1966) H. P. McKean.  A class of Markov processes associated with nonlinear parabolic equations.  _Proceedings of the National Academy of Sciences_ , 56(6):1907–1911, 1966.  doi: 10.1073/pnas.56.6.1907.  URL https://www.pnas.org/doi/abs/10.1073/pnas.56.6.1907.
  * Metzen et al. (2017) J. H. Metzen, T. Genewein, V. Fischer, and B. Bischoff.  On detecting adversarial perturbations.  In _International Conference on Learning Representations_ , 2017.
  * Mosbach et al. (2019) M. Mosbach, M. Andriushchenko, T. Trost, M. Hein, and D. Klakow.  Logit pairing methods can fool gradient-based attacks, 2019.  URL https://arxiv.org/abs/1810.12042.
  * Nicolae et al. (2018) M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig, I. Molloy, and B. Edwards.  Adversarial robustness toolbox v1.2.0.  _CoRR_ , 1807.01069, 2018.
  * Nie et al. (2022) W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar.  Diffusion models for adversarial purification.  In _Proceedings of the 39th International Conference on Machine Learning_ , volume 162 of _Proceedings of Machine Learning Research_ , pages 16805–16827. PMLR, 17–23 Jul 2022.
  * Nocedal and Wright (1999) J. Nocedal and S. J. Wright.  _Numerical optimization_.  Springer, 1999.
  * Pilipenko (2014) A. Pilipenko.  _An introduction to stochastic differential equations with reflection_.  Lectures in Pure and Applied Mathematics. Universität Potsdam, 2014.
  * Rajkomar et al. (2019) A. Rajkomar, J. Dean, and I. Kohane.  Machine learning in medicine.  _New England Journal of Medicine_ , 380(14):1347–1358, 2019.  doi: 10.1056/NEJMra1814259.  URL https://www.nejm.org/doi/full/10.1056/NEJMra1814259.
  * Robbins and Monro (1951) H. Robbins and S. Monro.  A stochastic approximation method.  _The Annals of Mathematical Statistics_ , 22(3):400–407, 1951.
  * Sato et al. (2024) K. Sato, A. Takeda, R. Kawai, and T. Suzuki.  Convergence error analysis of reflected gradient Langevin dynamics for non-convex constrained optimization, 2024.  URL https://arxiv.org/abs/2203.10215.
  * Sharma et al. (2020) S. Sharma, M. Bhatt, and P. Sharma.  Face recognition system using machine learning algorithm.  In _2020 5th International Conference on Communication and Electronics Systems (ICCES)_ , pages 1162–1168, 2020.  doi: 10.1109/ICCES48766.2020.9137850.
  * Sheikholeslami et al. (2021) F. Sheikholeslami, A. Lotfi, and J. Z. Kolter.  Provably robust classification of adversarial examples with detection.  In _International Conference on Learning Representations_ , 2021.
  * Song et al. (2018) Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman.  Pixeldefend: Leveraging generative models to understand and defend against adversarial examples.  In _International Conference on Learning Representations_ , 2018.
  * Szegedy et al. (2014) C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus.  Intriguing properties of neural networks, 2014.  URL https://arxiv.org/abs/1312.6199.
  * Słomiński (1994) L. Słomiński.  On approximation of solutions of multidimensional SDE’s with reflecting boundary conditions.  _Stochastic Processes and their Applications_ , 50(2):197–219, 1994.  ISSN 0304-4149.  doi: https://doi.org/10.1016/0304-4149(94)90118-X.  URL https://www.sciencedirect.com/science/article/pii/030441499490118X.
  * Tramer and Boneh (2019) F. Tramer and D. Boneh.  Adversarial training and robustness for multiple perturbations.  In _Advances in Neural Information Processing Systems_ , volume 32, 2019.
  * Tramèr et al. (2018) F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel.  Ensemble adversarial training: Attacks and defenses.  In _International Conference on Learning Representations_ , 2018.
  * Villani (2009) C. Villani.  _Optimal transport: Old and new_.  Springer, 2009.
  * Wang (2023) F.-Y. Wang.  Exponential ergodicity for singular reflecting McKean–Vlasov SDEs.  _Stochastic Processes and their Applications_ , 160:265–293, 2023.
  * Wang et al. (2023) Z. Wang, T. Pang, C. Du, M. Lin, W. Liu, and S. Yan.  Better diffusion models further improve adversarial training.  In _Proceedings of the 40th International Conference on Machine Learning_ , volume 202 of _Proceedings of Machine Learning Research_ , pages 36246–36263. PMLR, 23–29 Jul 2023.
  * Wong and Kolter (2018) E. Wong and Z. Kolter.  Provable defenses against adversarial examples via the convex outer adversarial polytope.  In _Proceedings of the 35th International Conference on Machine Learning_ , volume 80 of _Proceedings of Machine Learning Research_ , pages 5286–5295. PMLR, 10–15 Jul 2018.
  * Wong et al. (2019) E. Wong, F. Schmidt, and Z. Kolter.  Wasserstein adversarial examples via projected Sinkhorn iterations.  In _Proceedings of the 36th International Conference on Machine Learning_ , volume 97 of _Proceedings of Machine Learning Research_ , pages 6808–6817. PMLR, 09–15 Jun 2019.
  * Wong et al. (2020) E. Wong, L. Rice, and J. Z. Kolter.  Fast is better than free: Revisiting adversarial training.  In _International Conference on Learning Representations_ , 2020.
  * Xu et al. (2023) K. Xu, Y. Xiao, Z. Zheng, K. Cai, and R. Nevatia.  Patchzero: Defending against adversarial patch attacks by detecting and zeroing the patch.  In _2023 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)_ , pages 4621–4630, Los Alamitos, CA, USA, 2023. IEEE Computer Society.
  * Xu et al. (2018) W. Xu, D. Evans, and Y. Qi.  Feature squeezing: Detecting adversarial examples in deep neural networks.  In _Network and Distributed System Security Symposium_ , 2018.
  * Xue et al. (2023) H. Xue, A. Araujo, B. Hu, and Y. Chen.  Diffusion-based adversarial sample generation for improved stealthiness and controllability.  In _Advances in Neural Information Processing Systems_ , volume 36, pages 2894–2921. Curran Associates, Inc., 2023.
  * Yang et al. (2019) Y. Yang, G. Zhang, D. Katabi, and Z. Xu.  ME-net: Towards effective adversarial robustness with matrix estimation.  In _Proceedings of the 36th International Conference on Machine Learning_ , volume 97 of _Proceedings of Machine Learning Research_ , pages 7025–7034. PMLR, 09–15 Jun 2019.
  * Ye and Zhu (2018) N. Ye and Z. Zhu.  Bayesian adversarial learning.  In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, editors, _Advances in Neural Information Processing Systems_ , volume 31. Curran Associates, Inc., 2018.  URL https://proceedings.neurips.cc/paper_files/paper/2018/file/586f9b4035e5997f77635b13cc04984c-Paper.pdf.
  * Yun et al. (2019) S. Yun, D. Han, S. Chun, S. Oh, Y. Yoo, and J. Choe.  Cutmix: Regularization strategy to train strong classifiers with localizable features.  In _2019 IEEE/CVF International Conference on Computer Vision (ICCV)_ , pages 6022–6031, Los Alamitos, CA, USA, 2019. IEEE Computer Society.

Competing interests: The authors declare none.