Measuring Adversarial Robustness using a Voronoi-Epsilon Adversary

Previous studies on robustness have argued that there is a tradeoff between accuracy and adversarial accuracy. The can be inevitable even when we neglect generalization. We argue the inherent to commonly used definition of accuracy, which uses an adversary construct points constrained by $\epsilon$-balls around data points. As $\epsilon$ gets large, may use real from other classes as examples. propose Voronoi-epsilon both Voronoi cells $\epsilon$-balls. This balances two notions perturbation. result, based this avoids training large. Finally, show nearest neighbor classifier maximally robust against proposed data.