Recently, there is an emerging interest in adversarially training a classifier with a rejection option (also known as a selective classifier) for boosting adversarial robustness. While rejection can incur a cost in many applications, existing studies typically associate zero cost with rejecting perturbed inputs, which can result in the rejection of numerous slightly-perturbed inputs that could be correctly classified. In this work, we study adversarially-robust classification with rejection in the stratified rejection setting, where the rejection cost is modeled by rejection loss functions monotonically non-increasing in the perturbation magnitude. We theoretically analyze the stratified rejection setting and propose a novel defense method -- Adversarial Training with Consistent Prediction-based Rejection (CPR) -- for building a robust selective classifier. Experiments on image datasets demonstrate that the proposed method significantly outperforms existing methods under strong adaptive attacks. For instance, on CIFAR-10, CPR reduces the total robust loss (for different rejection losses) by at least 7.3% under both seen and unseen attacks.

翻译：近年来，在对抗训练中引入拒绝选项（即选择性分类器）以提升对抗鲁棒性引起了广泛关注。尽管在许多应用中拒绝会带来成本，但现有研究通常对拒绝扰动输入赋予零成本，这可能导致大量轻微扰动但可正确分类的输入被错误拒绝。本文研究在分层拒绝场景下带拒绝机制的对抗鲁棒分类，其中拒绝成本通过随扰动幅度单调非增的拒绝损失函数建模。我们从理论上分析了分层拒绝设置，并提出一种新型防御方法——基于一致性预测的对抗训练拒绝策略（CPR）——用于构建鲁棒选择性分类器。在图像数据集上的实验表明，所提方法在强自适应攻击下显著优于现有方法。例如，在CIFAR-10数据集上，CPR在已知和未知攻击下均能将不同拒绝损失下的总鲁棒损失降低至少7.3%。