Unrestricted Adversarial Training

The Unrestricted Adversarial Examples Challenge (UAEC) is a longstanding open problem in adversarial robustness that goes beyond $\epsilon$-bounded threat models. It requires a classifier that (i) achieves high accuracy on natural, unambiguous images (e.g., birds vs. bikes), (ii) does not misclassify unambiguous images of one class as another, and (iii) is allowed to abstain when inputs are ambiguous, where “unambiguous” is defined by human agreement. While conceptually appealing, UAEC remains largely unsolved.

A key limitation of $\epsilon$-bounded robustness is that increasing $\epsilon$ to cover broader variations eventually forces the model to treat genuinely valid examples as adversarial, effectively collapsing the distinction between correct and incorrect inputs rather than capturing semantic robustness. As a result, standard adversarial training methods do not extend naturally to the unrestricted setting.

In this work, we study UAEC through a simplified high-dimensional toy setting and obtain positive results, providing a first step toward understanding unrestricted robustness.