Montreuil, Y., Carlier, A., Ng, L.X. & Ooi, W.T.. (2025). Adversarial Robustness in Two-Stage Learning-to-Defer: Algorithms and Guarantees. Proceedings of the 42nd International Conference on Machine Learning, in Proceedings of Machine Learning Research, 267:44699-44725 Available from https://proceedings.mlr.press/v267/montreuil25a.html.
Abstract:
Two-stage Learning-to-Defer (L2D) enables optimal task delegation by assigning each input to either a fixed main model or one of several offline experts, supporting reliable decision-making in complex, multi-agent environments. However, existing L2D frameworks assume clean inputs and are vulnerable to adversarial perturbations that can manipulate query allocation—causing costly misrouting or expert overload. We present the first comprehensive study of adversarial robustness in two-stage L2D systems. We introduce two novel attack strategies—untargeted and targeted—which respectively disrupt optimal allocations or force queries to specific agents. To defend against such threats, we propose SARD, a convex learning algorithm built on a family of surrogate losses that are provably Bayes-consistent and $(\mathcal{R}, \mathcal{G})$-consistent. These guarantees hold across classification, regression, and multi-task settings. Empirical results demonstrate that SARD significantly improves robustness under adversarial attacks while maintaining strong clean performance, marking a critical step toward secure and trustworthy L2D deployment.
License type:
Publisher Copyright
Funding Info:
This research / project is supported by the National Research Foundation, Prime Minister Office, CREATE - DesCartes under Campus for Research Excellence and Technological Enterprise (CREATE) program - DesCartes
Grant Reference no. : NA
This research / project is supported by the National Research Foundation, Singapore - AI Singapore Programme
Grant Reference no. : AISG2-PhD-2023-01-041-J
Description:
Proceedings of the 42nd International Conference on Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s)