Tractable and Near-Optimal Adversarial Algorithms for Robust Estimation in Contaminated Gaussian Models

Consider Huber’s contaminated Gaussian model (Huber (1964)): independent observations $X_{1},\ldots,X_{n}$ are obtained from $P_{\epsilon}=(1-\epsilon)\mathrm{N}(\mu^{*},\Sigma^{*})+\epsilon Q$, where $\mathrm{N}(\mu^{*},\Sigma^{*})$ is a $p$-dimensional Gaussian distribution with mean vector $\mu^{*}$ and variance matrix $\Sigma^{*}$, $Q$ is a probability distribution for contaminated data, and $\epsilon$ is a contamination fraction. Our goal is to estimate the Gaussian parameters $(\mu^{*},\Sigma^{*})$, without any restriction on $Q$ for a small $\epsilon$. This allows both outliers located in areas with vanishing probabilities under $\mathrm{N}(\mu^{*},\Sigma^{*})$ and other contaminated observations in areas with non-vanishing probabilities under $\mathrm{N}(\mu^{*},\Sigma^{*})$. We focus on the setting where the dimension $p$ is small relative to the sample size $n$, and no sparsity assumption is placed on $\Sigma^{*}$ or its inverse matrix. The latter, $\Sigma^{*-1}$, is called the precision matrix and is of particular interest in Gaussian graphical modeling. In the low-dimensional setting, estimation of $\Sigma^{*}$ and $\Sigma^{*-1}$ can be treated as being equivalent.

There is a vast literature on robust statistics (e.g., Huber and Ronchetti 2009; Maronna et al. 2018). In particular, the problem of robust estimation from contaminated Gaussian data has been extensively studied, and various interesting methods and results have been obtained recently. Under Huber’s contamination model above, while the bulk of the data are still Gaussian distributed, a challenge is that the contamination status of each observation is hidden, and the contaminated data may be arbitrarily distributed. In this sense, this problem should be distinguished from various related problems, including multivariate scatter estimation for elliptical distributions as in Tyler (1987) and estimation in Gaussian copula graphical models as in Liu et al. (2012) and Xue and Zou (2012), among others. For motivation and comparison, we discuss below several existing approaches directly related to our work.

Existing work.  As suggested by the definition of variance matrix $\Sigma^{*}$, a numerically simple method, proposed in Öllerer and Croux (2015) and Tarr, Müller and Weber (2016), is to apply a robust covariance estimator for each pair of variables, for example, based on robust scale and correlation estimators, and then assemble those estimators into an estimated variance matrix $\hat{\Sigma}$. These pairwise methods are naturally suitable for both Huber’s contamination model and the cellwise contamination model where the components of a data vector can be contaminated independently, each with a small probability $\epsilon$. For various choices of the correlation estimator, such as the transformed Kendall’s $\tau$ and Spearman’s $\rho$ estimator, this method is shown in Loh and Tan (2018) to achieve, in the maximum norm $\|\hat{\Sigma}-\Sigma^{*}\|_{\max}$, the minimax error rate $\epsilon+\sqrt{\log(p)/n}$ under cellwise contamination and Huber’s contamination model. However, because a transformed correlation estimator is used, the variance matrix estimator in Loh and Tan (2018) may not be positive semidefinite (Öllerer and Croux (2015)). Moreover, this approach seems to rely on the availability of individual elements of $\Sigma^{*}$ as pairwise covariances and generalization to other multivariate models can be difficult. In our numerical experiments, such pairwise methods have relatively poor performance when contaminated data are not easily separable from the uncontaminated marginally, especially with nonnegligible $\epsilon$.

For location and scatter estimation under Huber’s contamination model, Chen, Gao and Ren (2018) showed that the minimax error rates in the $L_{2}$ and operator norm, $\|\hat{\mu}-\mu^{*}\|_{2}$ and $\|\hat{\Sigma}-\Sigma^{*}\|_{\mathrm{op}}$, are $\epsilon+\sqrt{p/n}$ and attained by maximizing Tukey’s half-space depth (Tukey (1975)) and a matrix depth function, which is also studied in Zhang (2002) and Paindaveine and Van Bever (2018). Both depth functions, defined through minimization of certain discontinuous objective functions, are in general difficult to compute, and maximization of these depth functions is also numerically intractable. Subsequently, Gao et al. (2019) and Gao, Yao and Zhu (2020) exploited a connection between depth-based estimators and generative adversarial nets (GANs) (Goodfellow et al. (2014)), and proposed robust location and scatter estimators in the form of GANs. These estimators are also proved to achieve the minimax error rates in the $L_{2}$ and operator norms under Huber’s contamination model. More recent work in this direction includes Zhu, Jiao and Tse (2020), Wu et al. (2020), and Liu and Loh (2021).

GANs are a popular approach for learning generative models, with numerous impressive applications (Goodfellow et al. (2014)). In the GAN approach, a generator is defined to transform white noises into fake data, and a discriminator is then employed to distinguish between the fake and real data. The generator and discriminator are trained through minimax optimization with a certain objective function. For GANs used in Gao et al. (2019) and Gao, Yao and Zhu (2020), the generator is defined by the Gaussian model and the discriminator is a multi-layer neural network with sigmoid activations in the top and bottom layers. Hence the discriminator can be seen as logistic regression with the “predictors” defined by the remaining layers of the neural network. The GAN objective function, usually taken to the log-likelihood function in the classification of fake and real data, is more tractable than discontinuous depth functions, but remains nonconvex in the discriminator parameters and nonconcave in the generator parameters. Training such GANs is challenging through nonconvex-nonconcave minimax optimization (Farnia and Ozdaglar (2020); Jin, Netrapalli and Jordan (2020)).

There is also an interesting connection between GANs and minimum divergence (or distance) (MD) estimation, which has been traditionally studied for robust estimation (Donoho and Liu (1988); Lindsay (1994); Basu and Lindsay (1994)). A prominent example is minimum Hellinger distance estimation (Beran (1977); Tamura and Boos (1986)). In fact, as shown in $f$-GANs (Nowozin, Cseke and Tomioka (2016)), various choices of the objective function in GANs can be derived from variational lower bounds of $f$-divergences between the generator and real data distributions. Familiar examples of $f$-divergences include the Kullback–Leibler (KL), squared Hellinger divergences, and the total variation (TV) distance (Ali and Silvey (1966); Csiszár (1967)). In particular, using the log-likelihood function in optimizing the discriminator leads to a lower bound of the Jensen–Shannon (JS) divergence for the generator. Furthermore, the lower bound becomes tight if the discriminator class is sufficiently rich (to include the nonparametrically optimal discriminator given any generator). In this sense, $f$-GANs can be said to nearly implement minimum $f$-divergence estimation, where the parameters are estimated by minimizing an $f$-divergence between the model and data distributions. However, this relationship is only approximate and suggestive, because even a class of neural network discriminators may not be nonparametrically rich with population data. A similar issue can also be found in the previous studies, where minimum Hellinger estimation and related methods require a smoothed density function of sample data. This approach is impractical for multivariate continuous data.

In addition to MD estimation mentioned above, two other methods of MD estimation have also been studied for robust estimation both in general parametric models and in multivariate Gaussian models. The two methods are defined by minimization of power density divergences (also called $\beta$-divergences) (Basu et al. (1998); Miyamura and Kano (2006)) and that of $\gamma$-divergences (Windham (1995); Fujisawa and Eguchi (2008); Hirose, Fujisawa and Sese (2017)). See Jones et al. (2001) for a comparison of these two methods. In contrast with $f$-divergences, these two divergences can be evaluated without requiring smooth density estimation from sample data, and hence the corresponding MD estimators can be computed by standard optimization algorithms. To our knowledge, error bounds have not been formally derived for these methods under Huber’s contaminated Gaussian model.

Various methods based on iterative pruning or convex programming have been studied with provable error bounds for robust estimation in Huber’s contaminated Gaussian model (Lai, Rao and Vempala (2016); Balmand and Dalalyan (2015); Diakonikolas et al. (2019)). These methods either handle scatter estimation after location estimation sequentially in two stages, or resort to using normalized differences of pairs with mean zero for scatter estimation.

Our work.  We propose and study adversarial algorithms with linear spline discriminators, and establish various error bounds for simultaneous location and scatter estimation under Huber’s contaminated Gaussian model. Two distinct types of GANs are exploited. The first one is logit $f$-GANs (Tan, Song and Ou (2019)), which corresponds to a specific choice of $f$-GANs with the objective function formulated as a negative loss function for logistic regression (or equivalently a density ratio model between fake and real data) when training the discriminator. The second is hinge GAN (Lim and Ye (2017); Zhao, Mathieu and LeCun (2017)), where the objective function is taken to be the negative hinge loss function when training the discriminator. The hinge objective can be derived from a variational lower bound of the total variation distance (Nguyen, Wainwright and Jordan (2010); Tan, Song and Ou (2019)), but cannot be deduced as a special case of the $f$-GAN objective even though the total variation is also an $f$-divergence. See Remark 3. In addition, we allow two-objective GANs, including the log$D$ trick in Goodfellow et al. (2014), where two objective functions are used, one for updating the discriminator and the other for updating the generator.

As a major departure from previous studies of GANs, our methods use a simple linear class of spline discriminators, where the basis functions consist of univariate truncated linear functions (or ReLUs shifted) at $5$ knots and the pairwise products of such univariate functions. For hinge GAN and certain logit $f$-GANs including those based on the reverse KL (rKL) and JS divergences, the objective function is concave in the discriminator. By the linearity of the spline class, the objective function is then concave in the spline coefficients. Hence our hinge GAN and logit $f$-GAN methods involve maximization of a concave function when training the spline discriminator for any fixed generator. In contrast with nonconvex-nonconcave minimax optimization for GANs with neural network discriminators (Gao et al. (2019); Gao, Yao and Zhu (2020)), our methods can be implemented through nested optimization in a numerically tractable manner. See Remarks 1, 10 and 11 and Algorithm 1. While the outer minimization for updating the generator remains nonconvex in our methods, such a single nonconvex optimization is usually more tractable than nonconvex-nonconcave minimax optimization.

In spite of the limited capacity of the spline discriminators, we establish various error bounds for our location and scatter estimators, depending on whether the hinge-GAN or logit $f$-GAN is used and whether an $L_{1}$ or $L_{2}$ penalty is incorporated when training the discriminator. See Table 1 for a summary of existing and our error rates in scatter estimation. Our $L_{1}$ penalized hinge GAN method achieves the minimax error rate $\epsilon+\sqrt{\log(p)/n}$ in the maximum norm. Our $L_{2}$ penalized hinge GAN method achieves the error rate $\epsilon\sqrt{p}+\sqrt{p/n}$, whereas the minimax error rate is $\epsilon+\sqrt{p/n}$, in the $p^{-1/2}$-Frobenius norm. While this might indicate the price paid for maintaining the convexity in training the discriminator, our error rate reduces to the same order $\sqrt{p/n}$ as the minimax error rate provided that $\epsilon$ is sufficiently small, $\epsilon=O(\sqrt{1/n})$, such that the contamination error term $\epsilon\sqrt{p}$ is dominated by the sampling variation term $\sqrt{p/n}$ up to a constant factor. To our knowledge, such near-optimal error rates were previously inconceivable for adversarial algorithms with linear discriminators in robust estimation. Moreover, the error rates for our logit $f$-GAN methods exhibit a square-root dependency on the contamination fraction $\epsilon$, instead of a linear dependency for our hinge GAN methods. This shows, for the first time, some theoretical advantage of hinge GAN over logit $f$-GANs, although comparative performances of these methods may vary in practice, depending on specific settings.

To facilitate and complement our sample analysis, we provide error bounds for the population version of hinge GAN or logit $f$-GANs with nonparametric discriminators, that is, minimization of the exact total variation or $f$-divergence at the population level. From Theorem 1, population minimum TV or $f$-divergence estimation under a simple set of conditions on $f$ (Assumption 1) leads to errors of order $O(\epsilon)$ or $O(\sqrt{\epsilon})$ respectively under Huber’s contamination model. Assumption 1 allows the reverse KL, JS, reverse $\chi^{2}$, and squared Hellinger divergences, but excludes the mixed KL divergence, $\chi^{2}$ divergence, and, as reassurance, the KL divergence which corresponds to maximum likelihood estimation and is known to be non-robust. Hence certain (but not all) minimum $f$-divergence estimation achieves robustness under Huber’s contamination model or an $\epsilon$ TV-contaminated neighborhood. Such robustness is identified for the first time for minimum $f$-divergence estimation, and is related to, but distinct from, robustness of minimum distance estimation under $\epsilon$ contaminated neighborhood with respect to the same distance (Donoho and Liu (1988)). See Remark 7 for further discussion. The population error bounds in the $L_{2}$ and $p^{-1/2}$-Frobenius norms are independent of $p$ and hence tighter than the corresponding $\epsilon$ terms in our sample error bounds for both hinge GAN and logit $f$-GAN. These gaps can be attributed to the use of nonparametric versus spline discriminators.

Remarkably, our population analysis also sheds light on the comparison of our sample results and those in Gao, Yao and Zhu (2020). On one hand, another set of conditions (Assumption 2), in addition to Assumption 1, are required in our sample analysis of logit $f$-GANs with spline discriminators. On the other hand, GANs used in Gao, Yao and Zhu (2020) can be recast as logit $f$-GANs with neural network discriminators (see Section 5.2). But minimax error rates are shown to be achieved in Gao, Yao and Zhu (2020) for an $f$-divergence (for example, the mixed KL divergence) which, let alone Assumption 2, does not even satisfy Assumption 1 used in our analysis to show robustness of minimum $f$-divergence estimation. The main reason for this discrepancy is that the neural network discriminator in Gao, Yao and Zhu (2020) is directly constrained to be of order $\epsilon+\sqrt{p/n}$ in the log odds, which considerably simplifies the proofs of rate-optimal robust estimation. In contrast, our methods use linear spline discriminators (with penalties independent of $\epsilon$), and our proofs of robust estimation need to carefully tackle various technical difficulties due to the simple design of our methods. See Figure 2(b) for an illustration of non-robustness by minimization of the mixed KL divergence, and Section 5.2 for further discussion on this subtle issue in Gao, Yao and Zhu (2020).

Notation.  For a vector $a=(a_{1},\dots,a_{p})^{T}\in\mathbb{R}^{p}$, we denote by $\|a\|_{1}=\sum_{i=1}^{p}|a_{i}|$, $\|a\|_{\infty}=\max_{1\leq i\leq p}|a_{i}|$, and $\|a\|_{2}=(\sum_{i=1}^{p}a_{i}^{2})^{1/2}$ the $L_{1}$ norm, $L_{\infty}$ norm, and $L_{2}$ norm of $a$, respectively. For a matrix $A=(a_{ij})\in\mathbb{R}^{m\times n}$, we define the element-wise maximum norm $\|A\|_{\max}=\max_{1\leq i\leq m,1\leq j\leq n}|a_{ij}|$, the Frobenius norm $\|A\|_{\mathrm{F}}=(\sum_{i=1}^{m}\sum_{j=1}^{n}a_{ij}^{2})^{1/2}$, the vectorized $L_{1}$ norm $\|A\|_{1,1}=\sum_{i=1}^{m}\sum_{j=1}^{n}|a_{ij}|$, the operator norm $\|A\|_{\mathrm{op}}=\sup_{\|x\|_{2}\leq 1}\|Ax\|_{2}$, and the $L_{\infty}$-induced operator norm $\|A\|_{\infty}=\sup_{\|x\|_{\infty}\leq 1}\|Ax\|_{\infty}$. For a square matrix $A$, we write $A\succeq 0$ to indicate that $A$ is positive semidefinite. The tensor product of vectors $a$ and $b$ is denoted by $a\otimes b$, and the vectorization of matrix $A$ is denoted by $\mathrm{vec}(A)$. The cumulative distribution function of the standard normal distribution is denoted by $\Phi(x)$, and the Gaussian error function is denoted by $\mathrm{erf}(x)$.

We illustrate the performance of our rKL logit $f$-GAN and six existing methods, with two samples of size $2000$ from a $10$-dimensional Huber’s contaminated Gaussian distribution with $\epsilon=5\%$ and $10\%$, based on a Toeplitz covariance matrix and the first contamination $Q$ described in Section 6.2. Figure 1 shows the 95% Gaussian ellipsoids for the first two coordinates, using the estimated location vectors and variance matrices except for Tyler’s M-estimator (Tyler (1987)), Kendalls’s $\tau$ with MAD (Loh and Tan (2018)), and Spearman’s $\rho$ with $Q_{n}$-estimator (Öllerer and Croux (2015)) where the locations are set to the true means. The performance of our JS logit $f$-GAN and hinge GAN is close to that of rKL logit $f$-GAN. See the Supplement for illustration based on the second contamination in Section 6.2.

Among the methods shown in Figure 1, the rKL logit $f$-GAN gives an ellipsoid closest to the truth, followed with relatively small but noticeable differences by the JS-GAN (Gao, Yao and Zhu (2020)), MCD (Rousseeuw (1985)), and Mest (Rocke (1996)), which are briefly described in Section 6.1. The remaining three methods, Kendall’s $\tau$ with MAD, Spearman’s $\rho$ with $Q_{n}$-estimator, and Tyler’s M-estimator show much less satisfactory performance. The estimated distributions from these methods are dragged towards the corner contamination cluster.

The relatively poor performance of the pairwise methods, Kendall’s $\tau$ with MAD and Spearman’s $\rho$ with $Q_{n}$-estimator, may be explained by the fact that as shown by the marginal histograms in Figure 1, the data in each coordinate are one-sided heavy-tailed, but no obvious outliers can be seen marginally. The correlation estimates from Kendall’s $\tau$ and Spearman’s $\rho$ tend to be inaccurate even after sine transformations, especially with nonnegligible $\epsilon=10\%$. In contrast, our GAN methods as well as JS-GAN, MCD, and the Mest are capable of capturing higher dimensional information so that the impact of contamination is limited to various extents.

We review various adversarial algorithms (or GANs), which are exploited by our methods for robust location and scatter estimation. To focus on main ideas, the algorithms are stated in their population versions, where the underlying data distribution $P_{*}$ is involved instead of the empirical distribution $P_{n}$. Let $\{P_{\theta}:\theta\in\Theta\}$ be a statistical model and $\{h_{\gamma}:\gamma\in\Gamma\}$ be a function class, where $P_{\theta}$ is called a generator and $h_{\gamma}$ a discriminator. In our study, $P_{\theta}$ is a multivariate Gaussian distribution $\mathrm{N}(\mu,\Sigma)$, and $h_{\gamma}$ is a pairwise spline function which is specified later in Section 4.2.

For a convex function $f:(0,\infty)\to\mathbb{R}$, the $f$-divergence between the distributions $P_{*}$ and $P_{\theta}$ with density functions $p_{*}$ and $p_{\theta}$ is

For example, taking $f(t)=t\log t$ yields the Kullback–Liebler (KL) divergence $D_{\mathrm{KL}}(P_{*}\|P_{\theta})$. The logit $f$-GAN (Tan, Song and Ou (2019)) is defined by solving the minimax program

where

Throughout, $f^{\#}(t)=tf^{\prime}(t)-f(t)$ and $f^{\prime}$ denotes the derivative of $f$. A motivation for this method is that the objective $K_{f}$ is a nonparametrically tight, lower bound of the $f$-divergence (Tan, Song and Ou (2019), Proposition S1): for each $\theta$, it holds that for any function $h$,

where the equality is attained at $h_{*\theta}(x)=\log\{p_{*}(x)/p_{\theta}(x)\}$, the log density ratio between $P_{*}$ and $P_{\theta}$ or equivalently the log odds for classifying whether a data point $x$ is from $P_{*}$ or $P_{\theta}$. There are two choices of $f$ of particular interest. Taking $f(t)=t\log t-(t+1)\log(t+1)+\log 4$ leads the Jensen–Shannon (JS) divergence, $D_{\mathrm{JS}}(P_{*}\|P_{\theta})=D_{\mathrm{KL}}(P_{*}\|(P_{*}+P_{\theta})/2)+D_{\mathrm{KL}}(P_{\theta}\|(P_{*}+P_{\theta})/2)$, and the objective function

which is, up to a constant, the expected log-likelihood for logistic regression with log odds function $h(x)$. For $K_{f}=K_{\mathrm{JS}}$, program (1) corresponds to the original GAN (Goodfellow et al. (2014)) with discrimination probability $\mathrm{sigmoid}(h(x))$. Taking $f(t)=-\log t$ leads to the reverse KL divergence $D_{\mathrm{rKL}}(P_{*}\|P_{\theta})=D_{\mathrm{KL}}(P_{\theta}\|P_{*})$ and the objective function

which is the negative calibration loss for logistic regression in Tan (2020).

The objective $K_{f}$ with fixed $\theta$ can be seen as a proper scoring rule reparameterized in terms of the log odds function $h(x)$ for binary classification (Tan and Zhang (2020)). Replacing $K_{f}$ in (1) by the negative hinge loss (which is not a proper scoring rule) leads to

where

This method is related to the geometric GAN described later in (13) and will be called hinge GAN. By Nguyen, Wainwright and Jordan (2009) or Proposition 5 in Tan, Song and Ou (2019), the objective $K_{\mathrm{HG}}$ is a nonparametrically tight, lower bound of the total variation distance scaled by $2$: for each $\theta$, it holds that for any function $h(x)$,

where the equality is attained at $h_{*\theta}(x)=\mathrm{sign}(p_{*}(x)-p_{\theta}(x))$, and $D_{\mathrm{TV}}(P_{*}\|P_{\theta})=\int|p_{*}(x)-p_{\theta}(x)|/2\,\mathrm{d}x$. The objectives $K_{f}$ and $K_{\mathrm{HG}}$, with fixed $\theta$, represent two types of loss functions for binary classification. See Buja, Stuetzle and Shen (2005) and Nguyen, Wainwright and Jordan (2009) for further discussions about loss functions and scoring rules.

The preceding programs, (1) and (3), are defined as minimax optimization, each with a single objective function. There are also adversarial algorithms, which are formulated as alternating optimization with two objective functions (see Remark 1). For example, GAN with the $\log D$ trick in Goodfellow et al. (2014) is defined by solving

The second objective is introduced mainly to overcome vanishing gradients in $\theta$ when the discriminator is confident. The calibrated rKL-GAN (Huszár (2016); Tan, Song and Ou (2019)) is defined by solving

The two objectives are chosen to stabilize gradients in both $\theta$ and $\gamma$ during training. The geometric GAN in Lim and Ye (2017) or, equivalently, the energy-based GAN in Zhao, Mathieu and LeCun (2017) as shown in Tan, Song and Ou (2019), is defined by solving

Interestingly, the second line in (10) or (13) involves the same objective $-\mathrm{E}_{P_{\theta}}h_{\gamma}(x)$, which can be equivalently replaced by $K_{\mathrm{rKL}}(P_{*},P_{\theta};h_{\gamma})$ because $\gamma$ and hence $h_{\gamma}$ are fixed.

We propose and study various adversarial algorithms with simple spline discriminators for robust estimation in a multivariate Gaussian model. Assume that $X_{1},\ldots,X_{n}$ are independent observations obtained from Huber’s $\epsilon$-contamination model, that is, the data distribution $P_{*}$ is of the form

where $P_{\theta^{*}}$ is $\mathrm{N}(\mu^{*},\Sigma^{*})$ with unknown $\theta^{*}=(\mu^{*},\Sigma^{*})$, $Q$ is a probability distribution for contaminated data, and $\epsilon$ is a contamination fraction. Both $Q$ and $\epsilon$ are unknown. The dependency of $P_{\epsilon}$ on $(\theta^{*},Q)$ is suppressed in the notation. Equivalently, the data $(X_{1},\ldots,X_{n})$ can be represented in a latent model: $(U_{1},X_{1}),\ldots,(U_{n},X_{n})$ are independent, and $U_{i}$ is Bernoulli with $\mathrm{P}(U_{i}=1)=\epsilon$ and $X_{i}$ is drawn from $P_{\theta^{*}}$ or $Q$ given $U_{i}=0$ or 1 for $i=1,\ldots,n$.

For theoretical analysis, we consider two choices of the parameter space. The first choice is $\Theta_{1}=\{(\mu,\Sigma):\mu\in\mathbb{R}^{p},\Sigma\succeq 0,\|\Sigma\|_{\max}\leq M_{1}\}$ for a constant $M_{1}>0$. Equivalently, the diagonal elements of $\Sigma$ is upper bounded by $M_{1}$ for $(\mu,\Sigma)\in\Theta_{1}$. The second choice is $\Theta_{2}=\{(\mu,\Sigma):\mu\in\mathbb{R}^{p},\Sigma\succeq 0,\|\Sigma\|_{\mathrm{op}}\leq M_{2}\}$ for a constant $M_{2}>0$. For simplicity, the dependency of $\Theta_{1}$ on $M_{1}$ or $\Theta_{2}$ on $M_{2}$ is suppressed in the notation. For the second parameter space $\Theta_{2}$, the minimax rates in the $L_{2}$ and operator norms have been shown to be achieved using matrix depth (Chen, Gao and Ren (2018)) and GANs with certain neural network discriminators (Gao, Yao and Zhu (2020)).

Our work aims to investigate adversarial algorithms with a simple linear class of spline discriminators for computational tractability, and establish various error bounds for the proposed estimators, including those matching the minimax rates in the maximum norms for the location and scatter estimation over $\Theta_{1}$, and, provided that $\epsilon\sqrt{n}$ is bounded by a constant (independent of $p$), the minimax rates in the $L_{2}$ and Frobenius norms over $\Theta_{2}$.