mlsanityData to 7 Oct 2026

Wasserstein distributional robustness of neural networks

arXiv 2306.09844 ↗First posted 16 Jun 2023cs.LG cs.CV math.OCcited by 15

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are known to be vulnerable to adversarial attacks (AA). For an image recognition task, this means that a small perturbation of the original can result in the image being misclassified. Design of such attacks as well as methods of adversarial training against them are subject of intense research. We re-cast the problem using techniques of Wasserstein distributionally robust optimization (DRO) and obtain novel contributions leveraging recent insights from DRO sensitivity analysis. We consider a set of distributional threat models. Unlike the traditional pointwise attacks, which assume a uniform bound on perturbation of each input data point, distributional threat models allow attackers to perturb inputs in a non-uniform way. We link these more general attacks with questions of out-of-sample performance and Knightian uncertainty. To evaluate the distributional robustness of neural networks, we propose a first-order AA algorithm and its multi-step version. Our attack algorithms include Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) as special cases. Furthermore, we provide a new asymptotic estimate of the adversarial accuracy against distributional threat models. The bound is fast to compute and first-order accurate, offering new insights even for the pointwise AA. It also naturally yields out-of-sample performance guarantees. We conduct numerical experiments on the CIFAR-10 dataset using DNNs on RobustBench to illustrate our theoretical results. Our code is available at https://github.com/JanObloj/W-DRO-Adversarial-Methods.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Builds on 39 of its 61 references that are in the map. First posted on arXiv 16 Jun 2023.

Builds on

39 of 61 references.

References · 39

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  9. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  10. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  12. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
27 more
  1. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  2. 2018Generalizing to Unseen Domains via Adversarial Data Augmentationcited by 451
  3. 2021Towards Out-Of-Distribution Generalization: A Surveycited by 431
  4. 2017Certifying Some Distributional Robustness with Principled Adversarial Trainingcited by 333
  5. 2015Data-driven Distributionally Robust Optimization Using the Wasserstein Metric: Performance Guarantees and Tractable Reformulationscited by 285
  6. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  7. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  8. 2021Improving Robustness using Generated Datacited by 233
  9. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  10. 2016Distributionally Robust Stochastic Optimization with Wasserstein Distancecited by 182
  11. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  12. 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 181
  13. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
  14. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  15. 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
  16. 2016Measuring Neural Net Robustness with Constraintscited by 90
  17. 2020Adversarial Distributional Training for Robust Deep Learningcited by 79
  18. 2020Enabling certification of verification-agnostic networks via memory-efficient semidefinite programmingcited by 65
  19. 2020Finite-Sample Guarantees for Wasserstein Distributionally Robust Optimization: Breaking the Curse of Dimensionalitycited by 49
  20. 2022A Unified Wasserstein Distributional Robustness Framework for Adversarial Trainingcited by 36
  21. 2020Sensitivity analysis of Wasserstein distributionally robust optimization problemscited by 10
  22. 2021On the regularized risk of distributionally robust learning over deep neural networkscited by 8
  23. 2017Computational aspects of robust optimized certainty equivalents and option pricingcited by 7
  24. 2017Computational Methods for Martingale Optimal Transport problemscited by 6
  25. 2022Coresets for Wasserstein Distributionally Robust Optimization Problemscited by 6
  26. 2022The out-of-sample prediction error of the square-root-LASSO and related estimatorscited by 4
  27. 2021Human Imperceptible Attacks and Applications to Improve Fairnesscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 7; 2026: 4.

15 papers.

Sort:

  1. 2025Mitigating Spurious Correlation via Distributionally Robust Learning with Hierarchical Ambiguity Setscited by 7
  2. 2024Attack Anything: Blind DNNs via Universal Background Adversarial Attackcited by 3
  3. 2024A local squared Wasserstein-2 method for efficient reconstruction of models with uncertaintycited by 2
  4. 2024Wasserstein Distributionally Robust Shallow Convex Neural Networkscited by 2
  5. 2025Distributional Adversarial Attacks and Training in Deep Hedgingcited by 2
  6. 2026Robust Generalization with Adaptive Optimal Transport Priors for Decision-Focused Learningcited by 2
  7. 2025Wasserstein distributional adversarial training for deep neural networkscited by 1
  8. 2025Improving Mixup Calibration with Wasserstein Distributionally Robust Optimizationcited by 1
  9. 2024Generalizing Few Data to Unseen Domains Flexibly Based on Label Smoothing Integrated with Distributionally Robust Optimizationcited by 0
  10. 2025Temporal Robustness in Discrete Time Linear Dynamical Systemscited by 0
  11. 2025Distributionally robust approximation property of neural networkscited by 0
  12. 2025Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networkscited by 0
3 more
  1. 2026Concave Certificates: Geometric Framework for Distributionally Robust Risk and Complexity Analysiscited by 0
  2. 2026Age Predictors Through the Lens of Generalization, Bias Mitigation, and Interpretability: Reflections on Causal Implicationscited by 0
  3. 2026Optimal Transport Reweighting for Robust Learning under Spurious Correlations and Label Noisecited by 0