mlsanityData to 7 Oct 2026

Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networks

arXiv 2510.10000 ↗First posted 11 Oct 2025cs.LG math.OC stat.MLcited by 0

Not on the map. Why?

Abstract (arXiv)

Wasserstein distributionally robust optimization (WDRO) provides a framework for adversarial robustness, yet existing methods based on global Lipschitz continuity or strong duality often yield loose upper bounds or require prohibitive computation. We address these limitations with a primal approach and adopt a notion of exact Lipschitz certificates to tighten this upper bound of WDRO. For ReLU networks, we leverage the piecewise-affine structure on activation cells to obtain an exact tractable characterization of the corresponding WDRO problem. We further extend our analysis to modern architectures with smooth activations (e.g., GELU, SiLU), such as Transformers. Additionally, we propose novel Wasserstein Distributional Attacks (WDA, WDA++) that construct candidates for the worst-case distribution. Compared to existing attacks that are restricted to point-wise perturbations, our methods offer greater flexibility in the number and location of attack points. Extensive evaluations demonstrate that our proposed framework achieves competitive robust accuracy against state-of-the-art baselines while offering tighter certificates than existing methods. Our code is available at https://github.com/OLab-Repo/WDA.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 53 of its 66 references that are in the map. First posted on arXiv 11 Oct 2025.

Builds on

53 of 66 references.

References · 53

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  2. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Gaussian Error Linear Units (GELUs)cited by 3,431
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  10. 2016Adversarial examples in the physical worldcited by 1,762
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2020WILDS: A Benchmark of in-the-Wild Distribution Shiftscited by 1,366
38 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2019Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shiftcited by 1,274
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  5. 2017Sigmoid-Weighted Linear Units for Neural Network Function Approximation in Reinforcement Learningcited by 935
  6. 2020On Layer Normalization in the Transformer Architecturecited by 906
  7. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  8. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  9. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  10. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  11. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  12. 2020Measuring Robustness to Natural Distribution Shifts in Image Classificationcited by 452
  13. 2019On Evaluating Adversarial Robustnesscited by 442
  14. 2018Lipschitz regularity of deep neural networks: analysis and efficient estimationcited by 413
  15. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  16. 2015Data-driven Distributionally Robust Optimization Using the Wasserstein Metric: Performance Guarantees and Tractable Reformulationscited by 285
  17. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  18. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 241
  19. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  20. 2016Distributionally Robust Stochastic Optimization with Wasserstein Distancecited by 182
  21. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  22. 2020The Lipschitz Constant of Self-Attentioncited by 171
  23. 2019Wasserstein Distributionally Robust Optimization: Theory and Applications in Machine Learningcited by 169
  24. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  25. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  26. 2020Exactly Computing the Local Lipschitz Constant of ReLU Networkscited by 102
  27. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  28. 2023Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Modelscited by 79
  29. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  30. 2022Efficiently Computing Local Lipschitz Constants of Neural Networks via Bound Propagationcited by 45
  31. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  32. 2023How Smooth Is Attention?cited by 44
  33. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  34. 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
  35. 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 35
  36. 2024MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsificationcited by 20
  37. 2023Wasserstein distributional robustness of neural networkscited by 15
  38. 2023MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustnesscited by 12

50 most cited of 53 All 53 (JSON)

Built on by

Not cited yet.