[20] Vikas K. Garg, Adam Tauman Kalai, Katrina Ligett, and Zhiwei Steven Wu. Learn to expect the unexpected: Probably approximately correct domain generalization. In AISTATS, volume 130, pages 3574-3582, 2021.
[21] Muhammad Ghifary, W. Bastiaan Kleijn, Mengjie Zhang, and David Balduzzi. Domain generalization for object recognition with multi-task autoencoders. In ICCV, pages 2551-2559. IEEE Computer Society, 2015.
[22] Tejas Gokhale, Swaroop Mishra, Man Luo, Bhavdeep Singh Sachdeva, and Chitta Baral. Generalized but not robust? comparing the effects of data modification methods on out-of-domain generalization and adversarial robustness. In ACL, pages 2705-2718, 2022.
[23] Noah Golowich, Alexander Rakhlin, and Ohad Shamir. Size-independent sample complexity of neural networks. In  $COLT$ , volume 75, pages 297-299, 2018.
[24] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial nets. In NeurIPS, pages 2672-2680, 2014.
[25] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[26] Ishaan Gulrajani and David Lopez-Paz. In search of lost domain generalization. In  $ICLR$ , 2021.
[27] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770-778, 2016.
[28] Zeyi Huang, Haohan Wang, Eric P. Xing, and Dong Huang. Self-challenging improves cross-domain generalization. In ECCV, volume 12347, pages 124-140, 2020.
[29] Adam Ibrahim, Charles Guille-Escuret, Ioannis Mitliagkas, Irina Rish, David Krueger, and Pouya Bashivan. Towards out-of-distribution adversarial robustness. CoRR, abs/2210.03150, 2022.
[30] Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Stable neural ODE with lyapunov-stable equilibrium points for defending against adversarial attacks. In NeurIPS, pages 14925-14937, 2021.
[31] Justin Khim and Po-Ling Loh. Adversarial risk bounds for binary classification via function transformation. CoRR, abs/1810.09519, 2018.
[32] Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. CoRR, abs/2010.01950, 2020.
[33] David Krueger, Ethan Caballero, Jorn-Henrik Jacobsen, Amy Zhang, Jonathan Binas, Dinghuai Zhang, Rémi Le Priol, and Aaron C. Courville. Out-of-distribution generalization via risk extrapolation (rex). In ICML, volume 139, pages 5815-5826, 2021.
[34] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In ICLR, 2017.
[35] Yann LeCun. The mnist database of handwritten digits. http://yann.lecun.com/exdb/mnist/, 1998.
[36] Jaeho Lee and Maxim Raginsky. Minimax statistical learning with Wasserstein distances. In NeurIPS, pages 2692-2701, 2018.
[37] Boqi Li and Weiwei Liu. WAT: improve the worst-class robustness in adversarial training. In AAAI, pages 14982-14990, 2023.
[38] Da Li, Yongxin Yang, Yi-Zhe Song, and Timothy M. Hospedales. Deeper, broader and artier domain generalization. In ICCV, pages 5543-5551, 2017.
[39] Da Li, Yongxin Yang, Yi-Zhe Song, and Timothy M. Hospedales. Learning to generalize: Meta-learning for domain generalization. In AAAI, pages 3490-3497, 2018.