SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\mathcal {R} _ {\delta} = \frac {A _ {\delta}}{A} \geqslant \frac {W (0) - V (0)}{W (0) - V (0)}.
$$
Proof of Theorem 5.1. By adding and subtracting  $W(\delta) \mathbb{1}_S$ , Proposition 5.2 now gives
$$
\begin{array}{l} V (\delta) = \sup  _ {Q \in B _ {\delta} (P)} \mathbf {E} _ {Q} \left[ C (\delta) \mathbb {1} _ {S} + W (\delta) \mathbb {1} _ {S ^ {c}} \right] + o (\delta) \\ = \sup  _ {Q \in B _ {\delta} (P)} \mathbf {E} _ {Q} \left[ W (\delta) - \left(W _ {\delta} - C (\delta)\right) \mathbb {1} _ {S} \right] + o (\delta) \\ = W (\delta) - (W (\delta) - C (\delta)) A _ {\delta} + o (\delta). \\ \end{array}
$$
Naturally, we can rewrite loss  $V(0)$  using the usual tower property
$$
V (0) = A C (0) + (1 - A) W (0) = W (0) - (W (0) - C (0)) A.
$$
Together these yield
$$
\begin{array}{l} V (\delta) - V (0) = \left(1 - A _ {\delta}\right) \left(W (\delta) - W (0)\right) + A _ {\delta} \left(C (\delta) - C (0)\right) + \left(W (0) - C (0)\right) \left(A - A _ {\delta}\right) + o (\delta) \\ \geqslant (W (0) - C (0)) (A - A _ {\delta}) + o (\delta). \\ \end{array}
$$
Plugging in  $C(0) = [V(0) - (1 - A)W(0)] / A$  completes the proof.
B Bounds on Out-of-Sample Performance
The concentration inequality in Fournier and Guillin (2015) is pivotal to derive the out-of-sample performance bounds. It characterizes how likely an empirical measure can deviate from its generating distribution. We note that recently (Larsson et al., 2023, Olea et al., 2023) obtained concentration inequalities considering other transport costs, including sliced Wasserstein distances which are of particular interest for regression tasks. Recall we denote  $\hat{P}$  as the empirical measure of training set  $\mathcal{D}_{tr}$  with size  $N$  and  $\check{P}$  as the empirical measure of test set  $\mathcal{D}_{tt}$  with size  $M$ . We use the same  $\hat{\mathbf{\Gamma}}$ ,  $\check{\mathbf{\Gamma}}$  notations to denote quantities computed from  $\hat{P}$  and  $\check{P}$ , respectively. We restate the concentration inequality as
$$
\mathbb {P} \left(\mathcal {W} _ {p} (\widehat {P}, P) \geqslant \varepsilon\right) \leqslant K \exp \left(- K N \varepsilon^ {n}\right),
$$
where  $K$  is a constant only depending on  $n$  and  $p$ . For convenience,  $K$  might change from line to line in this section. Together with Theorem 5.1, we give an out-of-sample clean accuracy guarantee in Corollary 5.3.
Proof of Corollary 5.3. By triangle inequality and concentration inequality, we have
$$
\mathbb {P} \left(\mathcal {W} _ {p} (\check {P}, \hat {P}) \geqslant 2 \varepsilon\right) \leqslant \mathbb {P} \left(\mathcal {W} _ {p} (\check {P}, P) \geqslant \varepsilon\right) + \mathbb {P} \left(\mathcal {W} _ {p} (P, \hat {P}) \geqslant \varepsilon\right) \leqslant 2 K \exp \left(- K \varepsilon^ {n} \min  \{M, N \}\right).
$$
With Theorem 5.1, it implies that with probability at least  $1 - 2K\exp (-K\varepsilon^n\min \{M,N\})$  , we have
$$
\check {A} \geqslant \hat {A} _ {2 \varepsilon} \geqslant \hat {A} \hat {R} _ {2 \varepsilon} ^ {l} + o (\varepsilon).
$$
The following results provide a guarantee on the out-of-sample adversarial performance.
Proof of Theorem 5.4. Estimates in Fournier and Guillin (2015) imply that with probability at least  $1 - K\exp (-KN\varepsilon^{n})$ , we have  $B_{\delta}(\hat{P})\subseteq B_{\delta +\varepsilon}(P)$ . Hence, we derive  $V(\delta)\leqslant \hat{V} (\delta +\varepsilon)$ . On the other hand, since  $J_{\theta}$  is L-Lipschitz, from (Bartl et al., 2021, Appendix Corollary 7.5) we obtain
$$
\widehat {V} (\delta + \varepsilon) = \widehat {V} (\delta) + \varepsilon \sup _ {Q \in B _ {\delta} ^ {\star} (\widehat {P})} \left(\mathbf {E} _ {Q} \| \nabla_ {x} J _ {\theta} (x, y) \| _ {*} ^ {q}\right) ^ {1 / q} + o (\varepsilon),
$$
where  $B_{\delta}^{\star}(\hat{P}) = \arg \max_{Q\in B_{\delta}(\hat{P})}\mathbf{E}_{Q}[J_{\theta}(x,y)]$ . Combining above results, we conclude that with probability at least  $1 - K\exp (-KN\varepsilon^{n})$
$$
V (\delta) \leqslant \widehat {V} (\delta) + \varepsilon \sup _ {Q \in B _ {\delta} ^ {\star} (\widehat {P})} \left(\mathbf {E} _ {Q} \| \nabla_ {x} J _ {\theta} (x, y) \| _ {*} ^ {q}\right) ^ {1 / q} + o (\varepsilon) \leqslant \widehat {V} (\delta) + \mathsf {L} \varepsilon .
$$
Proof Corollary 5.5. By Theorem 5.1, we have
$$
\Delta A _ {\delta} (P) \leqslant \frac {V (\delta) - V (0)}{W (0) - C (0)} + o (\delta).
$$
We now bound the numerator and denominator separately. By taking  $\varepsilon = \delta$  in Theorem 5.4, we have with probability at least  $1 - K\exp (-KN\delta^n)$ ,  $V(\delta)\leqslant \widehat{V} (\delta) + \mathsf{L}\delta$ . Similarly, we can also show that  $V(0)\geqslant \widehat{V} (0) - \mathsf{L}\delta$ . Hence, we have with probability at least  $1 - K\exp (-KN\delta^n)$ ,
$$
V (\delta) - V (0) \leqslant \widehat {V} (\delta) - \widehat {V} (0) + 2 L \delta .
$$
For the denominator, notice that  $\mathbb{P}(\hat{P}\in B_{\delta}(P))\geqslant 1 - K\exp (-KN\exp (\delta^n))$ . By Assumption 5.1 (ii), we have with probability at least  $1 - K\exp (-KN\delta^n)$
$$
\mathcal {W} _ {p} (\hat {P} (\cdot | S), P (\cdot | S)) + \mathcal {W} _ {p} (\hat {P} (\cdot | S ^ {c}), P (\cdot | S ^ {c})) = o (\delta).
$$
$$
\left| C (0) - W (0) - \widehat {C} (0) + \widehat {W} (0) \right| = o (\delta).
$$
Combining above results, we conclude that with probability at least  $1 - K\exp (-KN\delta^n)$
C W-PGD Algorithm
We give the details of W-PGD algorithm implemented in this paper. Recall in Section 4, we propose
$$
x ^ {t + 1} = \operatorname {p r o j} _ {\delta} \left(x ^ {t} + \alpha h \left(\nabla_ {x} J _ {\theta} \left(x ^ {t}, y\right)\right) \| \Upsilon^ {- 1} \nabla_ {x} J _ {\theta} \left(x ^ {t}, y\right) \| _ {s} ^ {q - 1}\right), \tag {17}
$$
where we take  $\| \cdot \| = \| \cdot \|_r$  and hence  $h$  is given by  $\langle h(x), x \rangle = \| x \|_s$ . In particular,  $h(x) = \operatorname{sgn}(x)$  for  $s = 1$  and  $h(x) = x / \| x \|_2$  for  $s = 2$ . The projection step  $\mathrm{proj}_{\delta}$  is based on any off-the-shelf optimal transport solver  $\mathcal{S}$  which pushes the adversarial images back into the Wasserstein ball along the geodesics. The solver  $\mathcal{S}$  gives the optimal matching  $T$  between the original test data  $\mathcal{D}_{tt}$  and the perturbed test data  $\mathcal{D}_{tt}'$ . Formally,  $\mathrm{proj}_{\delta}$  maps
$$
x ^ {\prime} \mapsto x + \delta d ^ {- 1} (T (x) - x),
$$
where  $d = \left\{\frac{1}{|\mathcal{D}_{tt}|}\sum_{(x,y)\in \mathcal{D}_{tt}}\| T(x) - x\| _r^p\right\}^{1 / p}$  the Wasserstein distance between  $\check{P}$  and  $\check{P}'$ . See Algorithm 1 for pseudocodes. In numerical experiments, due to the high computational cost of the OT solver, we always couple each image with its own perturbation.
Algorithm 1: W-PGD Attack
Input: Model parameter  $\theta$ , attack strength  $\delta$ , ratio  $r$ , iteration step  $I$ , OT solver  $\mathcal{S}$ ;  
Data: Test set  $\mathcal{D}_{tt} = \{(x,y) | (x,y) \sim P\}$  with size  $M$ ;  
def  $\mathrm{proj}_{\delta}(\mathcal{D}_{tt}, \mathcal{D}_{tt}')$ :  
[ T = \mathcal{S}(\mathcal{D}_{tt}, \mathcal{D}_{tt}') ] // Generate transport map from OT solver  
[ d = \left\{\frac{1}{M} \sum_{(x,y) \in \mathcal{D}_{tt}} \|T(x) - x\|_r^p\right\}^{1/p} ] // Calculate the Wasserstein distance  
for  $(x,y)$  in  $\mathcal{D}_{tt}$  do  
[ x' \gets x + \delta d^{-1}(T(x) - x); \quad // \text{Project back to the Wasserstein ball} ]  
[ x' \gets \operatorname{clamp}(x', 0, 1); ]  
return  $\mathcal{D}_{tt}'$ .  
def attack( $\mathcal{D}_{tt}$ ):  
\[
\begin{aligned}
& \alpha \gets r\delta / I; \\
& \mathcal{D}_{tt}^{adv} \gets \mathcal{D}_{tt}; \\
& \text{for } 1 \leqslant i \leqslant I \text{ do} \\
& \Upsilon = \left(\frac{1}{M} \sum_{(x,y) \in \mathcal{D}_{tt}^{adv}} \| \nabla_x J_\theta(x,y)\|_s^q\right)^{1/q}; \\
& \text{for } (x,y) \in \mathcal{D}_{tt}^{adv} \text{ do} \\
& \text{for } (x,y) \gets (x + \alpha h(\nabla_x J_\theta(x,y)) \| \Upsilon^{-1} \nabla_x J_\theta(x,y)\|_s^{q-1}, y);
\end{aligned}
\]  
\[
\begin{aligned}
& \mathcal{D}_{tt}^{adv} = \mathrm{proj}_{\delta}(\mathcal{D}_{tt}, \mathcal{D}_{tt}^{adv}); \\
& \text{return } \mathcal{D}_{tt}^{adv}.
\end{aligned}
\]
D Wasserstein Distributionally Adversarial Training
Theorem 4.1 offers natural computationally tractable approximations to the W-DRO training objective
$$
\inf  _ {\theta \in \Theta} \sup  _ {Q \in B _ {\delta} (P)} \mathbf {E} _ {Q} [ J _ {\theta} (x, y) ]
$$
and its extension
$$
\inf  _ {\theta \in \Theta} \sup  _ {\pi \in \Pi_ {\delta} (P, \cdot)} \mathbf {E} _ {\pi} \left[ J _ {\theta} \left(x, y, x ^ {\prime}, y ^ {\prime}\right) \right].
$$
First, consider a regularized optimization problem:
$$
\inf  _ {\theta \in \Theta} \mathbf {E} _ {P} \left[ J _ {\theta} (x, y) + \delta \Upsilon \right].
$$
The extra regularization term  $\delta \Upsilon$  allows us to approximate the W-DRO objective above. A similar approach has been studied in Garcia Trillos and Garcia Trillos (2022) in the context of Neural ODEs, and Sinha et al. (2018) considered Wasserstein distance penalization and used duality.
Training is done by replacing  $P$  with  $\widehat{P}$ . Note that  $\widehat{\Upsilon}$  is a statistics over the whole data set. In order to implement stochastic gradient descent method, an asynchronous update of the parameters is needed. We consider  $\| \cdot \|_{*} = \| \cdot \|_{s}$  and, by a direct calculation, obtain
$$
\nabla_ {\theta} \widehat {\Upsilon} = \widehat {\Upsilon} ^ {1 - q} \mathbf {E} _ {\widehat {P}} \big [ \langle \nabla_ {x} \nabla_ {\theta} J _ {\theta} (x, y), \mathrm {s g n} (\nabla_ {x} J _ {\theta} (x, y)) \rangle \| \nabla_ {x} J _ {\theta} (x, y) \| _ {s} ^ {q - 1} \big ].
$$
We calculate the term  $\widehat{\Upsilon}^{1 - q}$  from the whole training dataset using parameter  $\theta^*$  from previous epoch; we estimate
$$
\mathbf {E} _ {\hat {P}} \left[ \langle \nabla_ {x} \nabla_ {\theta} J _ {\theta} (x, y), \operatorname {s g n} (\nabla_ {x} J _ {\theta} (x, y)) \rangle \| \nabla_ {x} J _ {\theta} (x, y) \| _ {s} ^ {q - 1} \right]
$$
on a mini-batch and update current parameter  $\theta$  after each batch. At the end of an epoch, we update  $\theta^{*}$  to  $\theta$ . See Algorithm 2 for pseudocodes.
Another classical approach consists in clean training the network but on the adversarial perturbed data. To this we employ the Wasserstein FGSM attack described in Section 4 and shift training data  $(x,y)$  by
$$
(x, y) \mapsto \Big (\operatorname {p r o j} _ {\delta} \big (x + \delta h \big (\nabla_ {x} J _ {\theta} (x, y) \big) \| \widehat {\Upsilon} ^ {- 1} \nabla_ {x} J _ {\theta} (x, y) \| _ {s} ^ {q - 1} \big), y \Big).
$$
Similarly to the discussion above, an asynchronous update of parameters is applied, see Algorithm 3 for details. Empirical evaluation of the performance of Algorithms 2 and 3 is left for future research.
Algorithm 2: Loss Regularization
Input: Initial parameter  $\theta_0$ , hyperparameter  $\delta$ , learning rate  $\eta$ ;  
Data: Training set  $\mathcal{D}_{tr} = \{(x,y) | (x,y) \sim P\}$  with size  $N$ ;  
 $\theta^* \gets \theta_0, \theta \gets \theta_0$ ;  
repeat  
 $\Upsilon = \left( \frac{1}{N} \sum_{(x,y) \in \mathcal{D}_{tr}} \| \nabla_x J_\theta * (x,y) \|_s^q \right)^{1/q}$ ; // Calculate  $\Upsilon$  from  $\theta^*$   
repeat  
Generate a mini-batch  $B$  with size  $|B|$ ;  
// Calculate gradient  $\nabla_\theta J_\theta(x,y)$ $\nabla_\theta J_\theta(x,y) = \frac{1}{|B|} \sum_{(x,y) \in B} \nabla_\theta J_\theta(x,y)$ ;  
// Calculate gradient  $\nabla_\theta \Upsilon$ $\nabla_\theta \Upsilon = \Upsilon^{1-q} \frac{1}{|B|} \sum_{(x,y) \in B} \langle \nabla_x \nabla_\theta J_\theta(x,y), h(\nabla_x J_\theta(x,y)) \rangle \| \nabla_x J_\theta(x,y) \|_s^{q-1}$ ;  
// Update  $\theta$  by stochastic gradient descent  
 $\theta \gets \theta - \eta (\nabla_\theta J_\theta(x,y) + \delta \nabla_\theta \Upsilon)$ ;  
until the end of epoch;  
 $\theta^* \gets \theta$ ;  
until the end condition.
Algorithm 3: Adversarial Data Perturbation
Input: Initial parameter  $\theta_0$ , hyperparameter  $\delta$ , learning rate  $\eta$ ;  
Data: Training set  $\mathcal{D}_{tr} = \{(x,y) | (x,y) \sim P\}$  with size  $N$ ;  
 $\theta^* \gets \theta_0, \theta \gets \theta_0$ ;  
repeat  
 $\Upsilon = \left( \frac{1}{N} \sum_{(x,y) \in \mathcal{D}_{tr}} \| \nabla_x J_\theta * (x,y) \|_s^q \right)^{1/q}$ ; // Calculate  $\Upsilon$  from  $\theta^*$   
repeat  
Generate a mini-batch  $B$  with size  $|B|$ ;  
// Do W-FGSM attack on  $B$ $(x,y) \gets (\mathrm{proj}_{\delta}(x + \delta h(\nabla_x J_\theta(x,y)) \| \Upsilon^{-1} \nabla_x J_\theta(x,y) \|_s^{q-1}), y)$ ;  
// Update  $\theta$  by stochastic gradient descent  
 $\theta \gets \theta - \eta \frac{1}{|B|} \sum_{(x,y) \in B} \nabla_\theta J_\theta(x,y)$ ;  
until the end of epoch;  
 $\theta^* \gets \theta$ ;  
until the end condition.
E Robust Performance Bounds
As pointed out in Section 7, with attack budget  $\delta = 8 / 255$  some neural networks have lower bounds  $\mathcal{R}^l$  surpassing the reference value  $\mathcal{R}$  obtained from AutoAttack. It is because for most of neural networks  $\delta = 8 / 255$  is outside the linear approximation region of the adversarial loss  $V(\delta)$ , and we underestimate  $V(\delta)$  by using first order approximations in Theorem 4.1. In Figure 4, we plot our proposed bounds  $\mathcal{R}^u$  and  $\mathcal{R}^l$  against  $\mathcal{R}$  for  $(\mathcal{W}_{\infty}, l_{\infty})$  threat model with  $\delta = 8 / 255$ .
In general, to compute more accurate lower bounds on the adversarial accuracy, as explained in Section 6, we can consider the first lower bound in (13). We thus introduce  $\mathcal{R}^l (n)$  given by
$$
\mathcal {R} ^ {l} (n) = \frac {W (0) - V (\delta , n)}{W (0) - V (0)},
$$
where  $V(\delta, n)$  is the approximated adversarial loss computed by a W-PDG- $(n)$  attack. In Figures 5 and 6, we include plots for different bounds of  $\mathcal{R}$  under  $\mathcal{W}_2$  threat models which illustrate the changing performance of the lower bound in Theorem 5.1 as  $V(\delta)$  is computed to an increasing accuracy. We achieve this performing a W-PDG- $(n)$  attack, where  $n = 5, 50$ . An  $n = 50$  attack takes
Figure 4:  $\mathcal{R}^u\& \mathcal{R}^l$  versus  $\mathcal{R}$ . Bounds are computed based on CE loss across neural networks on RobustBench under a  $(\mathcal{W}_{\infty},l_{\infty})$  threat model with budget  $\delta = 8 / 255$ . At this  $\delta$  linear approximation may be inefficient as seen from the blue dots crossing the diagonal.
10 times more computational time than the  $n = 5$  attack and the latter is 5 times more computational costly than the one-step bound  $\mathcal{R}^l$ . The plots thus illustrate a trade-off between computational time and accuracy of the proposed lower bound. For clarity, we also point out that Figure 5 has a different scaling from the other plots.
In practice, we would compare our one-step-attack bound  $\mathcal{R}^l$  with the bound obtained by iterating the attack several steps: we propose W-PGD(5) in our paper and report  $\mathcal{R}^l (5)$ . If the difference between the two is small it indicates linear approximation is working very well. If the difference is significant, we would use  $\mathcal{R}^l (5)$  and maybe compare it against  $\mathcal{R}^l (10)$ . If we observe that  $V(\delta)$  is convex - as for the CE loss under  $(\mathcal{W}_{\infty},l_{\infty})$  attack - the lower bound should decrease. In this case, the one-step bound may in fact not be a lower bound for too large as shown in Figure 4. If we observe  $V(\delta)$  is concave - as for the ReDLR loss and our  $\mathcal{W}_2$  attacks - the one-step lower bound might be too low and will increase with additional PGD steps. This is visible in Figures 5 and 6.
Figure 5: Comparison of lower bounds computed from different W-PDG- $(n)$  attacks, where  $n = 5, 50$ . Bounds are computed based on CE loss across neural networks on RobustBench under  $(\mathcal{W}_2, l_{\infty})$  threat models with budget  $\delta = 1/510, 1/255$ .
F Experiments on Other Datasets
We illustrate our theoretical results on CIFAR-100 (Krizhevsky, 2009) and ImageNet (Deng et al., 2009) datasets. We analyze all the networks included on RobustBench leaderboards. Only  $l_{\infty}$  norm on images is considered as RobustBench does not provide any models for  $l_{2}$  for these datasets. Similar to CIFAR-10, CIFAR-100 is a low resolution dataset but with 100 classes. Each class contains 500 training images and 100 testing images, and each image has  $32 \times 32$  pixels in 3 color channels. For
Figure 6: Comparison of lower bounds computed from different W-PDG- $(n)$  attacks, where  $n = 5, 50$ . Bounds are computed based on ReDLR loss across neural networks on RobustBench under  $(\mathcal{W}_2, l_2)$  threat models with budget  $\delta = 1/32, 1/16$ .
ImageNet dataset, we use a subset of 5000 images selected by RobustBench. The size of image may vary among different preprocessing. A typical size is  $224 \times 224$  pixels in 3 color channels. Numerical results mirror those for CIFAR-10 in the body paragraph.
Before the discussion on the numerical results, we remark that the computation time of our proposed methods do not suffer from the curse of dimensionality. Despite the fact that complexity of Wasserstein distance in higher dim can cause troubles, this does not happen for our methods due to our formulae for the first order sensitivity. This means that the approximation to the worst case Wasserstein adversarial attack is explicit and only requires us to compute the gradient  $\nabla_{x}J_{\theta}(x,y)$ . In consequence, the size of the image only affects the first layer of the DNN and the number of classes affects the last layer of the DNN. The computational time is thus mostly determined by the (hidden) architecture of the DNN model we consider.
In Figure 7, we compare the adversarial accuracy under pointwise threat models and distributional threat models. For  $\mathcal{W}_{\infty}$  threat model, we apply a combination PGD-50 attack based on CE, DLR losses to obtain the reference adversarial accuracy; for  $\mathcal{W}_2$  threat model, we apply a 50-step W-PGD-ReDLR to obtain the reference WD-adversarial accuracy. Similar to CIFAR-10, we observe a drop of adversarial accuracy under distributional threat models on CIFAR-100 and ImageNet.
In Figure 8, we plot the bounds  $\mathcal{R}^l$  and  $\mathcal{R}^u$  against  $\mathcal{R}$  on CIFAR-100 and ImageNet. We compute bounds under  $\mathcal{W}_{\infty}$ -attack based on CE loss across neural networks on RobustBench;  $\mathcal{W}_2$ -attack for the same sets of neural networks with bounds computed using ReDLR loss, where  $\mathcal{R}^l(5)$  denotes the lower bound (eq. (13)) computed from a 5-step W-PGD attack. For pointwise threat models, our upper and lower bounds sandwich the true (AutoAttack) accuracy ratio very well at a fraction of the computational cost. For distributional threat models, our bounds work but the tightness of the bound is model-dependent. We display also the improved bound obtained with 5 steps of W-PGD attack which leads to a marked improvement in the lower bound's performance. This is akin to Figure 5 in Appendix E.
G Comparison to Existing Attack Methods
In this section, we compare our proposed W-PGD attack with existing attack methods. We reiterate that our method focuses on distributional threats under a given budget  $\delta$ . While the W-DRO formulation has been explored in numerous works, as discussed, we believe that none of them proposed an AA method specifically tailored for the distributional threat under a given attack budget.
We illustrate the main difference between our sensitivity approach and duality approach employed in Sinha et al. (2018), Volpi et al. (2018), Hua et al. (2022), etc. When using duality of W-DRO, the optimization involves a minimization over the Lagrangian multiplier  $\lambda$ . However, in the aforementioned works, a fixed  $\lambda$  is used. While their choice of  $\lambda$  may be optimal for some budget  $\delta$ , there is no universal approach to achieve an optimal attack for a given budget  $\delta$ . In contrast, our attack is an explicit first-order approximation designed to be optimal for a given budget  $\delta$ . It only involves  $\nabla_{x}J_{\theta}(x,y)$  and its norms which are fast to compute using standard methods.
Figure 7: Shortfall of WD-adversarial accuracy on CIFAR-100 (left) and ImageNet (right).
Figure 8:  $\mathcal{R}^u$  &  $\mathcal{R}^l$  versus  $\mathcal{R}$  on CIFAR-100 (top) and ImageNet (bottom).
Despite no existing baseline for addressing distributional threat, it is possible to reverse engineer a comparison setup ex post. We employ CW attack which gives the minimum distortion needed to successfully attack an image. Due to the computational cost of CW attack, the experiment is conducted on the first 1000 correctly classified images from the ImageNet subset used by RobustBench. By calculating the square root of the mean square of the minimum distortion over this chosen dataset, we obtain a reference  $(\mathcal{W}_2,l_\infty)$  budget 0.000711 to perform our distributional attacks. Employing our W-PGD(50)-ReDLR attack results in 934 images being successfully attacked out of the 1000. The CW attack, which by construction was successful on all 1000 images, took ca 4.5h to run (on a Tesla V100-SXM2-32GB-LS GPU) and the time needed to be scaled linearly with the number of images as the attack has to be performed image by image. In contrast, our attack took ca 50min to run (on a NVIDIA A100-SXM4-40GB GPU). In addition, we use mini-batches, which allows for computational speed improvements based on the available GPU memory.
H Additional Numerical Results
In Tables 3 and 4, we report the clean accuracy and the adversarial accuracy under different threat models for all but 4 neural networks available on RobustBench (model zoo). All networks are named after their labels on RobustBench (model zoo). We remove Standard  $l_{\infty}$ -network and Standard  $l_{2}$ -network because they are not robust to any attacks. In addition, we also remove Kang2021Stable which contains NeuralODE blocks and Ding2020MMA which has a huge gap between adversarial accuracies obtained from PGD and AutoAttack.
In Tables 5, 6, 7 and 8, we include the complete list of  $\mathcal{R}$  and its bounds used in Figure 3. We write  $\Delta \mathcal{R}^u = \mathcal{R}^u -\mathcal{R}$  and  $\Delta \mathcal{R}^l = \mathcal{R}^l -\mathcal{R}$ .
Table 3: Complete list of adversarial accuracies under  $\left( {{\mathcal{W}}_{\infty },{l}_{\infty }}\right)$  and  $\left( {{\mathcal{W}}_{2},{l}_{\infty }}\right)$  threat models.
δ=1/8	δ=1/4	δ=1/8
Network	Clean	W∞	W2	W∞	W2	W∞	W2
Augustin2020Adversarial	91.08	87.88	82.03	84.48	73.17	72.91	56.66
Augustin2020Adversarial_34_10	92.23	89.20	83.70	85.80	74.06	76.25	56.33
Augustin2020Adversarial_34_10extra	93.96	91.63	84.86	88.32	75.04	78.79	59.73
Ding2020MMA	88.02	83.57	77.69	78.44	69.67	66.09	53.47
Engstrom2019Robustness	90.83	86.81	81.99	82.37	73.77	69.24	57.77
Gowal2020Uncovering	90.89	87.62	83.19	84.26	75.83	74.50	60.94
Gowal2020Uncoveringextra	94.73	92.64	88.08	89.52	79.74	80.53	60.18
Rade2021Helper_R18_ddpm	90.57	88.03	83.57	84.58	77.26	76.15	62.74
Rebuffi2021Fixing_28_10cutmix_ddpm	91.79	89.26	86.09	86.43	81.06	78.80	67.18
Rebuffi2021Fixing_70_16cutmix_ddpm	92.41	90.36	87.27	87.69	81.67	80.42	67.93
Rebuffi2021Fixing_70_16cutmixextra	95.74	93.78	89.73	91.18	81.59	82.32	63.43
Rebuffi2021Fixing_R18_cutmix_dppm	90.33	87.48	84.24	84.48	78.38	75.86	63.85
Rice2020Overfitting	88.68	85.07	80.62	80.35	73.28	67.68	56.83
Rony2019Decoupling	89.04	84.74	78.47	79.25	69.39	66.44	51.15
Sehwag2021Proxy	90.93	88.42	85.50	85.66	80.50	77.24	67.96
Sehwag2021Proxy_R18	89.76	87.08	83.34	83.87	77.62	74.41	65.02
Wang2023Better_WRN-28-10	95.16	93.44	88.99	90.79	82.58	83.68	68.65
Wang2023Better_WRN-70-16	95.54	93.76	89.94	91.79	83.47	84.97	70.09
Wu2020Adversarial	88.51	85.32	81.33	82.05	75.31	73.66	62.21