A Unified Wasserstein Distributional Robustness Framework for Adversarial Training
Authors: Anh Tuan Bui
Trung Le
Quan Hung Tran
He Zhao
Dinh Phung
Venue: ICLR 2022 Poster (2022)
Keywords: Adversarial Machine Learning
Distributional Robustness

Abstract: It is well-known that deep neural networks (DNNs) are susceptible to adversarial attacks, exposing a severe fragility of deep learning systems. As the result, adversarial training (AT) method, by incorporating adversarial examples during training, represents a natural and effective approach to strengthen the robustness of a DNN-based classifier. However, most AT-based methods, notably PGD-AT and TRADES, typically seek a pointwise adversary that generates the worst-case adversarial example by independently perturbing each data sample, as a way to ``probe'' the vulnerability of the classifier. Arguably, there are unexplored benefits in considering such adversarial effects from an entire distribution. To this end, this paper presents a unified framework that connects Wasserstein distributional robustness with current state-of-the-art AT methods. We introduce a new Wasserstein cost function and a new series of risk functions, with which we show that standard AT methods are special cases of their counterparts in our framework. This connection leads to an intuitive relaxation and generalization of existing AT methods and facilitates the development of a new family of distributional robustness AT-based algorithms. Extensive experiments show that our distributional robustness AT algorithms robustify further their standard AT counterparts in various settings.

Published as a conference paper at ICLR 2022
A UNIFIED WASSERSTEIN DISTRIBUTIONAL ROBUST- NESS FRAMEWORK FOR ADVERSARIAL TRAINING
Tuan Anh Bui', Trung Le", Quan Hung Tran", He Zhao', and Dinh Phung!:
Monash University 'Adobe Research
'VinAl Research
ABSTRACT
It is well-known that deep neural networks (DNNss are susceptible to adversar- ial attacks, exposing a severe fragility of deep learning systems. As the result, adversarial training (AT) method, by incorporating adversarial examples during training. represents a natural and effective approach to strengthen the robustness of DNN-based classifier. However, most AT-based methods, notably PGD-AT and TRADES, typically seek a pointwise adversary that generates the worst-case adversarial example by independently perturbing each data sample, as way "probe" the vulnerability of the classifier. Arguably, there are unexplored benefits considering such adversarial effects from an entire distribution. To this end, this paper presents unified framework that connects Wasserstein distributional robust- ness with current state-of of-the-arr art AT methods. We introduce new Wasserstein cost function and a new series of risk functions, with which we show that standard AT methods are special cases of their counterparts our framework. This connection leads to an intuitive relaxation and generalization of existing AT methods and facilitates the development of a new family of distributional robustness AT-based algorithms. Extensive experiments show that distributional robustness AT algorithms robustify further their standard AT counterparts in various settings
INTRODUCTION
Despite remarkable performances of DNN-based deep learning methods, even the ofate-of-the-art (SOTA) models are reported to be vulnerable to adversarial attacks (Biggio et al. 2013: Szegedy
al. 2014 Goodfellow al., 2015 Madry et al., 2018 Athalye al. [018]] Zhao al. 2019b]]
2021a), which is of sigmificant concern given the large number of applications of deep learning im
real-world scenarios. Usually, adversarial attacks are generated by adding small perturbations to benign data but to change the predictions of the target model. To enhance the robustness of DNNs, various adversarial defense methods have been developed, recently Pang et al. (2019): [Dng et al. (2020); Zhang al. (2020b); Bai et al. (2020). Among number of adversarial defenses, Adversarial Training (AT) is one of the most effective and widely-used approaches (Goodfellow et al. 2015
Madry et al. 2018 Shafahi al., 2019 Tramer & Boneh 2019 Zhang & Wang, 2019 Xie et al. 2020). In general, given a classifier, AT can be viewed as a robust optimization process (Ben-Ti Tal al. 2009) of seeking pointwise adversary (Staib & Jegelka 2017) that generates the worst-case adversarial example by independently perturbing each data sample.
Different from AT, Distributional Robustness (DR) (Delage & Ye, 2010 Duchi al.) 2021 Gao
et al. 2017 Gao & Kleywegt 2016 Rahimian & Mchrotra 2019) looks for a worst-case distribution that generates adversarial examples from known uncertainty set of distributions located in the ball centered around the data distribution. To measure the distance between distributions, different kinds of metrics have been considered in DR, such as f-divergence (Ben- al., 2013) Miyato et al., (015)) Namkkong & Duchi (016) and Wasserstein distance (Shaticezadeh-Abaaee Abadeh et al. 2015)]
Blanchet et al.] 2019) Kuhn et al. (019)) where the latter has shown advantages over others on efficiency and simplicity (Staib & Jegelka 2017; (Sinha et al. (208).. Therefore, adversary in DR specific data sample, but moves the entire distribution around
does not look for the perturbation
the data distribution, thus, is expected to have better generalization than AT unseen data samples
Our code is available http://gchhh..cmm//anaaauu////n -iapsiffddiissritutioooo---ioooo

---

Published as a conference paper at ICLR 2022
Sinha et al. 2018 a generalization and better alternative to AT and several attempts (Staib & Jegelka 2017| [Sinha et al. 2018) have shed light on connecting AT with DR. However, to the best of our knowledge, practical DR approaches that achieve comparable peformance with SOTA AT' methods on adversarial robustness have not been developed yet.
(Staib & Jegelka 2017;
Conceptually and theoretically, DR can be viewed as
To bridge this gap, we propose a unified framework that connects distributional robustness with various SOTA AT methods. Built on top of Wasserstein Distributional Robustness (WDR), we introduce a new cost function of the Wasserstein distances and propose a unified formulation of the risk function in WDR, with which, we can generalize and encompass SOTA AT methods in the DR setting. including PGD-AT (Madry et al., 2018). TRADES (Zhang et al., 2019), MART (Wang et al.) 2019) and AWP (Wu et al. 2020). With better generalization capacity of distributional robustness, the resulted AT methods in our DR framework are shown to be able to achieve better adversarial robustness than their standard AT counterparts.
The contributions of this paper are in both theoretical and practical aspects, summarized as follows: I) Theoretically, we propose a general framework that bridges distributional robustness and standard robustness achieved by AT. The proposed framework encompasses the DR versions of the SOTA AT methods and we prove that these AT methods are special cases of their DR counterparts. 2) Practically, motivated by theoretical study, develop novel family of algorithms that generalize the AT methods in the standard robustness setting, which have better generalization capacity. 3) Empirically, conduct extensive experiments on benchmark datasets, which show that the proposed AT methods in the distributional robustness setting achieve better performance than standard AT methods.
2 PRELIMINARIES
2.1 DISTRIBUTIONAL ROBUSTNESS
Distributional Robustness (DR) is emerging framework for learning and decision-making under uncertainty, which seeks the worst-case expected loss among a ball of distributions, containing all distributions that are close to the empirical distribution (Gao et al.] 2017). Wasserstein DR has been one of the most widely-used variant of DR, which has rich applications in (semi) -super-sueee learning
(Blanchet & Kang 2020 Chen & Paschalidis 2018 Yang 2020), generative modeling (Huynh et al.
2021 Dam et al. 2019). transfer learning and domain adaptation (Lee & Raginsky 20188) Duchi et al.
2019 Zhao al. 2019a| Nguyen et al., 2021a a b Le et al. 2022b a), topic modeling (Zhao et al.
2021b), and reinforcement learning (Abdullah et al. 2019) Smirnova et al. 2019 Derman & Mannor
2020). For more comprehensive review, please refer to the surveys Kuhn et al. (2019); Rahimian & Mehrotra (2019). Here we consider generic Polish space S endowed with a distribution I.. Let
f:5-R be a real-valued (risk) function and e: x S + R2, be a cost function. Distributional robustness setting aims to find the distribution Q in the vicinity of P and maximizes the risk in the E form (Sinha et al. 2018 Blanchet & Murthy 2019):
sup (P..()
Ee [S (=))
(1)
where e > and We denotes the optimal transport (OT) cost, or a Wasserstein distance is a metric, defined as:
>ET(P.Q) / od7,
W. (P. Q) == inf
where I (P. Q) is the set of couplings whose marginals are IP and Q. With the assumption that E L1 (P) is upper semi-continuous and the cost e is a non-negative lower semi-continuous
satisfying c(2, 2²) 0 iff z', Sinha et al. (2018): Blancher & Murthy (2019) show that the dual
form for Eq. is:
inf
Ae + E sup (f (x/) (x)))(o((/)))))))) Ac -o) INP
(3)
X
Sinha et al. 2018) further employs Lagrangian for Wasserstein- uncertainty sets to arrive at relaxed version with 2 0:
sup (Eg If (z) (P. ()]
(f (z)) Ac
(4)
2-P
2

---

Published as a conference paper at ICLR 2022
2.2 ADVERSARIAL ROBUSTNESS WITH ADVERSARIAL TRAINING
In this paper, we are interested in image classification tasks and focus on the adversaries that add small perturbations to the pixels of image to generate attacks based gradients. which the most popular and effective. FGSM (Goodfellow et al. 2015) and PGD (Madry et al., 2018) are the most representative gradient-basee attacks and PGD the most widely-used one, due to its effectiveness and simplicity. Now we consider classification problem on the space S = X' x y where is the data space, y/ is the label space. We would like learn a classifier that predicts the label of a datum well hg X + V. Learning of the classifier can be done by minimising its loss: (he (4) y), which can typically be the the cross-entropy loss. In addition to predicting well on benign data, adversarial defense aims to make the classifier robust against adversarial examples. As the most successful approach, adversarial training is a straightforward method that creates and then incorporates adversarial examples into the training process. With this general idea, different AT methods vary in the way of picking which adversarial examples one should train on. Here we list three widely-used AT methods.
PGD-AT (addy et al. 2018) seeks the most violating examples to improve model robustness:
inf Ex
g sup (tr)
CE (ho (z) + CC (ho (z) v))
(5)
where Be (1:) = {a' cx (a. x') I c. 3 is the trade-off parameter and cross-entropy loss CE.
TRADES (Zhang et al. 2019) seeks the most divergent examples to improve model robustness:
inf Ep B sup DEL (ho (x') he (4)) CE (ho (z) (e).))
(6)
0
where x' E B. (z) and DEL is the usual Kullback-Leibler (KL) divergence.
MART WWag al. 2019) takes into account prediction confidence:
inf Bg (1 - [he (w)),,)
sup DEL (hs (z') hh (2)) + BCE (ho (x) (z) 2'EB,())
(7)
where BCE (ho (x), .g) is defined as: log [hho (z)),, log (1 maxe/y (ho (z)l
2.3 CONNECTING DISTRIBUTIONAL ROBUSTNESS ADVERSARIAL TRAINING
To bridge distributional and adversarial robustness, Sinha et al. (018) proposes an AT method, named Wasserstein Risk Minimization (WRM), which generalizes PGD-AT through the principled lens of distributionally robust optimization. For smooth loss functions, WRM enjoys convergence guarantees similar to non-robust approaches while certifying performance even for the worst-case population loss. Specifically, assume that P is joint distribution that generates pair where x E X' and y E y. The cost function is defined as: c (z,=²) = Cx (x, x²) + 0o x 1 f + y'} where z' = (a'; y/), cx X x X -> R is cost function X, and 1 {-) is the indicator function. One can define the risk function f as the loss of the classifier, i.e., f (z) = e (hg (x) .y). Together with Eq. [ attaining robust classifier is to solve the following min-max problem:
(z, y)
inf sup (F,O
Eq [E (he (x),
The above equation shows the generalisation of WRM to PGD-AT. With Eq. arrive at Eq. (9) as below where 0 is trade-off parameter:
3 and Eq.
one can
inf Ep sup {e (he (z²).v) Aox (ed .0)3
(9)
3 PROPOSED UNIFIED DISTRIBUTION ROBUSTNESS FRAMEWORK
Although WRM Sinna et al. 2018) sheds light on connecting distributional robustness with adver- sarial training, its framework and formulation is limited to PGD-AT, which cannot encompass more
3

---

Published as a conference paper at ICLR 2022
advanced AT methods including TRADES and MART. In this paper, we propose unified formulation for distributional robustness, which is a more general framework connecting state-of-th tfe-the-art AT and existing distributional robustness approaches where they become special cases.
Let Idd be the data distribution that generates instance x ~ Fd and IP the conditional to generate label y ~ 1/12 given x where r y. y. For our purpose, we consider the space S X' x X y and joint distribution PA on S consisting of samples (z, y) where x ~ Pd and y P |sx- Now consider distribution Q on S such that We (Q, AP < E. A draw ~ PA will take the form 2 (2, 2, y) whereas z' ~ Q will be z' = (x', x" ..) We propose cost function c(z, defined as: c(z,z') = cx (x, + 0o x cx x") + 0o x 1 { y'). where we note that this cost function non negative, satisfies c(z, 2) and lower semi-continuous, i.e. lim inf c(2,2') 2 c(z, 20). 2'
(10)
With our new setting, it is useful to understand the "vicinity" of P via the distribution OT-ball condition W. (Q,PA) < c. Since there exists a transport plan y E (PA. A. Q)) s.t. I cdly < c and c(2,2") is finite and y' = y, and second, x' tends to be close to x. To see why the later is the case, since 1pd is a marginal of IP the first x in (Ir F. y), therefore if Qd is the marginal of Q on x' in (a', x²", which explains the closeness between of x and x'.
7, this implies that if 22)z") ~ Y, then first, it is easy to see that x" =
then Wa (Q Pd) I Wa (Q.PA)
Given =a=("', x=,, 30) Q where W. PA) <,, e, we define unified risk function go (=') w.r.t a classifier he that encompasses the unified distributional robustness (UDR) version for PGD-AT, TRADES, and MART (cf Section 2.2
UDR-PGD: go (=') == CF (he (x")) + BCF (ho (x')
. UDR-TRADES: 90 (z') = :D] (he (u"),//)) )//) + 3D KL (ho (x') he (x")).
UDR--ARTT: go (2') == BCE (ho (x"), 9²) + 3(1 - (ho (z")),) DKL (ho (z'), ho (x"))
Now we derive the primal and dual objectives for the proposed UDR framework. With the UDR risk function g0(²") defined previously, following Eq. T and Eq. 3 the primal (left) and dual (right)
forms of our UDR objective are:
sup {gg (z') Ao xc =01))
inf sup @.F.(..Faa
Eq 1go (z')] = inf inf Xe + Ep
(11)
0 X20
With the cost function defined in Eq. (TO), the dual form in 11 can be rewritten as:
{go (z') - >cx (e', m0)3
inf 8,200
>e + Eea
sup w''
inf Ax Epp
sup {ge (a' 20, Acx (or.
(12)
0.220
where we note that IP is distribution over pairs (x, u) for which x ~ pdd and y ~ F. The min-max
problem in Eq. (12) encompasses the PGD-AT, TRADES, and MART distributional robustness
counterparts the choice of the function go (x',,r,,) y) by simply choosing an appropriate go (a' 2x, y) as shown in Section 2.3
In what follows, we prove that standard PGD-AT, TRADES, and MART presented in Section 2 are specific cases of their UDR counterparts by specifying corresponding cost functions. Given a cost function ex (e.g., L1. Lz, and Loo), we define new cost function čx as:
ēx (z, (2,z') = Cxx (x,,"")
(f) Se
100
otherwise.
(13)
The cost function ēx is lower semi-continuous.
By defining the ball B, (x) {a' : ex (x,x') S c] = {x': : Eτ (x,,x') S <e), we achieve the following theorem on the relation between distributional and standard robustness.
"To encompass MART with our framework. assume classifier is adversarially trained by Eq. with adversarial examples generated by sup DKL. (he (x'). he (x)) + BCE (he (2).)). This is slightly dif- ferent from the original MART, where the adversarial examples are generated by sup (2) OF (ho (z'),))
4

---

Published as a conference paper at ICLR 2022
Theorem 1. With the cost function č₂ defined as above, the optimization problem:
inf
Ae + Ep
sup {go (a', a. y) - xox (a' x0))
(14)
0,x20
is equivalent to the optimization problem:
inf EE
sup go (x's x..) x'EB.(x)
(15)
Proof. See Appendix|AAoor the proof.
Theoretical contribution and comparison to previous work. Theorem [ says that the standard
PGD-AT, TRADES, and MART are special cases of their UDR counterparts, which indicates that our
UDR versions of AT have richer expressiveness capacity than the standard ones. Different from
WRM (Sinha et al. (2018) our proposed framework is developed based on theoretical foundation of
(Blanchet & Murthy 2019). is worth noting that the theoretical development is not trivial because theory developed in Blanchet & Murthy (2019) is only valid for bounded cost function, while the cost function is unbounded. More specifically, the transformation from primal dual forms in Eq. requires the cost function to be bounded. In Theorem in Appendix A we prove this primal-dual form transformation for the unbounded cost function Cx. which is certainly not trivial.
Moreover, our UDR is fundamentally distinctive from WRM in its ability to adapt and learn X, while this is ppper-parameter in WRM. As a result of fixed X, WRM fundamentally same PGD in the sense that these methods can only utilize local information of relevant benign examples when crafting adversarial examples. contrast, our UDR can leverage both local and global information of multiple benign examples when crafting adversarial examples due to the fact that À is adaptable and captures the global information when solving the outer minimization in (4). Further explanation can be found in Appendix B
4 LEARNING ROBUST MODELS WITH UDR
In this section we introduce the details of how to learn robust models with UDR. To do this, we first discuss the induced cost function êx defined as in Eq (13) which assists us in understanding the connection between distributional and standard robustness approaches. We note that ēx is non- differential outside the perturbation ball (i.e., cx (z' x) 2 e). To circumvent this, we introduce a smoothed version êx to approximate εx follows:
ēx (z, x') == 1 (cx(2x,)) x') < <c} cx(xx x') + (cx(1, 2 t) (c+ cx(mx))))) -5). (16)
where 7 is the temperature to control the growing rate of the cost function when x' goes out of the perturbation ball. It is obvious that êx (x, ) is continuous and approaches εx (xr,x)) when Using the smoothed function êx (z, x²) from Eq. (16). the final object of our UDR becomes:
inf 0,520
Ae + Epp sup {go (a', x. v) Xax (a' [xm)
(17)
With this final objective, our training strategy involves three iterative steps at each iteration w.r.. batch of data examples, which are shown in Algorithm [
Craft adversarial examples w.r.t. the current model and the parameter X. Given the current model 0 and the parameter X, we find the adversarial examples by solving:
argmax (go æ, v) Xêx (a',x))
(18)
where different methods (i.e., UDR-PGD, UDR-TRADES etc.) specifies go(2', xr, y) differently.
Similar other AT methods like PGD-AT, employ iterative gradient ascent update steps to optimise to find æ" Specifically, we start from random example inside the ball B, and update in k steps with the step size 17 > 0. Since the magnitude of the gradient V Vz' xr y) is significantly smaller than that of V (ax,, x), we use sign (V (z),z)) in the update formula rather than Ca (a', r). These steps are shown 2(a) to 2(c) of Algorithm
5

---

Published as a conference paper at ICLR 2022
An important difference from ours to other AT methods is that at each up- date step, we do not apply any explicit projecting operations onto the ball B.- Indeed, the parameter À controls how distant x² to its benign counterpart I. Thus, this can be viewed as im- plicitly projecting onto a soft ball gov- erned by the magnitude of the param- eter À and the temperature т. Specif- ically, when À becomes higher, the crafted adversarial examples x² stay closer to their benign counterparts æ and vice versa. When 7 is set closer to O, the smoothed cost function éx ap- proximates the cost function čx more tightly. Thus, our soft-ball projection more identical the hard ball pro- jection as in projected gradient ascent.
Algorithm The pseudocode of our proposed method.
Input: training set D, number of iterations T, batch size N adversary parameters {k, c,) for t T do
Sample mini-batch { vi D
2. Find adversarial examples {xę Jimi using Eq. 18
(a) Initialize randomly: x! = I; + noise where noise ~ e)
(b) for to k: do
i. x x:itter x3 + nsiggn (V =0 (2 Fi, Us))
x 2 x aitter
(x x4))
(c) Clip to valid range: x clip( ( 0,1)
3. Update parameter À using Eq.
19
4. Update model parameter using Eq. 20
Output: model parameter 0
Update the parameter A. Given current model 0, we craft a batch of adversarial examples {=])== corresponding to the benign
examples {a;} crafted above. Inspired by the Danskin's theorem, we update À as follows:
An = - 11A (s (E- N
Σ Ex(a,, a.))
N
7
(19)
where > 0 is learning rate and An represents the new value of X.
The proposed update of À is intuitive: if the adversarial examples stay close to their benign examples, i.e. ΣN (xf,, æi) < e, decreases to make them more distant to the benign examples and vice versa. Therefore the adversarial examples are crafted more diversely, which can further strengthen the robustness of the model.
3. Update the model parameter 0. Given the set of adversarial examples {z;) Ji=1 crafted as above and their benign examples {=;) with the labels {y we update the model parameter 0 to minimize Ep (V (a:" (a.,,,,)) .)) using the current batches of adversarial and henign examples:
1 N
6, 0
Vogo(=,, ,.. M.)
(20)
where no > is learning rate and 0, specifies the new model parameter.
5 EXPERIMENTS
We use MNIST LeCun et al. 1998). CIFARIO and CIFAR100 (Krizhessky et al. 2009) as the
benchmark datasets in our experiment. The inputs were normalized [0, 1J. We apply padding pixels at all borders before random cropping and random horizontal flips as used in Zhang et al. (2019). We use both standard CNN architecture (Carlini & Wagner, 2017) and ResNet architecture (He et al. 2016) in our experiment. The architecture and training setting are provided in Appendix D
We compare our UDR with the SOTA AT methods, i.e., PGD-AT (Madry et al., 2018), TRADES (Zhang et al. 2019) and MART (Wang et al. (011)). Because TRADES and MART performances are strongly dependent on the trade-off ratio (i.e., in Eq. (6) and (7) between natural loss and robust loss, we use the original setting in their papers (CIFAR 10/CIFAR100: 3 6 for BRADES/UDD-TRADEEEE
= for MART/UDR MART; MNIST: = for all the methods). We also tried with the distributional robustness method WRM (Sinha al. 2018). However, WRM did not seem to obtain reasonable performance in our experiments. Its results can be found in Appendix F For all the AT methods, we use {k: 40, e = 0.3, 0.01) for the MNIST dataset,

---

Published as a conference paper at ICLR 2022
Table I: Comparisons of natural classification accuracy (Nat) and adversarial accuracies against different attacks. Best scores are highlighted in boldface.
MNIST
CIFARIO
CIFARI00
Nat
PGD
AA
B&B
Nat
PGD
AA
B&B
Nat
PGD
AA
B&B
PGD-AT
99.4
94.0
88,9
91.3
86,4
46.0
42.5
44.2
72,4
41.7
39.3
39.6
UDR-PGD
99.5
94.3
90.0
91.4
86.4
48,9
44.8
46.0
73.5
45.1
41.9
42.3
TRADES
99.4
95.1
90.9
92.2
80.8
51.9
49.1
50.2
68.1
49.7
46.7
47.2
IDR-TRADES
96.9
92.2
95.2
53.6
49,9
49,9
47.8
MART
99.3
94.7
90.6
92.9
81.9
53.3
48.2
49.3
68.1
49.8
44.8
45.4
UDR-MART
99.3
96.0
92.3
94.4
80.1
54.1
49.1
50.4
67.5
52.0
48.5
48.6
Table 2: Robustness evaluation under different PGD attack strengths c. Avg represents for the average improvement of our DR methods over their counterparts.
0.8
MNIST
0.6
0.3
0.325
0.35
0.375
0.4
0.425
Avg
PGD-AT
94.0
67.8
21.1
6.8
2.3
1.2
UDR-PGD
94.3
92.9
79.2
22.3
31,57
TRADES
95.5
85.2
34.4
5.8
0.6
0.1
UDR TRADES
96.9
96.9
95.8
95.1
94.5
88.5
$7.68
natural acc
MAKT
94.7
66.1
0.9
0.2
10
10-2
10
10
UDR-MART
96.0
95.0
94.1
92.8
88.8
37.7
55.5
CIFRRI
(a) Natural/robust accuracy trade-off
14.
Avg
0.5
T=1.0
PGD-AT
46.0
33.7
23.7
15.2
9.5
3.6
rm5g
UDR-PGD
48.9
36.4
26.3
18.5
13.0
7.1
3.08
T-0.5r
TRADES
42.5
0.0.
0=0.05m
IIDR-TRADES
53.6
43.6
35.2
27.5
20.7
10.9
1.62
MART
53.3
43.2
34.1
25.5
18.4
UDR-MART
29.7
22.9
CIFARI00
0.1
12.5
10:37
17405
10007
11475
10K0
Avg
0.0
PGD-AT
34.5
27.8
22.6
0.035
0.040
0.045
0.655
UDR-PGD
45.1
38.3
31.9
26.2
21.4
14.2
3.43
(b) Robustness in correlation with
TRADES
49.7
44.3
39.9
35.2
31.2
23,5
UDR-TRAL AOR-TRADES
44.8
31.7
Figure I: Further analysis param- eter sensitivity.
MART
49.8
45.3
41.0
36.6
32.4
25.1
UDR-MART
52.0
47.8
44.1
40.2
36.2
29.4
3.25
(k 10, - for the CIFARIO dataset and {k = 10, 0.01, 0.001 for the CIFARI00 dataset, where &o is number of iteration, e is the distortion bound and is the step size of the adversaries.
We use different SOTA attacks to evaluate the defense methods including: 1) PGD attack (Madry al. 2018) which is one of the most widely-used gradient based attacks. For PGD, we set 200 8/255, y = 2/255 for CIFAR10, and
and = 0.3, 0.01 for MNIST, for CIFARIOO which are the standard settings. 2) B&B attack (Brendel et al. 2019) which is decision based attack. Following Tramer al. (2020), we initialized with the PGD attack with A: 20 and corresponding {c, 7 then apply B&B attack with 200 steps. 3) Auto-Attack (AA) (Croce & Hein. 2020b) which is ensemble methods of four different attacks. We use 0.3, 8/235, 0.01, for MNIST, CIFAR1O, and CIFAR 100, respectively. The distortion metric we use in our experiments 1. for all measures. We the full test for PGD and 1000 test samples for the other attacks.
0-01. 17 = 0.001
7

---

Published as a conference paper at ICLR 2022
Table Adversarial accuracy in the blackbox settings. Arg represents for the average improvement of our DR methods over their counterparts.
Souree
PGD-AT
UDR-P
TRADES
UDR-T
MART
UDR-M
Avg
Target
PGD-AT
61.6 63.6
61.6
61.7
62.4
UDR-PGD
63.4
64.0
64.1
2.0
TRADES
61.2
61.3
58.9
59.8
UDR-TRADES
62.7
62.8
61.1
61.6
1.8
MART
61.4
61.4
58.9
59.5
UDR-MART
62.3
62.1
60.1
60.5
1.0
5.1 MAIN RESULTS
Whitebox Attacks with fixed First, compare the natural and robust accuracy of the AT methods and their counterparts under our UDR framework, against several SOTA attacks. Note that in this experiment, the attacks are with their standard settings. The result of this experiment is shown in Table It can be observed that for all the AT methods, our UDR versions are able to boost the model robustness significantly against all the strong attack methods in comparison on all the three datasets. These improvements clearly show that our UDR empowered AT methods achieve the SOTA adversarial robustness performance. Specifically, our UDR-PGD's improvement over PGD) on both CIFAR10 10 and CIFAR100 is over 3% against all the attacks. Similarly, our UDR-MART also improves over MART with a 3% gap on CIFAR100.
Whitebox Attacks with varied Recall that UDR is designed to have better generalization capacity than standard adversarial robustness. this experiment, we exam the generalization capacity by attacking the AT methods (including UDR variants) with PGD with varied attack strength while keeping other parameters PGD attack the same. This a highly practical scenario where attackers may use various attack strengths that are different from that the model is trained with. The results of this experiment are shown in Table 2 We have the following remarks of the results: 1) All AT methods perform reasonably well (our UDR variants
better than their counterparts) when PGD attacks with the same e that these methods are trained on. This is shown in the first column on all the datasets, whose results in line with these in Table 2) With increased e, the performance of all the AT methods deteriorates, which is natural. However, the advantage of our UDR methods over their counterparts becomes more and more significant. For example, when 0.375, all of our UDR methods can achieve at least 80% robust accuracy on MNIST, while others can barely defend. This clearly demonstrates the benefit of our UDR framework on generalization capacity.
Blackbox Attacks. To further exam the gen- eralization of the UDR framework, we conduct the experiment with the blackbox setting via transferred attacks. Specifically, we use PGD to generate adversarial examples according to the model trained with a specific AT method, i.e., the source method. Next, we use the gen- erated adversarial examples to attack another AT method, i.c., the target method. This to see whether an AT method can defend against attacks generated from other models. We report the results in Table 3 It can be seen that with better generalization capacity, our UDR meth- ods also outperform their standard counterparts with margin of 2% in the blackbox setting.
Table 4: Robustness evaluation against Auto-
Attack and PGD (k = 100) with WRN-34-10 on the full test set of CIFARIO dataset. (*) Omit the cross-entropy loss of natural images. Detail can be
found in Appendix D
Nat
PGD
AA
C&W
PGD-AT
84.93
55.04
52.12
40.85
UDR-PGD*
55.71
47.31
TRADES
K5.70
56.97
53.82
47.65
EDR-TRADES
84.93
$7.35
$4.45
49.14
AWP-AT
85.57
57.78
53.91
49.91
UDR-AWP-AT
85.51
58.65
$4.40
54.44
Zhang et al. 2020a
84,52
$3.51
Huang cta.
2020
83.48
53.34
Zhang cl 2019
84.92
53.08
88.22
52.86
Results with WideResNet architecture. We would like to provide further experimental re- sults on the CIFARI0 dataset with WideResNer (WRN-34-10) as shown in Table 4 It can be seen that our distributional frameworks consistently outperform their standard AT counterparts in both metrics. More specifically, while that for TRADES is 0.5%. To make a more concrete conclusion, we deploy our framework on a recent SOTA standard AT which is AWP-AT al. (2020). The result shows that our distributional
improvement over PGD-AT against Auto-Attack is around 0.8%,
8

---

Published as a conference paper at ICLR 2022
Table 5: Average norm L1 and Lo of the perturbation =12"
212
L1
Lso
p(ó & 0.9c)
5()
p(d 1.1c)
PGD
0.0270
0.031
19.7%:
100%
100%
UDR-PGD at epoch Oth
0.0278
0.031
18.9%
100%
100%
UDR-PGD at epoch 200th
0.0301
0.034
19.5%
22.1%
100%
Table 6: Comparison to PGD-AT with different perturbation limitations.
10
12
14
16
2u
Avg
255
265
265
255
255
205
PGD-AT at 0.031
46.0
33.7
23.7
15.2
9.5
3.6
RGD-AT at 0.034
46.7
34.8
24.7
16.2
10.1
3.7
0.75
PGD-AT 0.037
44.9
33.3
23.7
15.6
10.0
3.8
-0.07
UDR-PGD at 0.081
48.9
36.4
26.3
18.5
13.0
7.1
3.08
robustness version (UDR-AWP-AT) also improves its counterpart by 0.5%. With the same setting (i.e., same architecture and without additional data). our UDR-TRADES and UDR-AWP-AT achieve better robustness than recently listed methods on RobustBench (Croce et al. 2020) Remarkably, the additional experiment with C&W (L2) attack shows a significant improvement of our distributional methods over standard AT by around 5%. More discussion can be found in Appendix F
5.2 ANALYTICAL RESULTS
Benefit of the soft-ball projection. Here we would like to analytically study why our UDR methods are better than standard AT methods, by taking UDR-PGD and PGD-AT as examples. The visualization on the synthetic dataset can be found in Appendix E Recall that one of the key differences between UDR-PGD and PGD-AT is that the former uses the soft-ball projection and the later use the hard-ball one, discussed in the second paragraph under Eq. (8)) More specifically, Table rreports the average norm (L1 and Lise) of the perturbation 8 = |-" x in PGD and our UDR-PGD. can be seen that: (i) At the beginning of the training process, there no difference between the norms of the perturbations generated by PGD and our UDR-PGD, More specifically, most of the pixels lie on the edge of the hard-ball projection (i.e., p00.9c < 8 S <) = p(8 S e) p(6 < 0.9c) > 80%). model converges, there are 77.9% pixels lying slightly beyond the hard-ball projection (i.... p(6 > <)). It is because our soft-ball projection can be adaptive based on the value of This flexibility helps the adversarial examples reach better local optimum of the prediction loss, therefore, benefits the adversarial training.
(ii) When
Next, show that doing PGD adversarial training with larger cannot achieve the same defence performance as our methods with the soft-ball projection. We conduct more experiments with PGD-AT with e 0.034 (the final when our model converages) and e = 0.037 show that simply extending the hard-ball projection doesn't 't benefit adversarial training. More specifically, the average robustness improvement with e 0.034 is 0.75%, while there is no improvement with e 0.037.
Parameter sensitivity o. Figure Ta and [p show the our framework's 's sensitivity to on CIFARIO under the PGD attack. It can be observed that overly small values of r can hardly improve adversarial robustness while overly big values of may hurt the natural performance (aCCnat = 68.7% with 1.0). Empirically, we find that T = 2n performs well in our experiments.
6 CONCLUSIONS
In this paper, we have presented a new unified distributional robustness framework for adversarial training, which unifies and generalizes standard AT approaches with improved adversarial robustness. By defining a new family of risk functions, our framework facilitates the development of the distri- butional robustness counterparts of the SOTA AT methods including PGD-AT, TRADES, MART and AWP. Moreover, we introduce a new cost function, which enables us to bridge the connections between standard AT methods and their distributional robustness counterparts and to show that the former ones can be viewed as the special cases of the later ones. Extensive experiments on the benchmark datasets including MNIST, CIFAR1O, CIFAR100 show that our proposed algorithms are able to boost the model robustness against strong attacks with better generalization capacity.
"enhuttBench reported robust accuracy of 56%17% for AWP-TRADES version from higher than but might be used reference.
Wu et al. 2020 which

---

Published as a conference paper at ICLR 2022
ACKNOWLEDGEMENT
This work was partially supported by the Australian Defence Science and Technol- ogy (DST) Group under the Next Generation Technology Fund (NGTF) scheme. The authors are grateful to the anonymous (meta) reviewers for their helpful comments.
REFERENCES
Mohammed Amin Abdullah, Hang Ren, Haitham Bou Ammar, Vladimir Milenkovie, Rui Luo, Mingtian Zhang, and Jun Wang. Wasserstein robust reinforcement learning. arXiv preprint arXiv:1907.13196, 2019. 2.T
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pp. 274 283, 2018.
Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving adversarial robustness via channel-wise activation suppressing. In International Conference on Learning Representations, 2020.
Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust optimization. Princeton university press, 2009.
Aharon Ben-Tal, Dick Den Hertog, Anja De Waegenaere, Bertrand Melenberg, and Gijs Rennen. Robust solutions of optimization problems affected by uncertain probabilities. Management Science, 59(2):341-357, 2013.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srndic, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases, pp. 387-402. Springer, 2013. 1
Jose Blanchet and Yang Kang. Semi-supervised learning based distributionally robust optimization. Data Analysis and Applications 3: Computational, Classification Financial, Statistical and Stochastic Methods, 5:1-33, 2020.
2.1
Jose Blanchet and Karthyek Murthy. Quantifying distributional model risk via optimal transport.
Mathematics of Operations Research, 44(2):565-600, 2019. 2.1 2.1 3 A C
Jose Blanchet, Yang Kang, and Karthyek Murthy. Robust wasserstein profile inference and applica- tions to machine learning. Journal of Applied Probability, 56(3):830-857 2019. [
Wieland Brendel, Jonas Rauber, Matthias Kümmerer, Ivan Ustyuzhaninov, and Matthias Bethge. Accurate, reliable and fast robustness evaluation. In Advances in Neural Information Processing Systems, pp. 1286 1-861-12871, 2019. 5
Anh Bui, Trung Le, He Zhao, Paul Montague, Olivier de Tamas Abraham, and Dinh Phung. Im- proving adversarial robustness by enforcing local and global compactness. In European Conference on Computer Vision, pp. 209-223. Springer, 2020.
Anh Bui, Trung Le, He Zhao, Paul Montague, Seyit Camtepe, and Dinh Phung. Understanding and achieving efficient robustness with adversarial supervised contrastive learning. arXiv preprint 2011v22101.1002, 202 C
Anh Tuan Bui, Trung Le, He Zhao, Paul Montague, Olivier de Vel, Tamas Abraham, and Dinh Phung.
Improving ensemble robustness by collaboratively promoting and demoting adversarial robustness. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 6831-6839, 2021b. C
N. Carlini and D. Wagner. Towards evaluating the robustness neural networks. In 2017 ieee
symposium security and privacy (sp), pp. 39-57. IEEF, 2017. 5
D F
10

---

Published as a conference paper at ICLR 2022
Ruidi Chen and Ioannis C Paschalidis. A robust learning approach for regression models based on distributionally robust optimization. Journal of Machine Learning Research, 19(13), 2018. 2.1
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference on Machine Learning, pp. 2196-2205. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216
PMLR, 2020b. S
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag. Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein, Robusthench: standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.096700 2020.
D
Jiequan Cui, Shu Liu, Liwei Wang, and Jiaya Jia. Learnable boundary guided adversarial training. International Conference on Computer Vision, 2021.
Nhan Dam, Quan Hoang, Trung Le, Tu Dinh Nguyen, Hung Bui, and Dinh Phung, Threc-player wasserstein gan via amortised duality. International Joint Conference on Artificial Intelligence 2019, pp. 2202-2200 Association for the Advancement of Artificial Intelligence (AAAI), 2019.
Erick Delage and Yinyu Ye. Distributionally robust optimization under moment uncertainty with application to data-driven problems. Operations research, 58(3):555-61 612, 2010.
Esther Derman and Shie Mannor. Distributional robustness and regularization in reinforcement learning. arXiv preprint arXiv:2003.0289. 2020. 2.
Yinpeng Dong, Zhijie Deng, Tianyu Pang. Jun Zhu, and Hang Su. Adversarial distributional training for robust deep learning. Advances in Neural Information Processing Systems, 0888770-828, 2020.
C
John C Duchi, Tatsunori Hashimoto, and Hongseok Namkoong. Distributionally robust losses against
mixture covariate shifts. Under review, 2019. 2.1
John C Duchi, Peter Glynn, and Hongseok Namkoong. Statistics robust optimization: A generalized empirical likelihood approach. Mathematics of Operations Research, 2021.
Rui Gao and Anton J Kleywegt. Distributionally robust stochastic optimization with wasserstein
distance. arXiv preprint 160::: 099 2016. [
Rui Gao, Xi Chen, and Anton J Kleywegt. Wasserstein distributionally robust optimization and variation regularization. arXiv preprint arXiv:1712.06000 2017.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, org abs
2015. URL (ttp::
6572
2.2 C
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016. 5
Quan Hoang, Trung Le, and Dinh Phung. Parameterized rate-distortion stochastic encoder. In Hal Daumé III and Aarti Singh (eds.), Proceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pp. 4293-4303.
PMLR, 18 Jul 2020. C
Lang Huang, Chao Zhang, and Hongyang Zhang. Self-adaptive training: beyond empirical risk minimization. Advances in Neural Information Processing Systems, 33, 2020.
Viet Huynh. Dinh Phung, and He Zhao. Optimal transport for deep generative models: State of the art and research challenges. In The 30th International Joint Conference on Artificial Intelligence
(IJCAI), pp. 4450-4457 2021. 2.1
11

---

Published as a conference paper at ICLR 2022
Alex Krizhevsky et al. Learning multiple layers of features from tiny images. 2009.
Daniel Kuhn, Peyman Mohajerin Esfahani, Viet Anh Nguyen, and Soroosh Shafieezadeh-Abadee Wasserstein distributionally robust optimization: Theory and applications in machine learning. In Operations Research & Management Science the Age of Analytics, pp. 130-166. INFORMS. 2019. 2.1
Trung Le, Dat Do, Tuan Nguyen, Huy Nguyen, Hung Bui, Nhat Ho, and Dinh Phung. On label shift in domain adaptation via wasserstein distance. arXiv preprint 1rXiv:21 3021a. 2.1
Trung Le, Tuan Nguyen, Nhat Ho, Hung Bui, and Dinh Phung. Lamda: Label matching deep domain adaptation. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp.
PMLR, 18-24 Jul 2021b. 2.1
Trung Le, Anh Bui, Tue Le, He Zhao, Paul Montague, Quan Tran, and Phung Dinh. On global- view based defense via adversarial attack and defense risk guaranteed bounds. In International Conference on Artificial Intelligence and Statistics. PMLR, 2022. C
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2) 22222224 1998. [
Jaeho Lee and Maxim Raginsky. Minimax statistical learning with wasserstein distances. In NeurlPS, pp. 2692-2701, 2018. 2.1
Alexander Levine and Soheil Feizi. Wasserstein smoothing: Certified robustness against wasserstein adversarial attacks. In International Conference on Artificial Intelligence and Statistics, pp. 3938-3947. PMLR, 2020. C
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
2.2 C
Takeru Miyato. Shin-ichi Maeda, Masanori Koyama, Ken Nakae, and Shin Ishii. Distributional smoothing with virtual adversarial training. arXiv preprint wwxiiv:507.00000 2015. [
Takeru Miyato, Shin-ichi Maeda, Masanori
Koyama, and Shin Ishii. Virtual adversarial training: regularization method for supervised and semi-supervised learning. JEEE transactions on pattern analysis and machine intelligence, 11799119791199,, 2018. C
Amir Najafi, Shin-ichi Maeda, Masanori Koyama, and Takeru Miyato. Robustness to adversarial perturbations in learning from incomplete data. Advances in Neural Information Processing Systems, 32:5541-5551, 2019. C
Hongseok Namkoong and John C Duchi. Stochastic gradient methods for distributionally robust optimization with f-divergences. In NIPS, volume 29, pp. 2208-2216 2016. !
Tuan Nguyen, Trung Le, Nhan Dam, Quan Hung Tran, Truyen Nguyen, and Dinh Phung. Tidot: A teacher imitation learning approach for domain adaptation with optimal transport. In Zhi-Hua Zhou (ed.), Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, International Joint Conferences Artificial Intelligence Organization,
IJCAI-21, pp.
8 2021a. Main Track. 2.1
Tuan Nguyen, Trung Le, He Zhao, Quan Hung Tran, Truyen Nguyen, and Dinh Phung. Most: Multi-souree domain adaptation via optimal transport for student-teacher learning. In Uncertainty in Artificial Intelligence, pp. 225-235. PMLR, 2021b. 2.1
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning, pp. 4970-4979, 2019.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. In International Conference on Learning Representations, 2020.
12

---

Published as a conference paper at ICLR 2022
Hamed Rahimian and Sanjay Mehrotra. Distributionally robust optimization: A review. arXiv preprint arXiv:I908. 1,0,:,9908.06659, 2019. [2.11
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In
International Conference Machine Learning, pp. 8093-8104. PMLR, 2020. D
A. Shafahi, M. Najibi, M A. Ghiasi, 7. Xu, J. Dickerson, C. Studer, S. Davis, G. Taylor, and Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, pp. 3333-33644 2019.
Soroosh Shafieezadeh- Abbaeehhh Peyman Mohajerin Esfahani, and Daniel Kuhn. Distributionally robust logistic regression. In Proceedings of the 28th International Conference on Neural Information Processing Kestems-Volumee 1, pp. 1576-1584, 2015.
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifying some distributional robustness with principled adversarial training. In International Conference on Learning Representations, 2018.
Elena Smirnova, Elvis Dohmatob, and Jérémie Mary. Distributionally robust reinforcement learning.
arXiv preprint 1902: 0902008708 2019. 2.1
Matthew Staib and Stefanie Jegelka. Distributionally robust deep learning generalization of
adversarial training. NIPS workshop on Machine Learning and Computer Security, 2017. D
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http:/ ttstp://arxive http://axvvvvv//o wrg./viorrraaaaa /abs/ 1312. 6199 1
Nguyen-Duc Thanh, Le Trung, Zhao He, Cai Jianfei, and Phung Dinh. Particle- based adversarial local distribution regularization. In International Conference on Artificial Intelligence and Statistics. PMLR, 2022. C
Florian Tramèr and Dan Bonch. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems, pp. 5868, 2019.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems, 33, 2020. 5
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference Learning Representations, 2019.
2.2 D
Dongxian Wu, Shu-Tao Xia, and Yisen Wang- Adversarial weight perturbation helps robust general- ization. Advances in Neural Information Processing Systems, 33, 2020.
D
Cihang Xie. Mingxing Tan, Boqing Gong, Alan Yuille, and Quoc V Le. Smooth adversarial training. arXiv preprint ar arXiv:2006.1 14536, 2020.
[
Insoon Yang. Wasserstein distributionally robust stochastic control: A data-driven approach. IEEE
Transactions on Automatic Control, 2020. 2.T
Haichao Zhang and Jianyu Wang. Defense against adversarial attacks using feature scattering-based adversarial training. In Advances in Neural Information Processing Systems, pp. 1829-1839, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 7472-7482, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In International Conference Machine Learning, pp. 1128771227. PMLR, 2020a.
13

---

Published as a conference paper at ICLR 2022
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-rewest reweehheereweighted adversarial training. In International Conference on Learning Representations, 2020b. !
Han Zhao, Remi Tachet Des Combes, Kun Zhang, and Geoffrey Gordon. On learning invariant representations for domain adaptation. In International Conference on Machine Learning, pp.
7523-7532. PMLR, 2019a. 2.
He Zhao, Trung Le, Paul Montague, Olivier De Vel, Tamas Abraham, and Dinh Phung. Perturba- tions are not enough: Generating adversarial examples with spatial distortions. arXiv preprint arXiv:/910.01322 2019b. 1
He Zhao, Thanh Nguyen, Trung Le, Paul Montague, Olivier De Vel, Tamas Abraham, and Dinh Phung. Learning attack with fewer pixels: A probabilistic post-hoc framework for refining arbitrary dense adversarial attacks. arXiv preprint arXiv:2010.06131, 20220,,,,,,,,,,,.,..... D
He Zhao, Dinh Phung, Viet Huynh, Trung Le, and Wray Buntine. Neural topic model via optimal transport. In International Conference on Learning Representations (ICLR), 2021b. https //openreiew www./e/fffoo wttt:/ffrrmmmd=00s00800
2.1
A THEORETICAL DEVELOPMENT
Theorem 1. With the cost function čx defined as above, the optimization problem:
inf
de
+ Ep
sup {go (z', v) - xēx (æ', xx)
(21)
0,220
is equivalent to the optimization problem:
inf Ep
sup 9o (o', ,,,)) r'e.(x)
(22)
Proof. We need to prove that
inf
de + Ep
sup {go (z', a. v) Xox (e', = Ep
sup
go (z', xx,0))
(23)
X20
x' (w)
By the definition of the cost function Ex, the LHS of (23) can be rewritten as:
{go (z', ,,,y,) Aex (a's (d', Be sup (o (1.
min
inf
Ae E>
sup (x),(())
(24)
Given any À > 0 and x' E Be (x), we have
Ac 00 (x', v. Acx (x', xx) go x,,) A(c cx (x',x)) 2 Er 1go (x),
Hence, arrive at
Ae + sup (x)
tgo (x', x, Acx (x', >
sup go (a' xr,)) x²EB.(x)
λe + Ep
sup
(go (I' x. Xex (a', xx)
2 Ep
sup (t)
go (a' 2z, v)
a' (x)
which follows that
inf ASO
de Es
sup (x)
(go (x' (x,,),,)) dex (al,
2 Ep
sup xx)B.(x)
Es [go x2
(25)
14

---

Published as a conference paper at ICLR 2022
We now prove the inequality
lim A
Xe
Ep
sup (x)
{go (z', 22 v) Xex (e', (e',
EEp
sup xxEB.(x)
Ep [go (x' M v)
Take a sequence (Nn 7 0+. Given a feasible pair (a, y). we define
fu (x' (2,1) = go (x', x. y) + An fe - cx (a' x)] Val E (.)...
is evident that fn (s'; æ, y) converges pointwise to go (x', x, y) over the compact set B, (x). There- fore, fn (x'; x. y) converges uniformly to go (x', x, y) this set. This follows that
Ya 0, 3ng n (a) In (x'; go (x' x. v)ll a, Val Be (x), 2 mn-
Hence, we obtain for all x' E B. (z) and 2 no:
go (x' 2r y) fn (a': < go x,,) + +a.
This leads the following for all n 2 no:
sup go (x', x. v) a S sup E'E. (u)
fn (d112,)) S sup go (z', 2,,3) + a.
ee),
x'EB,(z)
Therefore, obtain:
lim sup fn (x';2,)) sup 10000 (R)
go (x,,
(x)
for feasible pairs (x, y). which further means that
lim Ep 000
sup x'EB,(x)
fn (21:z,1) Ep
sup (.).(())
go (z' (2',2,1)
or equivalently
lim Er Anc + Ep n-000
sup (.)
(go (x', - -nex (x',
Ep
sup (B)
9o (x', v)
(26)
Because Eq. (66) holds for every sequence Pnnnn1 O reach
lim +
λe + EE
tgo (x', x. v) - Acx (e', r'EB,())
sup
Ep
sup (')
Ep Igo (x' x v))
(27)
By combining 125 and
27
we reach
inf
de Es
sup x'e.(())
(go (x' (,,)), dex (el (et,
ASO
Ep
sup xx)B.(x)
Es [go xe
(28)
15

---

Published as a conference paper at ICLR 2022
Finally, we have
sup {ge (z', x, xox (z', (d',x))
inf
de + Ep
A20
fgo x, sex (e', x))3 } Es sup go (o', (2)
min
inf
de + Ep
sup x'EB,(x)
A20
Br sup go (o', 2 w)
min
Ep
sup (x)
Er Lga (x', x,,
[x'
Ep
sup (t)
Ep 1g0 (2',,,1)]
That concludes our proof.
One of most technical challenge we need to bypass in our work is that in theory developed in Blanchet & Murthy (2019), to equivalently transform the primal form to the dual form, it requires the cost. function be finite. In the following theorem, we reprove the equivalence of the primal and dual forms in our context.
Theorem 2. Assume that the function g is upper-bounded by a number L.. We have the following equality between the primal form and dual form
sup (QPA().PA)
Eolg = inf X
Ae EPA
sup (g)) - xc(222))
where: Z = (I, v). x' = (x', x, ,y"),, and we huve defined
c(z, 2 ãx (z) 00 āx (x,x") x0
for which we have defined
{ cx (x,2²) 00
(fee Se
Cx (x. (x,x²)
otherwise.
Proof. Given a positive integer number n > O, we define the following metrics:
6t (2,z') Ex (x,2²) + 0o E3 (x, (e,"") + 00 x 1 (u # v').
cx (x)x") if (2,x') <c otherwise.
xx (2,x²)
n
We have ex / xx and e" /c. We now prove that
sup @w(k.Fa)er
lg = inf sup
Ee lg (z')).
Q.We (2PP)s
In fact, for each n, we have Ct < c.
Therefore, We (Q.P2) I We (Q.PP)).
hence
(Q: W. (Q.PA) < C (Q Wen (Q,PA) c), implying that
E2 lg (>')) @:IQPFAEe
sup
sup
Eg lg (z'))
Eg < inf
Eg ig (z')]
sup W(
sup
Q-Wa- (e.a)e
Let us define
A UZ ((2,2)) :2= (x,==(,,,,,)10000) (x v'),exx ex (I, < e, = x2 = y),
B UeyDE ((2,2)) :2= (x, y). (xl x"" vy) cx (x. e, x, v)
16

---

Published as a conference paper at ICLR 2022
To simplify our proof, without generalization ability, for each n, denote Qn the distribution in (Q : Wen PA) < E) that peaks Eg [ge (z')] and "n as the optimal transport plan of Wen (Qn, PA) which admits PA and Qn its marginals. Note that because Wen (Qn. IP) < e, the support of " almost surely determines on A U B. We then have
/ c" (2,z') (5.2)dm(( (2,2²)
Wer (Qn, =
c (2,z (2,22) d" (2,22) (2,2))
S cx (2,xz) do (2,2)) + / ndm (2,2²)
S ex (2,, x') d (2,2²) + n'nn (B) <.
Therefore, we obtain: In (B) < c We now define 7n as a restricted measure of 7/n on A, meaning that Fn (C) (A) (B) n.
Yn (C') (1 (n ()) 7n (C) for any measure set C c A, where (n(A)
limm-+00 (n" (n= O. Let Pn as marginal distribution of Q. corresponding to the dimensions of z'. appears that
We (N,, PA) S / 2(2,2') dra (2,2) + / c(2,2') d (2,2²)
(1) / cx (2, dr (2,2) / edin (2,22)
Note that we have because in (B) = 0.
This implies that Pa E (Q: W. (Q, PA) < e). which follows that
Eq (x')) 2 Er, [go (z') = Ey lg (=')]
sup Pc
/ (2)) di (2,2)) / ((')) drnn (2,2))
9 d5 (2, nn (A) + in (B)
/ g (2') dyn (z') (2,2")
In (A)
(1 (1+ n ')) 1/ ((2') (2m))
/ g((2) dmn
ALB
B
11 o m -1) ") / g(3)) (2
9 (2') doy (2)
ALB
2 1 0 mn ")
B2 Bg (z')) - Ldkra (2,2¹)
sup (Q.Paee
Eo (o 2 (1 + o n ")
Note that we have conclusion sup Qc
sup (QPA)e
Eg 190 (z')) - Inn (B)
(2) 1 + o
n '))
Eq Igo (2')
Le
sup (Q.Pa
n
(2)
due Fn (B) 0 and
due 7n (B)
Therefore, we reach the
n.
sup <c)
Ee (ga (z')) = inf
sup Q.W... (e.Pa)ee
Eq Igw (z'))
17

---

Published as a conference paper at ICLR 2022
Next, apply primal-dual form in Blanchet & Murthy 2019) for the finite metric ox to reach
sup War (aE
22 Ige (2')1
inf X
Xe + Ex
sup {ge (z)) - Ae" (</, (2,
Finally, taking n + oo and noting that c* 7 C, we reach the conclusion.
B FURTHER EXPLANATION WHY OUR UDR CAN UTILIZE GLOBAL INFORMATION AND THE ADVANTAGE OF SOFT-BALL
Algorithm The pseudocode of our proposed method.
Input: training set DD number iterations T', batch size N, adversary parameters {k, e, 1/} for t to T do
1. Sample mini-batch f0 V: D
2. Find adversarial examples { Ji=1 using Eq. 18
(a) Initialize randomly: z! = + noise where noise ~ u(-e,
(b) for 1 to k do . .ninter x. + r/sign (V (= Iz, vz)l;))
ii x," 2++ x:nter h7r V 2 ((ainter xz)
(c) Clip valid range: 2t 1iipptt000
3. Update parameter À using Eq.
19
4. Update model parameter 0 using Eq. 20
Output: model parameter 0
The advantage of our soft ball comes from the adaptive capability of X, which is controlled by global effect regarding how far adversarial examples 2; from benign examples z;. Let us revisit Algorithm 1. In the step 2.(b).,, we update
inter x. + rssign (V V= u))
x
with the aim to find winter that can maximize go Wi, wii as in the standard versions.
Furthermore, in the step 2. update
xx+1 = pinter - DAV_C(a inter ,x,) = rinter nd (Iinter - 2:)
(1 (1- m1) (1-n))
mitter + mAZi
(29)
where we assume L2 cost c(xr, ,²) point of af inter and Fú, hence sh++1 is drawn back to 2; wherein the drawn-back amount is proportional ndÀ.
1/2 || 222 is used. is evident that + 1 is an interpolation
We now revisit the formula to update À as Eq.
(9
N Σ N
An = A
6
2x xx:)
which indicates that À is globally controlled. More specifically, if average distance from x to 2y (i.e., 1 ΣM (x 2x)) is less than (i.c., adversarial examples are globally close to benign examples), N
A is adapted decreasingly. Linking with the formula in Eq. (29 in this case, n-1 gets back to a; less aggressively to maintain the distance between xxf and x;. Otherwise, adversarial examples are globally far from benign examples, is adapted increasingly. In this case, xn+11 gets back to x; more aggressively reduce more the distance hetween xa and di.
18

---

Published as a conference paper at ICLR 2022
C RELATED WORK
Adversarial Attacks. In this paper, we are interested in image classification tasks and focus on the adversaries that add small perturbations to the pixels of an image to generate attacks based on gradients, which are the most popular and effective. FGSM (Goodfellow et al., 2013) and PGD (Madry et al., 2018) are the most representative gradient-based attacks and PGD is the most widely- used one, due to its effectiveness and simplicity. Recently, there are several variants of PGD that achieve improved performance, for example, Auto-Attack by ensembling PGD with other attacks (Croce & Hein 2020a) and the B&B method (Brendel et al. (2019) by attacking with decision- boundary initialized with PGD. Along with PGD, these attacks have been considered as benchmark attacks for adversarial robustness.
Among various kinds of defense approaches, Adversarial Training (AT), originating in Gooodfelow et al. (2015), has drawn the most research attention. Given its effectiveness and efficiency. many variants of AT have been proposed with (1) different types of adversarial examples (e.g., the worst-case examples as in Goodfellow et al. (2015) most divergent examples as
Adversarial defenses.
in Zhang et al. (2019), (2) different searching strategies (e.g., non-iterative FGSM and Rand FGSM
(Madry et al. (0188). (3) additional regularizations (c.g., adding constraints in the latent space (Zhang & Wang 2019; Bui et al. 2220; 2021a Hoang et al. 2020)), ) and (4) different model architectures
(e.g., activation function (Xie et al. 2020) or ensemble models (Pang et al. 2019 Bui al. b02
Distributional robustness. There have been a few works attempting to connect DR with adversarial
machine learning improve adversarial robustness based the ideas of DR (Sinha et al. 2018
Staib & Jegelka, 2017| Miyato et al. 2018: Zhang & Wang, 2019 Najafi et al. 2019; Levine &
Feizi| 2020; Le al. 2022 Thann al. 2022). A recent work of Dong al. (0200) proposes
new AT algorithm by constructing a distribution over each data sample to model the adversarial
examples around it, which is still in the category of pointwise adversary (Sinha et al. 2018) and has no relations to DR. Although its aim of enhancing adversarial robustness is visually related ours, its mythology is different from ours. Therefore, we consider [Sinha et al. (2018); Staib & Jegelka (2017) as the most relevant ones to ours. Specifically, both works leverage the dual form of Wasserstein DR (Blanchet & Murthy 2019) for searching worst-case perturbations for AT, where Sinha et al. (2018) (WRM) focuses on certified robustness with comprehensive study on the tradeoff's between complexity, generality, guarantees, and speed, while Staib & Jegelka (2017) (FDRO) points out that Wasserstein robust optimization can be viewed as the generalization to standard AT.
Although our study is inspired by the two works, there are significant differences and new results of ours: 1) We introduce new Wasserstein cost function and new series of risk functions in WDR, which facilitate our framework to generalize and encompass many SOTA AT methods. While WRM can be viewed as the generalization to PGD-AT only. 2) Most importantly, although WDR has been demonstrated to have superior properties over standard AT in the two papers, unfortunately, WRM and FDRO have not been observed to outperform standard AT methods. For example, the experiments of FDRO show that adversarial robustness on MNIST of WRM and FDRO is worse than that of AT with PGD and iteRative-FGSM (Staib & Jegelka 2017). Moreover, WRM and FDRO's effectiveness either on more complex colored images (e.g.. CIFAR10) or against more advanced attacks (e.g.. Auto-Attack) has not been carefully studied yet. On the contrary, we conduct extensive experiments to show the SOTA performance of our proposed algorithms.
D EXPERIMENTAL SETTINGS
For MNIST dataset. We use a standard CNN architecture for the MNIST dataset which is identical with that in Carlini & Wagner (2017). We use the SGD optimizer with momentum 0.9, starting learning rate Ie-2 and reduce the learning rate (x0.1) at epoch (55, 75, 90}. We train with 100 epochs.
For CIFARIO and CIFARI00 dataset with ResNet18 architecture. We use the ResNet18 for the CIFARIO and CIFARI00 dataset. We use the SGD optimizer with momentum 0.9, weight decay 3.5e-3 as in the official implementation from Wang et al. (2019) g The starting learning rate 1e-2 and reduce the learning rate (x0.1) at epoch (75, 90, 100). We train with 200 epochs.
19

---

Published as a conference paper at ICLR 2022
For hard/soft-ball projection experiments. For PGD-AT, we use the following three ad- hoc strategies for E: 1) Fixing é = 8/255; 2) Fixing = 16/255; 3) Gradually increas- ing/decreasing efrom 8/255 to 16/255. from epoch 20 to epoch 70, with the changing rate 5 = 8/255/50 per epoch. For example, the perturbation bound of the increasing strategy at epoch i is: 64 min( 16
max
255 255 + (i 20)āj); the perturbation bound for decreasing strategy is: 255
255
G = max(
255 min(
20)))).
255
For CIFARIO with WideResNet architecture. We follow the setting in Pang et al. (2020) for the additional experiments on CIFARIO 10 with WideResNet-34-10 architecture. More specifically, we train with 200 epochs with SGD optimizer with momentum 0.9, weight decay 5e-4. The learning rate is 0.1 and reduce epoch 100th and 150th with rate 0.1 (Rice al., 2020 Wu et al. 2020). More importantly, to match the performance as reported in Croce et al. (2020), we omit the cross-entropy loss of the natural images in PGD-AT and UDR-PGD. More specifically, the objective function
of PGD-AT in Eq. (5) has been replaced by: infa Ep (sup='eB.(a) CE (he (z)),)) while the
unified risk function for UDR-PGD to be: go (=') == BCE (ho (x'), v'). We also switch Batch Normalization layer evaluation stage when crafting adversarial examples as adviced in Pang et al. 2020)).
E VISUALIZING THE BENEFIT OF DISTRIBUTIONAL ROBUSTNESS
Synthetic dataset setting. We conduct an experiment on a synthetic dataset with a simple MLP model to visualize the benefit of our UDR framework over the standard AT methods, by taking UDR- PGD and PGD-AT as examples. The synthetic dataset consists of three clusters A, B1, B2 where A, B are two classes as shown in Figure 2c The data points are sampled from normal distributions, i.e., A ~ N ((-2, 0). Σ) B1 ~ // ((2, O), Σ) and B2 ~ / ((6. 0), Σ) where Σ 0.5 * with / is the identity matrix. There are total 10k training samples and 2k testing samples with densities of three clusters are 10%, 50% and 40%, respectively. We use a simple model of 4 Fully-Connected (FC) layers as follows: Input -> ReLUU(C(1))) -> ReLLU(C((1O)) -> ReLUU(C(1)) -> Softmax(FC(2)), where FC(K) represents for FC with k hidden units. We use Adam optimizer with learning rate le-3 and train with 30 epochs. We use [k- 20, e 1.0, 77 = 0.1} for adversarial training (either PGD-AT or (DR-PGD) and PGD attack with {k- = 200, c = 2.0, r = 0.1} } for evaluation.
It is a worth noting that while the distance between clusters is 2, we limit the perturbation 1 for the adversarial training to show the advantage on the flexibility of the soft-ball projection on the same/limited perturbation budget. Intuitively, cluster A has the lowest density (10%), therefore, the ideal decision boundary should be surrounded cluster A which sacrifices the robustness of the cluster but increases the overall robustness eventually.
Comparison between UDR-PGD and PGD-AT. First, we visualize the trajectory of adversarial example from PGD and our UDR-PGD as in Figures 2b 2a to compare behaviors of two adversaries on the same pre-trained model. can be seen that: (i the PGD's adversarial examples and ours are pushed toward the lower confident region to maximize the prediction loss (0 x., y); (ii) however, while the adversarial examples of PGD are limited on the hard- pard-projection ball, our adversarial examples have more flexibility. Specifically, those are close the decision boundary (cluster A, B1) can go further, while those are distant to the decision boundary (cluster B2) stay close to the original input, This fiexibility helps the adversarial examples reach better local optimum of the prediction loss, hence, benefits the adversarial training. Consequently, as shown in Figure 2c the final decision boundary of our UDR-PGD is closer to the ideal decision boundary than that of PGD-AT, hence, achieving better robustness. Quantitative result shows that the robust accuracy of our UDR-PGD is 82.6%, while that of PGD-AT is 74.5% with the same PGD attack (k 200, c 2.0, n = 0.1).
Comparison among UDR-PGD settings. Here we would like to provide more understanding about our framework through the experiment with PGD-AT shown in Figure 3 First, we compare the trajectories of the adversarial examples of UDR-PGD with different À as shown in Figures Bal Bb It can be seen that the crafted adversarial examples stay closer to their benign counterparts when X becomes higher (i.c., À = 0.1 in Figure In contrast, the soft-projection ball is extended when becomes smaller (i.e., À = 0.01 in Figure 3b). On the other hand, with the same À but smaller ras
20

---

Published as a conference paper at ICLR 2022
-2.5
10.0
(a) UDR-PGD
(b) PGD
(c) Decision Boundary
Figure 2: (a)/ Trajectory of PGD and UDR-PGD adversarial examples. Each trajectory includes 20 intermediate steps. For better visualization, we do not use random initialization. The model is the natural training at epoch 1. (c) The final decision boundary comparison.
shown in Figure 3c the soft-ball projection is more identical the hard ball projection as shown in Figure 2b These behaviors concur with the theoretical expectation discussed in Section 4.1 in the main paper.
Figure 3d shows the learning progress of parameter A. It can be observed that (i) the converges to regardless of its initialization value and (ii) the convergence rate of À depends on the parameter (i.e., smaller slower convergence). We choose 2n for the experiments on real-world image datasets.
235
Audl
135
(a) A 0.1, 1.0
(b) A 0.01, T 1.0
(c) A 0.01, 0.01
(d) Changing of À
Figure 3: (a)(b)/(c): Trajectory of UDR-PGD adversarial examples with different settings, Each trajectory includes 20 intermediate steps. For better visualization, do not use random initialization. The model is the natural training at epoch 1. (d) The changing of parameter X.
Further results soft-ball projection. In Figure we compare our UDR-PGI with the soft-ball projection to PGD-AT with the hard-ball projection with different settings against the PGD attack on
CIFARIO. For PGD-AT, we use the following three ad-hoc strategies for e: 1) Fixing = 8/255; 2) Fixing 16/255; 3) Gradually increasing/decreasing from 8/255 to 16/255 (Refer to Appendix D for details). can be seen that is hard to find an effective strategy of the perturbation boundary of the hard-ball projection for PGD-AT, which can outperform ours. This demonstrates the benefit of our soft- poft-project operation.
F MORE RESULTS AND ANALYSIS
Further results with C&W (I.2) attack. We enrich the comprehensiveness of the experiments by further evaluating the defense methods with C&W (I.2) attack (Carlini & Wagner 2017) which is very strong optimization based attack. The experiment has been conducted on the CIFARIO dataset with WideResNet architecture. The hyper-parameters are E (0.5, 0.7, 1.0), kappa = 0, steps 1000, 0.01 where kappa is the confidence coefficient and is box-constraint coefficient As shown in Table [ our distributional robustness version significantly outperform the standard ones term of robust accuracy. For example, against C&W (c=0.5) attack, the robust accuracy gap between UDR-PGD and PGD-AT is 6% while that for UDR-AWP-AT and AWP-AT is around 5%. The average improvement of robust accuracies against different levels of attack strengths around
WWe the implementation from httphh//ww/hh.o.ooooo//////aaaan
21

---

Published as a conference paper at ICLR 2022
50
udr-pgd ==8/255
pgd-at
45
pgd-at @ ==16/255
pgd-at @ e-Increasing
40
pgd-at @ e-decreasing
robust accuracy
35
30
25
15
10
0.035
0.040
0.045
0.050
0.055
Figure 4: Hard/soft- ball projections
Table 7: Robustness evaluation against C&W attack with WRN-34-10 on the full test set of the CIFAR10 dataset (10K test images). c box-constraint coefficient. (*) Omit the cross-entropy loss of natural images.
Nat
0.5
c= 0.7
c= 1.0
Avg-Gap
PGD-AT*
84.93
40.85
25.90
12.95
UDR-PGD*
84.60
47.31
31.58
16.57
5.25
TRADES
85.70
47.65
34.30
21.03
UDR-TRADES
84.93
49.14
36.33
23.28
1.92
AWP-AT
85.57
49.91
34.31
18.97
UDR-AWP-AT
85.51
54.44
39.86
23.61
4.91
5%. This result strongly emphasizes the contribution of distributional robustness and the soft-ball projection over the standard adversarial training.
Experimental results WRM (Sinha et al.) 2018).. The performance of WRM highly depends on the Lagrange dual parameter (or 0.5/7 in their implementation 6 which controls the robustness level. As mentioned in their paper, with large 7, the method is less robust but more tractable. Generally, decreasing will reduce the natural accuracy but increase the robustness of the model as shown in Table g We obtained the best performance on MNIST with y = 0.05 (CNN), while CIFARIO 10 and CIFAR 100 with 7 0.5 (ResNet18). The best results with three benchmark datasets have been reported as Table 9 (recall results from Table It a worth mentioning that while could obtain similar performance reported Sinha et al. (2017) on the MNIST dataset with their architecture (3 Convolution layers + 1 FC layer), however, WRM seems much less effective with larger architectures.
Table 8: Result of WRM with different 0.5/7 on the CIFAR10 dataset.
Nat
PGD
AA
B&B
0.1
90.9
15.3
13.7
15.8
0.5
86.7
33.9
32.6
35.4
83.7
41.4
2.0
79.4
45.4
43.6
45.5
5.0
71.6
47.5
45.2
46.2
10.0
65.0
43.4
44.4
22

---

Published as a conference paper at ICLR 2022
Table 9: Comparisons of natural classification accuracy (Nat) and adversarial accuracies against different attacks. Recall results from Table [ with additional results of WRM. Best scores are highlighted in boldface.
MNIST
CIFARIO
CIFARI00
Nat
PGD
AA
B&B
Nat
PGD
AA
B&B
Nat
PGD
AA
B&B
WRM PGD-AT
91.8
27.1
4.5
8.2
83.7
40.9
39.8
41.4
56.6
24.7
21.3
22.9
99.4
94.0
88.9
91.3
86.4
46.0
42.5
44.2
72.4
41.7
39.3
39.6
UDR-PGD
99.5
94.3
90.0
91.4
86.4
48.9
44.8
46.0
73.5
45.1
41.9
42.3
Further results of whitebox attacks with varied Here would like to provide results defending against whitebox attacks with a bigger range of c as shown in Figure It can be seen that in wide range of attack strengths our DR methods consistently outperform their AT counterparts.
mbuut acturary
100
80
PIF
alrog] udverades udvnurtt
rebous accuracy
udhogg
trades
Dove eccurscy
60
traded uch-trecho
ushitrades mart
60
40
40
20
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.02
0.04
0.06
0.00
0.10
0.12
0.01
0.02
0.02
0.04
(a) MNIST
CIFARIO
(c) CIFARIO0
Figure 5: Robustness evaluation against multiple attack strengths.
The convergence of the algorithm. During the training, we observed that while adversarial exam- ples distribute inside/outside the hard ball differently (i.e., as shown in Figure ). but generally the average distance to original input is less than c. Therefore, according to the update formulation in Eq. (19), X tends to decrease to and eventually is stable at 0 because of very small learning rate as shown in Figure 3d In addition, we visualize the training progress as shown in Figure to show the convergence our method. It can seen that, the error-rate reduces over training progress and converges at the end of the training progress.
goan
naleer glain Book
addeaanor Siam adv-sror glas
0.
nat-ieror Mled
adviaroo gits
adhvaror glos
0.8
0.5
0.4
0.2
0.2
9.0
50
100
150
200
50
100
150
200
50
100
150
200
(a) MNIST
(b) CIFARIO
(c) CIFAR100
Figure 6: Training progress our UDR-PGD on different datasets, evaluating on the full training set (e.g., 50k images) and the full testing set (e.g., 10k images). Robust accuracy is against PGD attack with & 20.
Further experiment result on CIFAR100. We would like provide additional experiment result on CIFAR100 100 dataset such that all defenses are adversarially trained with 255
8 Our UDR-PGD
g outperforms PGD 3.7% at 255 and 2.3% average, while our UDR-TR TRADES and UDR-MART outperform their counterparts by around 0.5 and 0.7%, respectively. is worth noting that, in our experiment, MART is quite sensitive with changes of (MART's natural accuracy drops lower
23

---

Published as a conference paper at ICLR 2022
Table 10: Robustness evaluation on CIFARIO0 dataset. The last column "Avg" represents the average
gap of robust accuracy between our methods and their standard AT counterparts.
Nat
8
10
14
T6
2u
Avg
253
235
255
253
235
25.
PGD-AT
63.7
22.8
16.1
11.4
7.8
5.1
2.4
UDR-PGD
64.5
26.5
18.9
13.7
9.8
7.0
3.5
2.30
TRADES
60.2
30.3
24.5
18.8
14.8
11.5
6.7
UDR TRADES
60.1
30.8
25.1
19.3
15.5
12.2
7.5
0.52
MART
54.1
32.0
26.8
21.9
17.4
13.8
7.6
54.4
32.3
27.4
22.5
18.4
14.4
8.5
0.67
Table 11: Distance function and its gradient
Var(aaa))
L1
Lim1
Vi E [1.d]
Lg 7
(it x
Ex mi)
1, argmax, | 2
Tue
max,
11 - s!ll
otherwise
performance than that of TRADES): that might explain the lower gap between UDR-MART and MART with the new e.
G CHOOSING THE COST FUNCTION
In this section, provide the technical details of our learning algorithm in Section 4 in the main paper, especially, the important of choosing cost function č(ι, x²). Given the current model 0 and the parameter we find the adversarial examples by solving:
ra
argmax_ {ga(a', v) Adx (x',z)}
We employ multiple gradient ascent update steps without projecting onto the hard ball B,. Specifically, the updated adversarial at step 1. + 1 as follows:
1 x +n (V x. y) - A V (a',x))
Given the smoothed cost function as in Equation (19), the updating step as follows:
xt + n (V go x, v) A XV a cx (x', 2)), xt + n 2 x. A V cx (z', x)). otherwise.
if cx (x',x) <e
It shows that, the pixels that are depending on the parameter r. We consider three popular distance functions of cx (a', .x) with their gradient Table [] It worth noting that, while the norm L1, L2 have gradient in all pixels, the Loo has gradient in only one pixel per image. It means that, when using Loo norm as the cost function Cx (a,, only single pixel has been traced back at each iteration. In contrast, using L2 will project all pixels toward the original input with the step size of each. As in the discussion in Section F only small part of an MNIST image contributes to the prediction, while in contrast, most of pixels of CIFAR 10 image affect to the prediction. Based on this observation, we use the T, for the MNIST dataset and L2 for the CIFAR 10 dataset the updating step. However, the perturbation strength has been measured in Loo. therefore, still use Loo in the Equation (22) update X.
ball B. will be traced back with a longer step,
We also visualize the histogram gradient Vargo(z', x, y) and V V (x', xr) as shown Figure 7 It can be seen that the strength of gradient gradl Vargo(x', xr, is much smaller than grad2 = Vr (x', 22), for example, on the MNIST dataset, gradl E [-5 x 10 10-4, 4.5 x 10-4] while grad2 00.., 0.3] which is 600 times larger. Therefore, if using single update step, the gradient Vr (x', x) dominates the other and pulls the adversarial examples close to the natural input. These adversarial examples weaker and do not helps improve the robustness. Alternatively,
24

---

Published as a conference paper at ICLR 2022
break single update step for solving Equation (21) to two sub-steps shown in Algorithm to balance between push/pull steps. It also can be seen that the grad2 corresponds with the perturbation boundary and the step size 77. For example, the MNIST dataset, grad2 has the range from 0.3, 0.3] and has the highest density around [-0.01, 0.01] where (0.3, 0.01) are the perturbation boundary and step size in the experiment.
200.0
30030
3ore
"ua.
30000
gosse
604
3009
000
00 Eae Poe th th
CIFARIO, gradl
(b) MNIST, grad2
(c) CIFARIO, gradi (d) CIFARIO, grad2
Figure 7: Histogram of gradient strength of gradl V Vz'g0 2) and grad2 V.rCx (x', ,)) on MNIST and CIFAR1O dataset. We use L2 norm for the cost function cx (x'xx) T = and
25


Reviews:
[{"review_id": "t-kfuVZ-28D", "reviewer": "Reviewer_7bWw", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is overall well-written and interesting to read. The proposed method, while unifying previous methods, performs better than previous methods (PGD, TRADES and MART). The proofs are not carefully checked. \n\nMy major comments follow.\n1.\tIt is proved that (14) is equivalent to the standard adversarial training objective, but is (14) the dual program of the Wasserstein distributional robust optimization? It seems that the equivalence of the dual program requires certain constraints on the function $g_\\theta$. \n2.\tI understand that why you need to use sign of the gradient of $\\hat{c_{\\mathcal{X}}}$ in practice. But I feel the need of more explanations to show where the difficulty comes from. For example, if the objective function (17) is fundamentally good for adversarial training, then it may not need such tricks. More concisely, I wonder if it is just an empirical trick or there are more underlying reasons.\n3.\tI’d like to understand more about the reasons of the empirical success of the proposed method. I see that the authors contribute some of the success to “soft-ball projection” and “utilizing the global information”, but I’m curious to understand more beyond the general discussion, e.g., theoretical analysis about the empirical success. I understand that in-depth theoretical analysis may worth another paper, but it would be great if the authors can provide more insights. \n", "summary_of_the_paper": "This paper proposes a unified framework for adversarial training from the perspective of Wasserstein distributional robustness. It is proved that some standard previous adversarial training methods are special cases of the proposed framework. The paper also proposes an adversarial training method given the framework. Empirical results demonstrate that the proposed method is more effective than previous methods.", "summary_of_the_review": "The proposed method is novel and interesting to me. The empirical results seem promising. Overall, I think the paper has a decent empirical contribution, and it also has the potential to offer a unified theoretical explanation for adversarial training. Unless I misunderstand some key parts of the paper, I recommend accepting. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "mVc2t2pHmV", "reviewer": "Reviewer_1ivF", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Theoretical contribution\nThe paper extends the previously established connection between AT, distributional robustness and optimal transport (Blanchet & Murthy [2016 on arxiv, 2019 published]; Sinha et al. 2017). However, my impression is that the main theoretical contribution for employing the work by Blanchet et al. for connecting distributional robustness with AT was made by Sinha et al. 2017: They proved a relaxed version of the dual form of the risk function using a Lagrangian penalty formulation and show the way to place PGD-AT in this WDR framework.\nThe paper proposed here extends this result to incorporate other AT approaches in the relaxed dual form established by Sinha et al. 2017. To achieve this, the authors reformulate the cost function proposed by Sinha et al. 2017 such that it incorporates TRABES and MART as well. As a consequence their cost function becomes unbounded (eq 13), which requires an additional proof for the dual form. The authors provide this proof, which defines the core of their theoretical contribution.\n\n### Strengths\n- The paper is well structured and clearly highlights contributions of the work.\n- The results are convincing: the paper gives both theoretical insights and the corresponding practical implications with competitive empirical results on standard deep learning classification problems (MNIST, CIFAR10, CIFAR100; Table 1), and improved robustness scores for increasing adversarial attack strengths (Table 2). \n\n### Weaknesses\n- In contrast to what the authors write at the end of section 3 in \"Theoretical contribution and comparison to previous work\", my impression is that Sinha et al's approach is actually based on the theoretical foundation of Blanchet & Murthy 2019 (Sinja et al. cite the version that was put on arxiv in 2016). \n- The adapted cost function for incorporating all three AT approaches is unbounded and is used as a smoothed version in practice to be differentiable (eq 16). This change makes sense, however, the authors do not elaborate on the effects this might have on the theoretical insights.\n- A clear comparison to the WRM approach by Sinha et al. (2017) is missing. Given that this is a related approach that already connects WDR with AT (limited to PGD-AT), it is important to highlight their differences. The authors do describe the approach by Sinha et al. (2017) but do not highlight the exact theoretical difference to their approach. Additionally, they do not show empirical results for WRM on the example problems. \n- Some of the empirical results appear a bit oversold, e.g. the authors state that in Table 1 their approach “boosts the model robustness” compared to the other AT methods. However, in many cases the difference seems relatively small, on the order of 0.1, or 1.0 percent. It is clear that the performance of their approach is competitive, but to make strong statements about them the results would need error bars, e.g., standard errors of the mean over 5 or 10 repetitions of the benchmark. \n- A detailed discussion of related work happens only in the appendix which is not part of the core submission and cannot be taken into account for evaluating the submission. It would be good to move part of that discussion to the main paper.\n- The paper has quite some grammatical errors like misplaced commas, missing words misspellings, which impedes clarity and readability.\n\n### Suggestions for improvements\n- If possible, find an example used in Sinha et al. (2017) to compare to, e.g., their MNIST example. If their code is not available or difficult to tune, it should be possible to conduct the experiment with your methods and compare with the numbers in their paper. \n- I do not think that SOTA is necessary for your paper to get accepted. However, I think that this is an important topic for the DNN community and that it should therefore be clearly communicated which approaches work well in which scenarios, e.g., does WRM work better for PGD-AT attacks? \n- weakening of the statements about the results in Table 1 and 2 and to conduct additional repetitions of the benchmarks to have error bars on the numbers in the table. \n- Add an actual figure caption for figure 1. \n- Clarify the theoretical contributions of your approach vs. Sinha et al. (2017), e.g., that their work is based on Blancet & Murthy (2019) as well. \n- Some references are not correct, e.g., Sinha et al. 2017 is not a preprint, it was actually accepted as an oral contribution to ICML 2018. Please check all your references and make sure you credit previous work correctly. \n\n### Questions:\n- Why is WRM fundamentally the same as PGD with lambda fixed? In WRM lambda is fixed as a penalty parameter before optimization, but this does not mean that it is the same as PGD. Could you clarify this statement? \n\n### Typos/minor points\n- There are several occasions in the paper where the definitive article to a noun, or the plural to make it indefinite, is missing e.g., already in the second sentence of the abstract. \n- paragraph between equations 2 and 3: iif <- iff\n- paragraph between equations 3 and 4: relaxation <- relaxed\n- section 2.2 first paragraph: was AML defined before? \n- sentence between equations 8 and 9: “one can derive to Eq. (9)” maybe you mean “one can arrive at” or “derive Eq (9)”? \n- paragraph after equation 10: “The see why the later is the case” <- “To see why the latter is the case”\n- paragraph after equation 12: “upon on” <- “on” (?)\n- paragraph after equation 15: “theory developed in (B & M., 2019)” <- “the theory developed in B & M (2019). \n- There are other occasions where the “in text” vs “in parentheses” citations are mixed up, please double check. \n- section 4 second sentence: “we first discuss about” <- “we first discuss”\n\nand it is likely that I missed some, so please make sure to check for typos carefully. \n", "summary_of_the_paper": "The paper proposes a new approach for improving adversarial training (AT) in deep neural networks (DNN). While previous approaches generated point-wise adversary examples to enrich the training data set, this approach extends previous work on Wasserstein distributional robustness (WDR) and suggests a unified WDR framework to encompass previous approaches and to improve AT. The theoretical results show that previous approaches can indeed be formulated in the WDR framework. The empirical results show that the newly derived methods for AT improve the robustness to adversarial attacks on several classic DNN example problems. ", "summary_of_the_review": "The paper makes a theoretical contribution by extending the work on WDR for AT to other AT approaches. It shows promising results of their unifying framework on common example problems. Therefore, taking into account the weaknesses listed above I vote for a score marginally above the acceptance threshold. However, I am willing to increase my score if the weaknesses listed above are addressed, especially a thorough comparison to the WRM approach by Sinha et al (2017) (~500 citations, oral paper at ICML 2018). ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "SxuaVCruLM", "reviewer": "Reviewer_wEoc", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\nAuthor(s) seem to be aware of the related literature based on their references to prior works, and also the exact description of the said works. Mathematical statements are rigor and correct as far as I have checked. Moreover, paper is very well-written.\n\nWeaknesses:\nEven though paper explicitly insists that its proposed theoretical results are $\\underline{\\mathrm{not}}$ trivial, at least I, as a reader, have failed to understand their significance. The relation between point-wise adversaries which are commonly used in AT-like methods and W-DRO is already known to the community. This fact has been mentioned even by the author(s) themselves; For example, see their reference to Staib and Jegelka (2017), or the seminal work of Sinha et al. (2017). I rely on author(s)' claim that results are new, since no prior work has tried to derive explicit relations similar to Theorems 1 and 2 of the current paper. Still, the current results do not seem surprising and worthy of publication at ICLR.\n\nAdditional note: paper claims that results are not trivial since the dual form that is usually utilized in W-DRO assumes a bounded loss function, while this condition has been relaxed here. TBH, I haven't checked the proofs, completely. However, no sophisticated mathematical tools have been used throughout the paper and proofs are rather simple and short. It would be more informative if author(s) can give more insight about the technical difficulties that they have faced while deriving the results and thus shed light on their possible significance.\n\nPaper also claims some experimental contributions. I am not completely familiar with the experimental side of this line of research, so I wait to see other reviewers' comments on that matter.\n\n-------------------------------\n\nMinor comments and suggestions:\n\n\"The see why\" -> \"To see why\"", "summary_of_the_paper": "This paper aims to establish a formal relation between Wasserstein distributionally robust optimization (W-DRO) and a number of Adversarial Training (AT)-like defenses against adversarial attacks. In particular, three well-known defenses, namely PGD-AT, TRADES and MART have been the center of attention.\n\nPaper derives a theory that shows each of the above methods are special cases of a W-DRO, settled in a properly-defined augmented space. ", "summary_of_the_review": "Paper seems to lack enough theoretical novelty at this stage. My current vote is Weak Reject, but I also like to see other comments and feedbacks.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "PHAzhHSlhIQ", "reviewer": "Reviewer_Rag4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\nThe unified distributional robustness framework presents a different perspective to adversarial robustness of deep learning through new Wasserstein cost functions. This work improves WRM (Sinha et al., 2017) to cover more adversarial training methods, e.g., TRADES and MART. This paper also develops a new family of algorithms that generalize the AT methods in the standard robustness setting, and experimental results show the proposed algorithms achieve better performance than standard AT methods.\n\nWeakness:\n1.\tThe theoretical contribution (Theorem 1) needs to be better justified. It is not very clear how this work differs from WRM (Sinha et al., 2017) with respect to the main conclusions of equivalence and proof techniques. From Theorem 1, it does not seem obvious that “the standard PGD-AT, TRADES, and MART are special cases of their UDR counterparts.” It is also unclear how significant the boundness of cost function is, although the extension of results from bounded to unbounded cost function may be not trivial.\n2.\tThe literature review does not seem comprehensive – some recent distributional robustness methods are not mentioned, e.g., feature scattering (Zhang & Wang, 2019), Adversarial Distributional Training (Dong et al., 2020)\n3.\tWhen using different SOTA attacks to evaluate the defense methods, why the C&W attack (Carlini & Wagner, 2017) is excluded from the comparison?\n4.\tSome typos here and there. For example, “The see why the later is the case, …”; “… and a new serious of risk functions in WDR, …”; “While when τ is set closer to 0, …”; “The results of this experiment is shown …”; “… are different from those the model is trained with”; “…, and the later use the hard-ball one, …”; “… therefore, benefits the adversarial training.”; “doing PGD adversarial training with larger cannot achieve …”\n", "summary_of_the_paper": "This work aims to improve WRM (Sinha et al., 2017) with respect to Wasserstein distributional robustness to cover more state-of-the-art adversarial training methods in addition to the most commonly used PGD-AT method. To this end, this paper presents a unified framework to connect Wasserstein distributional robustness with PGD-AT, TRADES, and MART methods. The introduced Wasserstein cost function can cover those of commonly used AT methods as special cases. A family of algorithms are developed to generalize AT methods with better generalization. Extensive experiments show the improvement of the proposed robustness AT algorithms over those commonly used ones.", "summary_of_the_review": "In general, this paper presents some solid contributions to distributional robustness including both theoretical and experimental results. This paper is acceptable to the conference, but some weaknesses should be fixed, including the theoretical justifications and more comprehensive comparisons.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "FDkGEBFr5E3", "reviewer": "Reviewer_T7rh", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This is an excellently well-written paper that applies the idea of distributional robustness for crafting adversarial examples. The methodology in the paper extends that of (Sinha et. al. 2017) by introducing learnable parameters. Moreover, a soft-ball based projected gradient descent is used instead of a hard one. Extensive experiments are conducted to demonstrate that the proposed method UDR when applied in conjunction with existing perturbation methods, such as PGD and TRADES, produces better results on standard datasets.\n\nOne weakness is that the paper develops a white-box attack methodology, where the adversary (Algorithm 1) is assumed to have a complete knowledge of the model parameters (model parameters being simultaneously updated with the attack generation parameters). This makes the attack algorithm not that realistic.\n\nSome specific comments:\n\n1. It's a bit strange to see the symbol \\infty in an algebraic equation (Equation 10). The usual way of writing this would be with a symbol M, and stating that M is larger than M_0.\n2. The authors should explain precisely what is meant by \"lower semi-continuous\", and argue why that is the case with the defined cost function.\n3. CE (the cross-entropy loss) is currently undefined. It should be defined in a similar manner as the definition of BCE.\n4. stay closely --- stay close\n5. For the blackbox attacks (reported in Page 8), do you also learn the model parameters by Algorithm 1?\n \n\n\n", "summary_of_the_paper": "This paper applies the idea of distributional robustness for crafting adversarial examples. The methodology in the paper extends that of (Sinha et. al. 2017) by introducing learnable parameters. Moreover, a soft-ball based projected gradient descent is used instead of a hard one.\n", "summary_of_the_review": "I'm leaning towards an accept due to the use of the novel idea of soft-ball projection and the demonstration that the proposed method works on a number of different standard datasets.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper extends the previously established connection between adversarial training (AT) and Wasserstein distributional robustness (WDR) to other adversarial defense methods such as PGD-AT, TRADES and MART, and connects them to WDR. While this connection itself is not surprising given earlier works connecting AT and WDR, the paper makes contributions in establishing it formally and proposing algorithmic variations (eg, softball projection) that show clear empirical gains on standard benchmarks of MNIST/CIFAR10/CIFAR100 over point-wise adversarial defense methods.
Decision: Accept (Poster)