A Distributional Robustness Perspective on Adversarial Training with the $\infty$-Wasserstein Distance
Authors: Chiara Regniez
Gauthier Gidel
Hugo Berard
Venue: ICLR 2022 Submitted (2022)

Abstract: While ML tools are becoming increasingly used in industrial applications, adversarial examples remain a critical flaw of neural networks. These imperceptible perturbations of natural inputs are, on average, misclassified by most of the state-of-the-art classifiers. By slightly modifying each data point, the attacker is creating a new distribution of inputs for the classifier. In this work, we consider the adversarial examples distribution as a tiny shift of the original distribution. We thus propose to address the problem of adversarial training (AT) within the framework of distributional robustness optimization (DRO). We show a formal connection between our formulation and optimal transport by relaxing AT into DRO problem with an $\infty$-Wasserstein constraint. This connection motivates using an entropic regularizer-- a standard tool in optimal transport--- for our problem. We then prove the existence and uniqueness of an optimal regularized distribution of adversarial examples against a class of classifier (e.g., a given architecture) that we eventually use to robustly train a classifier. Using these theoretical insights, we propose to use Langevin Monte Carlo to sample from this optimal distribution of adversarial examples and train robust classifiers outperforming the standard baseline and providing a speed-up of respectively $\times 200$ for MNIST and $\times8$ for CIFAR-10.

Under review as a conference paper at ICLR 2022
A DISTRIBUTIONAL ROBUSTNESS PERSPECTIVE ON ADVERSARIAL TRAINING WITH THE OO- WASSERSTEIN DISTANCE
Anonymous authors Paper under double-blind review
ABSTRACT
While ML tools are becoming increasingly used in industrial applications, adver- sarial examples remain a critical flaw of neural networks. These imperceptible perturbations of natural inputs are, on average, misclassified by most of the state- of-the-art classifiers. By slightly modifying each data point, the attacker is creating a new distribution of inputs for the classifier. versarial examples distribution as tiny shift of the original distribution. We thus propose to address the problem of adversarial training (AT) within the framework of distributional robustness optimization (DRO). We show a formal connection between our formulation and optimal transport by relaxing AT into DRO problem with an oc- oo-Wasserstenn constraint. This connection motivates using entropic regularizer- a standard tool in optimal transport- for our problem. We then prove the existence and uniqueness of an optimal regularized distribution of adversarial examples against class of classifier (e.g., given architecture) that we eventually use robustly train a classifier. Using these theoretical insights, we propose use Langevin Monte Carlo to sample from this optimal distribution of adversar- ial examples and train robust classifiers outperforming the standard baseline and providing a speed-up of respectively x00 for MNIST and x8 for CIFAR-10.
this work, we consider the ad-
INTRODUCTION
We call adversarial example input which is hwwahhummpppaee -imerrepiimprcepiiblle e-perturbation' compared to a real example that results in an incorreet classification from classifier [Goodfellow et al., 2014; Sun et al., 2018 8; Athalye al., 2018; Santurkar al., 2019; Nguyen et al., 2015a; Kurakin et al., 2016; Moosavi-Dezfool et al., 2016). The particularity of these examples, which justifies their study, is the fact that most of the so-called adversarial examples are misclassified by large majority of state-of-the-ar neural networks. Long seen as bugs, Santurkar et al. [2019] asserts that the existence of adversarial examples is explained by the presence of easy-to-perturb patterns within the data distribution that are not perceptible by humans but useful for the classification task.
In response this discovery, different methods have been developed to train robust classifiers and to craft adversarial attacks by determining optimal perturbations [Nguyen et al., 2015b; Papernot et al., 201 6a; Goodfellow al., 2014; Papernot et al., 2016b; Tramèr et al., 2017; Madry et al., 2017]. Among these training methods, adversarial training [Goodfellow et al., 2014; Tramer et al., 2017; Madry et al., 2018] has settled as one of the strongest baselines to train robust classifiers. This method is relatively simple: it consists of training the classifier directly batches of adversarial examples, leading to the following optimization problem [Madry et al., 2018]:
min E ((z.g))-pann DER
max (ā,
(I)
1|8- Se
where is usually the cross-entropy loss and Pdata is the dataset distribution. Our goal is to rigorously connect adversarial training and robustness by providing distributional robustness
AAversariil example can be defined with respect to notion of distance that captures the fact that an c-perturbation is imperceptible by human. In this work, for the sake of simplicity, we focus on the for norm, which is the most common onc.

---

Under review as a conference paper at ICLR 2022
perspective [Delage and Ye, 2010; Ben-Tal and Nemirovski, 1998; Sinha et al., 2018] for adversarial training. Distributional robustness is a framework to study predictive models that aim at being robust against distribution shift. Given set of possible distribution P that given predictive model fo could encounter the distributionally robust classification task is:
min max Ez-pude [e[Ja(ū, v)))
(2)
BER PadaEP
Note that while standard adversarial training aims to use the point-wise optimal adversarial ž examples (i.e. for each natural input zi), our perspective considers the optimal adversarial distribution. Working at the scale of distributions leads us draw inspiration from the Kantorovich relaxation in Optimal Transport theory. To do so, we will define the set P using coupling measures between natural and adversarial distributions with the help of co-xc -asssesstttt distance.
Contributions. Our contributions are three-fold: First, we provide a strong connection between adversarial training and adversarial robustness and distributional robustness by using some tools from optimal transport, we call this formulation adversarial transport. Our second contribution to show that, in this specific setting, there exists, against any given classifier fo. an optimal distribution of adversarial examples and to provide closed-fome solution for this distribution. Our third contribution to use these theoretical insights to come up with a practical training method using Langevin Monte-Carde sampling to jointly find the optimal classifier and the optimal distribution of adversarial examples. By using this new technique for adversarial training we obtain robust classifiers outperforming the standard baseline [Madry al., 2018] in terms of robustness and clean accuracy. Moreover, this training technique provides a speed-up of respectively x x200 for MNIST and x 8 for CIFAR in terms of training time.
Related Work. Among the various works about defenses and attacks in the context of adversarial examples, Adversarial Training [Madry et al., 2018] is the most common baseline. However, in this procedure, adversarial examples are generated independently of the others by searching for the optimal perturbation for each one. Thus, AT seeks point-wise optimality and not global optimality. Here, the goal is to make our classifier robust to any unknown adversarial example distribution. It justifies the consideration of the DRO framework. DRO enables a mathematical formulation for dealing with uncertainty in complex systems [Delage and Ye, 2010; Lam, 2018; Rahimian and Mehrotra, 2019]. In ML, DRO tries to minimize the loss over the worst-case distribution in a neighborhood of the observed training data distribution [Duchi and Namkoong, 2016; 2018; Chouzenoux et al., 2019; Duchi et al., 2016]. Thus, DRO is pertinent in the case of adversarial examples and allows to bring a principled distributional perspective on AT.
Within the DRO framework, one crucial point is to properly define the uncertainty set which contains the underlying data distribution. The importance of this set lies in the fact that it allows to reduce the computation time and the search area of the underlying distribution [Delage and Ye, 2010; Ben-Tal and Nemirovski, 1998; Lam, 2018]. Different methods have been proposed to construct uncertainty sets. Among them, one considers the help of OT operators and defines the set with all the probability measures such as the p- p-Wasserstein distance from the observed distribution is less than given constant (p- Wasserstein (all)cBlanchet and Murthy, 2019].
Some works have started study p- --assersteinn DRO in the case of adversarial examples. Zheng et al. [2019] defines Distributionally Adversarial Attacks (DAA) which is generalization of PGD attacks on the space of probability measures with -2-DRO and [Staib and Jegelka, 2017] did the DrRD generalization of AT. E. W.ng et al. [2019] also considers the W, ball using an explicit formulation of the uncertainty set with coupling matrices. However, while the previous works modified the AT problem-tie the Wo p constraint on the adversarial distribution does not correspond to the distribution of adversarial examples computed in AT-our work aims at overcoming that. The original AT problem stays a the scale of the example and considers OT to deal with the displacement of pixels. This perspective leads to the discovery that the standard AT problem corresponds to an co- Wasserstein DRO problem with the lo underlying geometry.
In the meantime, as in our paper, entropic regularization is used to find closed forms of the coupling matrix. To extend this understanding of adversarial examples in the case of distributions we generalize this uncertainty set with the oc-oc Wasserstein distance and add entropic regularization. 2-00- Wasserstein DRO has already started to receive consideration in the case of AT [Gao et al., 2017].
Nevertheless, the use of the foo within the oo- Wasserstein distance allows both to consider the DRO problem at the dataset scale but also ensure that the adversarial condition is respected for each
2

---

Under review as a conference paper at ICLR 2022
element of the adversarial distribution. Together with the use of coupling matrices in our formulation, we found a concave and tractable formulation of our problem which results in a different technique to sample from this distribution (namely Langevin Monte Carlo). Finally, propose to keep them in memory to reuse the past samples for the update of the robust classifier.
Notations. In this work, will consider measurable finite dimensional input space X' IR.. We will note (2)) the Borel o-algebra of X' and M the set of all probability measures on A'
If not precised, a map T X' - X' is considered measurable. We, recall that given separable metric space A' s.t. any probability measure on X' is a Radon measure, for T X - X. the push-forward measure of / Tyox E MM(X) of some a M(X)4 satisfies: Vh E C(X), h())dB(G) Sx h(T(x))da(z).
2
ADVERSARIAL TRAINING, TRANSPORT, AND DISTRIBUTIONAL ROBUSTNESS
In this work, we say that is an adversarial example of f at the data point (z,3) if 1 20|00 S [Goodfellow et al., 2014]. Given a loss function É, an optimal adversarial example It aims at maximizing the following optimization problem:
I E arg max ((fo(z).v).
(3)
Se
In practice, a large value for ((fo (z). y) will yield a misclassification of the example y. By considering
the adversarial training problem (I), can notice that the distribution of input-output pairs seen by the classifier So depends on the value of its own parameters. We will call this distribution Padv- Such distribution be described as the pushforward of transport map T that respect the adversarial
example constraint [x) - x 01100 S e, Vx E X. In other words we have,
Pado TaPdata (#, y) Pade
7(x, y) Pdata s.t. T(x) and | l=|10c S (4)
This remark leads us to our first proposition that explicitly proposes a distributional robust optimiza-
tion (DRO) formulation of the adversarial training problem.
Proposition 2.1 (DRO formulation of adversarial training). The adversarial training problem (1) can be formulated as a DRO problem (2) where:
(Pado
3T - X, Pade T:Paata and [[((x) x11000 S <6, Vo E X}
(5)
Interestingly, one can draw parallels with Monge's formulation of optimal transport (OT), were given an initial measure μ and a target measure the task is solve the following problem
inf S c(x, (p=)) subject to V TeJ..
(6)
On the one hand, (6) and the DRO problem defined Proposition 2.1 are drastically different problems in essence, It can be explained by the difference between the constraints on the transportation map and the fact that while Equation 6 aims at minimizing a function of the transportation map T, Equation 2 aims maximizing function of the transported distribution Podu-
On the other hand, it is insightful to notice how both problems depend on set of transportation maps to connect the initial and the target distributions.
The limitations of Monge's problem are well known in the OT community: due to its non-linear constraint, the problem is often intractable and may not have solution (i.e. the infimum may not be achieved). That is why Kantorovich [1940], proposed to relax (6) into problem with linear constraints by considering coupling measures (an approach that allows a mass splitting from natural example z; to different locations R,). Such relaxation had the advantage to provide better understanding of the original problem leading novel theoretical guarantees (e.g., the existence of solutions for Kantorovich's 's problem, duality, and in some situations equality between Monge's problem and Kantorovich's 's problem) as well as tractable algorithms [Sinkhorn, 1964; Cuturi, 2013b].
In similar vein, we believe our perspective adversarial examples that combine ideas from distributional robustness and adversarial transport leads to a better understanding of the problem of adversarial training. Thus. will use that insight to consider coupling measures relax the adversarial training problem (1). It will lead to a new DRO formulation for adversarial training that call adversarial transport.
3

---

Under review as a conference paper at ICLR 2022
3 ADVERSARIAL TRANSPORT FORMULATION
We first define the notion of coupling measure, that we will use to define a relaxed version of the DRO formulation described in Proposition 2.1.
Definition 3.1 (Transport plan), Let Padv and Pdata be two distributions on x + [0, 1] is transport plan between Pado and Pdata if:
VA B(X), 7(A x X) = Pdata (A) and 4B E B(X), T(X B) Pado (B)
The space of transport plan between Pdata and Podv is denoted IT (paata Pado).
Informally, the coupling measure π ((X) & ((x) describes the spatial modification of the initial distribution Pdata the adversarial distribution Pode- For instance, in the discrete case where we have the datapoints (x,) and the potential adversarial examples (ūz), coupling is matrix P such that the value P represents the amount mass flowing from the natural example to the adversarial example j.
3.1 INCORPORATING THE PROXIMITY CONSTRAINT TO THE COUPLING.
Adversarial examples are tied to the original examples by a proximity constraint. Thus, a DRO formulation of adversarial training must encompass such constraint. For coupling measure it corresponds to the fact that it can transport (I, y) Pdata to (ir, y) ~ Padv only if || - Ø11>0 S c. Proposition 3.1 (DRO relaxation of adversarial training). The DRO problem (2) can be relaxed by considering coupling measure. that case the constraint set P Equation 2
take the form:
Peone {Pado 3x [((PatalPade) with supp(T) C {1z, R. v) || 2/1x0 S, }}.
This proposition proposes a convex relaxation of the initial constrain set (5). Intuitively, the set P constraints the distribution Pade to be e-close to Pdata- Because this set is convex we can hope corresponds to notion c-ball. We show in the next subsection that this intuition can be formalized by using the oo- oo-Wasserstein distance.
3.2 CONNECTION WITH OO- WASSERSTEIN
Given two distributions μ and v and distance function d, the -assssssettt distance corresponds to the minimal average E, norm to the power of p over the transport plans between μ and v. Formally, by calling = (x, y) and Z = X V, it can be defined
(L222 || E|l dz( 1/80
inf Way (u, nET((N.))
The p-oo- boo-Wasserstein distance can be defined as the limiting case p' + co. Thus, it can be seen as the minimal amount of point-wise transport (w.I.t. the lp norm) necessary to transport μ v. sup ||2 -
W p.oc (M,
inf rEll(u.)) (=.#))sm)p(T)
Thus by considering = we can establish that the set introduced in Proposition 3.1 can be described using the 00-c0- Wasserstein distance.
Proposition 3.2. [convex relaxation of adversarial training]For any < 1,2 the convex DRO relaxation of adversarial training can be reformulated
min DERd
max Pade EB, (Páaca)
I( w)1
(10)
where Be (pdota) = {pp Wo (p. Pdota) S E) and Wp.oo is defined in (9).
In other words, adversarial training can be seen as a DRO problem restricted to the distributions that are e-close the data distribution with respect to the 00-3c- Wasserstein Se-Wassersttenn distance within a space with the loo metric).
The p-p' Wasserstein distance has been widely studied the context of optimal transport [Champion et al., 2008; Villani, 2003]. The closeness of our formulation with OT encourages us to add an entropic regularization [Peyré and Cuturi, 2019; Cuturi, 201 3a].
This assumption is only for simplicity of exposition, what need in general is that min v/ which always be achieved by reparametrizing the discrete labels.
4

---

Under review as a conference paper at ICLR 2022
3.3 ENTROPY-REGULARIZEN FORMULATION
Entropic regularization has been a very successful approach for finding an approximate solution to OT problems [Cuturi, 2013b 3b; Genevay et al., 2016]. From a theoretical point of view, the entropic regularization prevents the sparsity of the coupling matrix, which is justified from a practical aspect in the context of transport by the fact that in practice the transport network diffuse [Wilson, 1969]. In the context of adversarial examples, this is justified by the fact that the adversarial examples are mostly located in areas of low probability for the input distribution [Song al., 2017; Ma al., 2018]. 8]. We suppose that Pdata admits density. For an arbitrary coupling measure л. we can define a relative entropy function as H (T) = - 12 z (log( (2, E)) 1)dx(z, 8) with H (T) +00 π does not admit a density. Thus our entropy entropy-regularized problem is:
min BER S.1. Padu (pdatt)
max TEll(pdate.Pads
(( (C( v) H())
(11)
The objective is strictly concave in therefore our regularized problem becomes strongly concave which ensures the existence and uniqueness of an optimal solution. will allow us to obtain an explicit formulation for the optimal coupling т and then for the optimal adversarial distribution Pode- The solution of this new problem will be an approximate solution of the original problem (A). By calling the optimal coupling Tx associated to this regularized problem (11) we have the following property:
Proposition 3.3. If + co, then T + π."
3.4 SOLUTIONS TO THE ADVERSARIAL TRANSPORTATION PROBLEM
In this section, we study the general framework where the two measures Pdata and Padv are defined on metric spaces X. No particular assumption is made on the form of Paato and Podv. The inner-objective of penalized adversarial transportation problem is the following:
(0) max (T)))===
max T TEll(p Pacto) s.t. 3pude EB, EB, (Páocc))
((E.a))Paaul (((fo()).)) v)1 B(
H
(12)
where B. (pdata) {p W oo (P, Pdata) E). For any given 0 E IR the function he is strictly- concave and the constraints on π are convex (ef Appendix for proof). Then, by using convex duality, deduce that the problem (12) has unique closed-form solution:
Proposition 3.4. For any given O E Rd, The optimization problem (12) has a unique solution.
xx" ((xr, v), (T. 5)) Pdata (I, v) (oop(A((J(()) v)) Se g-
(13)
For given natural example x. with a label y. x ((x,, y), (ā., 7)) grows with the propensity of it be better than the other elements of Bz(c) (the bball of radius e) to fool the classifier. We then deduce the explicit form of the adversarial distribution:
E Ex (Piata(y(a) exp(A Blo
Pado (7. 06.10 y)
(14)
THER, (xp(X
From this proposition, we notice that 5 E (c). then ((2, > 0, i.e. any examples which satisfies the adversary condition has non-zero probability to be considered an adversarial example of x. However, when À is large enough, most of the mass of the distribution lies where ((f(()) y) is close to its maximum value. Moreover it is interesting to notice that the mass of Pade (ā, y) can come from the transport of several input data-points as a potentially infinite number of input data-point x verify the constraint 1 || and thus could be transported to We will seen in the next section that is never happens in practice.
As we noticed before, the inner maximization problem is convex. By strong duality, we know that the dual form is equal to the primal. The primal can be ex- pressed with min over a lagrange multiplier s.t. a(x, y) - log( J.en...) (a) (
in ग and the constraints are
(c.f. Appendix A for proof) and is convex w.r.t. this variable. Thus, we can express the original min-max optimization problem as a convex minimizaion problem in which leads to our central theorem.
5

---

Under review as a conference paper at ICLR 2022
Theorem 3.1 (Characterization of the solutions), For any X >> 0, the solution set of the regularized
adversarial training problem (11) is:
0* E arg min (a log(
exp(AE([o(())))) =: ara min g(0),
(15)
and the optimal adversarial distribution associated with this adversarial training problem is
Podo () = dewp [Pdata( (y)zz)
exp(At(Se> (8),9)) Se= JEER.(S) exD(A
(16)
In order to solve (12) we would need to sequentially sample from π to compute the gradient of (see $4) for the exact derivation of V V0) Because of its normalization constant, the computation transport plan (29) for any given value of may be expensive to compute. However we will see in the next sections that: in practice, one computes this plan simultaneously with the training on the classifier and b) it has a simpler form in practice when dealing with a finite dataset.
A Zero-Sum game perspective on Adversarial Transport. One perspective (11) is that it corresponds to game between a classifier So and a transport plan и that aims at transporting the data distribution Pdita into an adversarial distribution Padv that is 6-close pdata with respect to the 00-00- -asseesssntt distance. While the classifier aims at minimizing the average cross-entropy loss over the adversarial dataset the transport plan aims at maximizing the errors of the classifier and its own entropy. This perspective is closely related to Adversarial examples games (AEG) [Bose et al., 2020] where the authors tried to learn an adversarial distribution with generator conditioned on the input examples. This work differs from AEG by its perspective (we connect adversarial examples with DRO), the problem formulation (we look for a regularized transport plan while AEG focused on generator), the algorithmic implementation (we consider Langevin to find the transport plan), and the finale focus since AFG concentrated on the generation of transferable adversarial example while our focus is on training robust classifiers.
This perspective also gives us an insight: the optimal distribution of adversarial examples may provide adversarial attacks that transfer well across models. The latter point can be supported by the following minimax theorem that is a simple extension of the result from [Bose et al., 2020, Prop. 1].
Proposition 3.5. Let call ((aa))>oad (e(fo()) v)1 (T) x) If (so 0 E θ) is convex set, then we have that
min max (0, T) = max min (00 T) OER TEP
(17)
TEP DER"
Peone = (Dadv 3r E [[ (Pado) with Supp(T) C ((x, u. I -|| S {ayEy])-
The assumption that the class of function (ff 1 θ is convex is not always true in practice but it holds in the case of linear classifier or when one assumes that we have infinite capacity classifiers (i.e. we can achieve measurable function). Moreover, considering the class of neural networks, it has been argued that they were spanning a set that is almost convex [Gidel et al., 2021].
3.5 PRACTICAL CASE: SEMI-DISCRETE ADVERSARIAL TRANSPORTATION PROBLEM
In practice, we do not have access to the true distribution Pdata but only to finite dataset sampled from this distribution (e.g MNIST/ CIFAR- 10, etc). This can be seen as considering the empirical distribution Pdota n Σ 82. However, even when considering empirical distributions, the dis- tribution of adversarial examples Padv is an arbitrary measure on metric space X' as an adversarial example could be any point in the -bll of radius e ball from the initial point (for datapoint æ; we call that ball Bz Its analysis is thus similar to the continuous case. However, in such a practical case the optimal transport map has simpler form under the following assumption
Assumption 3.1 (Empty intersection). We have that B (x., O B, (xry) for all 1 1 sitjsn.
For real world dataset, this assumption almost always true. It means that two datapoints are not e close which would mean that they are perceptually indistinguishable. We can actually show that if the inputs are high dimensional Assumption 3.1 hold with an exponentially high probability.
Proposition 3.6. Let assume that the datapoints z; are independently sampled from distribution p over [0, 1]d that is absolutely contimuous with respect to Lesbegue measure and has a bounded
value, i.e. p()) & M, x E (0, 1]d. Then P( + j E [m]. || x: silloo S <) = O

---

Under review as a conference paper at ICLR 2022
such a proposition could be extended to the more challenging setting where the data distribution is supported by a manifold but this is out of the scope this paper since its purpose is purely illustrative.
Theorem 3.2. |Churacterization of the solutions in the semi discrete case] For any > 0, the solution set of the regularized adversarial training problem (11) is:
1
E log ( exp()e(fe(() =: arg min g(0),
0 E aagg min
(18)
TEA
and under Assumption 3.1 the optimal adversarial distribution associated with this adversarial training problem is
())(A((f(())v)))
if Ai s.t. | - 3 1loo Se
Pade (2, y) =
ni (a.) exp (xp()e(Fa(())
(19)
0
otherwise.
The practical insight from this result is that the distribution of adversarial example can, practice be generated example-wise Meaning that for each datapoint F;,, i [ra] one can generate the distribution of adversarial examples around x; distributed as Padu (#. y) o exp(Ae(fo(()) y)), V - x;| S c. Practically, we will maintain finite dataset of the adversarial examples (fii,) associated with the datapoint T;
4 ADVERSARIAL TRANSPORT ALGORITHM
We want to solve the minimization problem (40). We can solve this problem using gradient descent:
" n Σ
(l(Jo(8)...)
g++1 8t - where Veg
Vol(fo(8), (.(x.)
dā (20)
S...C.) eA((fo(5)an) dā
To evaluate this gradient we need to sample from the distribution (()) x (x (z) over (x,). This be done via Langevin Monte Carlo [Durmus and Moulines, 2016] as the next section explains.
v)) defined
4.1 LANGEVIN MONTE CARLO
Unadjestued Langevin Algorithm [Durmus and Moulines, 2016] is convenient to sample high- dimensional probability distribution g. Having the following density w.r.t. the Lesbegue measure q(ī) & ex)(-U()), one can show that is the stationnary measure of the following Stochastic Differential Equation:
X = X - VU(X,) + 22
(21)
With (Ee), i.i.d (O, and (nt) constant or decreasing towards 0. L-smoothness of U gives existence and uniqueness of solution. Langevin MC can be seen as the sampling analog of gradient descent in optimization. In this work, we consider projected version of the Langevin algorithm since we need to sample within some lo balls. Such an algorithm has been analyzed by Bubeck et al. [2018] in the case where (zz) is convex. In our practical setting we will consider U, for J. E B. (xx.. i E [n] which are non-convex function. However, some results have been proven in that context by Ma et [2019]. Moreover, the Langevin algorithm has been recently used with great success in the context of diffusion models for deep learning for which the function U is not convex (see [Weng, 2021] for an overview).
Xe( (o) v.))
4.2 PRACTICAL SETTING
As described in Algorithm the training process has two loops:
1. Given minibatch (z,, B.), the inner loop samples the adversarial distributions qi (x) against the current classifier fo via Langevin MC where each samples are then projected onto Be(e) (operator PB.(e)) and onto the space N' (operator Px). It allows estimate Vg.
7

---

Under review as a conference paper at ICLR 2022
2. The outer loop consists of the stochastic gradient descent step (20).
Sign of the Gradient. Similarly to standard adversarial training and attack methods we use the sign of the gradient of g to update 9. It can be motivated by the fact that the sign of gradient is well suited to the geometry defined by the eo ball since it corresponds to the steepest descent direction [Boyd et al., 2004] in the &oo geometry [Balles et al., 2020].
Reusing the Examples. In practice, we restart the Langevin MC/ from the adversarial examples found at the previous iterations, this allow us to only use one step of Langevin MC in the inner loop and significantly speed-up training. This idea is justified by the fact that the distribution Pudo (ž, y) x exp(Xe(fel))
y)) is actually a continuous function of 0. It can be seen with duality argument from (12) where the function (x)) is strictly concave with respect to æ which implies the continuity of f + arg max, ho(T). . We leave as a future work the formalization of this argument.
Algorithm 1 Adversarial Transport with Langevin
5 EXPERIMENTAL RESULTS
1: input: dataset (Ir, yt) step-size: 77. number of adversarial examples: K, noise variance a.
We investigate the Adversarial Trans- port Algorithm at training robust clas-
2: Initialization: .i.k = x4 E [n], E [K]
3: for nb of steps do
sifiers (for a given hypothesis class)
4: Sample a minibatch: (z,, ViliEB B C [m]]
against adversarial attacks on MNIST and CIFAR-10.
5: Load the attacks: 2! Ti i B, k E [K]
6: for T: : nb langevin iter do
Experimental setup The experiments are realized on MNIST and CIFAR-10.
7: for E B, k E [K] do
(1+1)
+z(h + ssign (Vallf((E!t (1+1) 12))
(0(0)
8:
Lik x -iik
We perform all attacks and training with E = 0.3 for MNIST and e = 8.0 for
9:
Fi,k
(t+1) +- -PB(()) (++1)
+
CIFAR-10 (W.I.. to the foe norm). We train our robustly trained classifier us- ing stochastic gradient descent with the cross-entropy loss. We use learning
10:
a(++1) + -Px(a((t))
11:
Vag = B EiERAEEKK Vol(fo (f++1) .w)
1
12:
0 - n Vog
rate I, = 0.1 in the case of Adversarial
13:
Save the attacks: Ti,b + a i E [K]
Transport and update 0 with the sign of the gradient.
14:
Return: 9
For both datasets, we train classifier with 100 epochs, batch size of 100. For Langevin MC parameters, we take K 1, (A) = 0.2 and a 0.2 (i.e. À = 2n = 10). In theory, we must take À big enough to have a good approximate of the solution. Appendix B.I shows that in practice À = 10 is the best value to ensure convergence of our algorithm.
Baselines We test our robust classifier against first-order attacks: Fast Gradient Sign Method (FGSM) attacks [Goodfellow et al., 2014; Szegedy et al., 2014], Projected Gradient Descent (PGD) attacks with 40 iterations (PGD 40) and PGD attacks with 100 iterations (PGD 100) [Madry et al., 2017; 2018]. We compare those results with the performance of classifiers adversarially trained with PGD [Goodfellow et al., 2014; Madry et al., 2017; 2018] on the same attacks (we trained PGD classifiers according to the method described in the paper and use the same parameters: 4, = 0.01, 100 epochs, trained with PGD 40). All the attacks are generated via the library Advertorch of Pytorch'. The attacks are Eo bounded. Additional details concerning the tuning of hyperparameters and hypothesis classes used are given in the Appendix 1. We evalute white-box attacks (i.e. we have access to the gradient of the model we want to attack). The results are provided below:
5.1 PERFORMANCE ON MNIST
We first compare both methods on MNIST, the architecture is the same for both frameworks and described in the Appendix B.2. We make two main observations, first training the model using Langevin improves the overall robustness of the classifier against all attackers we tested against as shown in Table 1. Secondly, by re-using the samples from the previous iterations we converge much
*Code: http://ammnnnnan..ooopsssseeeeee Trainiign-nninCC BCA4
8

---

Under review as a conference paper at ICLR 2022
faster, indeed for each update of the classifiers only need to do one back kack-propagation instead. This leads to a very important speed up as observed in Fig 2.
Performance
Langevin
PGD
usigg
Train Adversarial
98.48%
94.81%
Larged
Clean test set
99.16%
98.82%
F0004
PGD
FGSM
96.53%
94.95%
PGD 40
93.12%
92.28%
PGD 100
91.87%
91.18%
Autoattack
88,55%
89.10%
33
Comparison of the performance for MNIST of robust classifiers trained with Langevin and PGD (with 40 iterations). The architecture of two classifiers architecture A. The attacks are FGSM, PGD 40, PGD 100, and autoattack (Croce and Hein [2020]). The classifier trained with Langevin more robust than the one trained with PGD except Autoattack.
Table 1:
Figure 1: Comparison of Langevin and PGD adversarial training on MNIST. We plot the error rate against FGSM function of the number of backprops. We observe that Langevin converges much faster only needs compute gradient per update of the classifier by being able to re-use the samples from the previous iterations. After 8 iterations, Langevin achieves a score that is not even reached by PGD after 1600 iterations.
measure
5.2 PERFORMANCE ON CIFAR-10
Performance
Langevin
PGD
Train Adversarial
99.82%
99.38%
Mudd saing:
Clean test set
78.72%
68.93%
PGD
FGSM
53.40%
45.58%
Eme TOMM
Largnin
63
PGD 40
49.57%
44.70%
PGD 100
49.50%
43.74%
m
Table 2: Comparison of the performance for CIFAR-10 of robust classifiers trained with Langevin and PGD (with 40 iterations). The ar- chitecture of the two classifiers is RESTNETI8. The attacks are FGSM, PGD 40, and PGD 100. As for MNIST, the classifier trained with Langevin is much more robust than the one trained with PGD for each measure.
-00
Figure 2: Comparison of Langevin and PGD adversarial training on CIFAR. We plot the eттоr rate against FGSM function of the number of backprops. We observe that Langevin converges much faster as only needs to compute gradient per update of the classifier by being able to re-use the samples from the previous iterations.
CONCLUSION
In this paper, we introduce the Adversarial Transport Framework. We derived this framework from Adversarial Training relaxation through regularized Distributionally Robust Optimization (DRO) with Co-oo-Wassersee
distance. The outcome of this work provides close form of the optimal adversarial distribution against a given classifier which can be sampled via Langevin Monte-Cand Carlo. From that, we have designed an algorithm that optimally trains (for given hypothesis class) classifier against adversarial examples. The major asset of our work, which surely justifies these outstanding results, is that considers the problem the scale of the entire dataset and not at the scale of the example.
Our algorithm brings several novelties: at each iteration, we perform gradient ascent on the distribution and gradient descent on the classifier. For this, we keep in memory the current distribution of adversarial examples and iterate on it at each step. In addition, only one iteration of Langevin MC is necessary at each step. As result, our experiments show that the Adversarial Transport classifier outperforms PGD trained classifier on MNIST and CIFAR-10, but also that our algorithm allows to train much faster than with PGD thanks to the novelties described above.

---

Under review as a conference paper at ICLR 2022
REFERENCES
A. Athalye, I.. Engstrom, and K. K. A. Ilyas. Synthesizing robust adversarial examples. Synthesizing robust adversarial examples. The Thirty-fifth International Conference on Machine Learning (ICML), 2018.
L. Balles, F. Pedregosa, and N. L. Roux. The geometry of sign gradient descent. arXiv preprint Stti:22002.080566 2020.
A. Ben-Tal and A. Nemirovski. Robust convex optimization. Math Oper Res, 23, pp. 769-805, 1998.
J. Blanchet and K. Murthy. Quantifying distributional model risk via optimal transport. Mathematics of Operations Research, 44(2):565-600, 2019.
J. Bose, G. Gidel, H. Berard, A. Cianflone, P. Vincent, S. Lacoste-Julien, and W. Hamilton. Adversar- ial example games. Advances in Neural Information Processing Systems, 33, 2020.
S. Boyd, S. P. Boyd, and L. Vandenberghe. Convex optimization. Cambridge university press, 2004.
S. Bubeck, R. Eldan, and J. Lehec. Sampling from log-concave distribution with projected langevin monte carlo. Discrete & Computational Geometry, 2018.
T. Champion, L. de Pascale, and P. Juutinen. The oc-wasserstein distance: local solutions and existence of optimal transport map. SIAM Journal on Mathematical Analysis, 2008.
E. Chouzenoux, H. Gérard, and J. Pesquet. General risk measures for robust machine learning. Foundations of Data Science 1, 249, 2019.
Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
M. Cuturi. Sinkhorn distances: Information Processing Systems, pages 2292-2300, 2013a.
Lightspeed computation of optimal transport. In Adv. in Neural
M. Cuturi. Sinkhorn distances: Lightspeed computation of optimal transportation distances. Advances in Neural Information Processing Systems 26, pages 2292-2300 2013b.
E. Delage and Y. Ye. Distributionally robust optimization under moment uncertainty with application to data-driven problems. Operations research, 2010.
J. Duchi and H. Namkoong. Stochastic gradient methods for distributionally robust optimization with fdivergences. In Advances in neural information processing systems, pp.
2016.
J. Duchi and H. Namkoong, Learning models with uniform performance via distributionally robust optimization. arXiv preprint 11X0v:/810008750, 2018.
J. Duchi, P. Glynn, and H. Namkoong. Statistics of robust optimization: A generalized empirical likelihood approach. arXiv preprint arXivv1610.03425. 2016.
A. Durmus and E. Moulines. High-dimensional bayesian inference via the unadjusted langevin algorithm. arXiv: 01559, 2016.
E. Wong, F. R. Schmidt, and Z. Kolter. Wasserstein adversarial examples via projected sinkhorn iterations. Proceedings of the 36th International Conference Machine Learning, PMLR 97:6808- 6817,, 2019.
R. Gao, X. Chen, and A. J. Kleywegt. Wasserstein distributional robustness and regularization in statistical learning. arXiv preprint arXiv: 2017.
A. Genevay, M. Cuturi, G. Peyré, and F. Bach. Stochastic optimization for large-scale optimal transport. NeurIPS, 2016.
G. Gidel, D. Balduzzi, W. Czarnecki, M. Garnelo, and Y. Bachrach. -aaited minimax theorem for non-convex games How i learned to stop worrying about mixed-nash and love neural nets. In International Conference on Artificial Intelligence and Statistics, pages 2548-2556 PMLR, 2021.
10

---

Under review as a conference paper at ICLR 2022
I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv:1412.6572, 2014.
L. V. Kantorovich, A new method of solving of some classes of extremal problems. In Dokl. Akad. Nauk SSSR, volume 28, pages 211-214, 1940.
A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial machine learning at scale. arXiv:1611.01236. 2016.
H. Lam. Recovering best statistical guarantees via the empirical divergence- based distributionally robust optimization. Operations Research, 2018.
X. Ma, B. Li, Y. Wang. S. M. Erfani, S. Wijewickrema, M. E. Houle, G. Schoenebeck, D. Song, and Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality. ICLR 2018, 2018.
Y.-A. Ma, Y. Chen, Jin, N. Flammarion, and M. I. Jordan. Sampling can be faster than optimization. Proceedings of the National Academy of Sciences, 2019.
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. arXiv: 1706. 06083 [stat.M]], 2017.
A. Madry, A. M. L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Q. Merigot and Thibert. Optimal transport: discretization and algorithms. 2020.
S. Moosavi-DezZooli A. Fawzi, and P. Frossard. Deepfool: simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages 2574-2582, 2016.
A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. Proceedings of the IEEÉ Conference on Computer Vision and Pattern Recognition, pp. 427-436, 2015a.
A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks easily fooled: High confidence predictions for unrecognizable images. Computer Vision and Pattern Recognition (CVPR 2015). IEEE, 2015b.
N. Papernot, P. McDaniel, Jha, M. Fredrikson, Z. B. Celik, and Swami. The limitations of deep learning in adversarial settings. Security and Privacy (EuroS&P) 2016 IEFF European Symposium on, pages 372-387, 2016a.
N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation as a defense to adversarial perturbations against deep neural networks. Security and Privacy (SP), 2016 IEEE Symposium on, pages 582-597. IEEE, 2016b.
G. Peyré and M. Cuturi. Computational optimal transport. Foundations and Trends in Machine Learning, vol. 11, no. 5-6, pp. 355-607, 2019.
H. Rahimian and S. Mehrotra. Distributionally robust optimization: review. arXiv preprint 1eXiv:1908005000 2019.
A. Santurkar, Tsipras, L. Engstrom, B. Tran, and A. Madry. Adversarial examples are not bugs, they are features. arXiv:1905.02177 2019.
A. Sinha, H. Namkoong, R. Volpi, and J. Duchi. Certifying some distributional robustness with principled adversarial training. ICLR, 2018.
R. Sinkhorn. A relationship between arbitrary positive matrices and doubly stochastic matrices. Ann. Math. Statist,, 35:876-879, 1964.
Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman. Pixeldefend: Leveraging generative
models to understand and defend against adversarial examples. ICLR 2018, 2017.

---

Under review as a conference paper at ICLR 2022
M. Staib and S. Jegelka. Distributionally robust deep learning generalization of adversarial training. In NIPS Machine Learning and Computer Security Workshop, 2017.
L. Sun, M. Tan, and Z. Zhou. A survey of practical adversarial example attacks. Cybersecurity, 1(1):9, 2018.
C. Szegedy, W. Zaremba, I. Sutskever, Bruna, Erhan, I. Goodfellow, and Fergus. Intriguing properties of neural networks. International Conference on Learning Representations (ICLR), 2014.
Tramer, A. Kurakin, N. Papernot, I. Goodfellow, D. Bonch, and P. McDaniel. Ensemble adversarial training: Attacks and defenses. International Conference Learning Representations (ICLR), 2017.
F. Tramèr, A. Kurakin, N. Papernot, D. Bonch, and P. McDaniel. Ensemble adversarial training: Attacks and defenses. 17Xiv:1705.07000 [stat.ML]. 2017.
C. Villani. Topics in optimal trunsportation, volume 58. American Mathematical Soc., 2003.
C. Villani. Optimal transport: old and new. Springer, 2009.
L. Weng. What are diffusion models?
2021. URL https: htt.://ww...ttt....//oo///////// mon. .hmll.
A. Wilson. The use of entropy maximizing models, in the theory of trip distribution, mode split and route split. Journal of Transport Economics and Policy, pages 108-126, 1969.
S.
Zagoruyko and N. Komodakis. Wide residual networks. 2017.
T. Zheng, C. Chenl, and K. Ren. Distributionaaly adversarial attack. The Thirty-Thin Third AAAI Conference on Artificial Intelligence, 2019.
12

---

max Under review as a conference paper at ICLR 2022
A PROOFS OF THEORETICAL RESULTS
Proposition 2.1. The adversarial training problem (1) can be formulated as a DRO problem (2)
where:
P= Pado : 31: X X, Padv T,Patta and [[T(x) x x1100 S e,, Vo E X}
(22)
Proof of Proposition 2.1. Let us start with the original adversarial training problem:
min (a..)))-pa max DER
112-211 (ā,
(23)
Let us call T(x) == I, thus, we have
((fo(T(z)))] = T, (I)(())))llll) Se, veed ((z.a))Paatu [/(
max
max
E (a.y)) ((fo(T(z))))))
By definition of the pushforward measure we have that
max (((.v))ppaac [T(x)=>Il<< ((Jo(T(z)v)) T, (1IT))==+l>>> VrEX
E (22.)) [e(So (()))
which conclude proof since then it is equivalent to maximize over T Padv Typdata-
Proposition 3.1. The DRO problem (2) can be relaxed by considering coupling measure. In that case the constraint set P Equation 2 take the form:
Peonv = {Pado 3x E I((PaatalPado) with supp(#) C {(,,8, ||[ - x/100 Seyyyy,
Proof of Proposition 3.1. We will prove that
Peonv
(24)
and that P Poony is convex. First let us start by showing that,
P C Pcone
(25)
Let us consider Pade E P. By definition of P there exists T X + X' such that Padv = TePdata
and [T((x) xlloe I Now, we can define the coupling measure TT (Id, Ia, T, IT..d))PPan Pdate
where (Ia, Ia. T, [a) = (z, y, (x), y). We can verify that πт E [[(pdata [TaPdota] and that by definition of T, we have supp or {(x, y, y) s.t. - x x/1oc S, I, E X. y E y
Finally, let us prove that P Peonv is convex. Let us consider P2 E Peono and X E [0, 1]. By definition of Peones we know that there exists Ti E [P(ata P1) and T2 E [[(Patta (P2) such that supp(=1) and supp( are included in {zz y, H. 3) s.t. _ - x x0100 S C, x E X, E ) }. By linearity of the marginalization we have that Ar + (1 A) T2 E I[ppttaal XPp + (1 A)p2). Moreoevr, we have that supp(An (Am + (1 - A)=2) = supp ) supp(T2) C [(x, y, T. v) s.t. || æ/1co Se, I,
X. E y Thus we have Ap1 + (1 A)p2 E Peonv It concludes the fact that Peonu is convex. O
Proposition 3.2 (convex relaxation of adversarial training). The convex DRO relaxation of adversar- ial training can be reformulated as
min BER
max
((E.)))ppa. ((E:)))pea..(((((tt, y)l
Pade E. (Pasta)
where B. (Pdota) {pl W 00.00 (p. Paata) S E} and p. defined in (9).
Proof of Proposition 3.2. Under mild assumptions (see the assumption of [Villani, 2009, Prop 5.21))
B. (pdata) = {p) Woo Woo,00 (p. Pdata) S {} = Peone-
Pado E Peono + 3 E I[pdarra with supp(ı) C ((x, R,y) || - ælloo S e, E )1
(26)
Ex [[daaa Padv) with
sup (x.5))))pp(r) || - E11 S
||2- E1100 Sc
(27)
min *paeee Paas)
sup (smp))))
(28)
Note that the second equivalence is possible because e < minlyy 1/ s and the third one because
the minimum is achieved by compactness of [[paata (aav)) (see [Villani, 2009, Prop 5.21]).
n
13

---

Under review as a conference paper at ICLR 2022
Proposition 3.3. I oo, then πÿ n.
Proof of Proposition 3.3. The proof is similar to the proof of Proposition 4.1 from Peyré and Cuturi [2019] since compact.
Proposition A.1. For any given 0 E R", the function he( 12 [R. (R.y) (( + (T))
is strictly-concave and the constraints on P are convex.
Proof. P and JF are convex sets: both constraints of P are linear, and is convex by F by assumptions.
Moreover,
he( (TT) the sum of concave term and strongly concave term. Indeed:
+ ((s.))) [(( y)] concave in a by linearity.
+ ((T) is strongly concave in m.
0 + hT(T)) is convex by convexity of (e.g. mean squared loss, cross entropy loss, ...).
Proposition 3.4. For any given 0 Rd, The optimization problem (12) has a unique solution,
x² ((x,, u), (T. v)) patta (z, v) (x=
(29)
For a given natural example with label y. T22 2) grows with the propensity of I be better than the other elements of Br (c) (the -bal of radius c) to fool the classifier. We then deduce the explicit form of the adversarial distribution:
Pado (3. y) Expps data (ylata(ylz)) (0)) JHEBIG exp()
x" x2, x Pdato (2, exp(A)(fo())) v)) -
Proof of Proposition 3.4. The objective function is concave and at the optimum xt ((x, v), (#. y)) 0 for each (x, i. y) s.t. |æ - ø|| S c. The objective function is C in the neighborhood of n²" Thus, we can introduce dual variable
R LL ,a) 0. The Lagrangian function L is:
L(T a)) = [
1 3 (log(T((Z))) v), (ā. v)) 1)dT((( (z.
Jaxz ((f(()). ((x, ((),
x 2x2
+ / a(x,y)
y)dx ()) (paaaalz (2,
/ dr dT((z, (I (1)
exx
2xz
(30)
a( / (e(fo()),)) v) 1 (00g( 1) ((xx,))dd(((, () v))
2x2
(31)
/ a(z, Pdata (2. v)dr
AL( a)) ((fo()),)) -
a(x, y) =
(32)
dn So at the optimum, for each ((x, v). (7. v)) s.t. || - øl| < e, we have
xx *"((,,)) (Z. exp(A(E(fo()), v))) exp( >a(r, v)))
In addition, know
14

---

Under review as a conference paper at ICLR 2022
(I: thus exp(-Xa" (z, v)) Pdota (z, 1) TSeB. exp(Ate(to(()))))dd Therefore, for each ((I, y), (T, v)) s.t. || x S
that J(a.))BB ((ay)) ( y), (ž, v))
exp exp(A(e(fa(()) v))
('x,,, (ã. v)) = Paata (x, 8)
v==
(a).(a))
And π (( (², v)) for each ((x, v), (1) s.t. I| - x1|
i.e.:
exp(M(((fo(B).
x ("x y). (2. v)) = ( v)
(aEBB(a) exp(A(((fe(T)) y 2| #11
n" ((z, (ā, v)) x Pdota (I, y) ex)(M((f(() -
Therefore, have that:
1
/ a(x, V)Daata (x, v))(1.))
sup L(, X
(33)
mupL(T, a) = À X /// Pdata (I, log(
1
Pdata Jd(r,)) 8)
(34)
(x) exp(X(((f(((
L(r, = X (12 Pdata logg
xxp(((tte((3,))))d))))) J
Pdata (2)
+1)
(2).(w))
(35)
Proposition 3.5. Let call E(2, (2. (((Jo()).)) HT) ((0, If (So 0 θ) is convex set, then we have that
min max (p0, rT)
max min (0(, π))
(36)
BER"
TEP BER
where {Pade 3m II(p2, vs Pr. xlloo= > }.
with क (((2, (ū, v)) 0, Vr, e
|
Proof. The proof is similar the proof of Theorem 28 from Merigot and Thibert [2020].
Proposition 3.6. Let us assume that the datapoints x; are independently sampled from a distribution p over [0, 1 that is absolutely continuous with respect to Lesbegue measure and has a upper-pour bounded value, i.e. p(x) & M, x E 1]" Then P(di + j E [n], || 2illoo I E) = ed)
Proof of Proposition 3.6. Let consider the quantity
P( イj [n]. || Ixlloc <) nnn P([lē æl100 Sel
(37)
2
n(n MVol(B(z,e))
(38)
2
nnn Med
1)
(39)
2
15

---

Under review as a conference paper at ICLR 2022
Theorem 3.2 (Characterization of the solutions in the semi discrete case). For any 0, the solution set of the regularized adversarial training problem (11) is:
(/ exp(Ae([o()) =: arg min g(0),
0" E arg min
log
(40)
TX 2m
and under Assumption 3.1 the optimal adversarial distribution associated with this adversarial training problem is
cxp(Ae((f(().v))
if 3i s.t. 1 - E1100 S
Pado (T, y)
[JEEB(())) exp(Ae(fo(3).g))
(41)
0
otherwise.
Proof of Theorem 3.2.
min max E (en H(T)
(42)
loeF PadeEP
From Proposition 3.5:
min / a(x, W)Paaaa v)dx) + 2 for a(x,z) = - log( (EEB.(z) (xp()(e([((Z).))))
-
Pdata (I, y)
min foet
(43)
(J pdata(s) log( JoeT A
1
min
exp(X(((66(3) - Potato (2, y) log(Paata (x, 8) )dd dx +
(44)
Finally, the probability distribution of the adversarial examples Pade is written:
Pado (āt, y)
v. dT((Z, (Z.))
(45)
xEX
Pado (i, y) = / Pdota(x, (2, v) exp(Ae(fa()), 9)))
Jx exp(Ne(fo d) 1|| dz
(46)
Pado (ï., 3)
Exppa,daa (daatalyla (11z) TEeB.c. (xp(A
(x p-
(47)
In practice: Pdata; n. so we have:
exp(Xe(fo(a).
Ei [m] s.t.
||. - 3 loc S
Podo (ū. 3)
(.EB,(..) exp(A((fe(t).)))
otherwise.
and then,
1 log
(f exp(Ae(f6(#) arg min g(0),
8t arg min nA
1=1
B ADDITIONAL RESULTS
B. TUNING OF HYPERPARAMETERS
In this section, detail the tuning of different hyperparameters. Among them:
16

---

Under review as a conference paper at ICLR 2022
T The number of Langevin iterations for crafting adversaries during the training process. a: Represents the noise which is the particularity of the Langevin. Indeed, it differs from the gradient descent by the addition of Gaussian noise. The noise allows adding randomness in the crafting of adversarial examples. Thus, the size of the noise, well its shape, are of primary importance in the performance of Langevin. For example, a too important noise will generate totally random examples and will erase the weight of the gradient.
1/t = À 7. represents the learning rate of Langevin MC. The parameter represents the learning rate Langevin.
In general, even if 2 2, we only keep the last batch of adversarial examples for updating Here, all the results are presented for 7 which gives the best results and the best computation time. further study could analyze the influence of using more batches of adversarial examples at each epoch of the training. The results for the influence of and rp (A) provided below:
0.
05
04-
Figure Influence of a (noise_sg saase__saaee___ on the performance of the classifier when training with Adversarial Transport framework with architecture A. These results are for T and m²(A) 0.2. We did the same experiment with other values of (A()) but whatever the value a, mi(A) = 0.2 gives the best result.
eroer rile
0.6
0.4
0.15
0.20
0.25
Figure 4: Influence of nh (A) (eta langevin) on the performance of the classifier when training with Adversarial Transport framework with architecture A. These results are for = and a 0.2. We did the same experiment with other values of but whatever the value of (A), 0.2 gives the best result.
The two of these typerparameters. Regarding that À 2q, these experiments show that the best value for we can take is À = 10. These graphs justify the fact that our whole study was conducted with (A)
similar. We notice that the method converges only for small range of values
0.2 and = 0.2.
B.2 MODELS ARCHITECTURE
We study the influence of the architecture of the neural network on the performance of our model. We test our algorithm with the two models below. Model B is the one used by Madry et al. [2018] for the PGD framework.
17

---

Under review as a conference paper at ICLR 2022
Architecture A
Conv(1,6445)
Performance
Langevin
PGD
ReLUO Conv(64,64,5)
Train Adversarial
98.48%
94.81%
Clean test set
99.16%
98.82%
ReLUO Dropout(0.25)
FGSM
96.53%
94.95%
PGD 40
93.12%
92.28%
Linear(64 x 20 x 20, 128)
PGD 100
91.87%
91.18%
Dropout(O.5) Linear( 28,10)
Table 3: Comparison of the performance of robust classifiers trained with the Adversarial Transport framework (Langevin) and PGD (trained with 40 iterations). The architecture of the two classifiers is the above architecture A. The robustness of these two models is tested against FGSM attacks, PGD with 40 iterations (PGD 40) and PGD with 100 iterations (PGD 100). The trained classifier with Langevin is more robust than the one with PGD.
Architecture
Cony(1,32.3.padding 1)
ReLU()
Conv(32,64,3, padding = I, stride 2)
Performance
Langevin
ReLU()
Train Adversarial
99.42%
Conv(32,64.3, padding
Clean test set
99.10%
ReLU()
FGSM
97.73%
Conv332,64,3, padding
PGD 40
94.82%
ReLUU
PGD 100
94.18%
Flatten()
Linear(7 X 64, 100)
ReLUO
Linear( 100,10)
Linear(100,10)
Table 4: Performance robust classifiers trained with the Adversarial Transport framework (Langevin) with architecture B. The robustness of this model is tested against FGSM attacks, PGD with 40 iterations (PGD 40) and PGD with 100 iterations (PGD 100). The results are better than for architecture A. Especially, and PGD 100 attacks. As explained in Madry et al. [2018), networks with larger capacity are stronger against ad adversarial attacks.
notice that there is no loss of performance between PGD 40 attacks
Performance
Langevin
PGD 40
Train Adversarial
98.90%
97.42%
Clean test set
84.07%
83.54%
FGSM
56.47%
59.51%
PGD 40
55.64%
58.88%
PGD 100
54.50%
57.97%
Autoattack
26.12%
26.04%
Table 5: Performance comparison of a wide ResNet (Zagoruyko and Komodakis [2017]) trained with the Adversarial Transport framework (Langevin) and PGD 40 on CIFAR-10. No hyperparameter tuning was done; the same setup described in Section 5 is used with the exception of only training for 36 epochs instead of 100. The Langevin framework took about 2h Om to train, while PGD 40 took 43h43m train.
18


Reviews:
[{"review_id": "ZR8tRnHeVFH", "reviewer": "Reviewer_CrMc", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths of the paper:**\n- The technical contribution of this paper is significant because it shows a connection between standard adversarial training such as PGD and distributional robustness. \n-  All obtained theoretical results are meaningful and have clear impacts.\n\n**Weaknesses of the paper:** \n- Although the obtained theoretical results sound reasonable and meaningful, the mathematical communication and proof in this paper seem not solid to me.  Specifically, in all derivations in Appendix, it only mentions $\\pi(x, x')$ with a lack of the label $y$. Still, it is unclear how to associate label y to Eq. (11) since Eqs. (9,10) only mention $x,x'$ and a WS distance between data distributions.\n- There are no proofs of Theorems 3.1 and 3.2 in Appendix. Moreover, Appendix is not well-organized to connect to the main paper.\n-  The experiments are too humble which need a comparison with more baselines using more advanced architectures. Moreover, the authors should report the robust accuracy for black-box attacks and Auto-Attack.", "summary_of_the_paper": "- This paper proposes using $\\infty$-Wasserstein distributional robustness for improving model robustness. Specifically, to obtain a tractable solution, it adds an entropic regularization term to the primal form of $\\infty$-Wasserstein distributional robustness. The Langevin algorithm is used to sample adversarial examples for adversarial training.\n\n- Although the experimental results show the merit of the proposed method, the experiments are still humble with a lack of experiments on more impactful architectures such as WideResNet and comparison to other SOTA adversarial training methods.", "summary_of_the_review": "This is a technically significant paper because it shows the connection between $\\infty$-Wasserstein distributional robustness and standard adversarial training PGD. All obtained theoretical results are meaningful and have clear impacts. However, the presentation and writing of the paper need to be improved to make it a more solid paper. \n- How to associate the label $y$ to the formulation?\n-  Appendix needs to be organized better and all proofs need to be consistent with the main paper.\n\nThe experiments are still humble which need a comparison with more baselines using more advanced architectures. Moreover, the robust accuracy for black-box attacks and Auto-Attack should be reported.\n\nIt is unclear why the proposed method is faster than PGD even a single adversarial particle is searched using the Langevin algorithm.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "NTRQRqwIn6", "reviewer": "Reviewer_mcjf", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The strength of this paper is a new adversarial training method that treats the problem as distributional-wise, as compared with traditional sample-wise adversarial training methods, and the proposed method has been shown to have better performance than some baselines.\n\nThe main weakness is the novelty of this paper. The technical or algorithmic contribution of this paper seems to be very limited. \nThe equivalence between the adversarial training under infinity-norm perturbations and the DRO under \\infty-\\infty-Wasserstein distance is very straightforward. Moreover, given such equivalence, the paper does not provide enough motivation about why we still want to consider the distributionally adversarial training. Also, instead of solving the DRO problem, the entropic regularizer is imposed in order to get a closed-form solution of the least favorable distribution. And it would be good to provide more theoretical insights.\nAlso, in the numerical results, how about the training time comparison between the proposed method and baseline methods? \n\nTypoes and minor issues:\n1 Page 6: “The latter point can be supported that the following…” should be “supported by the following”\n2 Page 7: the Lesbegue measure $q(\\tilde x)$ should be proportional to $exp(-U(\\tilde x))$\n3 Algorithm 1 line 9, should be $\\tilde{x}^{t}$ on the right hand side\n4 Figure 1 and 2: It would be better to use same color to denote the same method.", "summary_of_the_paper": "This paper establishes the equivalence between the adversarial training problem (under infinity-norm) and the Distributionally robust optimization (DRO) problem with \\infty-\\infty-Wasserstein distance. Then they propose to use an entropic regularizer to find the regularized optimal adversarial distribution more efficiently. Numerical results on MNIST and CIFAR-10 validate the performance of the proposed method.", "summary_of_the_review": "In summary, although this paper show certain equivalences between adversarial training and DRO, it is mostly a straightforward result under the infinity norm, and the overall contribution of this paper seems to be limited.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "C4TgBxoTl8G", "reviewer": "Reviewer_qU23", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\n\nThe results linking adversarial robustness to distributional robustness in Section 2 are both presented without proof, and already known and published. There are quite a few papers that present similar results, for example: \nhttps://arxiv.org/pdf/1710.10016.pdf \nhttp://proceedings.mlr.press/v139/cranko21a/cranko21a.pdf\n\nA significant weakness of this submission is the mathematical rigour, which is sorely lacking. Many of the propositions are presented without proofs, and there are simple mistakes of measure theory present throughout. For example on page 3, $\\pi$ is declared to be a coupling on the product $\\mathcal X \\times \\mathcal X$, yet later $\\pi:\\mathcal X \\times \\mathcal X \\to [0,+\\infty]$ is written. When this should in fact be $\\pi:\\mathcal B(\\mathcal X \\times \\mathcal X) \\to [0,+\\infty]$. Classically couplings are required to also be probability distributions, so this should in fact be  $\\pi:\\mathcal B(\\mathcal X) \\otimes \\mathcal B (X) \\to [0,1]$. This is an aesthetic issue, but in Proposition 3.1 it has real significance since the constraint $\\pi(x,\\tilde x) = 0$ is meaningless. A proof of this proposition is not presented and so it is impossible to evaluate the rigour here. The same issue occurs through the proof of Lemma A.2, where, more egregiously $\\log ( \\pi(x,x') )$ is integrated without a treatment of infinities. \n\nI believe it would substantially improve the paper to provide a proper discussion of the literature and characterising how these results improve upon existing ones. As an editorial note, if a proposition or theorem is simple enough to present without proof then it should not be leveraged as a cornerstone result, or perhaps included at all. \n\nThe experimental results however are encouraging, in the time since submission have you been able to more thoroughly \nevaluate your model against other state of the art approaches?\n\n\n", "summary_of_the_paper": "The authors present a connection between adversarial robustness and distributional robustness. A duality result is given linking the $\\infinity$-Wasserstein distance to an entropy regularisation problem. The problem is then solved using a Langevan-sampling based algorithm.\n\n\n", "summary_of_the_review": "The authors present an encouraging algorithm that appears to perform well. However, section 2 seems to consist almost entirely of known results. The new theoretical results included however are often shown without proof and are lacking in rigour.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: In this paper, authors study adversarial examples from a distributional robustness point of view. Reviewers had several concerns about the work and all thought the paper is not above the accept threshold. In particular, they mentioned that the presentation and writing of the paper need to be improved and results (specially the ones presented in Section 2) are not significant contributions and novel. Given all, I think the paper needs more work before being accepted.
Decision: Reject