Provable Robust Overfitting Mitigation in Wasserstein Distributionally Robust Optimization
Authors: Shuang Liu
Yihan Wang
Yifan Zhu
Yibo Miao
Xiao-Shan Gao
Venue: ICLR 2025 Poster (2025)
Keywords: Adversarial examples; Robust overfitting; WDRO
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Wasserstein distributionally robust optimization (WDRO) optimizes against worst-case distributional shifts within a specified uncertainty set, leading to enhanced generalization on unseen adversarial examples, compared to standard adversarial training which focuses on pointwise adversarial perturbations. However, WDRO still suffers fundamentally from the robust overfitting problem, as it does not consider statistical error. We address this gap by proposing a novel robust optimization framework under a new uncertainty set for adversarial noise via Wasserstein distance and statistical error via Kullback-Leibler divergence, called the Statistically Robust WDRO. We establish a robust generalization bound for the new optimization framework, implying that out-of-distribution adversarial performance is at least as good as the statistically robust training loss with high probability. Furthermore, we derive conditions under which Stackelberg and Nash equilibria exist between the learner and the adversary, giving an optimal robust model in certain sense.Finally, through extensive experiments, we demonstrate that our method significantly mitigates robust overfitting and enhances robustness within the framework of WDRO.

Published as a conference paper at ICLR 2025
PROVABLE ROBUST OVERFITTING MITIGATION IN WASSERSTEIN DISTRIBUTIONALLY ROBUST OPTI-
MIZATION
Shuang Liu, Yihan Wang, Yifan Zhu, Yibo Miao, Xiao-Shan Gao'
State Key Laboratory of Mathematical Sciences
Academy of Mathematics and Systems Science, Chinese Academy of Sciences Beijing 100190, China
University of Chinese Academy of Sciences, Beijing 100049, China
ABSTRACT
Wasserstein distributionally robust optimization (WDRO) optimizes against worst-case distributional shifts within specified uncertainty set, leading hanced generalization on unseen adversarial examples, compared to standard ad- versarial training which focuses pointwise adversarial perturbations. How- ever, WDRO still suffers fundamentally from the robust overfitting problem, as it does not consider statistical error. We address this gap by proposing novel ro- bust optimization framework under new uncertainty set for adversarial noise via Wasserstein distance and statistical error via Kullback-Leiin the Statistically Robust WDRO. We establish robust generalization bound for the new optimization framework, implying that out-of-distribution adversarial perfor- mance is least as good the statistically robust training loss with high proba- bility. Furthermore, we derive conditions under which Stackelberg and Nash equi- libria exist between the learner and the adversary, giving an optimal robust model in certain sense. Finally, through extensive experiments, we demonstrate that our method significantly mitigates robust overfitting and enhances robustness within the framework of WDRO.
divergence, called
INTRODUCTION
Optimization in machine learning is often challenged by data ambiguity caused by natural noise, ad-
versarial attacks (Goodfellow et al. 2014), or other distributional shifts (Malinin et al. [02 2022). To develop robust models against data ambiguity, Wasserstein Distributionally Robust Optimization (WDRO) (Kuhn et al., 2019) has emerged as a powerful modeling framework, which has recently attracted significant attention attributed to its connections generalization and robustness (Lee & Raginsky 2018: Mohajerin Esfahani & Kuhn 2018 An & Gao 2021).
Specifically, WDRO optimizes performance under the most adversarial data distribution within certain Wasserstein distance from the observed empirical distribution D,,, as shown below.
inf sup (',D'EU((.))
Ex~D [L(0, 2)]-
Here U(D),, (D' WD(D,, D') S }} the ambiguity set consisting of possible distributions of interest, and L(---) is the loss function. From both intuitive and theoretical perspectives, WDRO can be considered as more comprehensive framework that subsumes and extends adversarial train- ing (Staib & Jegelka 2017 Sinha et al.) 2017: Bui et al. 2022 Phan et al., (023). In contrast to standard adversarial training Madry et al. (017). WDRO operates on a broader scale by perturb- ing the entire data distribution rather than pointwise adversarial samples. This approach inherently promotes generalization to unseen adversarial examples.
However, find that WDRO still fundamentally suffers from the same robust overfitting phe- nomenon as standard adversarial training (Rice et al. 2020). This phenomenon observed in our
"Corresponding author.

---

Published as a conference paper at ICLR 2025
experiments degradation in adversarial robustness on test data after certain point in the train- ing process, which typically occurs shortly after the first learning rate decay (refer to Figure 2
A primary factor contributing to overfitting behavior is the inherent statistical error arising from finite sampling of train data Van Parys et al.) 202T, Bennouna & Van Parys. 2022). This error, defined as the discrepancy between the empirical distribution of the training data and the true underlying data distribution, manifests as a gap between empirical and population risk. Consequently, models optimized via traditional empirical risk minimization (ERM) may perform well on training data but generalize poorly to unseen samples. Although the recent literature Lam 2019); Van Parys et al.
& Van Parys (2022) has acknowledged the significance statistic error in robust optimization frameworks, its incorporation into WDRO remains an unexplored avenue.
To address these issues, we propose a novel ambiguity set obtained by combining Kullback-Leibler divergence and Wasserstein distance, which is called Statistically Robust WDRO (SR-WP) 3RR-DDRO.. We prove that the SR-WDRO formulation guarantee an upper bound on the adversarial test loss for any desired robustness and any loss function. Furthermore, we formalize the SR-WDRO as zero- sum game between the learner (decision maker), who chooses a model parameter 0 E O and the adversary who chooses a distribution from an ambiguity set, and we derive conditions under which Stackelberg and Nash equilibria exist between the learner and the adversary.
Finally, building upon our theoretical framework, we introduce novel and practical statistically robust loss training algorithm for neural networks, which incurs negligible additional computational burden compared standard adversarial training distributionally robust training. We conduct extensive experiments on benchmark datasets, which show that our proposed approach demonstrates superior efficacy in mitigating overfitting compared to existing training methodologies, in that our approach maintains performance on in-distribution data while substantially improving robustness to outtof-disttibuttin samples, thus mitigating the critical challenge in generalization.
The theoretical and practical contributions of this paper are summarized as follows.
We propose SR-WDRO based on our novel ambiguity set to mitigate robust overfitting in WDRO.
Theoretically, we prove that the adversarial test loss can be upper bounded by the statis- tically robust training loss with high probability, which can be considered as generaliza- tion bound for SR-WDRO. We also establish the conditions necessary for the existence of Stackelberg and Nash equilibria between the learner and the adversary.
We introduce a practically robust training algorithm based on SR-WDRO which maintains computational efficiency.
We conduct extensive evaluations on benchmark datasets and our results show that the SR- WDRO approach effectively mitigates robust overfitting and outperforms other existing robust methods in terms of adversarial robustness.
2 RELATED WORKS
Robust Overfitting. The phenomenon of robust overfitting has been focal point in the field of adversarial machine learning. The seminal work by Rice et al. (2020) brought this issue to the forefront, demonstrating that after a certain point in standard adversarial training, i.e., shortly af- ter the first learning rate decay, the robust performance on test data will continue to degrade with further training. Notably, conventional overfitting remedies such as explicit regularization and data augmentation do not improve performance beyond early stopping. [Schmidt et al.] (2018) attributed robust overfitting to sample complexity theory and suggested that more training data are required for adversarial robust generalization. This assertion is supported by empirical results in subsequent studies (Schmidt et al. 2018 Zhai et al., 2019).. Recent works also proposed various strategies to mitigate robust overfitting without relying on additional training data by sample re- re-weighting (Zhang et al. 2020 Wang et al. 2019). adversarial weight perturbation (Wu et al. 2020). weight smoothing (Chen et al. 2020). favoring large loss data (Yu al.) 2022), and considering the memorization effect (Dong et al. 2022; Wang et al., 2024 Yu et al. 2024). In our work, we will introduce the statistically robustness into WDRO to mitigate overfitting theoretically and practically.
2

---

Published as a conference paper at ICLR 2025
WDRO. WDRO has recently received significant attention in the context of adversarial training
Staib & Jegelka 2017 Wong et al., 2019; Sinha et al. 2017 Bui et al. 2022: Phan et al.) 2023).
Unlike standard adversarial training (Madry et al. 2017). which defends against attacks by bounding the perturbation to each individual data point, WDRO provides protection by imposing a bound on the average perturbation constrained by Wasserstein distance applied the entire data distribution.
This distinction positions WDRO as a more holistic approach to handling adversarial perturbations and generalizes better than adversarial training on unseen data samples (Bui et al. 2022). However, despite this advantage, WDRO remains vulnerable to the same robust overfitting phenomenon ob- served in standard adversarial training. primarily due its lack of consideration for statistical error. Recently, [Bennouna & Van Parys (2022); [ennouna et al. (2023) proposed a DRO formulation using an ambiguity set combining Kullback-Leiin
divergence and Levy- Levy-Prokhorov metric in an attempt to protect against corruption and statistical errors. In the absence of data poisoning, their framework effectively reduces to improving standard adversarial training with statistical robustness. However, approach diverges significantly. We leverage the inherent advantages of WDRO as our founda- tion and then augment it with statistical robustness to mitigate robust overfitting, which enables our framework achieve superior performance against adversarial perturbations.
PRELIMINARIES
Notations. Let Z R be compact nonempty set equipped with metric d(. -) and diam (2) sup[d(z, z, z' E } the diameter of Z which is finite. The class of Borel probability measures on 2 is denoted by P(2). For simplicity, denote Ex]s(=)) as the expectation of [(z) with p.
Definition (Wasserstein metrie). For p 2 1. the p-th Wasserstein metric between μ., P(Z) is
W Wplu, v) =
inf xEll(a))
(B(,, (2, 21)]
where the infanum is taken over all coupling of p and u, i.e. probability measure on the product space Z x Z with given marginals and v.
Definition (KL divergence). Kullback-Leine (KL) divergence between μu, E P(Z) is
KL(H,)) = p(2) log p(z)
g(2) de
where p(z),q(2) are probability density functions of μu v, respectively.
Wasserstein metric a function defined between two probability distributions, which represents the cost of an optimal mass transportation plan. Kullback-Leibler divergence measures the difference between two probability distributions, quantifying how one distribution diverges from a reference distribution. We additionally consider the Levy-Prokhorov (LP) metric and the total variation metric (TV). The Levy-Prokhorov metric is theoretically important because weak convergence of probabil- ity distribution is equivalent to the convergence in the ery-PProhoorov metric. In Appendix A.1 we establish the relationship among these probability discrepancies.
4 STATISTICALLY ROBUST WDRO
In Section 4.1 we first present the definition and game-theoretic description of SR- SR-WDRO. Sub- sequently, Section 4.2 we demonstrate that models trained with statistically robust loss achieve out-of-distribution generalization. Finally, in Section 4.3 we examine the existence of Stackelberg and Nash equilibria under some assumptions.
4.1 STATISTICALLY ROBUST WDRO AND GAME DESCRIPTION
We perform stochastic optimization with respect to an unknown data distribution D, given access only to an empirical distribution D,,, where is the observed finite sample size. The goal of distri- butionally robust optimization is learn robust model from D,, that will perform well on unseen test distribution D Drest which may either be the true data distribution D or more likely distributions shifted from D. Our work focuses primarily distribution shifts caused by adversarial attacks.
3

---

Published as a conference paper at ICLR 2025
W distance
KT. divergence
Observed Distribution
Adversurial Distribtton D
Test Distribution
De
adversarial noise
statistical error
Destt
Figure I: Illustration of our SR-WDRO. The adversarial perturbations are quantified using Wasser- stein distance between Dn, and D. The adversarial distribution then compared with the test distri- bution Drest using Kullback-Leible divergence, which accounts for the statistical error.
The WDRO constructs an ambiguity set based on the empirical distribution Da, and optimizes per- formance under the most adversarial distribution within certain Wasserstein distance from D,, as shown in Eq (I). However, previous WDRO methods still suffer fundamentally from the robust overfitting phenomenon. To mitigate this issue, incorporate the Kullback-Leibler (KL) diver- gence in WDRO, specifically aiming to reduce statistical error caused by training on finite samples, brief illustration is shown in Figure T
Our SR- WDRO can be interpreted as a novel combination of Kullback-Leibler divergence and Wasserstein distributional robust optimizations. We consider the ambiguity set:
(P,,) (D' E P(2) 3D" E P(2) (P D") e, KL(D", D') 5
where the desired protection against adversarial noise controlled by the adversarial budget e and statistical error is accounted by the statistical budget 7(7 > 0).
Now can formulate this robust optimization problem as zero-sum game between the learner who chooses a decision model 0 E Q and an adversary who chooses a distribution D' from the ambiguity set (Dn)). Let L(0, z) be the loss function (e.g. cross-entropy loss). Our game model as follows:
The adversary chooses a distribution D' E (U(,,,) to maximize the loss EE [0, 2)]. The learner selects a decision model 0 E O, aiming to minimize the loss Ep [(0 z)]
We introduce the statistically robust WDRO (SR- (R-WWDRO) problem:
inf sup #Ee (D.)
ED [((,)))
(3)
and denote the statistically robust loss as:
Ce, (0, = sup D'Eu(D.)
Ep [L(
4.2 CERTIFIED GENERALIZATION
In this subsection, rigorously establish that the model trained with statistically robust loss (0, Pn) enjoys the asymptotic out distribution generalization guarantee and safeguards against the statistical enror and adversarial noises simultancously. Let B(2;c) = {2'
2 d( z/) < E} be the e-ball around z under metric d. Proofs are provided in Appendix A.
Theorem (Generalization certificate). Let be the true data distribution, and D,, be the observed empirical distribution sampled i.i.d. from D. Then for all O. let 8 (diam{2)41) )", have
P 44 E E.....L(O.... < (0, (m) - 11-e-0 m(2.6)
(5)
where m(Z,6) == min(k 2 0: :E, Ex E Z, s.t. U B(S, 8) 2 Z} is the internal covering
number of the support set Z.
4

---

Published as a conference paper at ICLR 2025
In the proof of Theorem we in fact prove that the true distribution D can be in the ambiguity set ((,,,) with high probability. Compared to the results in (Bennouna & Van Parys 2022). the bound derived elucidates the dependency
parameters and Y, and the internal covering number is directly related to e. Unlike classical statistical learning, our bounds do not depend on the dimension of the parameter space + but rather the internal covering number of sample space 2. The result is uniform in that the probability approaches I for any 0 when the sample size n is sufficiently large.
Remark 4. To ensure that the bound in equation 5 is meaningful, the condition ? >> m(2, 6) log(4/6)/r must hold. Although this condition may seem strong due to the exponential depen- dency on the dimension of the sample space 2, the cover number is not excessively large in practice because the intrinsic dimensionality of the sample space is often much lower than its ambient dimen- sion, For example, the intrinsic dimensionality of MNIST' is around 13, CIFAR- 10 approximately 26, and ImageNet between 26 and 43 (Facco et al. 2017 Pope et al. f02T). Our theory can leverage this intrinsic dimensionality instead of the ambient dimension, making the condition more practicul.
We extend our analysis to consider adversarial robustness. wherein the test distribution D is subject to adversarial perturbations. We formalize this scenario by introducing an adversarial transforma- tion:
M 2 + arg max L(0,=').
z'EB(s:e)
This transformation maps each test input to its worst-case adversarial example within the c- neighborhood. Let M denote the pushforward measure of D under M, representing the dis- tribution of adversarial examples generated from D. And the expected loss under this adversarial distribution can be expressed as: tablishes a high-probability bound on the test adversarial loss:
= [Dommax/'BBsse ((0,²)). Our main result es-
Theorem (Robustness certificate). Lei 'D be the true data distribution, Dn the empirical distribu- tion sampled i..dd from D, and 6 (dimm(2)+1) for any O. Then
m(2,6)
P(VO E.E max 2(E((=;)))
L(O,z') =')= S (0, -e
4
(6)
8
where m m(2, 0) == min(k (k 2 0: 36, ... , E 2, s.t. U B(E 2 2) denote the internal covering number of the support set 2.
we observe that ensuring s-robustness on the test set typically needs a larger attack budget e + o during training. However, according to Theorem 3 an excessively large training budget may impede generalization for benign data. These findings align with previous experimental results on adversarial training (Tsipras et al. 2018: Andriushchenko & Flammarion, 2020).
From Theorem 5
Remark 6 (Comparison with Standard WDRO). From theoretical perspective, our framework differs from standard WDRO both the assumptions required and the form of the generalization bounds. Specifically, the generalization bounds in (Aziziun el al. (024) rely on additional assump- tions about the loss function, such as Lipschitz continuity and boundedness, which are not required in our framework. Furthermore, the form of the generalization bounds in our framework is fun- damentally different from those of WDRO. Our bound provides a stronger guarantee, where the probability of failure (i.e., the complement of the confidence level) decays exponentially with the sample size n. Importantly, this rate of decay is directly influenced by 7.
The result is also applicable to general out-of-distribution shifts such as domain gener- alization. Details are given in Appendix A.3
Remark 7.
4.3 NASH EQUILIBRIUM AND STACKELBERG EQUILIBRIUM
As mentioned in Section 4.1 the SR-WDRO problem constitutes zero-sum game. In this subsection, we show that Stackelberg equilibrium exists under natural assumptions and Nash equi- librium exists under more assumptions. The detailed definitions of the game equilibrium, along with the proofs for this section, are provided in the Appendix A.4
We need the following assumptions the loss function.
Assumption 8 (Loss function).
5

---

Published as a conference paper at ICLR 2025
i) For any 0 θ the loss function L(0, 2) is non-negative and upper semi-continuous in
i) For any Z, the loss function L(0, z) is lower semi-continuous in 0.
ii For any 0 E A there exist > 0, 2g E Z and lo E (0.p) such that L(0,2) c|1 (z, 20)l for all z E Z.
Assumptions (i) and (ii) regarding the continuity of the loss function common and are satisfied by neural network models, and assumption (iii) is necessary for the existence of the maximum in A). The following proposition establishes that the inner maximization problem is solvable, which is the key ingredient required to prove the existence of Stackelberg and Nash equilibrium.
Proposition 9. The ambiguity set ((D.))
(D' E P(Z) 3D" P(2) W, (Dn D") S
KL((D,, ,D) S r is compact in P()) with respect to weak topology. If AAssupptio & satisfied, then the supremum in (4) finite and can be attained for any 0 e.
Stackelberg game: We also consider a threat model in which the adversary has full knowledge of the learner's actions before determining own strategy. We can model our SR- 3R-WDRO problem (3) as zero-sum Stackelberg game between the leader (decision-makes who chooses decision model θ first, and the follower (adversary) who chooses distribution D' from the ambiguity set ((D,). after observing the leader's 's action. As corollary of Proposition we can give the existence of Stackelberg equilibrium.
Theorem 10 (Stackelberg Equilibrium). If Assumption g holds and @ is compact, then the game has Stackelberg equilibrium. i.e. there exists (0", D'=(0") such that
0" arg min max D'EBR(D,)
EDD|L(0,
D²*(0") E BR(Dn) arg max Ep [L(0,, D'EL((.))
In addition, with the convexity of L(O, 2) A. we can prove the existence of Nash equilibrium.
Theorem 11 (Minimax Theorem). If Assumptiin g holds, @ is convex, and L(0, z) is convex in 0 for any E 2, then
min max ED [T(0, max min ED (T.0, D'EU(D.))EE BEB
SE0 D'E)(D,))
We thus have established the existence for the Stackelberg and Nash equilibria of the SR-WDRO problem (3), viewed as zero-sum game between the learner and the adversary. The existence of Stackelberg equilibrium is considered for the first time for WDRO approaches. It can ob- served that the Stackelberg equilibrium requires weaker conditions to exist than the Nash equilib- rium, which gives the smallest statistically robust loss among all decision models can be consid- ered optimal robust in certain sense. Our result significantly extends the scope of WDRO theory and tackles a substantially more complex and general formulation compared with previous work SShaieezadeh-Abatee al. 2023).
5 COMPUTATIONALLY TRACTABLE REFORMULATION OF ER-WDRO
Having established the robustness certificate and equilibrium existence of SR- WDRO, we now turn our attention to practical methods for solving the optimization problem defined in Equation (3). We first show that the inner maximization problem ( can be simplified to minimization problem. Next, we apply our previous results to classification tasks and provide an approximate algorithm to solve the robust loss effectively.
Proposition 12 (Strong duality). (o, Dr)) in admits the dual formulation for all y > 0:
(0, =
inf
{E=" + ED, 1,,, B, 2),
(8)
X,920
n2max L(8,e)
where p(),B,n,,) -sup EEZ
B n L(0.))
11 - 2 (2,
In contrast, the dual reformulation for classical WDRO only involves À and takes the expectation of
the implicit function supeez (L((, Ad. (2,E)} with respect to D,,- The additional variables 3, introduced to account for the KI. divergence.

---

Published as a conference paper at ICLR 2025
Algorithm Statistically Robust WDRO Training
Input: Training set S., number of iterations T, batch size N, learning rate ne, 7) adversary pa- rameters: attack budget E, steps K, step size 17.
Output: Robust model A.
1: for = 1 to T do
2: Sample mini-batch {I yol Sn
3: Find UDR adversarial examples {x()
li=1'
4:
(1) x = I; + 8 where 8 ~ Uniform(-en) (-5,
5:
(2) for k = 1==10 to K:
6:
(a) x; iinter = _ + n (- 1 :3: 1/))))
7:
(b) x of enter avn _d( x;;
8:
(3) Clip valid range: 2 clip(1;; 1
00,1)
9:
Update parameter X: X + A 1/ E N
-= Σ 2x (2g mz))
10: Compute optimal weights {p: 1 problem (9)
11: Update model parameter: < ne VoLe,r (0: (.))))))))))
12:
end for
However, directly solving the statistically robust loss through either (4) or ( is intractable in prac- tice. In the remainder of this section, will primarily focus on applying results classification tasks and provide finite reformulation to solve the statistically robust loss approximately.
In classification tasks, it is often intuitive to restrict adversarial perturbations solely input samples (feature vectors). We present an adaptation of existing results to such scenarios. Let 2 = (X, Y) X' R. where X E X с I (mm-)) represents input data, and Y R+ denotes label. In the classification settings, Y E [I....,), We consider an adversary capable of perturbing only the input samples X. This constraint can be elegantly incorporated into our robust formulation by defining the Wasserstein cost function d: Z + R++ as follows. For 2 = (I. y) and 2' (x', ,')), we introduce the sample-shift cost function:
d(z,z') dx(xxx') 11y + y'}
where dx is the distance (like Lg norm) on and we assume that M is a very large positive number prevent label conversion.
Now we revisit the statistically robust loss:
(0, Dn) = sup ED (T(,=)) =)) ('E)(D,))
sup (sup (E [L(0, D', W, 2) So).
Intuitively, we start with the empirical distribution D, and identify the most adversarial sample distribution that satisfies the Wasserstein distance constraint. Then, within the KL divergence con- straint, similarly to (Bennouna et al. (2023), we adjust the sample weights to find the sample distribu- tion that maximizes the final loss. To identify the most adversarial sample distribution, we employ the UDR method (Bui et al.) 2022), which leverages the dual formulation of WDRO. In order to in our framework. This approach constructs a new Wasserstein cost function to search for adversarial samples that incorporate both local and global information, in contrast to Adversarial Training that considers only local information for each sample.
match this method, we set
For any given training data (sub)set {2, (I,, 34) 1+ compute the statistically robust loss (e) approximately as
max
- p:L (0, (I(,
x E arg max o! T.O0, (2/, v:))
Xdx (2/,
(0, (I., (i)
E R7. E Pi =
(9)
s.t.
E R Vi 1,
(L(gl)p) = Σi q log
91 S4.
7

---

Published as a conference paper at ICLR 2025
The À comes from the dual formulation of WDRO and is learnable parameter in UDR, and dx (xr x')
{dx (x, (s
dx (x, x²) = 1 {dx (x, < < (2, x')
where T > 0 is the temperature to control the growing rate of the cost function when x' is out of the perturbation ball.
The statistically robust loss is therefore in essence simply a re-weighting of adversarial loss. De- termining the statistically robust loss exactly requires evaluating the adversarial loss T,(0,²)) where the adversarial example is computed through the WDRO method (Bui et al.) (022), subsequently solving the exponential cone problem with n variables and constraints. This optimization can be efficiently executed using standard solvers. More details shown in Algorithm
6 EXPERIMENTS
In this section, we investigate the efficacy of our SR-WDRC training through extensive experiments on the CIFAR-I0 10 and CIFAR- datasets. We will show that our approach largely circumvents the robust overfitting phenomenon experienced by WDRO and achieves better adversarial robustness than other robust methods. The implementation of our approach publicly available the following GitHub repository: https://gitub..omm//an
sttp:/iiiiccooooooooiiii/ss/s Siinggg-xiinn/-----a WDRO.
We compare our method with PGD-AT (adry et al. 2017) and distributional robust methods: UDR-AT (Bui et al., 2022), HR training (Bennouna et al. 2023). We train ResNet-18 (He et al. 2016) with 200 epochs, and use SGD as the optimizer with learning rate decay by 0.1 at the epoch 100 and 150. For all methods,
implement adversarial training with {k: 10, 8/255, 1) 2/255} where is the iteration number, E is the attack budget and is the step size. We use different attacks evaluate the defense methods, including: 1) PGD-10 10 with {k 10, 8/ 8/255, 17 8 /4), 2) PGD-200 with {k = 200, & 8/255, v = e/4). 3) Auto-Attack (AA) (Croce & Hein 2020) with _ 8/255, which an ensemble method of four different attacks. The too -ooom used for all measures. Unless otherwise specified, we set
0.1 to its default value. The ablation study on y provided in latter part. We repeated all the experiments three times for different seeds. More training details are provided in Appendix A.6
3.5
5.0
Robust Tost Ace
Robust Test Loss
INGI-AT UDR HR
20
2.0
Our
20
10
50
100
150
200
50
100
100
200
Epochs
Epochs
Figure 2: Comparison of SR-WDRO against other robust training methods on CIFARIO (s 8/255). Left: Robust test accuracy. Right: Robust test loss. Our method (green) demonstrates competitive performance in both metrics, particularly in mitigating robust overfitting and higher ro- bust test accuracy.
Mitigating robust overfitting. First, we present the adversarial loss and adversarial accuracy on the test set over the 200 training epochs for different methods in Figure 2 It can be observed that the UDR method, similar to standard AT, suffers from severe robust overfitting. This particularly evident in the adversarial loss the test set, which increases sharply when robust overfitting occurs. Both HR and our SR- WDRO effectively mitigate this issue, and our method demonstrates superior robust test accuracy. Furthermore, in Table I
we report the best robust test accuracy and the final
8

---

Published as a conference paper at ICLR 2025
Table 1: Performance different methods on CIFAR-10 and CIFAR-I00 using a ResNet-18 for loo with budget 8/255. We use PGD-10 as the attack to evaluate robust performance. Nat is the natural test accuracy. The 'Best' Robust Test Ace is the highest robust test accuracy achieved during training whereas the 'Final' Robust Test Ace is last epoch's is robust accuracy. Best scores are highlighted in boldface.
Robust Test Acc (%)
Robust Methods
Nat
Final
Best
Diff
CIFAR-10
PGD-AT
84.80 0.14
45. + 0.19
52.91 + 0.11
7.75 0.17
UDR-AT
83.87 = 0.26
46.60 0.27
53.23
0.30
0.57
HR
83.95 = 0.32
47.32 + 0.59
51.23 + 0.25
3.90
Ours
83.34 = 0.16
48.58 + 0.21
51.95 + 0.19
3.36 0.06
CIFAR-100
PGD-AT
57.42 0.28
21.87 + 0.20
29.37 + 0.20
7.50
+ 0.35
UDR-AT
56.20 + 0.54
22.07
0.12
29.35 + 0.02
7.28
+ 0.10
HR
56.69 0.43
21.15 + 0.20
28.35 + 0.30
7.20
+ 0.49
Ours
56.71 = 0.08
23.09 + 0.20
28.95 + 0.29
5.86 = 0.50
robust test accuracy throughout the training process for different methods. The gap between these two metries is the smallest in method, indicating that approach mitigates robust overfitting more effectively. Furthermore, our method remains consistently effective across different attack budgets shown in Table in the Appendix A
As another popular adversarial defense strategy, TRADES (Zhang et al.) 2019) also exhibits over- fitting tendencies, albeit a lesser extent compared to PGD-AT. Our proposed approach effectively mitigates overfitting when applied to UDR-TRADES, as illustrated in Table in Appendix A.6
Results WRN28-10. We would like provide further experimental results the CIFAR-10 dataset with WRN28-10 10 as shown in Table 2 It can be observed that our method achieves the best performance in mitigating adversarial overfitting, as evidenced by the lowest robustness gap (Diff). Furthermore, it achieves the highest robust accuracy, demonstrating the effectiveness of our approach in enhancing robustness while maintaining strong performance on large models like WideResNNe28-10.
Table Robust performance of different robust methods using WideResNe128-10 on CIFAR-10 for loc with budget 8/255.
Robust Test Acc (%)
Robust Methods
Nat
Final
Best
Diff
CIFAR-10
PGD-AT
86.51 = 0.16
48.81 + 0.49
55.64 + 0.07
6.83 + 0.55
UDR-AT HR
85.99 - 0.15
49.01 0.13
55.82 + 0.19
6.81 + 0.31
84.89 0.16
48.45 0.31
52.45 + 0.27
4.00 = 0.34
Ours
84.52 = 0.27
51.26 + 0.42
53.87 = 0.06
2.61 + 0.47
Robustness for smaller &. Theorem 5Jshow shows that to ensure robustness on the test set, it generally necessary to employ larger attack budget during training compared to testing. In this experiment, we examine the robustness generalization by attacking different robust methods with smaller attack budget than the training attack budget while keeping other parameters of PGD attack the same. The results of this experiment are shown in Table 3 Our method consistently improves robustness for smaller test adversarial budget. This empirical observation corroborates the findings of Theorem [] indicating that our approach provides superior generalization guarantees for test set robustness when the training attack budget marginally exceeds that used during testing.

---

Published as a conference paper at ICLR 2025
Table Robustness evaluation on CIFAR-10 using ResNet-18 for Lce under different attack budget The adversarial training budget is set to be 8/255 consistently. We use stronger attacks such as PGD-200 and Auto-Attack.
8/255
6/255
4/255
E
PGD-200
AA
PGD-200
AA
PGD-200
AA
PGD-AT
42.86 +: 0.27
11.62
0.25
54.14
0.18
53.30 + 0.19
65.76 +: 0.03
65.18 0.13
UDR-AT
44.59
0.27
42.81
0.24
55.29
0.18
53.80 + 0.06
66.04
0.34
64.92 0.24
HR
45.27
0.52
41.99
+ 0.38
56.66
+ 0.30
53.70
+ 0.24
67.38
+ 0.16
65.09 - 0.24
Ours
46.79 0.11
44.06
+ 0.32
57.57
0.53
55.09
1 0.46
67.56 + 0.34
65.76 0.31
Different choice of Figure illustrates the effect varying values of statistical error in our framework mitigating robust overfitting. We observe that larger 7 values demonstrate reduced overfitting tendencies, particularly evident in the loss curves. However, excessively large leads to decrease in natural test accuracy, which drops from 84.8%( 0) to 80.4%(? 0.2). Conse- quently, we default to = 0.1 as trade-off between robust overfitting mitigation and natural test accuracy preservation.
50
60
2.
0LUG
0.0
Robust Test Ace
46
Robust Test Loss
0.1
0.15
0.2
0.06
0.15
0.2
144
15
50
100
150
200
50
100
150
200
Epochs
Epochs
Figure 3: Impact of statistical enror y on mitigating overfitting our method. Experiments con- ducted CIFAR1O with 8/255. Left: Robust test accuracy. Right: Robust test loss.
CONCLUSIONS
In this paper, we introduce SR-WDRO, a novel approach to address the challenge robust over- fitting in WDRO. Our method combines Kullhack-Leebllr divergence and Wasserstein distance to create a new ambiguity set, providing theoretical guarantees that adversarial test loss can be upper bounded by the statistically robust training loss with high probability and establishing conditions for Stackelberg and Nash equilibria between the learner and adversary. We developed a practical train- ing algorithm based this framework, which maintains computational efficiency comparable to standard adversarial training methods. Extensive experiments on benchmark datasets demonstrated that SR-WDD WDRO effectively mitigates robust overfitting and achieves superior adversarial robust- ness compared to existing approaches. Our work contributes both theoretical insights and practical advancements to the field of robust machine learning. The proposed method offers promising direction for developing more reliable and robust models in the face of distributional shifts.
Limitations and future works. Our SR-WDRO mitigates robust overfitting and improves robust accuracy compared to existing methods, although compromises with some natural accuracy drop and slight computational overhead. Due to the intractability of Equations (4) and (8), better approxi- mation is welcomed to solve BR-WDRO mitigate the compromise of accuracy and computational cost. Furthermore, we mainly focus on supervised learning this paper. expanding SR- SR-WDRO to broader tasks including unsupervised learning, regressive tasks is promising direction.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
This work is supported by NSFC grant No. 12288201 and No.92270001, and grant GJ0090202. The authors thank anonymous referees for their valuable comments.
REFERENCES
Yang An and Rui Gao. Generalization bounds for (wasserstein) robust optimization. Advances in Neural Information Processing Systems, 34: 111100081199999 2021.
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Neural Information Processing Systems, 10448-1666 2020.
Waiss Azizian, Franck lutzeler, and Jérôme Malick. Exact generalization guarantees for (regular- ized) wasserstein distributionally robust models. Advances in Neural Information Processing Systems, 36, 2024.
Amine Bennouna and Bart Van Parys. Holistic robust data-driven decisions. arXiv preprint arXiv:2207.09556, 2022.
Amine Bennouna, Ryan Lucas, and Bart Van Parys. Certified robust neural networks: Generalization and corruption resistance. In International Conference on Machine Learning, pp. 2092-2112. PMLR, 2023.
Jose Blanchet and Karthyek Murthy, Quantifying distributional model risk via optimal transport. Mathematics of Operations Research, 44(2):565 6000, 2019.
Anh Tuan Bui, Trung Le, Quan Hung Tran, He Zhao, and Dinh Phung. unified wasserstein distri- butional robustness framework for adversarial training. In International Conference on Learning Representations, 2022.
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In International Conference on Learning Representations, 2020.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- free attacks. In International Conference on Machine Learning, pp. 2206- 2216. PMLR, 2020.
Amir Dembo. Large deviations techniques and applications. Springer, 2009.
Yinpeng Dong, Ke Xu, Xiao Yang. Tianyu Pang, Zhijie Deng, Hang Su, and Jun Zhu. Exploring memorization in adversarial training. In International Conference on Learning Representations, 2022.
Elena Facco, Maria d' 'rrico, Alex Rodriguez, and Alessandro Laio. Estimating the intrinsic dimen- sion of datasets by minimal neighborhood information. Scientific reports, 7(1):12140, 2017.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6651 2014.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.
770-778, 2016.
Peter J. Huber. Robust Statistics. John Wiley & Sons, New York, 1981.
Daniel Kuhn, Peyman Mohajerin Esfahani, Viet Anh Nguyen, and Soroosh Shafieezaeh--haadee Wasserstein distributionally robust optimization: Theory and applications in machine learning. In Operations research & management science in the age of analytics, pp. 130-166. Informs, 2019.
Henry Lam. Recovering best statistical guarantees via the empirical divergence-based distribution- ally robust optimization. Operations Research, 67(4): 1094)10090-100 2019.

---

Published as a conference paper at ICLR 2025
Jacho Lee and Maxim Raginsky. Minimax statistical learning with wasserstein distances. Advances in Neural Information Processing Systems, 31, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks, arXiv preprint arXiv:1706.0608.. 2017.
Andrey Malinin, Neil Band, German Chesnokov, Yarin Gal, Mark JF Gales, Alexey Noskov, Andrey Ploskonosov, Liudmila Prokhorenkova, Ivan Provilkov, Vatsal Raina, et al. Shifts: A dataset of real distributional shift across multiple large-scale tasks. arXiv preprint
2021.
Andrey Malinin, Andreas Athanasopoulos, Muhamed Barakovie, Meritxell Bach Cuadra, Mark JF Gales, Cristina Granziera, Mara Graziani, Nikolay Kartashev, Konstantinos Kyriakopoulos, Po- Jui Lu, et al. Shifts 2.0: Extending the dataset of real distributional shifts. arXiv preprint
arXiv:2206. 15407, 2022.
Peyman Mohajerin Esfahani and Daniel Kuhn. Data-driven distributionally robust optimization using the wasserstein metric: Performance guarantees and tractable reformulations, Mathematical Programming, 171(1):115-16,, 2018.
Hoang Phan, Trung Le, Trung Phung, Anh Tuan Bui, Nhat Ho, and Dinh Phung. Global-local regularization via distributional robustness. International Conference on Artificial Intelligence and Statistics, pp. 7644-7664. PMLR, 2023.
Phil Pope, Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Repre- sentations, 2021.
Yu V Prokhorov. Convergence of random processes and limit theorems in probability theory. Theory of Probability & Its Applications, 122:1157- 1956.
Leslie Rice, Eric Wong, and Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, pp. 8093-8100 8104. PMLR, 2020.
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Ad- versarially robust generalization requires more data. Advances in Neural Information Processing Systems, 31, 2018
Soroosh Shafieezadeh-Abaleee Liviu Aolaritei, Florian Dörfler, and Daniel Kuhn. New perspectives regularization and computation in optimal transport-based distributionally robust optimization. arXiv preprint 230:::233300900 2023.
Aman Sinha, Hongseok Namkoong, Riccardo Volpi, and John Duchi. Certifying some distributional robustness with principled adversarial training. arXiv preprint 17X1v:1710.10571, 2017.
Maurice Sion. On general minimax theorems. Pucific Math., 8(1):171-176, 1958.
Matthew Staib and Stefanie Jegelka. Distributionally robust deep learning as generalization of adversarial training. In NIPS workshop Machine Learning and Computer Security, volume 3, pp. 4, 2017.
Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. arXiv preprint arXiv: 12152, 2018.
Bart PG Van Parys, Peyman Mohajerin Esfahani. and Daniel Kuhn. From data to decisions: Distri- butionally robust optimization is optimal. Management Science, 67(6):3387-3402, 2021.
Yifei Wang, Liannchen Li, Jiansheng Yang, Zhouchen Lin, and Yisen Wang. Balance, imbalance, and rebalance: Understanding robust overfitting from a minimax game perspective. Advances in Neural Information Processing Systems, 36, 2024.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
12

---

Published as a conference paper at ICLR 2025
Eric Wong, Frank Schmidt, and Zico Kolter. Wasserstein adversarial examples via projected Sinkhorn iterations. In International Conference on Machine Learning, volume 97, pp. 6808- 6817. PMLR. 2019.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust gen- eralization. In Advances in Neural Information Processing Systems, volume 33, pp. 2958-2969, 2020.
Chaojian Yu, Bo Han, Shen, Jun Yu, Chen Gong, Mingming Gong, and Tongliang Liu. Under- standing robust overfitting of adversarial training and beyond. In International Conference Machine Learning, pp. 25595-256100 PMLR, 2022.
Lijia Yu, Xiao-Shan Gao, and Lijun Zhang. Optimal robust memorization with relu neural networks. In International Conference on Learning Representations, 2024.
Man-Chung Yue, Daniel Kuhn, and Wolfram Wiesemann. On linear optimization over wasserstein balls. Mathematical Programming, 195(():1107-1122, 2022.
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversarially robust generalization just requires more unlabeled data. arXiv preprint /906. 00555, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pp. 7472-7482. PMLR, 2019.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweiggheed adversarial training. arXiv preprint arXiv:0010.01736, 2020.
13

---

Published as a conference paper at ICLR 2025
A APPENDIX
A.1 RELATIONSHIP BETWEEN DIFFERENT DISCREPANCIES
We first introduce Levy-Prokhorov and total variation metrics. Then we will establish relationships among the four metries: the Wasserstein metric, Levy-Prokhorov metric, total variation metric, and KL divergence.
Definition 13. The Levy-Prokhorov metric between μ, V E P(Z) is:
LP(,,V) == inf {- > ((A) S v(A)) VAEB(Z))
where A = {= 2 inf=eA
Definition 14. The total variation distance between any U.M E P(Z) is:
TV v) = inf (r > 0 w(A) S ((A) +T VAEB(Z));
The KL divergence (relative entropy) has some basic properties: (1) KL(U, v) > 0. which equal to if and only if ju v; (2) KL is not symmetric and does not satisfy the triangle inequality.
Here, we give some relationships between these discrepancies.
Proposition 15. For any u.v P(2), the Wasserstein metric and Levy-Prokhorov metric satisfy:
LP(u,V) Wp(n, < (diam(() + +)).P(m,,)
Proof. For any joint distribution ı on random variables x,
(x) S TP PP <) diam Z)) PP(((X,)) > T)
S P (diam Z) 7²) P(d(X,Y) >)
LP, v) S T(T E [0, 1)). we can choose a coupling of ju and so that (Pd((X,)) > r) is upper
bounded by (Huber 1981) Then have:
F (d" (x, Y)) s 7" (diam(2)* - < (diam (2)) +1)
Take the infimum of both sides over coupling, have:
Wpln, v) inf (dP (r(diam(2) 1)) < (diam{ + 1).
In order to bound Levy-Prokhorov metric by Wasserstein metric, choose such that W Wp(,, v) pt1
T and use Markov's inequality. We have
=P((((X)) 7B) () < 7P
E, (d
where x is any joint distribution on x Y. Then by Strassen's theorem HHubr 1981 Theorem 3.7), P(d(X, Y) r) equivalent to ((A) I v(AT) for all Borel set A [B [2,, which
means LP( v) S т, thus
241 LP(A,V)
S Wp(,vv)
Proposition 16. For any p, P(Z), the Wasserstein metric, total variation metric and KL diver- gence satisfy:
[LL v)
$
W,(n,)) < diam(2) TV(u,, diam(2)-
2
Proof. The total variation distance is equivalent to (1(,)) with the optimal transport cost d(z,z') T(= # z²) by definition, where T is the indicator function. As d(2, z') & diam( T(z #
14

---

Published as a conference paper at ICLR 2025
2'), have:
Wp w)(,,
inf =ell(a,))
(Beaee (2, =1)}
inf =el1(a,,))
(B(z,2))>m |diam( Z)P p. I[(= * 2')
diam( (
inf (ellu,))
E8 (2,x)) [[2, 22)3
= diam(2) -
And the second part is by Pinsker's inequality that TV(, S VAKL(U.V)
A.2 PROOFS OF THEOREMS AND
In this subsection, prove formally Theorem 3 and Theorem The goal is to show that SR-WDRO training loss is an upper bound on the test loss with high probability.
Lemma 17. Let Dn be the observed empirical distribution of n independent samples with mue distribution D on compact space Z. Then for all E >> O, let ō ( (diam(2)+1)" We have
m(2
P P(3D'S EP(Z), (P D) se, KL(DD, D) 17) 2 -0- 4
where m(2,,) == min(k 2 covering number of the support set Z.
E 2, s.t. U B(Ei, 2 2} denote the internal
Proof. We have:
IP AD E P(2), W, (D,, D') D') Se, (D, $7)
F (Dn (DEP(Z)) 3D' P( st. W,(D, D') SE, KL(D',)) S st)
=1-P(Dn E A)
where defined as: A D E P(Z): 3D' e P(Z) s. W WD D') SE, KL (D' 5
D") < D, E A} is the d-inflation the set A with respect the LP ball, which is compact as LP is continuous in the weak topology and Z is compact (Prokhorov) 1956).
Let . = (D' E to the LP metric. Denote BLP (D) (D" P(2): LP (D', "D)") 1 8)
Dembo (009) have established that for any A P(2) and 5 upper bound:
have for all > the
P (D, E A) S
exp
- inf KL (D',)) DEA
where (Lr 6) min(k k 2
... E A L. BLF (D,, S A} is the internal upper bound the internal
covering number of set AA with LP balls of radius 8. Furthermore, covering number of any set A in terms of the internal covering number the compact event as mLP(AA,) 6) < mLP(P(Z), 5) & (4/))m(2,5) for > (Dembo, 2009). Hence, we have:
(D, E A) < (4/0)m(Z.0) . exp (-n Sin_min D'E.AS
min KL (D',
The final inequality immediately leads to conclusion by remarking that D' A KL
7. Otherwise, suppose that there exists D E A with KL (D",") < 7. By definition of A
there exists D' E A such that LP(D", DD) = LP((D' D") < 5. And by Proposition 15
have W, (D',D") < (diam(Z) + I)LP D = E, so we have both W, (D', D") < E and KT. (D' D) 7, which implies that D' E A. is contradiction.
15

---

Published as a conference paper at ICLR 2025
Proof of Theorem
We restate the theorem below. Let D, be the observed empirical distri-
bution which may corrupted, and D the true data distribution. Then for E > 0, let
6 dlam(2)+1 ,, have
P P(Ve E θ (0) Ep|L(0, 21 - 21-e-> (1)
m
(10)
where m2 == min(k 0 I...... Eu E 2, s.t. U BE,, 0) 2 2} denote the internal covering number the support set Z.
Proof. Recall that the ambiguity KL(D", D) I 7}. By Lemma 17 we can ensure the ambiguity set ((D,)) contains the true distribution D with high probability:
((D,) {D 3D" P(Z) (D,,,, D") S
4 m22
(D (
It follows that
(4)
m(266)
P
sup DDEM(D,)
2 21-6-1
8
To facilitate analysis test adversarial distribution, introduce the Levy-Prokhorov (L.) metric given by |BBnnouna et al. (003), I.Pa is defined as:
LPe (D, = inf (I(d(z,))) e) (2,z") =E))))))))
(11)
We restate the theorem below. Let D be the true data distribution, Dn the empirical distribution sampled i.idd from D, and 5 = (Tam(2)+T) for any o > 0. Then
Proof of the Theorem 5
P (V EpE max L(0, 2')] S (0. 2 21-c" c e- (1) ( 2'EB(2:e)
m(2.8)
(12)
where m(2,5) 5) == min k 2 : 36 ... Ek E 2, s.t. U B(Ei, 8) 2 3} denote the internal covering number of the support set Z.
Proof. We consider the adversarial test distribution MM D. where M maps every input to arg (eB(ae) L(0, z²). It is clear that My E (D' E P(2) LP, s 0). Accord-
ing to Lemma 17 we have that for (dimm p::
P P(DD' E(Z), W (D D') So, D', KL 5 2 2 2 (4) m(2,5)
Let us denote here ee (Dx)= = (D) 3D',D"' D" E P(Z) s.t. (P D') o, KL(D', D") s
7, LP: LP" Dleat) < 0}. by the definition of My D. we have
m(Z,6)
4
D E
2 - nm
8
follows immediately that:
m(2,8)
sup
Ep [L(8,2)] EM E
21
-m
D'an E (Dn)
(D,)
And have
E T(0,2) = Ep! max I(002')).
=reB(=:e)
16

---

Published as a conference paper at ICLR 2025
It remains show that su Eug o. (Da) ED [L(0,2)] & (eto,y(0,2) Dn) for all 8. We have
sup
ED =]]
Pes Ele (Pa)
sup D'W,,(D..D'Sss (up test [L( 3D", Prest s.t. KL((), (") S n, LP=(D", D - 03
sup (D.,,(D..
sup
E 500e [[0 2)] ED", D Prstt s.t. LP: D") 1 0, KL(D"; Drest) S^}
s tom
[0, 3D', D" s.t. W, (D,, so, D 0, KL(D": Diest) S 5
3 BD [L) 3D', D s.t. (D, D') < W, D s KL(D"; D Drest) S 57
(Bp)
test [L 2] ED' s.t. W (D,,n, D s [L D S 7
I (0, D..)
The first equality follows from Lemma C.3 in Bennouna et (2023). the second inequality is clear as under LPs constraint we have d(z, 2') E for any 2, almost surely. The third inequality follows from the triangle inequality.
A.3 GENERAL DISTRIBUTIONAL SHIFTS
Our framework is applicable to variety of distributional shifts, not limited to the adversarial exam- ple distributions that we focus on. This includes other shifts such as those encountered domain generalization. If the distance between the test distribution and the original data distribution remains within certain bounds, we can still provide generalization guarantees. Here we assume that
Drest E (D's E P(Z): (D, < {0),
where is the adversarial budget and LPs is defined in equation 11 Here, we consider more general scenario where potential shifts might include corruptions or other variations, resulting in discrepancies between test samples and true samples. This formulation allows us to address broader range of distributional shifts beyond just adversarial examples. Similar to Theorem [ we have:
Theorem 18. Let D be the true data distribution, Dn the empirical distribution sampled i.idd. from D, D Drest the test distribution as defined above, and (diam(2)+1) for 0. Then
(1) m(2,8)
P(V0 OpE. [L(0 [2,0, S C0t
2 =1-e-m
(13)
where m(2.8) == min(k k 2 36,. ... f E 2, s.t. U B(E,,)) 2 2} denote the internal
covering number of the support set 2.
A.4 PROOFS FOR SECTION
In this subsection, we first give the definition of Nash equilibrium and Stackelberg equilibrium, then we provide the detailed proof of the existence of two game equilibrium.
Here we consider two player zero sum game, let the strategy spaces of player and player 2 be X and Y, respectively. Their utility functions are denoted by 41 (x, y) and u2(æz, y). where z E X is the strategy of player 1, and E is the strategy of player In a zero-sum game, u1(x, y) = (.).
such that neither player can improve their payoff by unilaterally changing their strategy, given the strategy of the other player.
Definition 19 (Nash Equilibrium). A Nash equilibrium is a pair of strategies
ui(x", .v') u (x,,"", Va E X; ui(x", (x".v) vvv) S u ui(x", .)) Vy
In Stackelberg game, player (the leader) moves first, and the other player (the follower) ob- serves the leader's 's action before selecting their own strategy. Let player be the leader and player be the follower.
17

---

Published as a conference paper at ICLR 2025
Definition 20 (Stackelberg Equilibrium). A Stackelberg equilibrium is pair of strategies (x", yx"))) where x" is the leader's optimal strategy and y (x*) ) is the follower's 's best response given the leader's s strategy.
Follower's 's best response: y" (x) = arg maxyEY U2(2, y)
2. Leader's optimal strategy: x² arg max U1 (I, y2 (x))
Thus, the Stackelberg equilibrium consists of the leader's strategy x², which maximizes the leader's payoff, and the follower's s response y" (x="), which is the best response to x=.
Proof of Proposition 9: (Restate) The ambiguity set 4(D,) (D' E P(Z) 3D"
P(2) s.t. W (2(,,, D") e, KI.(D", DD) S 7) is compact in P(Z) with respect to weak topology. And if the loss function satisfies Assumption g then the supremum is finite and can be attained for any 0 E O.
Proof. Firstly, we prove (DD.) is closed. Assume that any sequence (D'),- C C((D,)) weakly converges to D We will show that D (DD,,, which is equivalent to ((D,) is closed. By definition of ((D.), for each i, there exists D' such that (D,D,, Di) S, KL(Di, D') S 7. We aim to show that such DO also exist for the limit D preserving the Wasserstein and KI. constraints.
The set (D" E P(Z) Wp(Dn, D") < #} is compact in the weak topology of P(Z), as the Wasserstein ball is compact with respect to weak convergence. Therefore, from the sequence Di, can extract subsequence {Dis ر that converges weakly to some distribution Do, and by the compactness of the Wasserstein ball, Do satisfies: W (D DD) I Here, we abuse the notation and still denote the subsequence as (D
Next, the lower semicontinuity property of the Kullback-Leibler (KL.) divergence with spect to weak convergence. Since KL(Di, Di) < 7 for all i, and Di - DD weakly and D + Do weakly, we apply the lower semicontinuity of the KI. divergence conclude:
KL DO) & inminf KD D')= S.
++000
Thus, the limit point DD of the sequence (Dt) ) satisfies the conditions:
3D E P(2) s.t. (p,,,, D") S and KL(D", DO) S 7,
which implies that D E (D.)) Therefore, ((D.) is closed with respect to the weak topology.
Then prove that (Dn)) is subset of larger Wasserstein ball, any weak closed subset of a weakly compact set is weakly compact, we can prove U(D,,) is weak compact. For any D' ((D)), there exists D E PP(Z) such that W (p D") < and KL( (D" S 7. By Proposition
16 we have W S diam (2)()/2) then we have that (, D") < e and W,(D", D") diam (iam(Z)(7/2)) tr, thus (D,,n, D') s diam (2)/22))))) which means that u(P.) 1w,, (Dn, s s din-diam (iamm()(1:22)))) (1/2)
Next, show the supremum in 4 is finite. As (D,) Bw, (Dn, e + +-a- d (2)), it is clear that:
ED [)] (PE)
sup
sup
Ep [L(,,))]
D'EBw, (Da. ta The supremum the right side of the above inequality is finite by Yue et al. 2022 Theorem 2), which applies Assumption (iii) and D,, has a finite p-th moment. Thus the supremum have a finite
upper bound.
remains to be shown that supremum in 4 can be attained. We know that the objective func- tion suppreu(D.) Ep [T(0, =)] is weak upper semi-continuous in D' over the ambiguity set (D()).. This follows immediately from the proof of Yue et al.) (2022) Theorem 3), which reveals that suppreu(p.) ED> (0, x)] is weak upper semi-continuous over Bw, (Da, E + ya (Z)in As (D,)) is weak compact, Weirestrass's ''s theorem the guarantees the supremum in is indeed at- tained for any 0.
18

---

Published as a conference paper at ICLR 2025
Proof of the Stackelberg Equilibrium (Theorem I0] sumption 8 and we assume θ is compact, the game exists a Stackelberg equilibrium. ie. there exists
(Restate) If the loss function satisfies As-
0" E arg inf sup dEG ('E)(P.)
RD [D0,2,) D D0"0)) E argsup R [T(0[ D'E((P.)
Proof. By Proposition 9 for any 0, the supremum in 4 can be attained, that is, there exists best response (0) E arg maxppruu(P))) ED [I(0",2) for any 6, for simplicity we can as- sume (0) is unique since the supremum is unique. We consider the minimization problem: infage (0) (T,00, =)]. Furthermore, the expected loss objective (z_x0([((0=))) inherits lower- semicontinuity in 0 from the loss function 2() Specifically, lower semi-continuity holds because
lim inf BzzDi [L (0n, 2)] Iz iiminf([L 2)] EzzD ()),,
0,
then we have
lim inf Eo) [L (On, 2)] 2 ED- (0),
On 00
and by definition best response:
lim inf (o.) [L (6n, 2)] 0 00
liminf E (D) [L (6n, Z)],
On -10
thus we have
lim inf ED (0.) [L (0n,, Z)] 2 Eo (0) (0, 2)],
0-
which means the function infece (D) [0, =)] is lower-semi continuous on 0. Finally, since θ is compact, the minimization problem inf (D) [T((0, =)] has a solution d".
Proof of the Minimax Theorem 11 (Restate) If the loss function satisfies Assumption 8 holds, θ is convex, and L(O, 2) is convex in for any 2 E Z, then we have
min max Ep/ [L(0, 2)] = max min Ep [L0 EEe D ('EU(D.)
(14)
D' D'E BEO
Proof. We will verify the conditions of Sion's minimax theorem (Sion 1958). First, we show that D2 the ambiguity set ((n)) is convex. Assume that D D2 с ((D)). Then there exist Di =
1, 2) PP( such that WD(D., Di)= S E, KL(Di, Di) S 7. As KL--ivergence convex, for any A E [0, 1], we have
KL(AD= + (1- XYD2, AD + (1 A)D2)= & AKL(Di, + - D ST.
And for Wasserstein we have
WD XD + (1 2)Da) S
+ (1-))) D2 Se.
Let D" = AD + (1- - 2 which means XD + (1 X) D) E UDD.) Now we have convex and (D,.) is convex and weak compact by proposition
Furthermore, the expected loss objective Ez~D: [L(0, =)] inherits convexity and lower- semicontinuity in 0 from the loss function L(0,2). Specifically, lower semi-continuity holds because
inf Ez-D' [L (0n, 2)] Ez-D lim inminf(L((, 0--+0
Ez-D' [L(0, z)].
0.-+0
These inequalities leverage two key properties. The first inequality follows from Fatou's lemma for random variables with uniformly integrable negative parts, a property guaranteed by Assumption (i) that loss function is non-negative. The second inequality exploits the lower semi-continuity of the loss function L(B,)) -) in 9, as established in Assumption (ii).
Finally, it is readily verified that the objective function Ez-D' (0, 2)] is concave (in fact, linear) and weakly upper remi-continuous in D'. This follows directly from the proof of Proposition 9 This analysis establishes that all the conditions of Sion's 's minimax theorem satisfied. Consequently, the infimum and supremum in Equation can be interchanged.
It remains to show that both maxima in 77 reached. However, this follows immediately from the weak compactness of (DD,.. and the weak upper semi-continuity in D' of both the expected loss Ez-DY (0, =)] and the optimal expected loss inf EzzD (T(00,)) (I
19

---

Published as a conference paper at ICLR 2025
A.5 PROOF OF PROPOSITION 12
In this subsection, prove the dual formulation of the robust maximization problem.
Proof of Strong Duality (Proposition 12
(Restate) (0, D) admits the dual formulation for
all > 0:
(0,
inf
feE + ED EDlppA B. 2)]}
A.920 m2max I(0,=) x2
where ((A,,,n,2))
1pp88log 5ez
-(b15 (7 1), + (2,
Proof.
Le, (0,
=: sup (EDr
2) (
= sup (sup (ED [L(0, [[] D' E KL < (( s
inf 920 m2max ((0,2) { 3. L(8,2)
d2(=) + (7 17- m
sup Q2P(2). Se
aEZ
{ B B.log log 1j L(0,2)
8 dQ(z) (7 1)3 +1
lim
sup (2P(Z), W Wn(D.
inf 820 max L(0,2)+r #52
T-00
B dQ(2) + (7 - 1)3 +
lim
inf 020 maxax +(,
sup OCP(Z), ().D.
B log 17 2(0,2)
T-20+
lim
inf 820 n2 [(8,2)+T 222
sup QEP(Z), (P(P.
EQ
3. log
+ (r 1)8 +1
7-00+
n L(0,2)
inf As ED (pll 1ED A20
lim
inf B20 12 +(0,2)+T 2E2
r 7-00+
inf
A ED (,A,B,n)))]
820.A20 22max L(0,z) 2C2
Here, the equality (1) follows from Lemma 21 The equality (2) follows from the fact that
{ B log
3
inf
do(=) + (7 1)8 + 3 2 0, 2 max L(0, =)
L(0,2)
2E2
{ B Blog
3
< inf
dg(z) + + 1)8 + n : 0, 2 max L(0, 2) + 2
L(A,2)
{
3
Sinf
B log
do(=) + (7 1)3 + n: 3 2 0, 2 max L(0, 2)
+
T(0,2)
2
for any 0. The equality (3) follows from the minimax theorem of Sion 1958), and refer to
(Theorem 3.4's proof (Bennouna & Van Parys (022)) for the proof of this part. Finally, equality (4) follows from the strong duality of Wasserstein strong duality.
20

---

Published as a conference paper at ICLR 2025
Lemma 21.
Van Parys al. 2021) We have
{ Blog
B
sup QEP(2), (LL(D,Q)))
Ep: [L(0,
inf n max ((8g))
dD'(E) (7 1)B +1
11 11 L(O,g)
for all D' E P2) and
Lemma 22. |Blanchet & Murthy
2019) For all 'D' we have:
sup QEP(Z),
Ee [L(0,, x)] = inf {ee + ED ()]}
A20
W, (y
where p(),2) (L.,g (2)
geZ
A.6 FURTHER DETAILS ON EXPERIMENTS
We use the ResNet-18 for the CIFAR-IO and CIFAR-100 dataset. We use the SGD optimizer with momentum 0.9, weight decay 5e-4. The starting learning rate is 0.1 and reduce the learning rate (x0.1) at epoch {100, 150). We train with 200 epochs.
Mitigating overfitting on more attack budgets. We would like to provide further experimental results on the CIFAR-10 dataset more attack budgets (training and test attack budget is same) as shown in Table 4 The gap between these final robust accuracy and best robust accuracy is the smallest in method, indicating that approach most effectively mitigates overfitting even for different attack budgets.
Table 4: Robust performance of different methods on CIFAR-1Ousing a ResNet-18 for loc with budget 6/255, 10/255 and 12/255. We use PGD-10 the attack to evaluate robust performance. Nat the natural test accuracy. The "Best" robust test acc is the highest robust test accuracy achieved during training whereas the "Final" robust test acc is last epoch's 's robust accuracy.
Robust Test Acc (%)
Robust Methods
Nat
Final
Best
Diff
8 = 6/255
PGD-AT
87.46 = 0.17
54.33 + 0.12
60.41 + 0.08
6.08 + 0.18
UDR-AT
86.59 0.04
54.35 + 0.55
60.85 + 0.16
6.51
0.41
HR
87.02 + 0.12
55.23
+ 0.35
58.67 + 0.12
3.44 + 0.42
Ours
86.36 = 0.23
56.52 + 0.54
59.57 + 0.13
3.06 - 0.66
= 8/255
PGD-AT
84,80 + 0.14
45.16 + 0.19
52.91 0.11
7.75 + 0.17
UDR-AT
83.87 0.26
46.60
0.27
53.23 + 0.30
6.63 0.57
HR
83.95 = 0.32
47.32 + 0.59
51.23 + 0.25
3.90 0.47
Ours
83.34 0.16
0.21 48.58
51.95 + 0.19
3.36
0.06
10/255
PGD-AT
82.32 + 0.33
38.51 + 0.06
46.45 + 0.22
7.94 + 0.26
UDR-AT
81.49 0.54
39.54
0.64
47.33 + 0.55
7.79
0.27
0.27
HR
80.90 - 0.40
+ 0.43 43.52 0.59
41.78
45.70
+ 0.02
3.93
- 0.41
Ours
80.34 0.97
46.47 + 0.13
3.11 0.64
12/255
PGD-AT
79.55 0.06
34.16 + 0.30
41.79 0.12
7.63 + 0.41
UDR-AT
78.67
0.61
35.93 + 1.06
42.69 + 0.10
4.76-1001
HR
77.86 + 0.98
97.69
41.50 + 0.26
3.81 0.76
Ours
76.33 1.18
39.45 0.58
02.4440.3)
2.79 - 0.53
21

---

Published as a conference paper at ICLR 2025
Table 5: Robust performance of different robust methods based TRADES CIFAR-10 using ResNet-18 for (oo with budget 8/255. We use PGD-10 as the attack to evaluate robust performance. The "Best" robust test acc the highest robust test accuracy achieved during training whereas the "Final" robust test acc is last epochs's 's robust accuracy.
Robust Test Acc (%)
Robust Methods
Nat
Final
Best
Diff
TRADES
82.69 0.32
51.07 + 0.18
53.54 + 0.17
2.47 0.21
TRR-TRDDES
82.74 + 0.59
51.16 + 0.53
53.64 + 0.15
2.48 + 0.69
Ours-TRADES
81.79 = 0.55
52.22 + 0.42
53.581 0.19
1.36 + 0.62
Table 6: Robustness evaluation CIFAR-10 using ResNet-18 for 4oo under attack budget 8/255, where models are trained with a larger attack budget 10/255.
Methods(10/255)
Nat
10
PGD-200
AA
PGD-AT
82.32 + 0.33
46.98 + 0.06
45.03 + 0.12
43.17 + 0.08
UDR-AT
81.49 + 0.54
48.12 + 0.41
46.45 + 0.63
43.85 0.57
HR
80.90 0.40
50.04 = 0.45
48.69
0.41
44.05 = 0.42
Ours
80.58 + 0.98
50.86 + 0.72
49.71 + 0.88
45.86 = 0.88
Table 7: Robustness evaluation on CIFAR-10 using ResNet-18 for loo under attack budget 8/255, where models are trained with attack budget 12/255.
Methods(12/255)
Nat
PGD-10
PGD-200
AA
PGD-AT
79.55 + 0.06
48.99 + 0.38
47.20 + 0.26
44.48 + 0.07
UDR-AT
78.67 0.61
50.38 0.63
49.10 + 0.75
45.47 0.72
HR
76.65 + 0.65
$1.96
51.03 0.12
45.45
Ours
76.33 1.17
52.32 0.23
51.52 + 0.26
46.87 = 0.17
Mitigating overfitting on TRADES. We would like to provide further experimental results on the CIFAR-10 dataset on TRADES and its counterpart as shown in Table It can be observed that our method also can mitigates the robust overfitting, and enhances robustness while maintaining comparable accuracy.
Training with larger budgets. Theorem 5 shows that to ensure robustness the test set, it is generally necessary to employ a larger attack budget during training compared to testing. In this experiment, examine the robustness generalization by attacking different robust methods with fixed attack budget 8/255 with respect to larger training budgets 10/255. 12/255 while keeping other parameters of PGD attack the same. The results shown in Table and Table 7 demonstrate that our proposed SR-WDRO achieves the best robustness under various adversarial attacks.
Computation cost We evaluate the computational efficiency of our proposed SR- WDRO method against baseline approaches. Table presents the average training time per epoch and total training time for CIFAR-10 on single NVIDIA A800 GPU. Our SR- WDRO incurs a modest increase in per-epoch time (approximately 12.7% longer than standard adversarial training).
22

---

Published as a conference paper at ICLR 2025
Table 8: Training time per epoch and total training time for CIFAR-10 single NVIDIA A800 GPU.
Time Cost (s)
PGD-AT
UDR-AT
HR
Ours
200 epoch
12614.59
14104.05
13705.56 68.53
14216.43
per epoch
63.07
70.52
71.08
23


Reviews:
[{"review_id": "S0mtOTxoRz", "reviewer": "Reviewer_TYjK", "summary": "This paper proposes a new method for distributional robust optimization by considering a relaxation of statistical error in the distribution sets", "questions": "The paper is overall well written. I just have a couple of technical questions:\n1. The result in Theorem 3 implicitly assumes that $e^{-\\gamma\\cdot n} (4/\\delta)^m<1$, which is equivalently requiring $\\gamma\\ge\\frac{m\\log(4/\\delta)}{n}$. As $m$ is the covering number, typically in the order of exp(d) in a d-dimensional space, this implies that $\\gamma\\ge \\exp(d)/n$. Is this a too strict assumption?\n2. It would be helpful to show in theory that the standard method without considering the statistical error relaxation fails, while the proposed method succeeds. \n3. Is there a formal theory for the output of Algorithm 1?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper proposes a new method for distributional robust optimization", "weaknesses": "see the questions below", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SuIgPBvo03", "reviewer": "Reviewer_CBH1", "summary": "The paper proposes a novel approach called SR-WDRO to address robust overfitting in Wasserstein Distributionally Robust Optimization (WDRO) by incorporating Kullback-Leibler (KL) divergence. While the theoretical contributions are interesting, there are several concerns regarding clarity and experimental validation.", "questions": "**Minor:**\n \n1.\tEq. (1) and Line 38: Eq.(1) is defined directly in Wasserstein distance rather than the uncertain set. So the description of U(D_n) in line 38 is not self-consistent.\n\n2.\tThe range of gamma in Theorem 3 is not stated.\n\n3.\tTheorem 3, line 204: internal covering number of Z. Line 210: covering number of Z. Line 745: internal covering number of A and covering number of Z. Since the definition with and without internal is different, please clarify these statement precisely.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "**Theory:**\n\nThe mathematical framework is well-developed with thorough theoretical analysis. This paper provides two sets of theoretical results.\n\nThe first one is the generalization/robustness bound. The main idea is to show a high probability bound on D ∈ U(D_n) when the uncertainty set is defined with both two divergences. The second one is to establish the Stackelberg and Nash equilibria.\n\n**Experiments:**\n\nThe proposed method demonstrates some improvement in mitigating robust overfitting compared to UDR and HR.", "weaknesses": "**Clarity Issue:**\n\nThe main idea of the paper is summarized in Line 169: \"To mitigate this issue, we incorporate the Kullback-Leibler (KL) divergence in WDRO, specifically aiming to reduce statistical error caused by training on finite samples.\" However, this sentence lacks clarity in three critical aspects:\n\n1. What is the definition of statistical error?\n\nThe term \"statistical error\" appears multiple times starting from the abstract. However, while \"statistical\" and \"error\" are very general terms, it is hard to understand what this refers to exactly in the mathematical framework.\n\n2. Why is statistical error caused by training on finite samples?\n\nWithout a clear definition of statistical error, it is difficult to understand or verify this claim.\n\n3. Why does incorporating the Kullback-Leibler (KL) divergence in WDRO mitigate this issue?\n\nIn the rest of the paper, neither the theoretical results, including the bounds and Nash equilibrium, nor the experimental results provide a clear answer to this question.\n\n**Major Theoretical Concern:**\n\nSections 3 and 4 demonstrate that SR-WDRO possesses good bounds and equilibria properties. However, the paper does not discuss whether WDRO has or lacks these properties. Without this comparison, it is difficult to verify the necessity of introducing the SR- prefix.\n\nFor example, in Theorem 3, one could perform a simple sanity check: \n\n>By letting γ=0 (which reduces SR-WDRO to WDRO), the generalization bound reduces to $P()\\geq0$, which is a meaningless trivial bound. This suggests SR-WDRO has a better generalization bound than WDRO. \n\nHowever, the authors should provide a deeper analysis than my simple observation.\n\nThe same question applies to Section 4 - do WDRO admit Stackelberg and Nash equilibria under similar assumptions? Without addressing these comparative aspects, the theoretical advantages of SR-WDRO over WDRO remain unclear.\n\n**Major Experiments Concern:**\n\n1. Regarding robust overfitting, while SR-WDRO outperforms UDR and HR, Figure 2 still shows a decreasing phase. This raises concerns about whether WDRO-type methods are truly necessary in adversarial training settings, especially considering that simpler approaches like SWA or EMA could mitigate the decreasing phase with better performance.\n\n2. The comparison of the WDRO-type approaches with other types of adversarial training methods is not provided. As far as I know, it is not competitive with other methods under similar setting, such as no additional data, no generative data, and on ResNet-18.\n\n3. The exclusive use of ResNet-18 is limiting, as the adversarial training community typically requires evaluation on larger models.\n\nTo summarize, while SR-WDRO appears to achieve the ceiling performance among WDRO-type algorithms, this result actually raises pessimism about applying WDRO to adversarial training. Despite WDRO's importance in other operations research problems, its effectiveness in adversarial training remains questionable.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "i7BFtn7xcR", "reviewer": "Reviewer_cser", "summary": "The paper proposes a novel framework for the problem of Wasserstein distributionally robust optimization (WDRO) by introducing a novel ambiguity set. The effectiveness of the proposed approach is backed by the generalization certificate bound and the authors also establish the existence for the Stackelberg and Nash equilibria of the statistically robust WDRO problem. Empirically, the proposed practical training algorithm demonstrates its advantages on different adversarial robustness benchmarks.", "questions": "- Step 10 in Algorithm 1 is not clear to me. How can we compute the optimal weights {pi}?\n- Why use $\\operatorname{sign}\\left(\\nabla_x L\\left(\\theta,\\left(x_i^{k-1}, y_i\\right)\\right)\\right)$ to update the adversarial examples instead of $\\left(\\nabla_x L\\left(\\theta,\\left(x_i^{k-1}, y_i\\right)\\right)\\right)$?\n- A related work [1] that also incorporates both local and global information to optimize distributional robustness is worth discussing.\n- As distributional robustness is known to address natural distributional shifts, how well do you expect the method to perform under such circumstances (e.g., domain adaptation/generalization)?\n\n[1] Phan, Hoang, et al. \"Global-local regularization via distributional robustness.\" International Conference on Artificial Intelligence and Statistics. PMLR, 2023.\n\nMinor: Typo in line 104", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The proposed method seems theoretically sound,  and its effectiveness is supported by different empirical experiments. The authors offer a comprehensive analysis that encompasses both theoretical insights and empirical validations. I commend the authors for their commitment to reproducibility by making their code publicly available. Additionally, the detailed explanations of the experimental setup and the thoughtful interpretation of the results are particularly noteworthy.", "weaknesses": "- The experiments appear to be limited in scope: (i) they only compare against older baselines, and (ii) the model architecture and datasets used are relatively small-scale.\n- Empirically, the gains in adversarial robustness seem to come at the expense of natural accuracy, as observed in Table 1.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2KmRdReCk2", "reviewer": "Reviewer_DJPB", "summary": "This paper studies the Wasserstein distributionally robust optimization (WDRO) and considers both the adversarial attack and statistical error in the framework. Additional discussions are also provided in terms of the Stackelberg and Nash equilibria.", "questions": "Please address my comments in the weakness section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(1) The paper is clear and easy to understand. \n\n(2) The theoretical analysis is also sound. \n\n(3) The Nash equilibria perspective is interesting.", "weaknesses": "(1) The numerical experiments only demonstrate limited improvements. \n\n(2) There is no enough highlight on the technical challenges.\n\n(3) Based on existing litertaure,\n\nLi, Binghui, and Yuanzhi Li. \"Why clean generalization and robust overfitting both happen in adversarial training.\" (2023).\n\nthe robust overfitting phenomenon is more severe in the scenario of neural networks. Could the authors point out any possible way of analyzing WDRO in neural networks?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)