Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

TL;DR

The paper introduces a Wasserstein distance–based adversarial threat model that captures structured pixel-mass movements beyond traditional ℓ_p perturbations. It develops a fast, approximate projection onto the Wasserstein ball via projected Sinkhorn iterations with local transport plans, enabling practical generation of Wasserstein adversarial examples and efficient adversarial training. Empirical results on MNIST and CIFAR-10 show strong vulnerability of standard models and meaningful robustness gains from adversarial training, while highlighting challenges for provable defenses under Wasserstein perturbations. The work argues for a broader, convex perturbation framework and provides a concrete algorithmic tool that could extend to other domains and optimization settings.

Abstract

A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by $\ell_p$ norm-bounded perturbations. In this paper, we propose a new threat model for adversarial attacks based on the Wasserstein distance. In the image classification setting, such distances measure the cost of moving pixel mass, which naturally cover "standard" image manipulations such as scaling, rotation, translation, and distortion (and can potentially be applied to other settings as well). To generate Wasserstein adversarial examples, we develop a procedure for projecting onto the Wasserstein ball, based upon a modified version of the Sinkhorn iteration. The resulting algorithm can successfully attack image classification models, bringing traditional CIFAR10 models down to 3% accuracy within a Wasserstein ball with radius 0.1 (i.e., moving 10% of the image mass 1 pixel), and we demonstrate that PGD-based adversarial training can improve this adversarial accuracy to 76%. In total, this work opens up a new direction of study in adversarial robustness, more formally considering convex metrics that accurately capture the invariances that we typically believe should exist in classifiers. Code for all experiments in the paper is available at https://github.com/locuslab/projected_sinkhorn.

Figures (8)

• Figure 1: A minimal example exemplifying the difference between Wasserstein perturbations and $\ell_\infty$ perturbations on an image with six pixels. The top example utilizes a perturbation $\Delta_W$ to shift the image one pixel to the right, which is small with respect to Wasserstein distance since each pixel moved a minimal amount, but large with respect to $\ell_\infty$ distance since each pixel changed a maximal amount. In contrast, the bottom example utilizes a perturbation $\Delta_\infty$ which changes all pixels to be grayer. This is small with respect to $\ell_\infty$ distance, since each pixel changes by a small amount, but large with respect to Wasserstein distance, since the mass on each pixel on the left had to move halfway across the image to the right.
• Figure 2: A comparison of a Wasserstein (top) vs an $\ell_\infty$ (bottom) adversarial example for an MNIST classifier (for $\epsilon=0.4$ and $0.3$ respectively), showing the original image (left), the added perturbation (middle), and the final perturbed image (right). We find that the Wasserstein perturbation has a structure reflecting the actual content of the image, whereas the $\ell_\infty$ perturbation also attacks the background pixels.
• Figure 3: Wasserstein adversarial examples on the MNIST dataset for the four different models. Note that the $\ell_\infty$ robust and the adversarially trained models require a much larger $\epsilon$ radius for the Wasserstein ball in order to generate an adversarial example. Each model classifies the corresponding perturbed example as an 8 instead of a 5, except for the first one which classifies the perturbed example as a 6.
• Figure 4: Adversarial accuracy of various models on MNIST when attacked by a Wasserstein adversary over varying sizes of $\epsilon$-Wasserstein balls. We find that all models not trained with adversarial training against this attack eventually achieve 0% accuracy, however we do observe that models trained to be provably robust against $\ell_\infty$ perturbations are still somewhat more robust than standard models, or models utilizing binarization as a defense.
• Figure 5: Adversarial accuracy of various models on the CIFAR10 dataset when attacked by a Wasserstein adversary. We find that the model trained to be provably robust against $\ell_\infty$ perturbations is not as robust as adversarial training against a Wasserstein adversary.

Theorems & Definitions (6)

• Lemma 1
• Lemma 2
• Lemma 3
• proof
• Lemma 4
• proof