Pith. sign in

REVIEW 6 major objections 6 minor 40 references

DRO-Augment Framework: Robustness by Synergizing Wasserstein Distributionally Robust Optimization and Data Augmentation

T0 review · 6 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DRO-Augment: adding a W-DRO gradient penalty to data augmentation improves corrupted and attacked accuracy and yields a faster robust generalization rate.

desk verdict A plausible, mostly well-run empirical combination of a W-DRO gradient penalty with augmentation methods; the theory is real but has an L∞/L2 dual-norm mismatch and several missing details that need fixing. read the letter →

arxiv 2506.17874 v2 pith:LZY73QIK submitted 2025-06-22 stat.ML cs.CVcs.LG

Jiaming Hu , Debarghya Mukherjee , Ioannis Ch. Paschalidis This is my paper · ORCID
classification stat.MLcs.CVcs.LG MSC 68T0762G08
keywords WassersteindistributionallyrobustoptimizationdataaugmentationadversarialrobustnesscommoncorruptionsvariationregularizationgeneralizationboundCIFAR-Cbenchmark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes DRO-Augment, a training procedure that applies a standard data augmentation method (Mixup, AugMix, or NoisyMix) and then minimizes a variation-regularized loss that adds a Wasserstein distributionally robust optimization (W-DRO) penalty proportional to the norm of the loss gradient. The central claim is that this combination improves robustness to both natural corruptions and adversarial attacks, with reported average gains of about 1.1% on CIFAR-10-C and CIFAR-100-C and 5–7% under projected gradient descent (PGD) attacks on MNIST and Fashion-MNIST, while keeping clean accuracy essentially unchanged. The paper also proves an asymptotic excess-risk bound for a sparse quadratic-activation network trained on this regularized loss, and argues that the resulting rate $n^{-\alpha/(2\alpha+d)}$ is faster than the rate $n^{-\alpha/(3\alpha+2d)}$ obtained in prior work on the full W-DRO objective. A sympathetic reader would take the paper to be establishing that a theoretically motivated DRO penalty and data augmentation are complementary rather than competing routes to robustness.

What carries the argument

The load-bearing mechanism is the variation-regularized W-DRO proxy from [16]: instead of solving the inner supremum over Wasserstein balls, it penalizes the dual norm of the loss gradient, $\rho\bigl(\tfrac{1}{n}\sum_i\|\nabla\ell(f(x_i),y_i)\|_q^*\bigr)^{1/q}$, which is implementable in SGD. The theoretical rate is carried by the class $\mathcal{NN}^{a_1,a_2}_{U,L,p}$ of sparse ReQU networks whose gradient norms are at most $a_1/2$ and whose Hessian operator norms are at most $a_2/2$: those constraints let the proof use Lemma 8.1 to control the gap between $R_n$ and $D_{P_n,\rho}$ and Lemma 8.3 to approximate the smooth target $f^*$, tying the final rate to the number $U$ of active weights.

What would settle it

Re-run the CIFAR-10-C and PGD experiments with the $\ell_1$ input-gradient penalty (the true dual of the $\ell_\infty$ Wasserstein ball) in place of the $\ell_2$ penalty; if the reported gains vanish or reverse, the claim that DRO-Augment implements L∞-Wasserstein DRO fails.

Watch

Extended reading notes

Core claim

The paper claims that minimizing the variation-regularized loss $R_n(f)=\frac{1}{n}\sum_i \ell(f(x_i),y_i)+\rho\,\mathbb{E}_{P_n}[\|\nabla_x\ell(f(x_i),y_i)\|]$ on augmented data is an effective, computationally tractable surrogate for Wasserstein distributionally robust optimization, and that models trained this way beat their augmentation-only counterparts on both naturally corrupted and adversarially attacked test sets while keeping clean accuracy. The experiments place this claim on Mixup, AugMix, and NoisyMix over CIFAR-10-C, CIFAR-100-C, MNIST, and Fashion-MNIST; the reported average gains are about 1.1% on the CIFAR corrupted sets and 5–7% under PGD attacks. The theoretical contribution is Theorem 4.1: for a sparse ReQU network with bounded gradient and Hessian norms that minimizes $R_n$, the excess robust risk obeys $|D_{P_{\mathrm{true}},\rho}(\hat f)-D_{P_{\mathrm{true}},\rho}(f^*)| \le C_1\bigl(\sqrt{\tfrac{\log n\,(U+\log U)}{n}} + U^{-\alpha/d} + \rho\sqrt{\tfrac{\log n}{n}} + \rho^2\bigr)$, and choosing $U\asymp(n/\log n)^{d/(2\alpha+d)}$ gives the rate $(n/\log n)^{-\alpha/(2\alpha+d)} + \rho\sqrt{\log n/n}+\rho^2$. The paper reads this as showing that its variation-regularized estimator is both practically usable and theoretically faster than the rate $n^{-\alpha/(3\alpha+2d)}$ obtained in prior work for directly minimizing the robust objective.

Load-bearing premise

Everything hinges on the penalty actually trained being the W-DRO objective analyzed, but the paper reports no value of $\rho$ and uses an $\ell_2$ gradient penalty under an $\ell_\infty$ Wasserstein ball, so the required asymptotic equivalence is never verified.

Editorial extensions

If this is right

  • Augmentation methods combined with the W-DRO penalty systematically outperform their standalone versions on corrupted CIFAR-10/100-C across nearly all corruption types and severity levels, with a reported median gain of 3.1% on the seven most affected corruptions and an overall average gain of about 1.1%.
  • Under PGD attacks with $\varepsilon$ in $\{4/255, 8/255, 16/255\}$, the DRO-Augmented models gain on average roughly 7% on MNIST and 5% on Fashion-MNIST over the augmentation-only baselines, without lowering clean accuracy.
  • The framework is method-agnostic: Mixup, AugMix, and NoisyMix each show gains when the regularizer is added, so the same objective can wrap any augmentation strategy.
  • The regularized estimator has a theoretical excess-robust-risk rate of $n^{-\alpha/(2\alpha+d)}$ for sparse ReQU networks, improving on the $n^{-\alpha/(3\alpha+2d)}$ rate of prior work for directly minimizing the W-DRO objective.
  • The refined CIFAR-C severity rescaling proposed in the paper, if adopted, would make robustness comparisons across corruption types more meaningful for ResNet-family models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: the method's benefit likely concentrates on high-severity and noise-type corruptions, where the worst-case Wasserstein ball is most binding; the severity-5 tables are consistent with this, but the paper does not isolate severity as a variable.
  • Inference: if the empirical gains survive replacing the L2 penalty with the L1 penalty (the true dual of an $\ell_\infty$ Wasserstein ball), the framework becomes a drop-in regularizer for any augmentation pipeline; if not, the theoretical link to W-DRO is not what drives the gains.
  • Inference: the same variation penalty could transfer to diffusion or language-model training, where input-gradient norms are already computed, but the $\ell_\infty$-Wasserstein interpretation would need to be re-derived for those loss landscapes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper introduces DRO-Augment, a training procedure that combines standard data augmentation (Mixup, AugMix, NoisyMix) with a Wasserstein distributionally robust optimization (W-DRO) objective approximated by a gradient-norm penalty on the loss. Empirically, the authors report that DRO-Augment improves robustness over the corresponding augmentation baselines on CIFAR-10-C and CIFAR-100-C under common corruptions and on MNIST and Fashion-MNIST under PGD attacks, while roughly maintaining clean accuracy. Theoretically, they prove an excess risk bound (Theorem 4.1) for an estimator minimizing the variation-regularized loss over a class of sparse ReQU networks, claiming a rate of n^{-α/(2α+d)} for the L∞-Wasserstein DRO loss, improving on a recent result. The paper also proposes a 'Refined CIFAR-C' benchmark with redefined severity levels.

Significance. If the claims were fully established, the framework would be practically valuable: it is simple, compatible with several augmentation methods, and the empirical comparisons on standard benchmarks suggest consistent (though modest) gains. The theoretical analysis is an ambitious attempt to provide guarantees for a computationally tractable surrogate of W-DRO, and the claimed rate improvement over Liu et al. (2024) is noteworthy. The authors also provide a public implementation. However, the significance is tempered by several load-bearing gaps: the implemented L2 gradient penalty is not clearly connected to the L∞-Wasserstein objective used in the theory, key conditions of the approximation proposition are unverified in experiments, and there are inconsistencies in the reported experimental tables. The refined benchmark contribution is currently underdeveloped and contains apparent data errors.

major comments (6)
  1. [Section 4, Eq. (2.1), Theorem 4.1] The theoretical guarantee is stated for the L∞-Wasserstein DRO loss D_{P_true,ρ}(f) = sup_{Q: W∞(P_true,Q)≤ρ} E[ℓ(f(x),y)], but the estimator minimizes R_n(f) = (1/n)Σ[ℓ + ρ||∇ℓ||_2]. For L∞-Wasserstein transport, the dual norm is the L1 norm, so Proposition 2.1/Lemma 8.1 would justify a penalty ||∇ℓ||_1, not ||∇ℓ||_2. The manuscript does not show that the L2 gradient norm is an admissible surrogate for the L∞-Wasserstein supremum, and the proof of B1 in Appendix C explicitly uses L∞-covering arguments. Consequently, Theorem 4.1 does not currently control the excess risk of the actually implemented objective.
  2. [Section 2, Proposition 2.1; Section 3.2] Proposition 2.1 requires ρ = O(1/√n) and bounded gradient and Hessian norms of the predictor. No value or range of ρ is reported anywhere in the experiments, so it is unknown whether the scaling condition is met; for n = 50,000, O(1/√n) is around 0.0045, while the penalty weights that produce observable robustness effects are typically much larger. The paper also never checks that the trained PreActResNet-18 models satisfy the class constraints on gradient and Hessian norms (a1/2 and a2/2) that the theory assumes. Thus the link between the trained model and Theorem 4.1 is not established.
  3. [Appendix C, proof of B4; Lemma 8.3] The proof of B4 requires that the ReQU network f̄ approximating f* belongs to the class NN^{a1,a2}_{U,L} with gradient norm ≤ a1/2 and Hessian norm ≤ a2/2. Lemma 8.3 (from Belomestny et al.) provides H^ℓ approximation accuracy but does not guarantee that the constructed network satisfies these explicit norm bounds or that it has exactly the sparsity U used in the theorem. This is an unproven assumption that is load-bearing for the stated bound.
  4. [Section 3.4, Tables 5–9] The headline gains (median 3.1%, peak 12.7%) are computed from a post hoc selected subset of 7 of the 15 corruption types, and this selection is not justified. More importantly, the results in Tables 5 and 8 contain counterexamples to the claim of 'systematically outperforming': for instance, Mixup + DRO is below Mixup on CIFAR-100-C White (10.02 vs. 11.68), Shot (13.11 vs. 15.03), and Impulse (4.05 vs. 5.33) at severity 5, and similar negative differences appear in the averaged Table 8. The paper should either qualify the claim or provide statistical evidence (standard deviations, multiple seeds) that the positive differences are reliable.
  5. [Appendix E, Tables 10 and 11] Tables 10 and 11, which report the Refined CIFAR-10-C results for ResNet-18 and ResNet-34, are numerically identical for every corruption type and severity level, yet Table 3 reports different averages for these two models (e.g., S1 average 86.04 vs. 86.38). This indicates a copy/paste error and undermines the credibility of the proposed refined benchmark. The authors must correct the tables and verify that the refined severity redefinition is internally consistent.
  6. [Section 3.5, Table 2] The ablation results in Table 2 are not consistent with the main experimental tables. For example, the row with Augmented Data = yes, Mixing = yes, JSD = yes, W-DRO = yes reports CIFAR-100-C accuracy 67.59 and Fashion-MNIST-ε (ε=8/255) accuracy 21.79, but Table 9 lists AugMix + DRO as 62.82 for CIFAR-100-C and Table 1 lists AugMix + DRO at ε=8/255 as 30.89 for Fashion-MNIST. The ablation setup and numbers need to be reconciled with the main results.
minor comments (6)
  1. [Algorithm 1] The algorithm line for L_total writes ||∇_x L(f_θ(x_i), y_i)||_q, while Eq. (2.1) uses the dual norm ||·||_{q*}; the notation is inconsistent and should be aligned.
  2. [Section 3.2] The model name is written both as 'PreActResNet-18' and 'PreAct-ResNet18'; please standardize.
  3. [Section 1, Figure 1 caption] The caption says the figure shows results 'on Fashion-MNIST under adversarial attacks' but the first panel appears to show CIFAR-10-C; please clarify.
  4. [Section 5] The refined CIFAR-C benchmark is presented without a clear evaluation protocol or comparison to the original severity levels, and the accuracy thresholds (50%, 85%, 60%, etc.) appear to be chosen ad hoc; this section reads as preliminary.
  5. [Theorem 4.1] In the theorem statement, the probability expression 'n^{-c}' uses an unspecified constant c, and the phrase 'has O(log d + ⌊α⌋) layers' is informal; please state the dependence explicitly.
  6. [Appendix C] In the bound for B1, the passage 'ρτ^{-1} = O(n)' is used to select τ, but the resulting ρn^{-1} term in the final bound is not fully tracked; a short derivation would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the empirical claims are tested against external baselines and the theory rests on independent external results, not on the paper's own conclusions.

full rationale

The central empirical comparison is not circular: DRO-Augment is evaluated on external benchmarks (CIFAR-10-C, CIFAR-100-C, MNIST, Fashion-MNIST under PGD) against published augmentation baselines, so the reported gains are not forced by the method's definition. The theoretical bound in Theorem 4.1 is assembled from independent external ingredients: Lemma 8.1 is Theorem 1 of Gao, Chen, and Kleywegt [16], the ReQU approximation lemma is Theorem 1 of Belomestny et al. [5], and the metric-entropy and covering-number arguments cite [4], [1], and [36]. The paper's own citations [11,12] appear only as background on W-DRO and are not load-bearing for either the experiments or the proof. The possible mismatch between the L2 gradient penalty and the L∞-Wasserstein heading in Section 4, the unreported penalty weight ρ, and the unverified gradient/Hessian constraints for the trained PreActResNet-18 are substantive correctness or verification concerns, but they are not circularity: Theorem 4.1 is explicitly stated and proved for the variation-regularized estimator Rn(f), and the proof does not assume the robust-loss conclusion it aims to establish. The refined CIFAR-C severity calibration in Section 5 is a benchmark design choice rather than a prediction derived from the method. Overall, the derivation chain is self-contained against external baselines and external mathematical results, so no circular step is exhibited.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

The central empirical claim rests on the variational-regularization proxy for W-DRO (Eq. 2.1, Proposition 2.1 from [16]), plus standard network training choices. The two unreported hyperparameters, ρ and q, are free parameters whose values determine every reported number. The theory adds a Hölder-smoothness assumption on the target and an asserted bridge between the ReQU approximation lemma and the constrained network class. The refined CIFAR-C benchmark introduces target-accuracy anchors chosen by the authors, making its reported severity-level accuracies match its definitions by construction.

free parameters (3)
  • ρ (W-DRO regularization weight) = not reported
    Controls the gradient-penalty strength in Eq. (2.1) and Algorithm 1; its value is never stated in Section 3, so all empirical results depend on an unreported hand-chosen constant.
  • q (gradient-penalty norm) = not reported
    Algorithm 1 uses ||∇_x L||_q without specifying q; Section 4 uses q=2 for the claimed L∞-Wasserstein case, where the dual norm should be q=1; the implemented objective is therefore ambiguous.
  • Refined CIFAR-C target accuracy anchors = 50% and 85% (CIFAR-10); 20% to 60% (CIFAR-100)
    The refined benchmark's severity levels in Section 5 are defined by targeting benchmark accuracies (baseline at 50%, initial 85%, CIFAR-100 shifted down 30%). These anchors are chosen by the authors, and Tables 3-4 then report accuracies matching the targets by construction.
assumptions (5)
  • domain assumption Proposition 2.1 (Theorem 1 of [16]): the W-DRO objective equals empirical loss plus ρ times the mean gradient norm up to O(1/n) when ρ = O(1/√n) and gradient and Hessian norms are bounded.
    Section 2, Eq. (2.1) and Proposition 2.1. The paper's 'distributionally robust' framing rests on this prior theorem; the experiments never verify ρ = O(1/√n).
  • domain assumption The target function f* lies in the Hölder class H^α(R^d) with α > d/2.
    Theorem 4.1 and Section 4. A standard smoothness assumption, but it is on the unknown data-generating function and is not verified.
  • ad hoc to paper ReQU networks of class NN^{a1,a2}_{U,L} approximate f* at rate U^{-α/d} while satisfying gradient norm ≤ a1/2 and Hessian norm ≤ a2/2.
    Section 4.1 and Appendix B. Lemma 8.3 from [5] gives H^ℓ approximation but does not show the constructed networks obey the bounded-gradient and bounded-Hessian constraints imposed on the class defining f̂; this bridge is asserted, not proven.
  • domain assumption Bounded density condition around the nondifferentiable points of f (Lemma 8.1).
    Appendix B, Lemma 8.1 is invoked for bounds B_2 and B_3; it requires the data distribution to have bounded density near the ReQU kink sets, which is plausible but unverified.
  • standard math Standard empirical process bounds: covering numbers, VC dimension bounds, and Kolmogorov-Tikhomirov entropy u^{-d/α}.
    Appendix B, Lemmas 8.2-8.6. These are standard tools used for bounds B_1 and B_5, and are not in question.
invented entities (1)
  • Refined CIFAR-C benchmark (redefined severity levels)
    purpose: Claimed contribution in Section 5: a version of CIFAR-10-C and CIFAR-100-C whose severity levels produce consistent accuracy across corruption types (50% to 85% for CIFAR-10, 20% to 60% for CIFAR-100).
    The severity-to-corruption-parameter mapping is never described, so the benchmark cannot be constructed by an outside party; the reported accuracies in Tables 3-4 are the chosen targets by construction, giving no external falsifiable handle.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DRO-Augment Framework: Robustness by Synergizing Wasserstein Distributionally Robust Optimization and Data Augmentation." pith.science (2026). https://pith.science/paper/LZY73QIK

@misc{pith2026250617874,
  author       = {Pith},
  title        = {Pith review of: DRO-Augment Framework: Robustness by Synergizing Wasserstein Distributionally Robust Optimization and Data Augmentation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LZY73QIK}},
  note         = {Machine review of arXiv:2506.17874}
}
read the original abstract

In many real-world applications, ensuring the robustness and stability of deep neural networks (DNNs) is crucial, particularly for image classification tasks that encounter various input perturbations. While data augmentation techniques have been widely adopted to enhance the resilience of a trained model against such perturbations, there remains significant room for improvement in robustness against corrupted data and adversarial attacks simultaneously. To address this challenge, we introduce DRO-Augment, a novel framework that integrates Wasserstein Distributionally Robust Optimization (W-DRO) with various data augmentation strategies to improve the robustness of the models significantly across a broad spectrum of corruptions. Our method outperforms existing augmentation methods under severe data perturbations and adversarial attack scenarios while maintaining the accuracy on the clean datasets on a range of benchmark datasets, including but not limited to CIFAR-10-C, CIFAR-100-C, MNIST, and Fashion-MNIST. On the theoretical side, we establish novel generalization error bounds for neural networks trained using a computationally efficient, variation-regularized loss function closely related to the W-DRO problem.

Figures

Figures reproduced from arXiv: 2506.17874 by the authors.

Figure 1
Figure 1. The PreAct ResNet-18 model trained with each standalone augmentation method with [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Performance Comparison against seven types of corruptions under Severity Level 5 on [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Performance Comparison against seven types of corruptions under Severity Level 5 on [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 18 canonical work pages

  1. [27]

    Nonasymptotic bounds for adversarial excess risk under misspecified models.SIAM Journal on Mathematics of Data Science, 6(4):847–868, 2024

    Changyu Liu, Yuling Jiao, Junhui Wang, and Jian Huang. Nonasymptotic bounds for adversarial excess risk under misspecified models.SIAM Journal on Mathematics of Data Science, 6(4):847–868, 2024

    work page 2024

  2. [16]

    Wasserstein distributionally robust optimization and variation regularization.Operations Research, 72(3):1177–1191, 2024

    Rui Gao, Xi Chen, and Anton J Kleywegt. Wasserstein distributionally robust optimization and variation regularization.Operations Research, 72(3):1177–1191, 2024

    2024

  3. [1]

    cambridge university press, 2009

    Martin Anthony and Peter L Bartlett.Neural network learning: Theoretical foundations. cambridge university press, 2009

    2009

  4. [2]

    Wasserstein distributional robustness of neural networks, 2023

    Xingjian Bai, Guangyi He, Yifan Jiang, and Jan Obloj. Wasserstein distributional robustness of neural networks, 2023

    work page 2023

  5. [3]

    Sensitivity analysis of Wasserstein distributionally robust optimization problems

    Daniel Bartl, Samuel Drapeau, Jan Obloj, and Johannes Wiesel. Robust uncertainty sensitivity analysis. arXiv preprint arXiv:2006.12022, 4, 2020

    work page Pith review arXiv 2006

  6. [4]

    Almost linear vc dimension bounds for piecewise polynomial networks.Advances in neural information processing systems, 11, 1998

    Peter Bartlett, Vitaly Maiorov, and Ron Meir. Almost linear vc dimension bounds for piecewise polynomial networks.Advances in neural information processing systems, 11, 1998

    work page 1998

  7. [5]

    Simultaneous approximation of a smooth function and its derivatives by deep neural networks with piecewise-polynomial activations

    Denis Belomestny, Alexey Naumov, Nikita Puchkin, and Sergey Samsonov. Simultaneous approximation of a smooth function and its derivatives by deep neural networks with piecewise-polynomial activations. Neural Networks, 161:242–253, 2023

    work page 2023

  8. [6]

    Deep neural networks for nonparametric interaction models with diverging dimension.The Annals of Statistics, 52(6):2738–2766, 2024

    Sohom Bhattacharya, Jianqing Fan, and Debarghya Mukherjee. Deep neural networks for nonparametric interaction models with diverging dimension.The Annals of Statistics, 52(6):2738–2766, 2024

    work page 2024

Show all 40 references
  1. [7]

    Multivariate distributionally robust convex regression under absolute error loss.Advances in Neural Information Processing Systems, 32, 2019

    Jose Blanchet, Peter W Glynn, Jun Yan, and Zhengqing Zhou. Multivariate distributionally robust convex regression under absolute error loss.Advances in Neural Information Processing Systems, 32, 2019

    2019

  2. [8]

    Robust wasserstein profile inference and applications to machine learning.Journal of Applied Probability, 56(3):830–857, 2019

    Jose Blanchet, Yang Kang, and Karthyek Murthy. Robust wasserstein profile inference and applications to machine learning.Journal of Applied Probability, 56(3):830–857, 2019

    2019

  3. [9]

    Confidence regions in wasserstein distributionally robust estimation.Biometrika, 109(2):295–315, 2022

    Jose Blanchet, Karthyek Murthy, and Nian Si. Confidence regions in wasserstein distributionally robust estimation.Biometrika, 109(2):295–315, 2022

    2022

  4. [10]

    Listen, attend and spell: A neural network for large vocabulary conversational speech recognition

    William Chan, Navdeep Jaitly, Quoc Le, and Oriol Vinyals. Listen, attend and spell: A neural network for large vocabulary conversational speech recognition. In2016 IEEE international conference on acoustics, speech and signal processing (ICASSP), pages 4960–4964. IEEE, 2016

    2016

  5. [11]

    Distributionally robust multiclass classification and applications in deep cnn image classifiers.stat, 1050:27, 2021

    Ruidi Chen, Boran Hao, and Ioannis Paschalidis. Distributionally robust multiclass classification and applications in deep cnn image classifiers.stat, 1050:27, 2021

    2021

  6. [12]

    A robust learning approach for regression models based on distributionally robust optimization.Journal of Machine Learning Research, 19(13):1–48, 2018

    Ruidi Chen and Ioannis Ch Paschalidis. A robust learning approach for regression models based on distributionally robust optimization.Journal of Machine Learning Research, 19(13):1–48, 2018

    2018

  7. [13]

    Distributionally robust optimization under moment uncertainty with application to data-driven problems.Operations research, 58(3):595–612, 2010

    Erick Delage and Yinyu Ye. Distributionally robust optimization under moment uncertainty with application to data-driven problems.Operations research, 58(3):595–612, 2010

    2010

  8. [14]

    Bert: Pre-training of deep bidi- rectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidi- rectional transformers for language understanding. InProceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human lang...

    2019

  9. [15]

    Noisymix: Boosting model robustness to common corruptions.arXiv preprint arXiv:2202.01263, 2022

    N Benjamin Erichson, Soon Hoe Lim, Winnie Xu, Francisco Utrera, Ziang Cao, and Michael W Mahoney. Noisymix: Boosting model robustness to common corruptions.arXiv preprint arXiv:2202.01263, 2022

    2022 arXiv

  10. [17]

    Motivating the rules of the game for adversarial example research.arXiv preprint arXiv:1807.06732, 2018

    Justin Gilmer, Ryan P Adams, Ian Goodfellow, David Andersen, and George E Dahl. Motivating the rules of the game for adversarial example research.arXiv preprint arXiv:1807.06732, 2018

    2018 arXiv

  11. [18]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  12. [19]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. InComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14, pages 630–645. Springer, 2016

    2016

  13. [20]

    Benchmarking neural network robustness to common corruptions and perturbations.arXiv preprint arXiv:1903.12261, 2019

    Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations.arXiv preprint arXiv:1903.12261, 2019

    1903 arXiv

  14. [21]

    Augmix: A simple data processing method to improve robustness and uncertainty.arXiv preprint arXiv:1912.02781, 2019

    Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty.arXiv preprint arXiv:1912.02781, 2019. 10

    1912 arXiv

  15. [22]

    Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups.IEEE Signal processing magazine, 29(6):82–97, 2012

    Geoffrey Hinton, Li Deng, Dong Yu, George E Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Tara N Sainath, et al. Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups.IEEE Sign...

    2012

  16. [23]

    Adversarial classification via distributional robustness with wasserstein ambiguity.Mathematical Programming, 198(2):1411–1447, 2023

    Nam Ho-Nguyen and Stephen J Wright. Adversarial classification via distributional robustness with wasserstein ambiguity.Mathematical Programming, 198(2):1411–1447, 2023

    2023

  17. [24]

    On the rate of convergence of fully connected deep neural network regression estimates.The Annals of Statistics, 49(4):2231–2249, 2021

    Michael Kohler and Sophie Langer. On the rate of convergence of fully connected deep neural network regression estimates.The Annals of Statistics, 49(4):2231–2249, 2021

    2021

  18. [25]

    Imagenet classification with deep convolutional neural networks.Advances in neural information processing systems, 25, 2012

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks.Advances in neural information processing systems, 25, 2012

    2012

  19. [26]

    Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

    Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition.Proceedings of the IEEE, 86(11):2278–2324, 1998

    1998

  20. [28]

    Towards deep learning models resistant to adversarial attacks.stat, 1050(9), 2017

    Aleksander M ˛ adry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.stat, 1050(9), 2017

    2017

  21. [29]

    Data-driven distributionally robust optimization using the wasserstein metric: Performance guarantees and tractable reformulations.Mathematical Programming, 171(1):115–166, 2018

    Peyman Mohajerin Esfahani and Daniel Kuhn. Data-driven distributionally robust optimization using the wasserstein metric: Performance guarantees and tractable reformulations.Mathematical Programming, 171(1):115–166, 2018

    2018

  22. [30]

    A simple way to make neural networks robust against diverse image corruptions

    Evgenia Rusak, Lukas Schott, Roland S Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. A simple way to make neural networks robust against diverse image corruptions. InComputer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, Augus...

    2020

  23. [31]

    Nonparametric regression using deep neural networks with relu activation function

    Johannes Schmidt-Hieber. Nonparametric regression using deep neural networks with relu activation function. 2020

    2020

  24. [32]

    Distributionally robust logistic regression.Advances in neural information processing systems, 28, 2015

    Soroosh Shafieezadeh Abadeh, Peyman M Mohajerin Esfahani, and Daniel Kuhn. Distributionally robust logistic regression.Advances in neural information processing systems, 28, 2015

    2015

  25. [33]

    Certifiable distributional robustness with principled adversarial training

    Aman Sinha, Hongseok Namkoong, and John C Duchi. Certifiable distributional robustness with principled adversarial training. corr, abs/1710.10571.arXiv preprint arXiv:1710.10571, 2017

    2017 arXiv

  26. [34]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  27. [35]

    Attention is all you need.Advances in neural information processing systems, 30, 2017

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need.Advances in neural information processing systems, 30, 2017

    2017

  28. [36]

    Cambridge university press, 2018

    Roman Vershynin.High-dimensional probability: An introduction with applications in data science, volume 47. Cambridge university press, 2018

    2018

  29. [37]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.arXiv preprint arXiv:1708.07747, 2017

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  30. [38]

    mixup: Beyond empirical risk minimization.arXiv preprint arXiv:1710.09412, 2017

    Hongyi Zhang. mixup: Beyond empirical risk minimization.arXiv preprint arXiv:1710.09412, 2017

    2017 arXiv

  31. [39]

    How does mixup help with robustness and generalization?arXiv preprint arXiv:2010.04819, 2020

    Linjun Zhang, Zhun Deng, Kenji Kawaguchi, Amirata Ghorbani, and James Zou. How does mixup help with robustness and generalization?arXiv preprint arXiv:2010.04819, 2020

    2010 arXiv

  32. [40]

    Improving the robustness of deep neural networks via stability training

    Stephan Zheng, Yang Song, Thomas Leung, and Ian Goodfellow. Improving the robustness of deep neural networks via stability training. InProceedings of the ieee conference on computer vision and pattern recognition, pages 4480–4488, 2016. 7 APPENDIX A: Notations Scalars and indi...

    1959

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.