Wasserstein Robust Classification Error: Surrogate Loss Misalignment and Distributional Attacks

Wasserstein distributionally robust optimization (WDRO) provides a framework for evaluating model robustness through the worst-case expectation in the Wasserstein ball around a reference distribution. We prove that ordering hypotheses by increasing WDRO risk is equivalent to ordering them by decreasing robust accuracy if and only if the loss function is a positive multiple of the zero-one loss plus a label-dependent offset. For a class of loss functions including cross-entropy, we show that a hypothesis with perfect robust accuracy can conversely have a higher WDRO risk than another hypothesis with near zero robust accuracy. To evaluate robust accuracy directly, we develop Wasserstein distributional attacks (WDA), which add a weight generation stage after candidate support search to optimize the allocation of empirical mass under the Wasserstein constraint, rather than assigning each data point's full mass to one returned attack point as existing methods do. We further introduce a support-search algorithm for WDA that finds nearby misclassified inputs. On CIFAR-10, CIFAR-100, and ImageNet, WDA using our search algorithm achieves the lowest adversarial accuracy in most tested settings. Our code is available at https://github.com/OLab-Repo/WDA.