{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,23]],"date-time":"2026-08-23T14:51:44Z","timestamp":1787496704761,"version":"build-2736575974"},"reference-count":81,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2021,9,1]],"date-time":"2021-09-01T00:00:00Z","timestamp":1630454400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,9,1]],"date-time":"2021-09-01T00:00:00Z","timestamp":1630454400000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,9,1]],"date-time":"2021-09-01T00:00:00Z","timestamp":1630454400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,9,1]],"date-time":"2021-09-01T00:00:00Z","timestamp":1630454400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CCF-1841190"],"award-info":[{"award-number":["CCF-1841190"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CCF-1907786"],"award-info":[{"award-number":["CCF-1907786"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CCF-1942134"],"award-info":[{"award-number":["CCF-1942134"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007065","name":"Nvidia GPU Grant Program","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007065","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Inform. Theory"],"published-print":{"date-parts":[[2021,9]]},"DOI":"10.1109\/tit.2021.3100107","type":"journal-article","created":{"date-parts":[[2021,7,26]],"date-time":"2021-07-26T18:34:25Z","timestamp":1627324465000},"page":"6031-6052","source":"Crossref","is-referenced-by-count":12,"title":["Adversarial Risk via Optimal Transport and Optimal Couplings"],"prefix":"10.1109","volume":"67","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0311-150X","authenticated-orcid":false,"given":"Muni Sreenivas","family":"Pydi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4159-0900","authenticated-orcid":false,"given":"Varun","family":"Jog","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20828-2"},{"key":"ref72","first-page":"1178","article-title":"Adversarial vulnerability for any classifier","volume":"31","author":"fawzi","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref71","first-page":"1646","article-title":"Limitations of adversarial robustness: Strong no free lunch theorem","author":"dohmatob","year":"2019","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref70","first-page":"1","article-title":"Adversarial spheres","author":"gilmer","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)-Workshop Track"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1561\/2200000073"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/72.105415"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1090\/gsm\/058"},{"key":"ref39","article-title":"Generalized resilience and robust statistics","author":"zhu","year":"2019","journal-title":"arXiv 1909 08755"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ITW.2018.8613445"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s10107-017-1172-1"},{"key":"ref78","author":"goodfellow","year":"2016","journal-title":"Deep Learning"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1090\/mcom\/3303"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2018.04.027"},{"key":"ref32","first-page":"7498","article-title":"Lower bounds on adversarial robustness from optimal transport","author":"bhagoji","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref31","first-page":"1","article-title":"A closer look at accuracy vs. robustness","volume":"33","author":"yang","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref30","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","author":"cohen","year":"2019","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref37","first-page":"1","article-title":"Wasserstein distributional robustness and regularization in statistical learning","author":"gao","year":"2017","journal-title":"Proc INFORMS Annu Meeting"},{"key":"ref36","first-page":"1","article-title":"Distributionally robust stochastic optimization with Wasserstein distance","author":"gao","year":"2016","journal-title":"Proc INFORMS Annu Meeting"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1017\/jpr.2019.49"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1287\/opre.2014.1323"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177699803"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2008.2008128"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1176342363"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638718"},{"key":"ref28","first-page":"832","article-title":"When are non-parametric methods robust?","author":"bhattacharjee","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2017.2693198"},{"key":"ref27","first-page":"941","article-title":"Robustness for non-parametric classification: A generic attack and defense","author":"yang","year":"2020","journal-title":"Proc Int Conf Artif Intell Statist"},{"key":"ref65","volume":"523","author":"huber","year":"2004","journal-title":"Robust Statistics"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1193342380"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00929"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/s00222-016-0673-5"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1214\/17-AOS1675"},{"key":"ref69","author":"ledoux","year":"2001","journal-title":"The Concentration of Measure Phenomenon"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref20","first-page":"1","article-title":"Robustness may be at odds with accuracy","author":"tsipras","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref22","article-title":"Adversarial risk bounds via function transformation","author":"khim","year":"2018","journal-title":"arXiv 1810 09519"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref24","first-page":"1","article-title":"Evaluating the robustness of neural networks: An extreme value theory approach","author":"weng","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref23","first-page":"7085","article-title":"Rademacher complexity for adversarially robust generalization","author":"yin","year":"2019","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref26","first-page":"2266","article-title":"Formal guarantees on the robustness of a classifier against adversarial manipulation","author":"hein","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref25","first-page":"4939","article-title":"Efficient neural network robustness certification with general activation functions","volume":"31","author":"zhang","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref50","first-page":"1","article-title":"Robustness and regularization of support vector machines","volume":"10","author":"xu","year":"2009","journal-title":"J Mach Learn Res"},{"key":"ref51","first-page":"1576","article-title":"Distributionally robust logistic regression","volume":"28","author":"shafieezadeh-abadeh","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref59","first-page":"302","article-title":"Minimax classification with 0–1 loss and performance guarantees","volume":"33","author":"mazuelas","year":"2020","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref58","first-page":"2687","article-title":"Minimax statistical learning with Wasserstein distances","volume":"31","author":"lee","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref57","article-title":"A data-driven approach to multi-stage stochastic linear optimization","author":"bertsimas","year":"2020"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1287\/opre.2014.1314"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1287\/opre.1090.0795"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1287\/moor.2018.0936"},{"key":"ref53","first-page":"408","article-title":"Calibrated surrogate losses for adversarially robust classification","volume":"125","author":"bao","year":"2020","journal-title":"Proc 33rd Conf Learn Theory"},{"key":"ref52","first-page":"517","article-title":"A robust learning approach for regression models based on distributionally robust optimization","volume":"19","author":"chen","year":"2018","journal-title":"J Mach Learn Res"},{"key":"ref10","first-page":"1","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref11","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1307\/mmj\/1029003026"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref13","first-page":"1","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref14","first-page":"1","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref16","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","author":"cisse","year":"2017","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref81","article-title":"Reverse Euclidean and Gaussian isoperimetric inequalities for parallel sets with applications","author":"jog","year":"2020","journal-title":"arXiv 2006 09568"},{"key":"ref17","first-page":"1","article-title":"Are adversarial examples inevitable?","author":"shafahi","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33014536"},{"key":"ref19","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1051\/m2an\/2015020"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1126\/science.aar6404"},{"key":"ref3","doi-asserted-by":"crossref","first-page":"484","DOI":"10.1038\/nature16961","article-title":"Mastering the game of go with deep neural networks and tree search","volume":"529","author":"silver","year":"2016","journal-title":"Nature"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2205597"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-019-1724-z"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MCI.2018.2840738"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638947"},{"key":"ref49","first-page":"1283","article-title":"Second order cone programming approaches for handling missing and uncertain data","volume":"7","author":"shivaswamy","year":"2006","journal-title":"J Mach Learn Res"},{"key":"ref9","first-page":"4171","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"devlin","year":"2019","journal-title":"Proc Conf North Amer Chapter Assoc Comput Linguistics"},{"key":"ref46","article-title":"Distributionally robust deep learning as a generalization of adversarial training","author":"staib","year":"2017","journal-title":"Proc NIPS Workshop Mach Learn Comput Secur"},{"key":"ref45","first-page":"12280","article-title":"Theoretical analysis of adversarial learning: A minimax approach","author":"tu","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref48","first-page":"555","article-title":"A robust minimax approach to classification","volume":"3","author":"lanckriet","year":"2002","journal-title":"J Mach Learn Res"},{"key":"ref47","first-page":"7717","article-title":"Randomization matters. How to defend against strong adversarial attacks","author":"pinot","year":"2020","journal-title":"Proc Int Conf Mach Learn (ICML)"},{"key":"ref42","first-page":"15","article-title":"Regular conditional probability, disintegration of probability and radon spaces","volume":"23","author":"leao","year":"2004","journal-title":"Proyecciones"},{"key":"ref41","author":"billingsley","year":"2013","journal-title":"Convergence of Probability Measures"},{"key":"ref44","first-page":"10359","article-title":"Adversarial risk and robustness: General definitions and implications for the uniform distribution","volume":"31","author":"diochnos","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"},{"key":"ref43","first-page":"7446","article-title":"On the hardness of robust classification","author":"gourdeau","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst (NIPS)"}],"container-title":["IEEE Transactions on Information Theory"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/18\/9523437\/9496634-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/18\/9523437\/09496634.pdf?arnumber=9496634","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T10:54:20Z","timestamp":1652180060000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9496634\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,9]]},"references-count":81,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/tit.2021.3100107","relation":{},"ISSN":["0018-9448","1557-9654"],"issn-type":[{"value":"0018-9448","type":"print"},{"value":"1557-9654","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,9]]}}}