Wasserstein distributionally robust optimization (WDRO) provides a framework for adversarial robustness, yet existing methods based on global Lipschitz continuity or strong duality often yield loose upper bounds or require prohibitive computation. We address these limitations with a primal approach and adopt a notion of exact Lipschitz certificates to tighten this upper bound of WDRO. For ReLU networks, we leverage the piecewise-affine structure on activation cells to obtain an exact tractable characterization of the corresponding WDRO problem. We further extend our analysis to modern architectures with smooth activations (e.g., GELU, SiLU), such as Transformers. Additionally, we propose novel Wasserstein Distributional Attacks (WDA, WDA++) that construct candidates for the worst-case distribution. Compared to existing attacks that are restricted to point-wise perturbations, our methods offer greater flexibility in the number and location of attack points. Extensive evaluations demonstrate that our proposed framework achieves competitive robust accuracy against state-of-the-art baselines while offering tighter certificates than existing methods. Our code is available at https://github.com/OLab-Repo/WDA.

翻译：Wasserstein分布鲁棒优化（WDRO）为对抗鲁棒性提供了一个框架，然而基于全局Lipschitz连续性或强对偶性的现有方法往往产生宽松的上界或需要极高的计算成本。我们通过原始方法应对这些局限性，并采用精确Lipschitz证书的概念来收紧WDRO的上界。对于ReLU网络，我们利用激活单元上的分段仿射结构，获得了对应WDRO问题的精确可处理表征。我们进一步将分析扩展到具有平滑激活函数（如GELU、SiLU）的现代架构，例如Transformer。此外，我们提出了新颖的Wasserstein分布攻击（WDA、WDA++），其能构建最坏情况分布的候选。与局限于逐点扰动的现有攻击相比，我们的方法在攻击点的数量和位置上提供了更大的灵活性。大量评估表明，我们提出的框架在实现与最先进基线相竞争的鲁棒精度的同时，提供了比现有方法更紧致的证书。我们的代码可在https://github.com/OLab-Repo/WDA获取。