Deep neural networks (DNNs) are known to be vulnerable to adversarial attacks that would trigger misclassification of DNNs but may be imperceptible to human perception. Adversarial defense has been an important way to improve the robustness of DNNs. Existing attack methods often construct adversarial examples relying on some metrics like the $\ell_p$ distance to perturb samples. However, these metrics can be insufficient to conduct adversarial attacks due to their limited perturbations. In this paper, we propose a new internal Wasserstein distance (IWD) to capture the semantic similarity of two samples, and thus it helps to obtain larger perturbations than currently used metrics such as the $\ell_p$ distance. We then apply the internal Wasserstein distance to perform adversarial attack and defense. In particular, we develop a novel attack method relying on IWD to calculate the similarities between an image and its adversarial examples. In this way, we can generate diverse and semantically similar adversarial examples that are more difficult to defend by existing defense methods. Moreover, we devise a new defense method relying on IWD to learn robust models against unseen adversarial examples. We provide both thorough theoretical and empirical evidence to support our methods.

翻译：众所周知,深神经网络(DNNS)很容易受到引发DNS误分类的对抗性攻击,但可能无法被人理解。反向防御是提高DNS稳健性的一个重要方法。现有的攻击方法往往根据美元/美元/美元/美元距离至扰动样本等某些计量标准构建对抗性例子。然而,由于这些参数的干扰有限,可能不足以进行对抗性攻击。在本文中,我们提议新的内部瓦西斯坦距离(IWD)来捕捉两个样本的语义相似性,从而帮助获得比目前使用的美元/美元/美元距离等计量标准更大的扰动性。我们随后运用内部瓦西斯坦距离来进行对抗性攻击和防御。我们特别开发了一种新的攻击方法,依靠IWD来计算图像与其对抗性实例之间的相似性。这样,我们可以产生多样化和语义性相似的对抗性对抗性例子,而现有的防御方法更难加以保护。此外,我们设计了一种新的防御性模型,我们既可以用来学习可靠的IWD理论,又可以用来用来学习新的对抗性模型。