{'fraction_non_alphanumeric': 0.038876613187305856, 'fraction_numerical': 0.01706856246197201, 'mean_word_length': 4.521216407355022, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Robust Generative Adversarial Network

Generative adversarial networks (GANs) are powerful generative models, but usually suffer from instability and generalization problem which may lead to poor generations. Most existing works focus on stabilizing the training of the discriminator while ignoring the generalization properties. In this work, we aim to improve the generalization capability of GANs by promoting the local robustness within the small neighborhood of the training samples. We also prove that the robustness in small neighborhood of training sets can lead to better generalization. Particularly, we design a robust optimization framework where the generator and discriminator compete with each other in a \textit{worst-case} setting within a small Wasserstein ball. The generator tries to map \textit{the worst input distribution} (rather than a Gaussian distribution used in most GANs) to the real data distribution, while the discriminator attempts to distinguish the real and fake distribution \textit{with the worst perturbation}. We have proved that our robust method can obtain a tighter generalization upper bound than traditional GANs under mild assumptions, ensuring a theoretical superiority of RGAN over GANs. A series of experiments on CIFAR-10, STL-10 and CelebA datasets indicate that our proposed robust framework can improve on five baseline GAN models substantially and consistently.


Introduction
Generative adversarial networks (GANs) ) have been enjoying much attention recently due to their great success on different tasks and datasets (Radford, Metz, and Chintala 2015;Salimans et al. 2016;Ho and Ermon 2016;Li et al. 2017) The framework of GANs can be formulated as the game between generator and discriminator. The generator tries to produce the fake distribution which approximates the real data distribution, while the discriminator attempts to distinguish the fake distribution from the real distribution. These two players compete with each other iteratively. GANs are also popular for their theoretical value (Nowozin, Cseke, and Tomioka 2016;Uehara et al. 2016;Mohamed and Lakshminarayanan 2016).
Despite the success, traditional GANs usually suffer from training instability and low generalization capability Copyright c 2020, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved. which leads to poor generation performance. Most researches focus on how to stabilize the training of GANs (Arjovsky, Chintala, and Bottou 2017;Miyato et al. 2018;Gulrajani et al. 2017).However, the generalization property of GANs is not well understood. Several works showed that if the discriminator has poor generalization, the generator cannot learn effectively Arjovsky and Bottou ) and are prevented from learning the target distribution which leads to poor generations (Thanh-Tung, Tran, and Venkatesh 2019). To tackle such problem, recent work (Thanh-Tung, Tran, and Venkatesh 2019) proposed gradient penalty to regularizing the discriminator for improving generalization. Differently, we attempt to analyze the generalization capability of GAN from new prospective of local robustness and improve the generalization by promoting the robustness within small neighborhood of training data. Moreover, we also provide the corresponding upper bound for generalization.
The generalization of discriminator/generator is to describe how well it performs on unseen data (Arora et al. 2017a;Xu and Mannor 2012a;Thanh-Tung, Tran, and Venkatesh 2019).
Therefore, it can be measured by the difference between its performance on training data and the whole data space. Specifically, (Qi 2017; Xu and Mannor 2012a) directly evaluate it by the difference between loss functions on training set and the whole data set. In this paper, we use the same way to evaluate the generalization for both discriminator and generator as (Qi 2017; Xu and Mannor 2012a).
Specifically, we propose a novel method called robust generative adversarial network (RGAN) where the generator and discriminator still compete with each other iteratively, but in a worst-case setting with respect to all the possible distributions within a small region. Specifically, a robust optimization is designed with considering the worst distribution within a small Wasserstein ball. The generator tries to map the worst input distribution with respect to all the possible distributions within a small region (rather than a specific distribution as used in traditional GANs) to the real data distribution, while the discriminator attempts to distinguish the real and fake distribution with the worst perturbation. Under very mild assumptions, we prove that the proposed Robust GAN attains a tighter generalization upper bound than traditional GANs, making our model theoretically more attractive. We compare our robust framework with various popular GANs (e.g., DCGAN, WGAN-GP, SNGAN, and BWGAN) (Radford, Metz, and Chintala 2015;Adler and Lunz 2018;Miyato et al. 2018), all of which intend to control the discriminator only. We observe substantial improvements over these models consistently on all the datasets used in this paper. 1 In a nutshell, our contributions are as follows: 1) We proposed a novel robust method called robust generative adversarial network (RGAN) which ensures the better generalization than original GANs with theoretical gaurantees. 2) We analyse the relationship between robustness and generalization and provide corresponding upper bound. We show that robustness in sufficient small neighborhood of training data can boost generalization. 3) The optimization procedure is simple (just inject specific perturbations) but effective. 4) Our method can be easily implemented on different frameworks and achieves consistent improvement.

Related Work
Arjovsky et al. proved that the supports of the fake and real distributions are typically disjoint on low dimensional manifolds and there is a nearly trivial discriminator which can correctly classify the real and fake data (Arjovsky, Chintala, and Bottou 2017). The loss of such discriminator converges quickly to zero which causes the vanishing gradient for generator, further leading to the instability problem. To alleviate such problem, clipping weight and gradient penalty based methods are proposed to stabilizing the discriminator. (Gulrajani et al. 2017;Miyato et al. 2018;Arjovsky, Chintala, and Bottou 2017;Roth et al. 2017;Mescheder, Geiger, and Nowozin 2018;Petzka, Fischer, and Lukovnicov 2017). Different from these works, our method aims at improving generalization of GANs.
Several works have analyzed the generalization of GANs. (Arora et al. 2017a) provided the upper bound for generalization of discriminator with neural network distance and prove that such distance ensure the better generalization than Jensen-Shannon divergence and Wasserstein distance. (Qi 2017) analyze the upper bound of generalization for both generator and discriminator of Loss-Sensitive GAN. (Arora, Risteski, and Zhang 2018) proposed to measure the generalization capability of GAN by estimating the number of modes in the model distribution. Recently, (Thanh-Tung, Tran, and Venkatesh 2019) attempted to improve the generalization with gradient penalty. However, those previous works do not consider the relationship between local robustness and generalization. Our method improve the generalization from perspective of robustness and show superior performance than methods based on gradient penalty.
There are also some works analyzing the relationship between robustness and generalization. (Stutz, Hein, and Schiele 2019) showed that on-manifold robustness is essentially generalization with experiments. However, the theoretical bound is not provided. (Xu and Mannor 2012a) state the relationship between robustness and generalization theoretically. The defect is that such theory is hard to apply directly. Compared with previous works, we provide the stronger theoretical relationship between robustness and generalization. We also provide the upper bound for generalization which can be directly used to compare the generalization capability of two models.
The Robust Conditional Generative Adversarial Networks has been recently proposed to improve the robustness of conditional GAN for noised data. However, this method can merely implement on conditional GAN which improves the ability of generator only to defend the noise (Chrysos, Kossaifi, and Zafeiriou 2018). The generalization is not considered. Some other researchers also focus on the robustness of GAN to label noise (?) (Kaneko, Ushiku, and Harada 2019). In comparison, we propose a comprehensive study and focus on the model robustness of both discriminator and generator to input noise with a guaranteed tighter bound than traditional GANs.

Generative Adversarial Network
Formally, the training procedure of GAN can be formulated as: (1) where x and x = G(z) are real and fake examples sampled from the real data distribution P r and generation distribution P g respectively. The generation distribution is defined by G(z) where z ∼ P z (P z is a specific input noise distribution). The minmax problem cannot be solved directly since the expectation of the real and generation distribution is usually intractable. Therefore, an approximation problem can be defined as: where m examples of x i and z i are sampled from two specific distributions P r and P z . The mean value of the loss is used to approximate the original problem. However, robustness is not adequately considered especially when specific distributions P r and P z are assumed. This may sometimes cause the instability issue and further lead to degraded generations. In this paper, to alleviate such problem, we design a distributionally robust optimization. Particularly, we consider the worst distributions (rather than a specific single distribution) so as to achieve a robust GAN.
In this section, we design the distributionally robust optimization and develop the novel robust framework on GANs.

Distributionally Robust Optimization
Let d : X × X → R + . We define d(x, x 0 ) as the departure between x and x 0 (with x, x 0 ∈ X ). For distributionally robust optimization, we consider the robustness region P = {P : W (P, P 0 ) ≤ ρ} which describes the ρ -neighborhood of the distribution P 0 under the divergence W (., .). Normally, W (., .) can be defined as the Wasserstein metric where the corresponding d(x, x 0 ) = x − x 0 2 2 . 2 In comparison from the single distribution P 0 (typically used in traditional GANs), the robustness region P = {P : W (P, P 0 ) ≤ ρ} can usually lead to better robustness.
The distributionally robust optimization can be formulated as (Sinha, Namkoong, and Duchi 2017): where l(.) is a loss function parameterized by θ. The problem of (3) is typically intractable for arbitrary ρ. We can reformulate it into its Langrangian relaxation as follows: where λ is the Langrangian constant parameter. In order to solve this problem, we present a proposition: Proposition 0.1 Let l: θ × X → R and d: X × X → R + be continuous. Then, for any distribution P 0 and ρ > 0 we have (Proof is provided in (Sinha, Namkoong, and Duchi 2017)).
With Proposition 0.1, we can transform (4) as follows: where the second term d(x, x 0 ) is to restrict the distance between two points.

Robust Training over Generator
With the distributionally robust optimization, we first discuss how we can perform robust training over generator. The generator of traditional GANs tries to map a specific noise distribution P z (typically a Gaussian distribution) to the image distribution P r . The objective of generator is described as follows: 2 Though we focus on using 2-norm in this paper, other norms like 1-norm or ∞-norm can also be used.
For improving the robustness, we consider all the possible distributions within the robustness region P z = {P : W (P, P z ) ≤ ρ z } rather than a single specific distribution where W is defined as the Wasserstein metric measuring the distance between P and P z . To enable feasible optimization, we further consider to minimize the upper bound of (7) for all the possible distributions within the robustness region. Namely, we tend to minimize the worst distribution within the robustness region: With the similar method discussed in Section , we can also relax (8) as: where z i ∼ P z and the trade-off parameter λ z > 0.
Different from those previous methods, our method attempts to map the worst distribution (in the ρ z -neighborhood of the original distribution P z ) to the image distribution. Intuitively, we tend to learn a good G that can even perform well on the worst-case noisy points or the most risky points. Therefore, such generator would be robust against poor input noises and might be less likely to generate the lowquality images.

Robust Training over Discriminator
In traditional GANs described by (20), the generator attempts to generate a fake distribution to approximate the real data distribution, while the discriminator tries to learn the decision boundary to separate real and fake distributions. Apparently, a discriminator with a poor robustness would inevitably mislead the training of generator. In this section, we utilize the popular adversarial learning method (Goodfellow, Shlens, and Szegedy 2014; Zhang and Wang 2019) and propose the robust optimization method to improve the discriminator's robustness both for clean and noised data. Specifically, we define the robust regions for both the fake distribution P g = {P : W (P, P g ) ≤ ρ g } and real distribution P r = {P : W (P, P r ) ≤ ρ r }. The generator tries to reduce the distance between the fake distribution P g and real distribution P r . The discriminator attempts to separate the worst distributions in P g and P r . Intuitively, the worst distributions are closer to the decision boundary (less discriminative) and they are able to guide the training of discriminator to perform well on "confusing" data points near the classification boundary (such discriminator can be more robust than original one). We can reformulate the optimization of D in (20) as the following robust version: where z i ∼ P z , x ′ i ∼ P 1 , and G ′ ∼ P 2 . Similarly, with the Algorithm 1 Algorithm for RGAN 1: Input: size m, trade-off parameter λ, perturbation magnitude (respectively for G and D) ǫ 1 , ǫ 2 2: for number of training iterations do 3: Sample a batch of input noise z i ∼ P z of size m, a batch of real data x i ∼ P r of size m. λ is the tradeoff parameter for original objective and our objective. ǫ 1 and ǫ 2 are amplitude of perturbation for input and images respectively.

4:
Find the worst perturbation {r zadv , r dadv1 , r dadv2 } by maximizing the objective of generator and minimizing the objective of discriminator: Update G by descending along its stochastic gradient: Update D by descending along its stochastic gradient: ] 12: end for method discussed in Section , we can relax this problem as: Here is the set of small perturbations for the points sampled from real distribution P d which try to make the real distribution closer to the fake distribution. r 2 = {r i 2 } m i=1 tries to make the fake distribution closer to the real one. Intuitively, these perturbations try to enhance the difficulty of the classification task for discriminator by making the real and fake data less distinguishable. A discriminator trained with the difficult tasks would tend to be robust in practice. This has been proved theoretically in the next section.

Overall Optimization
We now integrate the robust training of generator and discriminator into a single framework: where G ′ (z i ) = G(z i ) + r i 2 and z i ∼ p λ z . p λ z is the mixture distribution defined by p λ z = (1 − λ)p z + λp ′ z and p ′ z is the worst distribution defined by p ′ z = arg max P :W (P,Pz)≤ρz E x∼P [1−logD(G(x))]. r i 2 is an arbitrary perturbation. It is noted that we also combine the original GAN into the framework, allowing a more flexible training. The specific algorithm can be seen in Algorithm 1:

Theoretical Analysis
In this section, we provide theoretical analysis for the RGAN while leaving the proof details in the complementary material due to the space limitation. We will show that our proposed robust method RGAN can attain a tighter generalizability upper bound than traditional GANs under reasonable mild assumptions, ensuring a theoretical superiority of RGAN over GANs. The main theorems are described in Theorem 0.4 and Theorem 0.5. Before this, we first set out some preliminary lemmas. Lemma 0.2 For an arbitrary fixed G, the optimal D of the game associated with RGAN (defined by the utility function V (G, D) in (21) The min-max problem of (21) is computationally intractable due to the expectations over real and fake distributions. An alternate way is to approximate the original problem with the empirical average of finite examples: where We now provide the analysis for the generalizability of the discriminator in Theorem 0.4. The generalizability of the discriminator in our RGAN is defined in a way similar to that in (Qi 2017) (Arora et al. 2017b D). Similarly, the generalizability of the discriminator in the original GAN is defined by |W θ m − W θ |, where W θ = max D S(G * , D) and W θ m = max D S m (G * , D). First, we give some definitions: where l(.) is the loss function and S is the training set.
Definition 0.2 Algorithm A is (ǫ, S, σ) adversarial robust, if within the ǫ-neighborhood of training set S, we have where y s b and y sa are labels of training samples s a and s b . s ′ b is a perturbed sample in the region B(s b , ǫ). Theorem 0.4 If the training set S d for discriminator consists of n i.i.d samples, the discriminator of RGAN D r and the original GAN D org are both (K, ǫ(S d )) robust, D r is (ǫ, S d , σ r ) adversarial robust, and D org is (ǫ, S d , σ org ) adversarial robust, then, for any δ > 0 and small enough ǫ, with the probability at least 1 − δ, we have D r obtains the tighter upper bound, i.e.: γ1σr where γ 1 , γ 2 ∈ [0, 1], which are closely related to σ r , σ org and the intersection of ǫ-neighborhood of training set N ǫ = si∈S d B(s i , ǫ) and data manifold Z. M is the upper bound of loss of data manifold Z.
Similarly, the generalizability of the generator for RGAN can be defined as the convergence of |Q φ m − Q φ |, where Q φ = min G V (G, D * ) and Q φ m = min G V m (G, D * ). For original GANs, the generalizability of the generator is defined by |U φ m − U φ |, where U φ = min G S(G, D * ) and U φ m = min G S m (G, D * ). We can also prove that the RGAN's generator has a tighter upper bound of the generalizability of the generator than traditional GANs.
Theorem 0.5 If the training set S g for generator consists of n i.i.d samples, the generator of our proposed method G r and original GAN G org are (K, ǫ(S g )) robust, G r is (ǫ ′ , S g , σ ′ r ) adversarial robust and G org is (ǫ ′ , S g , σ ′ org ) adversarial robust, then, for any δ > 0 and small enough ǫ ′ , with the probability at least 1 − δ, we have G r obtains the tighter upper bound, i.e.: , which are closely related to σ ′ r , σ ′ org and the intersection of ǫ ′ -neighborhood of the training set N ǫ ′ = si∈Sg B(s i , ǫ ′ ) and data manifold Z ′ . M ′ is the upper bound of loss of data manifold Z ′ .
It is noted that Theorem 0.4 and 0.5 made very mild assumptions to achieve tighter bound for G and D with the notion of (ǫ, S, σ) adversarial robustness, which helps bridge model generalizability and adversarial robustness. Specifically, it describes the variation of loss by upper bound σ on the ǫ-neighborhood of training set N ǫ = si∈S d B(s i , ǫ). If ǫ-neighborhood N ǫ intersects with data manifold Z and the variation of loss is bounded by σ in N ǫ , then the loss of intersection region can be also bounded by σ. Therefore, the generalizability on the intersection region can be bounded. When we set a small enough radius ǫ (as we did in practice), B(s i , ǫ) does not contain data points with different label of s i (for s i ∈ S). In this case, the upper bound of our method would be guaranteed tighter than original GANs. Some works have investigated the relationship between the adversarial robustness and generaliability (Yan, Guo, and Zhang 2019). However, no exact bound has been obtained.

Experiments
We present a series of experiments in this section. First, we show that our proposed RGAN can improve the performance of different types of baseline models including WGAN-GP, DCGAN, WGAN-GP (resnet), and BWGAN. Inception score and FID are used to evaluate the quality of generations.

Quantitative Comparison
To evaluate the performance of RGAN, we follow the previous works (Gulrajani et al. 2017; Adler and Lunz 2018) on robustness and mainly conduct experiments on CIFAR-10 and STL-10. In addition to other existing popular GAN models, we focus on comparing 5 models including WGAN-GP, WGAN-GP (resnet), DCGAN, SNGAN, and BWGAN, all of which try to control the discriminator. We implemented our proposed robust strategy on these baselines and would like to check if the robust training could indeed improve the performance. The structures and settings of our method are the same as baseline models. We train WGAN-GP, DCGAN, BWGAN and our proposed RGANs with 50, 000 training samples for 200, 000 epochs. For WGAN-GP (resnet) and our corresponding model, 100, 000 epochs appear sufficient. For each 500 epochs, we calculate the inception score for 50, 000 generated images. For training RGANs, there are three hyper-parameters λ (used to tradeoff our objective and the original one), ǫ 1 and ǫ 2 . We set λ = 0.1 which was searched from {0.001, 0.01, 0.1, 0.5, 1, 2}. We also set ǫ 1 = 0.01 and ǫ 2 = 4 which was searched from {0.001, 0.01, 0.1, 0.2, 0.5, 1, 2, 4, 5, 10}. For STL-10, we train our models and corresponding baselines with 800K training samples. The training settings keep the same as those for CIFAR-10.
We list the performance for different models in Table 1. Clearly, our proposed RGAN (which is based on WGAN-  (Radford, Metz, and Chintala 2015) 5.77 ± 0.02 7.36 ± 0.06 42.18 53.23 Improved GAN (-L+HA) (Salimans et al. 2016) 6.86 ± 0.06 EGAN-Ent-VI (Dai et al. 2017) 7.07 ± 0.10 DFM (Warde-Farley and Bengio 2016) 7.72 ± 0.13 CT GAN (Wei et al. 2018) 8.12 ± 0.12 SNGAN (Miyato et al. 2018) 8   GP-res) achieves the best result among all the methods in terms of both the criteria, i.e., Inception Score and FID. In order to check if the proposed robust strategy can indeed improve over different baselines, we also detail the performance in Fig. 1 where we plot the bar charts for different baseline models and their robust version with RGAN on two datasets (CIFAR-10 and STL-10). 3 It is noted that the robust 3 BWGAN appears not to converge in STL-10 in our experi-strategy can consistently improve the baselines on the two datasets in terms of both the criteria. In addition, we also show the convergence curves in Figure 2. Clearly, when our robust strategy is applied on the baseline GANs, an obvious increase of the inception scores can be observed (though the convergence speed is similar to that of baseline models). We also check if our robust strategy can boost the performance of the conditional versions of various GANs by taking CIFAR-10 as one illustrative example when the class or label information can be feeding in training. These results are reported in Table 2 where SNGAN was adopted as the baseline to implement RGAN. Evidently, the RGAN again demonstrates the highest performance, significantly better than the other models.

Ablation and Sensitivity Analysis
We conduct the ablation and sensitivity analysis in this subsection. Specifically, we experiment on CIFAR-10 with robust training over generator only, robust training over discriminator only, and robust training over both the generator ments. For fair comparison, we did not report the performance when BWGAN is used as the baseline in STL-10.  Figure 2: Inception score versus training step. Each subfigure shows the comparison between a different baseline model (blue curve) and its corresponding robust version (by applying the RGAN strategies, red curve). Robust GANs consistently achieve much better performance though they converge in a similar speed to baseline models. Robust training on discriminator only 5.87 ± 0.03 8.01 ± 0.11 6.02 ± 0.02 8.23 Robust training on generator & discriminator 5.91 ± 0.02 8.25 ± 0.10 6.11 ± 0.02 8.40 and discriminator, trying to see if a robust training is necessary on both generator and discriminator. The results are listed in Table 3. As observed, robust training on either generator or discriminator can consistently improve the performance of all baseline models, while a joint robust training on both generator and discriminator can further boost the performance. We also experiment the baseline models which were injected with random Gaussian input noise on both discriminator and generator (at the same level of noise magnitude as used in RGAN). Though marginal improvement can be observed after noise injections, our robust training on either generator or discriminator or both shows consistently better performance. It is interesting to note that robust training on discriminator only could lead to more performance gain than on generator only, implying that a robust discriminator may be more important. This would be investigated as future work.
In addition, taking again CIFAR-10 as one illustrative dataset, we also show that our proposed robust method can perform robust on some potential input noise which might lead to poor generations (input noise sampled from the worst input distribution). Specifically, we generate 50, 000 images with RGAN and various baseline models from the original distribution and worst distribution for five times. Then, we compute the inception score and their corresponding standard deviation. The results are showed in Fig. 3. As observed, without the robust training, those baseline models perform consistently worst in the case of the worst noises input than that of the original input noises. This shows that the traditional GANs may not be robust and may lead to worse performance in case of certain poor input noise. In comparison, when the robust training is implemented, RGAN leads to similar performance even if the worst input noise is given.
Finally, we examine in Fig. 4 how the performance of RGAN would vary versus the two parameters ǫ 1 and ǫ 2 (see Algorithm 1) (used to control the perturbation magnitude in robust training) on CIFAR-10. Clearly, RGAN appears more sensitive to the perturbation magnitude ǫ 2 in discriminator, while it is less sensitive to the perturbation ǫ 1 in generator.

Visualization
We present visualization results to compare various methods qualitatively on CIFAR-10 and CelebA. We first present a series of visualization trying to understand visually why the robust GAN could lead to better performance than the traditional GANs. To this end, we sample 500 data points from the original input distribution and worst input distribution respectively. We then plot the 2-dimensional T-SNE embedding of these points. We also would like to plot the real data distribution and the generated data from the traditional GAN as well as our robust GAN. For clarity, we take WGAN-GP as one example but we should bear in mind that the conclusion is basically the same for other traditional GANs like DCGAN. These plots are made in Figure 5 where one can inspect the meaning of each subfigure in the caption. We highlight some remarks as follows. First, Figure 5(a) indicates that the worst distribution covers wider range of areas, especially low density areas of the original distribution; this might cause poor generations since the worst input noise distribution is significantly different from the original input noise. Second, (b) shows that the worst real distribution (red) actually looks much similar to the worst generation distribution. It may be more robust and meaningful to minimize in the worst-case setting the departure of the real data distribution and the fake data distribution, which is conducted in our RGAN. Third, (c) shows that the real data distribution varies largely from the generated data points obtained by traditional GANs, indicating the poor generalization of the    The worst real distribution (red) and worst generation distribution (blue). It is noted that the worst data distributions are more similar to each other which are more difficult to be classified. (c): Red and blue points are images sampled from real distribution, and generated by WGAN-GP respectively. (d): Red points are sampled from real distribution, and blue points are generated by RGAN. The data distribution generated by RGAN is apparently closer to the real distribution.
traditional GAN; in comparison, with a robust optimization in the worst-case setting, (d) demonstrates that the generated data look very close to the real data.
To clearly examine the visual quality, we demonstrate some images generated by WGAN-GP, DCGAN and their corresponding RGANs on the CelebA dataset. These generated images are shown in complementary file for saving the space. General observations indicate that the existing GANs may sometimes lead to very bad generations. In comparison, with the robust training under the worst-case distribution, such very bad examples can hardly be seen in RGAN. This clearly demonstrates the advantages of the proposed model.

Conclusion
In this paper, we consider the generalization issue of GANs and propose a robust generative adversarial network model (RGAN). We have designed a robust optimization framework where the generator and discriminator compete with each other in a worst-case setting. The generator tries to map the worst input distribution (rather than a specific input distribution) to real data distribution, while the discriminator attempts to distinguish the real and fake distribution with the worst perturbation. We have provided theories showing that better generalization of the new robust framework can be guaranteed agaist traditional GANs. We also have conducted extensive experiments on CIFAR-10, STL-10 and CelebA datasets with two criteria (Inception score and FID) indicating that our proposed robust framework can improve consistently on several baseline GAN models. as: l(D r , s j , y sj ) − l(D r , z 1 , y z1 ) l(D r , s j , y sj ) − l(D r , s ′ , y s ′ ) (1 − λ i ) j∈Ni max z4∈Ci l(D r , s j , y sj ) − l(D r , z 4 , y z4 ) Here λ i represents the proportion of C i ∩N ǫ in C i . N C ǫ is the complementary set of N ǫ in the whole space and ǫ is small enough so that B(s i , ǫ) does not intersect with data manifold of different classes. In other words, all samples in B(s i , ǫ) share the same label y si . Moreover, D r is (K, ǫ(S d )) robust and (ǫ, S d , σ r ) adversarial robust. Then, we can further get the upper bound: where M is the upper bound of the loss on data Manifold Z. γ 1 = K i=1 λ i |Ni| n and γ 1 ∈ [0, 1]. Similarly, the upper bound for the generalizability of discriminator of original GANs can be formulated: (1 − λ i )E(l(D org , z, y z )|z ∈ C i ∩ N C ǫ )