arXiv CS open access

Wasserstein Filtering: A Sample Selection Method for Robust Distribution Learning

2026 · arxiv_cs

arXiv CS · Papers · 2026

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

Wasserstein Filtering: A Sample Selection Method for Robust Distribution Learning Yikai Xu∗, Zhao Chen†, and Jian Huang‡ August 14, 2026

arXiv:2608.13418v1 [stat.ML] 13 Aug 2026

Abstract Given a dataset where a portion of the samples are contaminated, our goal is to recover the underlying clean population distribution. To this end, we propose Wasserstein Filtering (WF), a novel sample selection framework that discards a fraction of suspicious samples and estimates the target distribution using the empirical measure of the remaining data. The core insight is to select a subset of samples whose empirical distribution maximizes its Wasserstein distance to the fully contaminated empirical distribution, thereby preferentially isolating and removing geometrically influential outliers. To render this optimization computationally tractable, we introduce three algorithms: a marginal screening scheme, SinkMarg, and two joint optimization algorithms, SinkWF and SlicedWF, leveraging entropic optimal transport and sliced Wasserstein approximations, respectively. On the theoretical front, we introduce the Far Exclusion and Local Projection (FELP) contamination model, which characterizes corruptions consisting of well-separated outliers and locally indistinguishable perturbations. Under this model, we prove that the WF estimator achieves minimax optimality over distribution families with bounded covariance. Extensive numerical experiments on synthetic datasets, benchmark anomaly detection suites, and robust generative learning with diffusion models demonstrate that WF serves as a highly practical, model-agnostic preprocessing tool. It delivers competitive outlier detection performance and provides substantial downstream benefits for generative modeling under heavy contamination. Keywords: robust distribution estimation; Wasserstein distance; optimal transport; outlier detection

Introduction

Let D = {x1 , . . . , xn } be a set of i.i.d. samples drawn from a population distribution P ∗ . We consider an adversarial corruption model where an adversary can inspect the dataset and modify up to an α-fraction e = {e en }. The contamination budget α ∈ [0, 1) of the samples, yielding a contaminated dataset D x1 , . . . , x constrains the adversary such that: n X

I{exi ̸=xi } ≤ αn.

i=1 ∗

Department of Applied Mathematics, The Hong Kong Polytechnic University, Hong Kong, China. Email: yikai.xu@polyu.edu.hk † School of Data Science, Fudan University, Shanghai, China. Email: zchen fdu@fudan.edu.cn ‡ Department of Data Science and Artificial Intelligence, and Department of Applied Mathematics, The Hong Kong Polytechnic University, Hong Kong, China. Email: j.huang@polyu.edu.hk

This formulation is commonly referred to as adversarial or Total Variation (TV) contamination, reflecting the fact that the TV distance between the clean and contaminated empirical measures satisfies ∥Pen − Pn ∥TV ≤ α Pn (Diakonikolas et al., 2019; Nietert et al., 2023). Here, Pn = n1 i=1 δxi is the clean empirical measure, P n Pen = n1 i=1 δxei is the contaminated empirical measure, and δx represents the Dirac delta measure centered at x. In this work, we address the following fundamental question in robust statistics: Can we design an accurate estimator and a computationally tractable algorithm to recover the true distribution P ∗ under the Wasserstein-1 metric, given samples subject to Total Variation (TV) contamination? We adopt the Wasserstein-1 distance as our metric of distributional discrepancy because it metrizes weak convergence, naturally tolerates support mismatch, and is highly sensitive to the geometry of outliers (Nietert et al., 2023). Furthermore, by considering the TV contamination model, we impose minimal assumptions on the noise structure and allow for worst-case, adaptive, and malicious corruptions of the data. While existing methods, such as iterative filtering (Nietert et al., 2024), achieve strong theoretical convergence guarantees under TV contamination, they suffer from practical limitations. Specifically, their algorithms rely heavily on the unrealistic assumption that P ∗ is isotropic, and they require prior knowledge of unknown spectral parameters associated with the covariance of P ∗ . To address these limitations, we propose an algorithm that dispenses with the isotropic assumption and operates entirely independently of the parameters of P ∗ . The trade-off for this flexibility is that we establish the theoretical optimality of our estimator under TV contamination subject to mild, physically meaningful structural constraints that make the optimization landscape amenable to analysis.

1.1

Key Contributions

In this work, given a contamination proportion α, we formulate robust distribution learning as a constrained sample selection problem. Specifically, we identify and filter out suspicious outliers, using the empirical measure of the remaining samples as a robust representative of the clean population distribution P ∗ . From this perspective, we introduce the Wasserstein Filtering (WF) estimator. Conceptually, the WF estimator searches over all possible subsets of the contaminated data of a size determined by the contamination rate α. It then selects the subset whose empirical distribution maximizes the Wasserstein-1 distance to the overall contaminated empirical distribution. By framing outlier detection as this targeted optimization problem, the estimator systematically isolates and discards the samples that exert the most severe geometric distortion on the empirical measure. Our main contributions are both methodological and theoretical, summarized as follows: 1. Novel Algorithmic Frameworks: We propose three distinct algorithms to compute the WF estimator: one marginal scheme (SinkMarg) and two joint optimization schemes (SinkWF and SlicedWF). These algorithms scale flexibly across different sample sizes and dimensionalities. 2. Rigorous Theoretical Guarantees: Beyond showing strong empirical performance on par with state-ofthe-art heuristic outlier detection methods, we establish the minimax optimality of the WF estimator under robust distribution estimation. Furthermore, we provide elementary optimization convergence rates for our joint algorithms. 3. Task- and Model-Agnostic Utility: A unique benefit of our sample selection formulation is its taskindependence. It serves as a modular preprocessing filter that cleans the dataset prior to downstream modeling. In Section 5, we demonstrate this versatility by pairing our filter with modern deep generative models (DDPM). Unlike existing approaches that modify the loss function in a model-dependent manner (Balaji et al., 2020; Nietert et al., 2023), our approach is entirely model-agnostic and can safeguard any downstream generative framework.

The rest of this paper is organized as follows. In Section 2, we introduce our Wasserstein Filtering framework, detailing both the mathematical estimator and its three algorithmic realizations. Rigorous theoretical properties, including minimax optimality and optimization convergence, are established in Section 3. In Section 4, we present systematic numerical experiments on synthetic and benchmark datasets to validate and compare the empirical performance of our methods. Section 5 demonstrates the practical utility of our framework as a task-agnostic data-filtering step for modern generative models. Finally, Section 6 concludes the paper.

1.2

Related Work

Robust statistics has accumulated a rich body of seminal research, with the fundamental concepts dating back to the pioneering work of Huber (1964). Over the decades, substantial efforts have been devoted to designing robust estimation and inference procedures capable of handling corrupted data; for a comprehensive modern review, see Loh (2025). In this context, we highlight the literature most relevant to robust distribution learning. The seminal work of Donoho and Liu (1988) first formulated the robust distribution estimation problem under the population TV-contamination model and introduced Minimum Distance Estimation (MDE) at the population level. More recently, Zhu et al. (2022) systematically generalized MDE, utilizing it to design mean and covariance estimation procedures that achieve population minimax optimality alongside strong empirical guarantees. For nonparametric density estimation, Liu and Gao (2019) established the minimax optimal rate of pointwise density estimation under Huber’s contamination model, demonstrating that kernel density estimators (KDE) can achieve this rate when equipped with an optimal bandwidth. However, this optimal bandwidth relies heavily on the smoothness of the underlying clean density and the contamination proportion, both of which are typically unknown in practice. Chao and Dobriban (2023) derived analogous minimax rates under Wasserstein contamination. On the methodological front, several algorithmic variants have been proposed to robustify density estimation, including the integration of Huber-type loss functions with KDE (Kim and Scott, 2012) and the application of the median-of-means principle to kernel frameworks (Humbert et al., 2022). Partial Optimal Transport (OT), also referred to as unbalanced OT or robust OT, is closely related to our framework. Originally developed within the mathematical analysis community (Caffarelli and McCann, 2010; Figalli, 2010; Liero et al., 2018; Chizat et al., 2018), partial OT was subsequently introduced to the statistics and machine learning communities to relax the strict mass-preserving constraint of standard OT. Recent methodological developments have leveraged this relaxation to handle noisy data. For instance, Balaji et al. (2020) defined a robust Wasserstein distance by incorporating a χ2 -divergence penalty on the marginal distributions. By replacing the standard Wasserstein distance in Wasserstein GANs (WGAN) (Arjovsky et al., 2017) with this robust formulation, they trained generative models that are structurally insensitive to outliers. Mukherjee et al. (2021) substituted the χ2 -divergence with a Total Variation (TV) penalty, deriving an equivalent formulation that thresholds the cost matrix, which is significantly more computationally convenient. Subsequently, the theoretical foundations of this TV-penalized robust Wasserstein distance have been rigorously established, spanning measure-theoretic dualities, optimization landscapes, and statistical convergence properties, particularly its convergence rates in robust distribution estimation when plugged into the MDE framework (Ma et al., 2025; Nietert et al., 2023). Parallel to these theoretical advances, the computational aspects of unbalanced OT (Pham et al., 2020; Nguyen et al., 2023) and its associated MDE optimization schemes (Nietert et al., 2024) have also been extensively investigated. Another closely related line of research is unsupervised outlier detection. Unlike robust statistics, this field is often heavily empirically driven, focusing on practical heuristic design and computational scalability rather than formal problem abstractions or minimax theoretical guarantees. Classical outlier detection methods typically assign an anomaly score to each sample based on criteria such as local density, distance,

recursive isolation, reconstruction error, or marginal extremeness. For instance, COPOD (Li et al., 2020) leverages empirical copulas and tail probabilities to construct a computationally efficient and highly interpretable outlier score. More recently, Deep Isolation Forest (DIF) (Xu et al., 2023) enhances traditional isolation-based detection by applying random neural network representations prior to isolation-tree partitioning. Large-scale benchmarks, such as ADBench (Han et al., 2022), have systematically evaluated these diverse anomaly detection algorithms across tabular and graph data.

Methodology

2.1

Estimator

To define the proposed estimator, we first recall the definition of the Wasserstein distance (Villani et al., 2009). Let (X , d) be a Polish metric space, and let Q(X ) denote the set of all Borel probability measures on X . For p ≥ 1, we define the space of probability measures with finite p-th moment as Z p Qp (X ) := µ ∈ Q(X ) : d(x, x0 ) dµ(x) < ∞ for some x0 ∈ X . (1) X

For any µ, ν ∈ Qp (X ), the Wasserstein-p distance between them is defined as: Wp (µ, ν) :=

p1 , d(x, y) dπ(x, y)

inf π∈Π(µ,ν)

X ×X

where Π(µ, ν) denotes the set of all Borel probability measures (or couplings) on X × X having marginal distributions µ and ν, respectively. Throughout this paper, unless specified otherwise, we assume X ⊆ Rd . Let d be the standard Euclidean metric (i.e., d(x, y) = ∥x − y∥2 ), and set p = 1. That is, we restrict our focus to the Wasserstein-1 distance on Rd , denoted simply as W1 . P e = {e en } ⊂ X ⊆ Rd be a set of possibly contaminated data points, and let Pen = n1 ni=1 δxei Let D x1 , . . . , x denote the corresponding contaminated empirical measure. For a given contamination fraction α ∈ [0, 1), we seek to identify a target distribution within the family of sub-empirical measures obtained by removing e Specifically, we look for the sub-measure that maximizes the Wasserstein distance to αn outliers from D. the contaminated empirical measure Pen : PbWF = argmax W1 (Pen , P ),

(2)

P ∈Pα

where the candidate family Pα of trimmed empirical measures is defined as:     X 1 eα ⊂ D, e |D eα | = (1 − α)n . Pα = µ ∈ Q(X ) : µ = δxei , D   (1 − α)n eα e i ∈D x

b ∈ Rn such that: By reformulating (2) in vector form, our goal is to find an optimal probability mass vector p b = argmax W1 (Pen , Pp ), p

(3)

p∈∆α

where Pp =

⊤ ei is the discrete measure induced by the weights p = (p1 , . . . , pn ) . Here, ∆α represents i=1 pi δx

the scaled, discretized simplex: n ⊤ ∆α = v ∈ R : v 1 = 1, vi ∈ 0,

1 (1 − α)n

for all i ∈ [n] .

(4)

As the discrete optimization problem (3) is NP-hard, we relax it to its convex hull: b WF = argmax W1 (Pen , Pp ), p

(5)

p∈conv(∆α )

where the convex hull of ∆α is given by conv(∆α ) = v ∈ Rn : v⊤ 1 = 1, 0 ≤ vi ≤

1 , ∀i ∈ [n] . (1 − α)n

(6)

b WF , serves as our estimated mass vector. Once p b WF is obtained, The optimal solution to (5), denoted by p we filter out contaminated samples based on its entries. Specifically, we estimate the clean distribution P ∗ using the empirical distribution of the retained samples: Pb∗ =

1 (1 − α)n

δxei ,

i: p bWF,i >τα

b WF = (b where τα is the α-quantile of the entries of p pWF,1 , . . . , pbWF,n )⊤ . Since Pb∗ ∈ Pα by construction, it serves as a natural discrete approximation of PbWF . In the following, we present one algorithm to solve the discrete formulation (3) and two algorithms to solve the relaxed formulation (5).

2.2

Algorithms

2.2.1

SinkMarg

By expressing the Wasserstein-1 distance in its primal form, we can reformulate the discrete optimization problem (3) as a discrete optimal transport problem: b = argmax p p∈∆α

min

⟨T, C⟩,

(7)

1 T∈Π( n 1,p)

ej ∥2 representing the Euclidean distance where C ∈ Rn×n is the cost matrix with entries Cij = ∥e xi − x + between the i-th and j-th samples, and Π(u, v) = {T ∈ Rn×n : T1 = u, T⊤ 1 = v} denotes the set of + feasible transport plans. Since computing the exact Wasserstein distance via linear programming is computationally expensive, we instead employ its entropy-regularized approximation (Cuturi, 2013): X Tij log(Tij ), W1,λ (Pen , Pp ) = min ⟨T, C⟩ + λ 1 1,p) T∈Π( n i,j∈[n] where λ > 0 is the regularization parameter, and Tij is the (i, j)-th entry of the transport plan T. 1 Let p−i ∈ Rn be a probability vector whose i-th entry is 0 and all other entries are equal to n−1 . A b is to assign zero mass to the αn points that yield the largest leave-one-out natural heuristic for estimating p (LOO) scores: W1,λ (Pen , Pp−i ) for i ∈ [n]. The intuition behind this approach is straightforward: if removing a single sample causes a significant shift in the distribution, that sample is highly likely to be a contaminated outlier. Based on this intuition, we introduce a marginal screening algorithm to solve (3), as outlined in Algorithm 1. As demonstrated in our numerical experiments, this algorithm performs well when the outliers are isolated.

However, due to its purely marginal nature, it fails to capture the group structure of clustered outliers and incurs a heavy computational burden when n is large.

Algorithm 1: Sinkhorn Marginal Screening Algorithm e α ∈ (0, 1), λ ∈ R+ Input: D, e 1: Normalize D 2: for i = 1, . . . , n do 3: Compute si = W1,λ (Pen , Pp−i ) 4: end e to obtain S = {e 5: Thresholding: filter D xi |si < τ1−α , i ∈ [n]} where τ1−α is the 1 − α quantile of leave-one-out scores {si , i ∈ [n]} Output: S

2.2.2

SinkWF

To solve the relaxed formulation (5), we consider its entropy-regularized version: b SinkWF = argmax W1,λ (Pen , Pp ), p

(8)

p∈conv(∆α )

where W1,λ (Pen , Pp ) =

X min ⟨T, C⟩ + λ Tij log(Tij ). 1 T∈Π( n 1,p) i,j∈[n]

Our proposed optimization scheme is detailed in Algorithm 2. To leverage gradient-based optimization, we transform the constrained problem (8) into an unconstrained, smooth formulation. First, we reparameterize the probability vector p using the softmax function to ensure it lies on the simplex: p(b) = softmax(b) for b ∈ Rn . Second, we incorporate the upper-bound constraint of the capped simplex conv(∆α ) as a penalty term added to the objective: 1 ⊤ e 1 , L(b) = −W1,λ (Pn , Psoftmax(b) ) + β1 ReLU softmax(b) − (1 − α)n where ReLU(x) = max(x, 0) is applied element-wise, and β > 0 is a penalty parameter. To update b via gradient descent, we need to compute the gradient gr = ∇b L(br ) at the r-th iteration. Rather than backpropagating directly through the Sinkhorn iterations using automatic differentiation (e.g., PyTorch’s AutoGrad), which is highly memory-intensive, we exploit the duality theory of optimal transport. Specifically, the gradient of the entropic Wasserstein loss with respect to the marginal distribution is given by: ∂W1,λ (Pen , Pp ) = v∗ , ∂p where v∗ ∈ Rn is the optimal dual potential associated with p, which is a direct byproduct of the Sinkhorn algorithm (Sinkhorn, 1964; Cuturi, 2013). Using this dual formulation to compute the gradient gr bypasses the need to store the computational graph of the Sinkhorn iterations, significantly reducing both time and memory complexity. After solving the entropic optimal transport problem to obtain the optimal plan Tr , one might consider using the unregularized cost ⟨Tr , C⟩ as a more accurate approximation of the true Wasserstein distance, as suggested by Luise et al. (2018). However, computing the gradient ∂⟨Tr , C⟩/∂p requires either backpropa-

gating through the Sinkhorn steps or solving a system of linear equations with O(n3 ) complexity, making it computationally prohibitive. Using the obtained gradient gr , we employ the Adam optimizer (Kingma and Ba, 2014) to update br for R iterations. To enhance the stability of our estimator, we repeat this optimization process T times with differPT (t) ent initializations. We then take the average of the T resulting probability vectors, T −1 t=1 softmax(bR ), as the final screening score, filtering out the αn samples with the smallest scores as suspected outliers. The complete procedure for SinkWF is detailed in Algorithm 2. In addition to this penalty-based approach for handling the capped simplex constraint, we also provide a projection-based optimization variant, alongside an automatic selection strategy for the hyperparameter α. These complementary details are discussed in Appendix A.1-A.2.

Algorithm 2: Sinkhorn Wasserstein Filtering Algorithm e α ∈ (0, 1), b0 , λ, γ ∈ R+ , R, T ∈ Z+ Input: D, e 1: Normalize D 2: for t = 1, . . . , T do 3: for r = 0, . . . , R − 1 do 4: Solve the following problem: Tr =

⟨T, C⟩ + λ

argmin 1 1,softmax(br )) T∈Π( n

tij log(tij )

(9)

i,j∈[n]

Compute gradient on br :

gr =

 

v∗ −



 1 ∂β1⊤ Relu softmax(br ) − (1−α)n 1  ∂solftmax(b ) r

∂solftmax(br )



∂br

(10)

Adam optimizer update: br+1 = Adam(γ, br , gj,j≤r )

(11)

end Save ht = softmax(bR ) 7: end e to obtain S = {xi |h̄i > τα , i ∈ [n]} where h̄i is the ith entry of 8: Thresholding: filter D PT 1 h̄ = T t=1 ht , τα is the α quantile of h̄i , i ∈ [n] Output: S 5: 6:

2.2.3

SlicedWF

In the SinkWF formulation (8), the cost matrix C must be explicitly constructed and stored. This incurs an O(n2 ) space and time complexity, which can be computationally prohibitive for large-scale datasets. To address this limitation, we consider a more memory-efficient alternative to the classical Wasserstein distance: the Sliced Wasserstein (SW) distance (Peyré et al., 2019). The SW distance is defined as: S 1X W1,S (Pen , Pp ) = W1 Pu⊤ xe, xe∼Pen , Pu⊤ , y, y∼P p i i S i=1

where Sd−1 denotes the d-dimensional unit sphere, and ui ∼ Sd−1 are random projection directions. The parameter S controls the number of projections used to approximate the continuous Sliced Wasserstein

distance. By projecting the d-dimensional data onto these random 1-dimensional directions, computing the SW distance simplifies to averaging S independent 1-dimensional Wasserstein distances. The corresponding estimator under this formulation is given by: b SlicedWF = argmax W1,S (Pen , Pp ), p

(12)

p∈conv(∆α )

where

W1,S (Pen , Pp ) =

1X . W1 Pu⊤ xe, xe∼Pen , Pu⊤ y, y∼P p i i S i=1

A well-known property of the 1-dimensional Wasserstein-1 distance is that it can be computed in closed form via the cumulative distribution functions (Peyré et al., 2019): Z 1 −1 Fu−1 = W1 Pu⊤ xe, xe∼Pen , Pu⊤ ⊤x e (t) − Fu⊤ y, y∼P (t) dt, i y, y∼Pp e, x e ∼P i

where F −1 (t) denotes the quantile function (inverse CDF) of the projected distributions. This 1-dimensional distribution matching can be solved sorted-by-index in O(n log n) time and O(n) space. Consequently, the Sliced Wasserstein approach bypasses the storage and computation of the O(n2 ) pairwise cost matrix C, drastically reducing memory requirements and running time. However, to maintain approximation accuracy, the required number of projections S generally scales with the data dimension d. The complete optimization process is detailed in Algorithm 1 in the Appendix A.3. An alternative projection-based variant for enforcing the capped simplex constraint conv(∆α ) is also deferred to Appendix A.1.

Theoretical Properties

3.1

Convergence of the Estimator

In this section, we establish the statistical convergence of PbWF to the true distribution P ∗ . We begin by introducing several essential concepts required to define our data contamination model. Recall that (X , d) is a Polish metric space (i.e., a complete and separable metric space), Q(X ) denotes the space of all probability measures on X , and Qp (X ) is defined as in (1). While our theoretical results are established within this general framework, it is helpful to keep in mind the standard setting where X is a compact subset of Rd equipped with the Euclidean metric d(x, y) = ∥x − y∥2 , and p = 1. Definition 1 (Wp Resilience (Nietert et al., 2023, Definition 1)). Let 0 ≤ α < 1 and ρ ≥ 0. A distribution µ ∈ Qp (X ) is said to be (ρ, α)-resilient with respect to the Wasserstein-p distance if Wp (µ, µ′ ) ≤ ρ 1 for all µ′ ∈ Qp (X ) such that µ′ ≤ 1−α µ. We denote the family of all (ρ, α)-resilient distributions in Qp (X ) by Wp (ρ, α). 1 The inequality between the two measures, µ′ ≤ 1−α µ, is understood pointwise; that is, it holds for any Borel set B ⊆ X . Intuitively, this condition implies that µ′ is obtained by removing up to an α-fraction of the probability mass from µ and subsequently normalizing the remaining measure. Resilience characterizes the structural stability of a distribution: it guarantees that the core of the distribution remains close to the original distribution in the Wasserstein metric, even after an adversary discards an α-fraction of its mass. Originally introduced to study robust mean estimation under adversarial

contamination (Steinhardt et al., 2018), this concept has recently been generalized to a distribution-free setting (Zhu et al., 2022; Nietert et al., 2023). Definition 2 (Support Total Variation Distance). For two probability distributions P1 , P2 ∈ Q(X ), we define the support total variation (STV) distance as: n o ∥P1 − P2 ∥STV = inf α ∈ [0, 1) : ∃S̄ ⊆ supp(P1 ) ∩ supp(P2 ) s.t. P1 (S̄) = P2 (S̄) = 1 − α and P1 |S̄ = P2 |S̄ , where supp(·) denotes the support of a probability measure, and P |S̄ represents the restriction of P to S̄, defined as P |S̄ (B) = P (B ∩ S̄) for any Borel set B ⊆ X . The STV distance is a structurally restricted variant of the classical total variation (TV) distance. Recall that if two probability distributions satisfy ∥P1 − P2 ∥TV ≤ α, then P2 can be viewed as being obtained from P1 by first removing an arbitrary α-fraction of the mass from P1 and replacing it with an arbitrary α-fraction of mass elsewhere (Diakonikolas et al., 2019). Building upon this deletion-addition decomposition, the STV distance enforces the additional constraint that the mass removal and addition must occur on disjoint supports. In other words, if ∥P1 − P2 ∥STV ≤ α, there exists a shared support S̄ containing 1 − α of the total probability mass, such that P2 is obtained by deleting the α-mass on supp(P1 ) \ S̄ and adding a new α-mass restricted to X \ S̄. It immediately follows from this definition that ∥P1 − P2 ∥TV ≤ ∥P1 − P2 ∥STV .

3.1.1

Population Setting

To isolate the geometric properties of our approach from finite-sample statistical fluctuations, we first analyze the problem in the population setting (corresponding to the infinite-sample limit). Let the clean distribution P ∗ belong to a (ρ, α)-resilient family: P ∗ ∈ G ⊆ W1 (ρ, α), and suppose the observed contaminated distribution Pe satisfies ∥Pe − P ∗ ∥STV ≤ α. We define the population-level estimator as: PbWF = PeSWF :=

1 e P |SWF , 1−α

where the optimal support SWF is given by: SWF = argmax W1 (PeS , Pe), e) S⊆supp(P e(S)=1−α P 1 e and PeS = Pe(S) P |S denotes the normalized restriction of Pe to S. This formulation directly mirrors our

empirical estimator, where the discrete support points each carry mass 1/n. We now introduce our proposed Far Exclusion and Local Projection (FELP) contamination model at the population level: Definition 3 (Population FELP Contamination). Given P ∗ ∈ W1 (ρ, α), we say that the contaminated distribution Pe belongs to the FELP contamination family CPFELP (α, ρ) if the following three conditions hold: ∗ 1. Support TV Bound: The total variation of the support satisfies: ∥Pe − P ∗ ∥STV ≤ α. Let S̄ be the shared support of mass 1 − α promised by the definition of the STV distance. 2. Far Exclusion (FE): Let Eρ := {x ∈ supp(Pe) \ S̄ | d(x, supp(P ∗ )) > ρ} define the region of “far outliers”. There exists a subset S+ ⊆ supp(Pe) with Pe(S+ ) = 1 − α and S+ ∩ Eρ = ∅ such that: sup

W1 (PeS , Pe) < W1 (PeS+ , Pe).

e), P e(S)=1−α S⊆supp(P e(S∩Eρ )>0 P

(13)

3. Local Projection (LP): Let Nρ := {x ∈ supp(Pe) \ S̄ | d(x, supp(P ∗ )) ≤ ρ} denote the region of “near outliers”. There exists a measurable projection map T : Nρ → supp(P ∗ ) such that: d(x, T (x)) ≤ ρ

and

T♯ Pe|Nρ ≤ P ∗ ,

(14)

where T♯ denotes the push-forward operator. In the FELP contamination model, the STV distance restricts the corruptive mass to support-wise perturbations bound by a budget of α. The far exclusion and local projection conditions further dictate the precise geometric structure of the contamination under which our estimator achieves minimax optimality: • Far Outliers (Eρ ): Must be sufficiently far from the clean support that they are guaranteed to be excluded by our Wasserstein-maximization estimator. • Near Outliers (Nρ ): Lie close to the clean support. Their impact on the distribution estimation error is negligible even if they are not removed, as they can be modeled as local perturbations from the clean distribution via the mass-non-increasing preimage map T −1 . By definition, we have the following nested relationship among the contamination families: CPFELP (α, ρ) ⊆ P ∈ Q(X ) : ∥P − P ∗ ∥STV ≤ α ⊆ P ∈ Q(X ) : ∥P − P ∗ ∥TV ≤ α . ∗ This nesting shows that the FELP model is structurally more restrictive than the classical population total variation (TV) contamination model. Nevertheless, FELP remains sufficiently rich to capture realistic scenarios. Indeed, adversarial contamination naturally decomposes in this manner: one component consists of far, well-separated outliers, while the other consists of near, indistinguishable inliers. This far-and-local decomposition sharing a similar spirit with the local perturbation and global adversary contamination models of Nietert et al. (2024), as well as the mild and gross contamination frameworks of Clark and McNicholas (2024). In what follows, we provide a concrete, low-dimensional example to demonstrate when the FELP model conditions are satisfied. Example (Uniform Cube in the Population Setting). Let S ∗ = [0, 1]d and consider the clean distribution P ∗ = Unif(S ∗ ). We corrupt the data via a split-and-replace mechanism that deletes clean subregions in S ∗ and replaces them with corrupted mass: in Sloc = [0, l] × [0, 1]d−1

→

out Sloc = [1, 1 + l] × [0, 1]d−1 ,

in Sfar = [l, 2l] × [0, 1]d−1

→

⊤ xout far = (L, 1, . . . , 1) ,

√ where 0 < α = 2l < 12 , and L > (1 + d) ∨ Cl,d for a constant Cl,d depending on d and l. We then define the contaminated probability measure as: out in ∪S in ) + l Unif(S Pe = P ∗ |S ∗ \(Sloc . loc ) + lδxout far far

√ Under this construction, we have Pe ∈ CPFELP (α, d). ∗ in in Proof sketch. By construction, S̄ = S ∗ \ (Sloc ∪ Sfar ) is the valid shared support between Pe and P ∗ , yielding ∥Pe − P ∗ ∥STV ≤ α. 1 For any P ′ ∈ Q1 (X ) satisfying P ′ ≤ 1−α P ∗ , we have:

√ √ W1 (P ′ , P ∗ ) ≤ diam(S ∗ )∥P ′ − P ∗ ∥TV ≤ α d ≤ d, √ which implies P ∗ ∈ W1 ( d, α).

√ √ out Setting ρ = d, and since L > 1 + d, we identify the near and far outlier regions as Nρ = Sloc out out and Eρ = {xfar }, respectively. For any x ∈ Sloc , we define the projection map T (x) = x − e1 , where e1 = (1, 0, . . . , 0)⊤ . This yields: d(x, T (x)) = 1 ≤

√ d=ρ

out in and T♯ Pe|Nρ = T♯ l Unif(Sloc ) = l Unif(Sloc ) ≤ P ∗,

satisfying the local projection condition. in in Next, choosing S+ = S ∗ \ (Sloc ∪ Sfar ) in the FELP definition, the Wasserstein distance W1 (PeS+ , Pe) is lower bounded by the cost of transporting the mass l at the atom xout far to S+ : W1 (PeS+ , Pe) ≥ l · d(xout far , S+ ) = l(L − 1). Conversely, for any admissible support S ⊆ supp(Pe) with Pe(S) = 1 − α and Pe(S ∩ Eρ ) > 0, the set S must l out e e e contain the atom xout far , meaning PS ({xfar }) = 1−α . To upper bound W1 (PS , P ), we construct a feasible e e transport plan from PS to P as follows: 1. Keep l mass at the atom xout far in place (incurring zero cost). αl out d−1 at xout , incurring a cost 2. Transport the excess mass 1−α far to the region S+ ∪ Sloc = [2l, 1 + l] × [0, 1] p αl of at most 1−α (L − 2l)2 + d − 1. p l l out 3. Transport the remaining mass 1− 1−α within S+ ∪Sloc , incurring a cost of at most 1− 1−α (1 − l)2 + d − 1.

Since this bound holds for any such S, we obtain: sup

W1 (PeS , Pe) ≤

e), P e(S)=1−α S⊆supp(P e(S∩Eρ )>0 P

p αl p l (L − 2l)2 + d − 1 + 1 − (1 − l)2 + d − 1. 1−α 1−α

Choosing L > Cl,d with al − 2lc2l + cl

(al − 2l)2 + (1 − c2l )(d − 1) , 1 − c2l 1 − 3l p 2l al = 1 + (1 − l)2 + d − 1, cl = l(1 − 2l) 1 − 2l Cl,d =

ensures that the far exclusion condition (13) is satisfied. We establish the error bounds for the population estimator PbWF under the FELP contamination model as follows: Theorem 1 (Population Risk of PbWF ). For any clean distribution P ∗ ∈ G ⊆ W1 (ρ, α) and contaminated distribution Pe ∈ CPFELP (α, ρ) with 0 ≤ α ≤ 12 , the population estimator satisfies: ∗ W1 (PbWF , P ∗ ) ≲ ρ. The core intuition behind Theorem 1 is as follows. The STV distance condition in the definition of CPFELP (α, ρ) guarantees the existence of a shared support S̄ of mass 1 − α, which yields a reference trimmed ∗ distribution PeS̄ . Note that PeS̄ is a feasible (1−α)-truncated candidate of Pe that satisfies PeS̄ = PS̄∗ . By the W1 resilience of P ∗ , it immediately follows that this reference distribution has a bounded risk: W1 (PeS̄ , P ∗ ) ≤ ρ. Consequently, the optimal estimator PbWF , which maximizes the Wasserstein distance to the contaminated distribution, is guaranteed to perform at least as well as this reference candidate. The FELP conditions then ensure that PbWF indeed identifies a support that achieves this optimal risk bound of O(ρ).

We next establish a minimax lower bound showing that this O(ρ) rate is optimal. Let T : Q(X ) → Q(X ) denote any population-level estimator, and define its maximum risk over the FELP contamination family as: R1,P ∗ ,T (α, ρ) =

sup

W1 (T (Pe), P ∗ ).

e∈C FELP P (α,ρ) P∗

We have the following minimax optimality result: Theorem 2 (Minimax Optimal Population Risk). Let Gcov (σ) ⊆ W1 (ρσ , α) be the class of distributions with bounded covariance: Gcov (σ) = µ ∈ Q(X ) : Σµ ⪯ σ 2 I . If 0 < α0 ≤ α ≤ 21 and the dimension satisfies 1 d ≲ α(1−α 2 ) , then: inf

sup

T P ∗ ∈Gcov (σ)

R1,P ∗ ,T (α, ρσ ) ≍ ρσ ,

√ where ρσ ≍ σ dα is the sharp resilience factor for the family Gcov (σ). In the case where the clean distribution class is restricted to bounded-covariance families, i.e., G = (α, ρσ ). This immediately yields Gcov (σ), Theorem 1 holds uniformly for any P ∗ ∈ Gcov (σ) and Pe ∈ CPFELP ∗ the upper bound: sup P ∗ ∈Gcov (σ)

R1,P ∗ ,PbWF (α, ρσ ) ≲ ρσ .

In conjunction with the lower bound in Theorem 2, this result establishes that our population estimator PbWF achieves the minimax optimal risk. The choice of Gcov (σ) is representative of standard robust statistics settings and imposes minimal assumptions on the clean distribution family G containing P ∗ . Indeed, our minimax optimality analysis can be readily extended to other standard distribution classes—such as sub-Gaussian families or families with bounded q-th moments (q ≥ 1)—using analogous arguments based on their respective resilience properties (Nietert et al., 2023). Furthermore, the conditions on the model parameters are highly practical: • Contamination Level (α): The condition α ≤ 21 is mild, indicating that our framework can tolerate a corruption level of up to 50% of the data mass. • Dimensionality (d): The dimension condition is quite natural, allowing the allowable dimension to grow as the contamination fraction α decreases.

3.1.2

Empirical Setting

In this section, we extend our analysis to the finite-sample regime by incorporating stochastic sampling errors. We first introduce the empirical counterpart of our proposed contamination model. i.i.d.

Definition 4 (Empirical FELP Contamination). Let x1 , . . . , xn ∼ P ∗ ∈ W1 (ρ, α) be clean samples with Pn e1 , . . . , x e denote the observed contaminated samples. We say empirical measure Pn = n1 i=1 δxi , and let x Pn n 1 e (α, ρ) that the contaminated empirical measure Pn = n i=1 δxei belongs to the empirical FELP family CPFELP n if the following three conditions hold: Pn 1. Empirical Support TV Bound: The fraction of corrupted samples is bounded by α: n1 i=1 I{xi ̸=xei } ≤ ej } with |S̄| = (1 − α)n be the uncorrupted shared support. α. Let S̄ ⊆ {xj | j ∈ [n], xj = x 2. Empirical Far Exclusion (FE): Let En,ρ := {x ∈ supp(Pen )\ S̄ | d(x, supp(Pn )) > ρ} define the region of “empirical far outliers”. There exists a subset S+ ⊆ supp(Pen ) with Pen (S+ ) = 1 − α and S+ ∩ En,ρ = ∅

such that: sup

W1 (Pen,S , Pen ) < W1 (Pen,S+ , Pen ),

(15)

en ), P en (S)=1−α S⊆supp(P en (S∩En,ρ )>0 P

where Pen,S = Pe 1(S) Pen |S is the normalized restriction of Pen to S. n

3. Empirical Local Projection (LP): Let Nn,ρ := {x ∈ supp(Pen ) \ S̄ | d(x, supp(Pn )) ≤ ρ} denote the region of “empirical near outliers”. There exists a projection map Tn : Nn,ρ → supp(Pn ) such that: d(x, Tn (x)) ≤ ρ

and

Tn♯ Pen |Nn,ρ ≤ Pn ,

(16)

where Tn♯ denotes the push-forward operator. Notably, our empirical FELP contamination model is defined directly on the realized sample rather than treating contaminated points as i.i.d. samples from a pre-specified population-level mixture Pe ∈ CPFELP (α, ρ). ∗ The latter framework is commonly referred to as the oblivious contamination model (Diakonikolas et al., 2019; Zhu et al., 2022). Formulating contamination in terms of the realized sample is significantly more realistic because the underlying population distribution is typically unknown in practice. Furthermore, empirical FELP aligns more closely with the classical TV contamination model discussed in Section 1, encompassing a broader class of adversarial corruptions than the oblivious model. By construction, any empirical FELP contaminated measure satisfies ∥Pen − Pn ∥STV ≤ α. Let Pn denote the joint distribution of the i.i.d. clean samples (x1 , . . . , xn ) ∈ X n , and let DnFELP (P ∗ , α) represent the family en ∈ Q(X n ) of the contaminated samples (e en ) generated via empirical FELP of all joint distributions P x1 , . . . , x contamination. We establish the statistical convergence of our empirical estimator PbWF (introduced in Section 2.1) under this finite-sample model below: Theorem 3 (Empirical Risk of PbWF ). Let P ∗ ∈ G ⊆ W1 (ρ, α) and let 0 ≤ α ≤ 21 . For any empirical en ∈ DFELP (P ∗ , α)), the empirical estimator satisfies: contamination Pen ∈ CPFELP (α, ρ) (i.e., P n n h i EePn W1 (PbWF , P ∗ ) ≲ ρ + EPn [W1 (Pn , P ∗ )] . Pn Similar to Theorem 1, the sample corruption constraint n1 i=1 I{exi ̸=xi } ≤ α implies that ∥Pen −Pn ∥STV ≤ ej } with α. This guarantees the existence of a reference bridge estimator Pen,S̄ , where S̄ ⊆ {xj | j ∈ [n], xj = x ∗ |S̄| = (1 − α)n. The expected W1 -risk of this reference estimator is bounded by ρ + EPn [W1 (Pn , P )]. Since Pen,S̄ discards all contaminated points and retains only clean samples, it represents the statistical benchmark (i.e., the best possible performance) for our filtering framework. Theorem 3 establishes that under empirical FELP contamination, the Wasserstein Filtering (WF) estimator indeed matches this optimal benchmark. To rigorously prove that the WF estimator is minimax optimal in the empirical setting, we introduce a mild condition ensuring that the Far Exclusion property holds with high probability under finite-sample realizations: Condition 1 (Far Exclusion with High Probability). For every clean distribution P ∗ ∈ G and every popu α ∗ e lation contamination Pe ∈ CPFELP ∗ 5 , ρ , the following holds. Let η := P |S̄ = P |S̄ represent the shared clean component, and decompose the outliers as νloc := Pe|Nρ and νfar := Pe|Eρ . Further, let λloc := T♯ νloc denote the projection of local outliers, and define the remaining clean mass as λfar := P ∗ |S̄ c − λloc ≥ 0. For any coupling πfar ∈ Π(λfar , νfar ), we construct a joint coupling π ∈ Π(P ∗ , Pe) defined as: π = (Id, Id)♯ η + (T, Id)♯ νloc + πfar ,

ei )ni=1 ∼ π n , we define the successful exclusion where Id is the identity map. Under the product measure (xi , x event E as:   en }, |S+ | = (1 − α)n, S+ ∩ En,ρ = ∅ such that ∃S+ ⊆ {e x1 , . . . , x            X X 1 1 E= . e e δxei , Pn  < W1  δxei , Pn  sup W1       |S| |S+ | S⊆{e x1 ,...,e xn }   ei ∈S ei ∈S+ x x |S|=(1−α)n, S∩En,ρ ̸=∅

1 such that π n (E c ) ≤ δn . We assume there exists a sequence δn ≤ 20

Condition 1 defines a canonical coupling π between the population distribution pair (P ∗ , Pe) under the population-level FELP contamination model. It asserts that under this coupling, the generated contaminated samples {e xi }ni=1 satisfy the empirical far exclusion event E—which is the central requirement of the empirical FELP model—with high probability. By viewing the observed samples {e xi }ni=1 as being generated from the clean samples {xi }ni=1 via this coupled process, Condition 1 provides a rigorous bridge from the population setting to the empirical setting. en ) such that Specifically, for any valid population pair (P ∗ , Pe), we can construct a sample sequence (e x1 , . . . , x FELP ∗ e their joint distribution Pn belongs to the empirical FELP family Dn (P , α). This construction implies that the empirical FELP contamination family is richer than its population counterpart. Consequently, the minimax risk under empirical FELP contamination is naturally lower bounded by the corresponding population-level minimax risk. In what follows, we demonstrate that Condition 1 is satisfied in the same uniform cube setting introduced in our population-level example. Example (Uniform Cube in the Empirical Setting). Consider the d-dimensional uniform cube S ∗ = in in out [0, 1]d with the clean distribution P ∗ = Unif(S ∗ ). Let Sloc , Sfar , Sloc , and xout far be defined exactly as in the α population setting (with l = 10 ), yielding the population contaminated distribution: out in ∪S in ) + l Unif(S Pe = P ∗ |S ∗ \(Sloc . loc ) + lδxout far far

From the population analysis, we have Pe ∈ CPFELP ∗

α 5,

√ d with the projection map T (x) = x − e1 and the

in in shared support S̄ = S ∗ \ (Sloc ∪ Sfar ). i.i.d.

ei for i ∈ [n] as: Let x1 , . . . , xn ∼ P ∗ . We construct the empirical contaminated samples x  in in  xi ∈ / Sloc ∪ Sfar ,  xi , ei = x

in xi + e1 , xi ∈ Sloc ,   xout , in xi ∈ Sfar . far

ei )ni=1 ∼ π n with π = (Id, Id)♯ η + (T, Id)♯ νloc + πfar , and we have Then, the coupled samples satisfy (xi , x 1 π n (E c ) ≤ 20 for sufficiently large n. out Proof sketch. Let Mloc = {e xi ∈ Sloc | i ∈ [n]} and Mfar = {e xi = xout far | i ∈ [n]}. Applying Hoeffding’s inequality, we define the high-probability concentration event Aϵ as: 2 |Mloc | |Mfar | − l ≤ ϵ, − l ≤ ϵ ≥ 1 − 4e−2ϵ n . P{Aϵ } := P n n

√ ei ∈ Mloc , we have√d(e For any x xi , supp(Pn )) ≤ d(e xi , T (e xi )) = 1 ≤ d = ρ, which confirms Mloc ⊆ Nn,ρ . ei ∈ Mfar satisfies d(e Under the assumption L > d + 1, any x xi , supp(Pn )) ≥ d(e xi , supp(P ∗ )) = L − 1 > √ d = ρ, confirming Mfar ⊆ En,ρ . Since Mloc ∪ Mfar = Nn,ρ ∪ En,ρ and Nn,ρ ∩ En,ρ = ∅, we obtain the partition Mloc = Nn,ρ and Mfar = En,ρ .

Next, we construct a valid uncorrupted empirical support S+ of size (1 − α)n by removing Mfar , Mloc , e = xi }. This construction and any remaining αn − |Mfar | − |Mloc | samples from the set of clean inliers {e x |x i i is feasible on the event Aϵ because: |Mfar | + |Mloc | ≤ 2(l + ϵ)n = α5 + 2ϵ n < αn, provided that ϵ < 25 α. Consequently, S+ ∩ En,ρ = ∅. Since Pen places a mass of |Mnfar | on the atom xout far , we establish the lower bound: W1 (PenS+ , Pen ) >

|Mfar | (L − 1). n

Conversely, let S be any corrupted subset of size (1 − α)n that contains at least one far outlier. Employing the same transportation plan coupling logic as in the population case, we obtain: sup en ) S⊆supp(P en (S)=1−α P en (S∩En,ρ )>0 P

W1 (PenS , Pen ) ≤

Therefore, the far exclusion event E is guaranteed to hold as long as: p |Mfar | |S ∩ Mfar | p |Mfar | (L − 1) > sup − (L − 2l)2 + d − 1 + (1 − l)2 + d − 1. n n n(1 − α) 1≤|S∩Mfar |≤|Mfar | On the concentration event Aϵ with ϵ < l, this inequality is satisfied by choosing: ( ) p √ √ l + ϵ + (l + ϵ − ∆ϵ,n,α ) d − 1 + (1 − l)2 + d − 1 d + 1, Cl,d , 2l, L > max , ∆ϵ,n,α (l − ϵ)(1 − 2α) 1 , . where ∆ϵ,n,α = min (1 − α)n 1−α √ 2 1 Asymptotically, this requires L = Ω(n d). This ensures Aϵ ⊆ E, meaning π n (E c ) ≤ π n (Acϵ ) ≤ 4e−2ϵ n ≤ 20 for a sufficiently large sample size n. We consider the finite-sample empirical risk: R1,P ∗ ,Tn ,n (α, ρ) =

sup FELP (P ∗ ,α) e Pn ∈Dn

h i EePn W1 (Tn (Pen ), P ∗ ) ,

where Tn is an empirical distribution estimator, with the subscript n distinguishing it from the populationlevel estimator T . The corresponding empirical minimax risk is defined as: R1,n (α, ρ) = inf sup R1,P ∗ ,Tn ,n (α, ρ). Tn P ∗ ∈G

We establish the minimax optimality of the empirical risk under the FELP model as follows: Theorem 4 (Minimax Optimality of Empirical Risk). Let P ∗ ∈ G ⊆ W1 (ρ, α) with 0 ≤ α ≤ 12 . Under Condition 1, the empirical minimax risk satisfies: α R1,∞ , ρ + inf sup E [W1 (Tn (Pn ), P ∗ )] ≲ inf sup R1,P ∗ ,Tn ,n (α, ρ) ≲ ρ + sup E [W1 (Pn , P ∗ )] , Tn P ∗ ∈G Tn P ∗ ∈G 5 P ∗ ∈G where the population-level minimax limit is given by: α R1,∞ , ρ = inf sup sup W1 (T (Pe), P ∗ ). T P ∗ ∈G e FELP α 5 P ∈C ∗ ( ,ρ) P

In particular, when G is the family of distributions with bounded covariance, Gcov (σ) = {µ ∈ Q(X ) : Σµ ⪯ 1 σ 2 I}, and assuming 0 < α0 ≤ α ≤ 12 alongside the dimension constraint d ≲ α(1−α 2 ) , we have: inf

sup

Tn P ∗ ∈Gcov (σ)

√ √ 1 R1,P ∗ ,Tn ,n (α, ρσ ) ≍ σ dα + σ dn− d .

Furthermore, the Wasserstein Filtering estimator PbWF achieves this optimal empirical minimax rate. The first part of Theorem 4 establishes that the empirical minimax risk is lower bounded by the sum of the population-level risk R1,∞ α5 , ρ (representing the infinite-sample limit) and the minimax rate of clean distribution estimation under the W1 metric. Conversely, the upper bound is characterized by the population-level resilience ρ and the expected estimation error of the empirical measure Pn over the √ class G. α ∗ When we assume bounded second moments (i.e., P ∈ Gcov (σ)), we have R1,∞ 5√ , ρ ≍ ρ ≍ σ dα by Theorem 2, while the empirical measure Pn achieves the optimal W1 -error rate of O(σ dn−1/d ) (Lei, 2020; Niles-Weed and Berthet, 2022). This matches the lower and upper bounds up to constant factors therefore shows that our Wasserstein Filtering estimator PbWF is minimax optimal. The focus on the bounded-covariance class Gcov (σ) is particularly significant because it allows the clean distribution to be heavy-tailed. Under heavy-tailed distributions, genuine data points can appear far from the mean, which naturally obscures the distinction between clean data and adversarial outliers. This makes outlier detection and robust estimation exceptionally challenging, highlighting the strength of our framework’s guarantees.

3.2

Convergence of the Algorithm

In this section, we analyze the algorithmic convergence of the sample weight optimization scheme employed in the SinkWF and SlicedWF algorithms. For simplicity of exposition, we let σ(b) = softmax(b) denote the 1 softmax mapping and define the clipping threshold as uα = (1−α)n . We consider the idealized objective function with the exact W1 distance: F (b) = W1 (Pn , Pσ(b) ) − β

n X

(σi (b) − uα )+ ,

i=1

where (t)+ = max{t, 0}. We further simplify the optimization dynamics from Adam to standard gradient ascent updates with step size γ > 0: br+1 = br + γ∇F (br ). We assume there exists an iteration index r0 and a compact set K ⊂ Rn such that the iterates satisfy br ∈ K for all r ≥ r0 . Without loss of generality, we treat r0 as the initial step and analyze the subsequent R iterations. To establish convergence, we introduce the following regularity conditions on the optimization landscape: Condition 2 (Unique Dual Potential). For every parameter vector b ∈ K and its induced probability vector p = σ(b), the exact Optimal Transport (OT) dual problem,   n n  1 X X ui + p j vj , W1 (Pn , Pp ) = maxn  n u,v∈R ui +vj ≤Cij

i=1

j=1

admits a unique optimal target potential v∗ (p) satisfying the normalization constraint

∗ j=1 vj (p) = 0.

Condition 3 (Stable Active Set and Non-boundary Hitting). Let m(p) ∈ {0, 1}n define the active-set indicator vector of the penalty term, where mi (p) = I{pi >uα } . There exists a constant vector m0 ∈ {0, 1}n such that m(σ(b)) = m0 for all b ∈ K. Furthermore, the softmax weights do not hit the boundary of the threshold, i.e., σi (b) ̸= uα for all i ∈ [n] and b ∈ K.

Condition 4 (Smoothness of the Optimal Dual). The optimal target dual potential v∗ (·) is Lipschitz continuous on the simplex image σ(K). That is, for any b, c ∈ K with p = σ(b) and q = σ(c), there exists a constant Lv∗ > 0 such that: ∥v∗ (p) − v∗ (q)∥2 ≤ Lv∗ ∥p − q∥2 . Theorem 5 (Convergence Rate of the WF Algorithm). Under Conditions 2–4, the gradient ∇F is LF Lipschitz continuous on K for some constant LF > 0. If the step size satisfies γ < L2F , the iterates of the gradient ascent scheme satisfy: v u max u i,j∈[n] ∥xi − xj ∥2 − F (br0 ) min ∥∇F (br )∥2 ≤ t . 2 r∈{r0 ,...,r0 +R−1} γ − LF2γ R Condition 2 and the non-boundary hitting portion of Condition 3 ensure that the objective function F (b) is continuously differentiable on K. This guarantees the existence of a unique, explicit gradient, thereby avoiding the analytical complexities associated with subgradient calculus. Additionally, Condition 4 together with the stable active set property in Condition 3 ensures the LF -Lipschitz smoothness of ∇F . Theorem 5 demonstrates that our sample-weight optimization framework achieves a sublinear conver√ gence rate of O(1/ R), matching the standard optimal rate for first-order methods in non-concave smooth optimization.

Numerical Studies

In this section, we evaluate the performance of our proposed methods against several state-of-the-art baselines: • DIF (Deep Isolation Forest) (Xu et al., 2023). • MDE (Minimum Distance Estimation) (Nietert et al., 2024). Note that the MDE algorithm evaluated here is a specialized version of the framework in Nietert et al. (2024) designed for TV corruption, which reduces to a standard spectral iterative filtering procedure (see Section 2.3 of Nietert et al. (2024)). • COPOD (Copula-based Outlier Detection) (Li et al., 2020). To assess performance on these binary classification (outlier detection) tasks, we employ two widely used metrics: the Area Under the Receiver Operating Characteristic curve (AUC-ROC) and the Area Under the Precision-Recall curve (AUC-PR).

4.1

Two-Dimensional Synthetic Data

We first compare our methods with the competing baselines on two-dimensional synthetic datasets to facilitate clear visualization. Specifically, we generate two classic datasets—the two-moons dataset and the concentric circles dataset, using the make moons and make circles functions from the scikit-learn Python library with a noise level of 0.1. For each dataset, we generate n = 500 samples, where a fraction α of the samples is corrupted. The corrupted samples are generated from two different Gaussian distributions representing different contamination strengths: Weak Case:

−0.5 0.01 , −0.5 0

0 , 0.01

and

Strong Case:

−2.5 0.01 , −2.5 0

0 . 0.01

The “strong” contamination scenario features outliers that are well-separated from the clean data cluster, whereas the ”weak” scenario places outliers much closer to the clean data, as illustrated in Figure A.3 in the Supplementary Material.

We consider two contamination proportions: α = 0.05 and α = 0.15. For the algorithms requiring the outlier fraction as an input (the robust WF variants and MDE), we provide the true value of α. For SinkWF and SlicedWF, the optimization parameters are initialized as b0 = 1 + 10−3 z, where z ∼ N (0, I), and we set the number of repetitions to T = 10. Other hyperparameters are selected via grid search, with the search spaces detailed in Appendix C.1. We repeat each experiment 50 times, executing an independent grid search for each run. The average AUC-ROC and AUC-PR, along with their corresponding standard errors, are reported in Table 1. Our implementations of the three WF algorithms leverage the Python Optimal Transport (POT) toolbox (Flamary et al., 2021) for SlicedWF and the GeomLoss library (Feydy et al., 2019) for SinkWF and SinkMarg.

Table 1: Results of 2D data. Weak and strong contamination implies the signal of corruption strength. The mean of 50 times repetition is recorded and the corresponding standard error is recorded in parenthesis right side. Dataset COPOD DIF MDE SlicedWF SinkWF SinkMarg Two moons

COPOD DIF MDE SlicedWF SinkWF SinkMarg

COPOD DIF MDE SlicedWF SinkWF SinkMarg Circles

COPOD DIF MDE SlicedWF SinkWF SinkMarg

Weak Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.89(0.02) 0.80(0.01) 0.25(0.05) 0.34(0.02) 0.96(0.02) 0.32(0.06) 0.49(0.12) 0.13(0.02) 0.67(0.05) 0.65(0.03) 0.08(0.01) 0.20(0.02) 0.77(0.12) 0.85(0.15) 0.23(0.29) 0.58(0.32) 0.85(0.10) 1.00(0.00) 0.31(0.28) 1.00(0.00) 0.63(0.06) 0.85(0.03) 0.11(0.05) 0.77(0.05) Strong Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 1.00(0.00) 0.97(0.00) 0.97(0.01) 0.83(0.01) 0.99(0.00) 0.42(0.10) 0.85(0.07) 0.21(0.06) 0.98(0.01) 1.00(0.00) 0.66(0.12) 1.00(0.00) 1.00(0.01) 0.99(0.02) 0.99(0.09) 0.96(0.11) 1.00(0.00) 1.00(0.00) 1.00(0.00) 1.00(0.00) 0.90(0.02) 0.91(0.02) 0.30(0.15) 0.88(0.03) Weak Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.58(0.02) 0.48(0.01) 0.06(0.00) 0.13(0.00) 0.24(0.07) 0.05(0.02) 0.03(0.00) 0.08(0.00) 0.42(0.05) 0.38(0.02) 0.04(0.00) 0.12(0.00) 0.80(0.14) 0.82(0.14) 0.19(0.09) 0.41(0.15) 0.88(0.07) 0.99(0.00) 0.33(0.17) 0.92(0.03) 0.72(0.08) 0.92(0.02) 0.16(0.08) 0.74(0.05) Strong Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 1.00(0.00) 0.96(0.00) 0.97(0.01) 0.77(0.01) 0.99(0.00) 0.49(0.09) 0.88(0.08) 0.19(0.04) 1.00(0.00) 1.00(0.00) 1.00(0.00) 1.00(0.00) 1.00(0.00) 0.99(0.03) 1.00(0.01) 0.95(0.12) 1.00(0.00) 1.00(0.00) 1.00(0.00) 1.00(0.00) 0.91(0.03) 0.93(0.02) 0.64(0.14) 0.89(0.02)

The experimental results in Table 1 demonstrate that SinkWF consistently achieves the best performance across most scenarios. Notably, SinkWF exhibits a more pronounced performance advantage over SlicedWF in the weak contamination regime. This behavior is visually illuminated by Figure A.3 in the Supplementary Material, which highlights that the directional signal of contamination is significantly weaker in the weak

case. As the data dimension d increases, this directional signal becomes even more severely diluted unless the number of random projections S in the sliced distance grows exponentially with d. In contrast, the entropic Optimal Transport used in SinkWF is inherently dimension-free, albeit at the expense of explicitly storing and computing the n × n cost matrix. Additionally, the two robust joint WF algorithms perform better as the contamination fraction α increases, a trend particularly evident under weak contamination. However, SinkWF remains highly sensitive to variations in this contamination proportion. Benefiting from the global geometric properties of the Wasserstein distance, our WF algorithms are capable of detecting outliers even when they are not exposed at the extreme edges of the clean data distribution. This capability is clearly illustrated in Figure A.3(a) in the Supplementary Material. In the two-moons dataset, while baselines like DIF and COPOD can identify some outlying points, the contrast is far more stark in the concentric circles dataset. Here, the outliers concentrate in the region between the inner and outer circles, completely surrounded by normal points. In this challenging scenario, DIF, MDE, and COPOD mistakenly flag points on the outer boundary of the clean distribution as outliers. This limitation stems from their underlying mechanisms, which rely heavily on tail mass or spatial isolation to determine outlier scores. By contrast, SinkWF and SinkMarg successfully isolate nearly all hidden outliers, while SlicedWF successfully recovers a significant portion of them. This is also reflected quantitatively in Table 1, where all three WF algorithms exhibit a substantial performance lead on the concentric circles dataset, particularly under weak contamination.

4.2

Benchmark Datasets

In this section, we systematically validate and compare our proposed framework across several standard benchmark datasets spanning two distinct modalities: tabular and graph-structured. • Tabular Data: We utilize representative datasets from the comprehensive anomaly detection benchmark ADBench (Han et al., 2022). • Graph-Structured Data: We evaluate our methods on the Tox21 molecular dataset. To process the graphs, we vectorize the molecular structures using the pretrained Mol2vec model (Jaeger et al., 2018). Both the raw datasets and the pretrained representations are retrieved using the DeepChem ecosystem (Ramsundar et al., 2019). The empirical results and performance comparisons for the Tabular Data are summarized in Table 2. The results for Graph-Structured Data are given in Table 6 in the Supplementary Material.

4.2.1

Discussion of Empirical Results

Tabular Data (Table 2). As shown in Table 2, SinkWF achieves state-of-the-art or near-optimal performance on datasets with higher contamination fractions α (e.g., yeast, cardiotocography, satellite, and shuttle), though its performance degrades in low-α regimes (e.g., pendigits). Conversely, SlicedWF exhibits a clear advantage on low-to-moderate dimensional datasets (such as pendigits, WBC, and satellite). In these settings, the lower-dimensional informative features ensure that random 1D projections preserve the class-separating geometric structure. However, the performance of SlicedWF systematically degrades as the dimensionality increases (e.g., optdigits). A notable failure mode for all Wasserstein Filtering (WF) variants occurs on the smtp dataset. In scenarios characterized by an extremely large sample size n and a microscopic contamination rate α, the total mass of the contaminated samples becomes statistically negligible. Consequently, the Wasserstein distance between the full empirical distribution and any sub-sample is dominated by the benign intra-class

Table 2: Full results of tabular benchmark datasets. SinkMarg on smtp dataset is abandoned since its runtime exceeds 24h.

Tabular

Dataset vertebral yeast annthyroid breastw cardio tocography Hepatitis Lymph shuttle pendigits satellite WBC smtp optdigits mean wins

(n, d, α) (240, 6, 12.50%) (1484, 8, 34.16%) (7200, 6, 7.42%) (683, 9, 34.99%) (1831, 21, 9.61%) (2114, 21, 22.04%) (80, 19, 16.25%) (148, 18, 4.05%) (49097, 9, 7.15%) (6870, 16, 2.27%) (6435, 36, 31.64%) (223, 9, 4.48%) (95156, 3, 0.03%) (5216, 64, 2.88%)

COPOD 0.39 0.41 0.68 0.99 0.88 0.65 0.80 1.00 0.99 0.82 0.50 0.99 0.90 0.71 0.77 28.57%

DIF 0.39 0.42 0.71 0.98 0.95 0.68 0.81 1.00 0.99 0.96 0.73 0.98 0.93 0.57 0.79 35.71%

Dataset vertebral yeast annthyroid breastw cardio tocography Hepatitis Lymph shuttle pendigits satellite WBC smtp optdigits mean wins

COPOD 0.10 0.31 0.16 0.98 0.46 0.37 0.42 0.87 0.91 0.11 0.34 0.90 0.47 0.05 0.46 7.14%

DIF 0.10 0.30 0.27 0.94 0.58 0.42 0.47 0.95 0.88 0.29 0.64 0.67 0.39 0.03 0.50 28.57%

AUC-ROC MDE SlicedWF 0.43 0.61 0.50 0.50 0.67 0.59 0.99 0.99 0.82 0.80 0.71 0.65 0.60 0.72 0.92 0.95 0.96 0.95 0.76 0.97 0.50 0.75 0.99 1.00 0.83 0.77 0.50 0.58 0.73 0.77 7.14% 28.57% AUC-PR MDE SlicedWF 0.11 0.15 0.34 0.34 0.16 0.10 0.97 0.99 0.24 0.52 0.35 0.41 0.19 0.34 0.21 0.31 0.74 0.77 0.05 0.38 0.32 0.68 0.80 0.96 0.06 0.01 0.03 0.04 0.33 0.43 0.00% 21.43%

SinkWF 0.74 0.70 0.61 0.99 0.76 0.77 0.68 0.96 0.98 0.58 0.66 0.94 0.58 0.67 0.76 28.57%

SinkMarg 0.34 0.35 0.82 0.98 0.56 0.46 0.63 0.99 0.75 0.72 0.66 0.97 0.35 0.66 7.14%

SinkWF 0.23 0.52 0.14 0.99 0.31 0.46 0.36 0.54 0.96 0.03 0.69 0.38 0.00 0.28 0.42 50.00%

SinkMarg 0.09 0.27 0.24 0.94 0.17 0.24 0.22 0.65 0.18 0.07 0.49 0.69 0.02 0.33 0.00%

variation of the clean data rather than the geometry of the outliers. In this regime, the core principle of our framework, maximizing distributional discrepancy by withholding an α-fraction of the data, loses its signal. In contrast, marginal-based methods such as COPOD and isolation-based methods like DIF succeed here; their mechanisms (marginal extremeness and recursive isolation, respectively) are designed to identify isolated, rare anomalies in low-dimensional spaces without requiring a population-level geometric signal. For SinkMarg, the best performance is achieved on annthyroid, which is a large dataset (n = 7200) with a low dimension (d = 6) and simple structure, where leave-one-out Sinkhorn scoring is highly effective at identifying well-isolated outliers. However, SinkMarg performs poorly on vertebral (AUC-ROC of 0.34) and yeast (0.35), performing worse than a random classifier. This highlights a fundamental limitation of SinkMarg: it cannot capture group-structured outliers, where contaminated points form tight, coherent clusters rather than isolated Dirac masses. Finally, MDE is theoretically elegant but practically weak across all tabular datasets. The datasets in ADBench feature highly heterogeneous distributions (comprising medical records, sensor data, and handwritten digits). The spectral filtering mechanism of MDE relies heavily on the assumption that the clean

distribution is isotropic, a condition that is severely violated in real-world tabular data.

Graph-Structured Data (Table 6 in the Supplementary Material). In the high-dimensional molecular representation space of Tox21, MDE fails completely. MDE iteratively computes the leading eigenvector of the sample covariance matrix and filters samples along this direction. In d = 300 dimensions with only a small fraction of outliers (∼3–12%), the leading eigenvector of the covariance matrix is entirely dominated by the variance of the clean data, rendering the diffuse contamination signal spectrally invisible. For SlicedWF, using S = 1000 random projections (see Appendix C.2) in a 300-dimensional space is insufficient. Most random 1D projections fail to align with the meaningful directions of molecular variation, making the sliced Wasserstein distance a poor proxy for the true W1 metric. This highlights a fundamental statistical-computational tradeoff: while SlicedWF enjoys an O(n) space complexity, it suffers a severe approximation bottleneck in high dimensions. In contrast, SinkWF incurs an O(n2 ) space complexity but preserves full geometric fidelity, rendering it robust to high dimensionality. When the true contamination rate α is unknown, we show in Appendix C.2 that our automatic determination procedure for α incurs negligible performance loss compared to using the ground-truth value.

4.3

Robust Generative Learning

In this subsection, we demonstrate how our proposed framework can facilitate downstream tasks, specifically robust generative learning. The goal of generative learning is to synthesize novel samples xi (i ≥ n + 1) e1 , . . . , x en . For this experiment, we that mimic the target distribution P ∗ based on corrupted observed data x deploy a diffusion-based generative model—the Denoising Diffusion Probabilistic Model (DDPM) (Ho et al., 2020)—on the MNIST handwritten digit dataset. We combine the standard training and testing partitions of MNIST to obtain a total sample size of n = 70, 000. The dataset is subjected to two distinct types of adversarial corruptions: • Strong Contamination: The top half of each contaminated image is completely masked (replaced with white pixels). • Weak Contamination: A random one-fourth portion of each contaminated image is masked, as illustrated in Figure 1(a). We compare the visual quality and distribution of the synthesized images generated by DDPM when trained on: (i) the raw contaminated dataset, and (ii) the clean dataset retrieved after filtering out suspected outliers using our proposed methods. Performance is evaluated using two sets of metrics: the classification accuracy of outlier detection (AUCROC and AUC-PR) and the quality of the generated images, quantified by the Fréchet Inception Distance (FID) (Heusel et al., 2017). Because the information in the corrupted regions is fundamentally unrecoverable, the FID is computed strictly between the synthesized images and the ground-truth clean (uncorrupted) images. Additionally, we evaluate a baseline scenario with no actual corruption (α = 0) while still running our algorithms with a nominal input of α = 0.05. This allows us to quantify the potential performance degradation (or ”robustness tax”) incurred by filtering uncorrupted datasets. In our implementation, we leverage POT for SlicedWF and the memory-efficient GeomLoss library for SinkWF and SinkMarg. We initialize the parameters as b0 = 1 + 10−3 z, where z ∼ N (0, I), and utilize the squared Wasserstein-2 (p = 2) distance across all three WF variants. We set the optimization iterations to T = 1 for SinkWF and T = 10 for SlicedWF. All remaining hyperparameter configurations are detailed in Appendix C.3. The empirical results are summarized in Table 3.

Discussion of Generative Results. As reported in Table 3, SlicedWF achieves slightly superior performance compared to SinkWF in outlier classification metrics (AUC-ROC and AUC-PR), whereas SinkWF yields a lower (better) FID score. Notably, SinkMarg proves computationally impractical in this setting;

the extremely large sample size (n = 70, 000) severely slows down the leave-one-out Sinkhorn computations, making it scale poorly to large-scale datasets. Consistent with our previous experiments, the outlier detection capabilities of SinkWF improve as the contamination rate increases from α = 0.05 to α = 0.15. Regarding image synthesis quality, the α = 0 baseline experiment demonstrates that applying our filtering algorithms to entirely clean data has a negligible impact on downstream generative modeling, indicating that our methods do not discard valuable clean samples. Conversely, the utility of filtering becomes striking under heavy contamination (α = 0.15): pre-filtering the training data with our WF algorithms yields a dramatic 3-to-4-fold reduction in FID score compared to training on the raw contaminated data, highlighting the necessity of robust data sanitization in generative workflows.

(a) Original and contaminated images. From left to right: clean images, strong contaminated images, and weak contaminated images.

(b) Generated images. First 3 images from the left side: trained on raw data with α = 0.15 weak contamination. The 3 images on the right: trained after outlier removal by SlicedWF.

Figure 1: Result of generated images without and with outlier removal preprocessing.

Table 3: Results of DDPM training on MNIST. FID evaluate the quality of generated images, AUCROC and AUC-PR evaluate the performance of outlier detection, weak and strong contamination are two modes of contamination. SinkMarg is abandoned since its runtime exceeds 24h.

Original data SlicedWF SinkWF SinkMarg

α=0 12.45 11.25 10.13 -

α=0 12.45 13.27 16.15 -

Weak contamination FID score AUC-ROC α = 0.05 α = 0.15 α = 0.05 α = 0.15 17.23 21.13 20.77 4.83 1.00 1.00 16.17 4.83 0.80 1.00 Strong contamination FID score AUC-ROC α = 0.05 α = 0.15 α = 0.05 α = 0.15 12.13 14.85 20.77 4.83 1.00 1.00 8.98 5.04 1.00 1.00 -

AUC-PR α = 0.05 α = 0.15 1.00 1.00 0.71 1.00 AUC-PR α = 0.05 α = 0.15 1.00 1.00 0.94 1.00 -

Conclusion

In this paper, we introduced Wasserstein Filtering (WF), a novel task-agnostic sample selection framework designed to detect and eliminate outliers that cause significant distributional distortion under the Wasserstein distance. By isolating a clean subset of the data, the empirical measure of the remaining samples naturally serves as a robust estimator of the underlying clean distribution. The core advantages of the WF framework are summarized as follows: • Task-Agnostic Preprocessing: As a pure sample-selection scheme, WF operates independently of downstream learning tasks, making it a highly versatile preprocessing tool for general data sanitization. • Minimal Distributional Assumptions: Unlike existing robust estimators, WF does not impose restrictive parametric assumptions on the clean distribution, nor does it require prior knowledge of its specific parameters. • Computational Tractability and Adaptivity: Harnessing modern deep-learning optimization frameworks (e.g., automatic differentiation and GPU acceleration), the optimization of sample weights is computationally efficient. Moreover, the framework is equipped with an automated data-driven procedure to estimate the unknown contamination rate α. • Robustness to Non-Tail and Structured Outliers: By leveraging the global geometric properties of optimal transport, WF successfully identifies structured outliers and hidden anomalies that do not lie on the extreme tails of the clean distribution, surpassing the limitations of isolation- and density-based methods. • Flexibility across Dimensions: The framework offers scalable options tailored to different data regimes: SlicedWF provides O(n) space efficiency in large-sample, low-dimensional settings (n ≫ d), while SinkWF maintains geometric fidelity in high-dimensional, moderate-sample regimes (d ≫ n). We systematically validated the empirical performance of the WF framework across tabular and graph data, demonstrating its consistent superiority over state-of-the-art baselines. Furthermore, on the theoretical front, we established the minimax optimality of the empirical risk under the Far Exclusion with Local Projection (FELP) contamination model, confirming that our framework achieves the optimal statistical rate of robust distribution estimation.

Supplementary Material This Supplementary Material contains the complete proofs for our theoretical results, additional algorithmic details, and further numerical evaluations.

Additional Methodological Details

A.1

Projection-Based Implementation

In Algorithms 2 and Algorithm 1 below in A.3, the constraint conv(∆α ) is handled by appending a penalty term to the objective function. In this section, we present an alternative approach based on direct projection. Specifically, we solve the projection problem onto the capped simplex conv(∆α ): projconv(∆α ) (br ) = argmin

z∈conv(∆α ) 2

∥z − br ∥2 .

To solve this, we employ the iterative algorithm proposed by Adam and Mácha (2022), which utilizes a bisection method to find the root of the optimality equation established in their Theorem 3.8. Crucially, the operations involved in this projection are differentiable almost everywhere, enabling seamless integration into gradient-based optimization via automatic differentiation (e.g., PyTorch’s AutoGrad ). Specifically, for the Sinkhorn Wasserstein Filtering (SinkWF) algorithm, the optimal transport problem and its associated gradient computation are modified as follows: X Tr = argmin ⟨T, C⟩ + λ tij log(tij ), 1 T∈Π( n 1, projconv(∆α ) (br )) i,j∈[n] gr = v ∗

∂ projconv(∆α ) (br ) . ∂br

This adaptation can be applied analogously to the Sliced Wasserstein Filtering (SlicedWF) algorithm: 1 W1,S Pen , Pprojconv(∆α ) (br ) = S

gr =

X ui ∼Ud , i∈[S]

Z 1 0

−1 Fu−1 ⊤x e (t) − Fu⊤ y, y∼P e, x e ∼P i

projconv(∆ ) (br ) α

∂W1,S Pen , Pprojconv(∆α ) (br ) ∂ projconv(∆ ) (br ) α

∂ projconv(∆α ) (br )

∂br

(t) dt,

By eliminating the penalty parameter β, this projection-based implementation bypasses the need for hyperparameter tuning on β, making it user-friendly in practice. We empirically evaluate the performance of this projection-based variant in Appendices C.1-C.3.

A.2

Automatic Determination of the Contamination Level

In Algorithms 2 and Algorithm 1 below in A.3, the contamination level α is an input parameter that typically must be specified a priori. To address settings where the ground-truth contamination rate is unknown, we introduce an automatic selection strategy that dynamically estimates α during the optimization process. Taking Algorithm 2 as an example, starting from an initial conservative estimate α0 (e.g., α0 = 0.1), we update the contamination level iteratively. Let pr+1 = Sort(softmax(br+1 )) denote the vector of sample weights sorted in descending order at iteration r + 1. We then update αr+1 according to: αr+1 = 1 −

argmaxi∈[n−1] (pr+1,i − pr+1,i+1 ) . n

The intuition behind this strategy is that clean and contaminated samples tend to be separated by a sharp transition in their assigned probability masses. By identifying the index of the largest adjacent gap (i.e., the “elbow” point) in the sorted weights, we can dynamically and adaptively partition the dataset into clean and contaminated subsets. The empirical performance of this adaptive α strategy is evaluated on benchmark datasets in Appendix C.

A.3

SlicedWF Algorithm

The complete optimization process for the SlicedWF algorithm is given below.

Algorithm 3: Sliced Wasserstein Filtering Algorithm (SlicedWF) e α ∈ (0, 1), b0 , γ ∈ R+ , R, T, S ∈ Z+ Input: D, e 1 Normalize D 2 for t = 1, . . . , T do 3 for r = 0, . . . , R − 1 do 4 Sample S random directions {u1 , . . . , uS } uniformly from Sd−1 5 Compute W1,S (Pen , Psoftmax(br ) ) via: S

1X S i=1

Z 1 0

−1 Fu−1 ⊤x e (t) − Fu⊤ y, y∼P e, x e ∼P n

softmax(br )

(t) dt

Compute the gradient gr : h i 1 ∂ W1,S (Pen , Psoftmax(br ) ) − β1⊤ ReLU softmax(br ) − (1−α)n 1 gr = ∂br Update parameters using Adam: br+1 = Adam(γ, br , gj,j≤r ) end Save ht = softmax(bR ) 8 end e to obtain S = {e 9 Thresholding: filter D xi | h̄i > τα , i ∈ [n]} where h̄i is the ith entry of PT 1 h̄ = T t=1 ht , τα is the α quantile of h̄i , i ∈ [n] Output: S 6 7

Additional Details for Section 3: Theoretical Properties

B.1

Convergence of the Estimator

B.1.1

Population Setting

Lemma 1 (Complementary Wasserstein Resilience). Let (X , d) be a metric space, p ∈ [1, ∞), and α ∈ [0, 1). If µ ∈ Qp (X ) is (ρ, α)-resilient with respect to the Wp distance, then µ is also

(1−α)1/p ρ, 1 − α 1−(1−α)1/p

-resilient

under Wp . That is, for every probability measure ν ∈ Qp (X ) satisfying ν ≤ α1 µ, we have: Wp (µ, ν) ≤

(1 − α)1/p ρ. 1 − (1 − α)1/p

Proof. Following the proof strategy of Lemma 10 in Steinhardt et al. (2018) (which establishes complementary mean resilience), let ν ∈ Qp (X ) be any probability measure satisfying ν ≤ α1 µ, and define η :=

µ − αν . 1−α

1 It is straightforward to verify that η ∈ Qp (X ) and η ≤ 1−α µ. Let π be an optimal coupling between η and ν with respect to the Wp distance. We construct a coupling

Population case Lemma 1

Lemma 3

Theorem 2

Lemma 2

Theorem 1

Lemma 4

Theorem 3

Lemma 5

Theorem 4

Empirical case

Figure A.2: Roadmap of estimator convergence Γ1 defined as: Γ1 := α(Id, Id)# ν + (1 − α)π, where Id denotes the identity map. Since the first marginal of Γ1 is αν + (1 − α)η = µ and its second marginal is ν, it constitutes a valid coupling between µ and ν. Consequently, we obtain: Z Wpp (µ, ν) ≤ d(x, y)p dΓ1 (x, y) Z = (1 − α) d(x, y)p dπ(x, y) = (1 − α)Wpp (ν, η). Taking the p-th root on both sides yields Wp (µ, ν) ≤ (1 − α)1/p Wp (ν, η). By the triangle inequality, we have: Wp (µ, ν) ≤ (1 − α)1/p (Wp (µ, ν) + Wp (µ, η)) . Rearranging terms, we find:

1 − (1 − α)1/p Wp (µ, ν) ≤ (1 − α)1/p Wp (µ, η) ≤ (1 − α)1/p ρ,

1 µ and the assumed (ρ, α)-resilience of µ. This where the final inequality follows from the relation η ≤ 1−α completes the proof.

Lemma 2 (Risk under Support Total Variation Contamination). Assume the true distribution P ∗ ∈ G ⊆ W1 (ρ, α) and the contaminated distribution Pe satisfies ∥Pe − P ∗ ∥STV ≤ α for some 0 ≤ α ≤ 21 . Then, the

population Wasserstein Filtering estimator PbWF satisfies: W1 (PbWF , P ∗ ) ≲ κPe,P ∗ (SWF ) ∨ ρ, where the discrepancy term κPe,P ∗ (SWF ) is defined as: κPe,P ∗ (SWF ) =

µ≤ e

inf 1

P (SWF \S̄)

P∗

W1 PeSWF \S̄ , µ ,

and S̄ is the shared support guaranteed by the definition of the support total variation distance. Proof. Since ∥Pe − P ∗ ∥STV ≤ α, by the definition of the Support Total Variation (STV) distance, there exists a measurable subset S̄ ⊆ X such that Pe(S̄) = P ∗ (S̄) = 1 − α and Pe|S̄ = P ∗ |S̄ . Consequently, we can write: W1 (PbWF , P ∗ ) ≤ W1 (PbWF , PeS̄ ) + W1 (PeS̄ , P ∗ ) = W1 (PbWF , PeS̄ ) + W1 (PS̄∗ , P ∗ ) ≤ W1 (PbWF , PeS̄ ) + ρ, 1 where the last inequality follows from the relation PS̄∗ ≤ 1−α P ∗ and the assumed (ρ, α)-resilience of P ∗ . Recall the Kantorovich-Rubinstein dual formulation for W1 . Let (ϕ∗ , SWF ) be an optimal pair realizing W1 (PbWF , Pe), where ϕ∗ is the optimal 1-Lipschitz dual potential. This yields: Z Z W1 (PbWF , Pe) = sup ϕ dPbWF − ϕ dPe ∥ϕ∥Lip ≤1

Z = =

∗

ϕ dPbWF − sup

ϕ∗ dPe Z Z ϕ∗ dPeS − ϕ∗ dPe,

e), P e(S)=1−α S⊆supp(P

where the third equality follows directly from the definition of the estimator PbWF . Thus, for any subset S ⊆ supp(Pe) with Pe(S) = 1 − α, we have: Z Z ϕ∗ dPeS ≤ ϕ∗ dPbWF . (17)

Now, let ψ be any 1-Lipschitz function (∥ψ∥Lip ≤ 1). We observe that: Z Z Z Z Z Z ∗ b b e b e ψ dPWF − ψ dPS̄ ≤ ψ dPWF − ψ dPS̄ + ϕ dPWF − ϕ∗ dPeS̄ Z Z 1 = (ψ + ϕ∗ ) dPe − (ψ + ϕ∗ ) dPe 1−α SWF S̄ ! Z Z 1 ∗ ∗ = (ψ + ϕ ) dPe − (ψ + ϕ ) dPe 1−α SWF \S̄ S̄\SWF Z Z Pe(SWF \ S̄) (ψ + ϕ∗ ) dPeSWF \S̄ − (ψ + ϕ∗ ) dPeS̄\SWF = 1−α Z Z δ (ψ(x) + ϕ∗ (x)) dPeSWF \S̄ (x) − (ψ(y) + ϕ∗ (y)) dPeS̄\SWF (y) = 1−α Z δ = (ψ(x) − ψ(y) + ϕ∗ (x) − ϕ∗ (y)) dπ(x, y) 1−α Z 2δ ≤ d(x, y) dπ(x, y), 1−α where the first inequality is obtained by setting PeS = PeS̄ in (17); the third equality follows because Pe(SWF ) = Pe(S̄) = 1 − α, which implies Pe(SWF \ S̄) = Pe(S̄ \ SWF ) := δ ≤ α; the fifth equality holds for any arbitrary coupling π of PeSWF \S̄ and PeS̄\SWF ; the last inequality is due to the Lipschitz constraints ∥ψ∥Lip ≤ 1 and ∥ϕ∗ ∥Lip ≤ 1. Taking the supremum over ψ on the left-hand side and the infimum over all valid couplings π ∈ e Π(PSWF \S̄ , PeS̄\SWF ) on the right-hand side, we get: Z W1 (PbWF , PeS̄ ) =

sup

Z ψ dPbWF −

∥ψ∥Lip ≤1

ψ dPeS̄

Z 2δ inf d(x, y) dπ(x, y) 1 − α π∈Π(PeS \S̄ ,PeS̄\S ) WF WF 2δ = W1 PeSWF \S̄ , PeS̄\SWF 1−α ( ) 2δ inf W1 PeSWF \S̄ , µ + W1 µ, PeS̄\SWF ≤ 1 − α µ≤ δ1 P ∗ ( ) 2δ ∗ e ≤ inf W1 PSWF \S̄ , µ + W1 (µ, PV ) sup 1 − α µ≤ δ1 P ∗ µ≤ δ1 P ∗ , V ⊆S̄, P ∗ (V )=δ ( ) 2δ ≤ inf W1 PeSWF \S̄ , µ + sup W1 (µ, ν) 1 − α µ≤ δ1 P ∗ µ,ν≤ δ1 P ∗ ( ) 2(1 − δ) 2δ e ≤ inf W1 PSWF \S̄ , µ + ρ 1 − α µ≤ δ1 P ∗ δ ≤

≤ 2κPe,P ∗ (SWF ) + 8ρ, where the third inequality uses the fact that Pe = P ∗ on the support S̄; the fifth inequality follows from 2δ Lemma 1; the final inequality is verified by noting that δ ≤ α ≤ 21 (which implies 1−α ≤ 2 and 4(1−δ) 1−α ≤ 8). ∗ b b e Combining this result with the initial bound W1 (PWF , P ) ≤ W1 (PWF , PS̄ ) + ρ completes the proof. We are now ready to prove establish the population risk bounds.

Proof of Theorem 1. Suppose for contradiction that Pe(SWF ∩Eρ ) > 0. By (13) in the definition of population FELP contamination, there exists a subset S+ ⊆ supp(Pe) with Pe(S+ ) = 1 − α and S+ ∩ Eρ = ∅ such that: W1 (PbWF , Pe) < W1 (PeS+ , Pe). Since PeS+ is a valid (1−α)-truncated version of Pe, this strictly contradicts the optimality of SWF . Therefore, we must have SWF ∩ Eρ = ∅, which in turn implies (SWF \ S̄) ∩ Eρ = ∅. Since SWF \ S̄ ⊆ Eρ ∪ Nρ , it follows that SWF \ S̄ ⊆ Nρ . Let Pe(SWF \ S̄) = δ, where 0 ≤ δ ≤ α. We define the push-forward measure µ = T# PeSWF \S̄ . For any measurable set B ⊆ X , we have: µ(B) = PeSWF \S̄ (T −1 (B)) 1 ≤ Pe|Nρ (T −1 (B)) δ 1 = T# Pe|Nρ (B) δ 1 ∗ ≤ P (B), δ where the last inequality follows from (14), thereby verifying that µ ≤ 1δ P ∗ . Next, let π0 = (Id, T )# PeSWF \S̄ . It is clear that π0 ∈ Π(PeSWF \S̄ , µ) represents a valid coupling. Consequently, we obtain: Z e W1 (PSWF \S̄ , µ) = inf d(x, y) dπ(x, y) e π∈Π(P SWF \S̄ ,µ)

Z ≤

d(x, y) dπ0 (x, y) Z

d(x, T (x)) dPeSWF \S̄ (x)

≤ ρ. This shows there exists a measure µ = T# PeSWF \S̄ ≤ 1δ P ∗ such that W1 (µ, PeSWF \S̄ ) ≤ ρ, which directly implies that κPe,P ∗ (SWF ) ≤ ρ. Applying Lemma 2, we conclude that W1 (PbWF , P ∗ ) ≲ ρ. To establish the minimax lower bound in Theorem 2, we first introduce the following auxiliary lemma, which provides a generic lower bound on the minimax risk via the modulus of continuity. Lemma 3 (Generic Lower Bound for Minimax Risk). Let G ⊆ W1 (ρ, α). The minimax estimation risk over G is lower bounded as: inf sup R1,P ∗ ,T (α, ρ) ≥ T P ∗ ∈G

1 ω(G, α, ρ), 2

where the modulus of continuity ω(G, α, ρ) is defined as: ω(G, α, ρ) = sup W1 (P0 , P1 ) : P0 , P1 ∈ G, CPFELP (α, ρ) ∩ CPFELP (α, ρ) ̸= ∅ . 0 1 Proof. Following the standard construction of the modulus of continuity in robust estimation (see, e.g., Donoho and Liu, 1988; Zhu et al., 2022), we fix an arbitrary estimator T . For any P0 , P1 ∈ G sharing a

common contaminated distribution Pe ∈ CPFELP (α, ρ) ∩ CPFELP (α, ρ), the triangle inequality yields: 0 1 W1 (P0 , P1 ) ≤ W1 (P0 , T (Pe)) + W1 (T (Pe), P1 ) n o ≤ 2 max W1 (P0 , T (Pe)), W1 (P1 , T (Pe)) . Taking the supremum over all such valid pairs (P0 , P1 ) and their shared contaminated distributions Pe on both sides, we obtain: ω(G, α, ρ) = sup W1 (P0 , P1 ) e P0 ,P1 ,P

n o ≤ 2 sup max W1 (P0 , T (Pe)), W1 (P1 , T (Pe)) e P0 ,P1 ,P

≤ 2 sup

sup

P ∗ ∈G P e∈C FELP (α,ρ) ∗

W1 (P ∗ , T (Pe))

= 2 sup R1,P ∗ ,T (α, ρ). P ∗ ∈G

Taking the infimum over all estimators T on both sides completes the proof. We are now ready to establish the minimax optimality results. Proof of Theorem 2. We first consider the general setting where the distribution class G satisfies G ⊆ W1 (ρ, α). Let e1 = (1, 0, . . . , 0)⊤ ∈ Rd denote the first standard basis vector, and let QU e1 represent the uniform law on the line segment: n ρo L ρ4 := te1 : 0 ≤ t ≤ ⊂ Rd , 4 where U ∼ Unif[0, ρ4 ]. We define the candidate distributions P0 , P1 and a shared contaminated distribution Pe as follows: P0 = (1 − α)QU e1 + αδ− ρ2 e1 ,

P1 = (1 − α)QU e1 + αδ ρ2 e1 ,

Pe = (1 − α)QU e1 + αδ− ρ4 e1 .

To apply Lemma 3, we verify that Pe ∈ CPFELP (α, ρ) ∩ CPFELP (α, ρ). By choosing the shared support 0 1 ρ S̄ = L 4 , we have: P0 (S̄) = P1 (S̄) = Pe(S̄) = 1 − α,

P0 |S̄ = P1 |S̄ = Pe|S̄ = (1 − α)QU e1 ,

and

which immediately implies ∥Pe − Pi ∥STV ≤ α for i = 0, 1. Next, we check the Far Exclusion and Local Projection (FELP) conditions. The only contaminated point under Pe is − ρ4 e1 , which satisfies: ρ ρ ρ d − e1 , supp(P0 ) = d − e1 , supp(P1 ) = < ρ. 4 4 4 Consequently, the far contamination region Eρ is empty for both P0 and P1 . For the local projection condition, we define the transport maps T0 and T1 by setting T0 − ρ4 e1 = − ρ2 e1 and T1 − ρ4 e1 = ρ2 e1 . These maps satisfy: ρ ρ ρ d − e1 , T0 − e1 = < ρ, 4 4 4

ρ ρ 3ρ d − e1 , T1 − e1 = < ρ, 4 4 4

as well as T0# Pe|Nρ = αδ− ρ2 e1 ≤ P0 and T1# Pe|Nρ = αδ ρ2 e1 ≤ P1 . This confirms that Pe ∈ CPFELP (α, ρ) ∩ 0 FELP CP1 (α, ρ). Assuming P0 , P1 ∈ G, Lemma 3 yields the following minimax lower bound: inf sup R1,P ∗ ,T (α, ρ) ≥ T P ∗ ∈G

1 1 1 ω(G, α, ρ) ≥ W1 (P0 , P1 ) = αρ ≳ ρ, 2 2 2

where the final inequality holds since α ≥ α0 > 0. Combined with the upper bound from Theorem 1, which establishes that inf sup R1,P ∗ ,T (α, ρ) ≤ sup R1,P ∗ ,PbWF (α, ρ) ≲ ρ, T P ∗ ∈G

P ∗ ∈G

we obtain the tight minimax rate of Θ(ρ). We now turn to the specialized case where G = Gcov (σ). It remains to verify that P0 , P1 ∈ Gcov (σ). For a general distribution of the form Pt,η = (1 − α)QU e1 + αδte1 with U ∼ Unif[0, η], its covariance matrix is given by: η2 η 2 ΣPt,η = (1 − α) + α(1 − α) t − e1 e⊤ 1. 12 2 For P0 , we have η = ρ4 and t = − ρ2 , while for P1 , we have η = ρ4 and t = ρ2 . To ensure that P0 , P1 ∈ Gcov (σ), we require the operator norm of the covariance to be bounded by σ 2 : (1 − α)

ρ ρ 2 ρ2 σ + α(1 − α) + ≤ σ 2 =⇒ ρ ≲ √ . 192 2 8 1 − α2

Furthermore, by Theorem 2 of Nietert et al. (2023), the resilience parameter under Gcov (σ) scales as ρ ≍ √ σ dα. Substituting this relation, we find that the covariance constraint is satisfied provided that the 1 dimension satisfies d ≲ α(1−α 2 ) , which holds by assumption. This completes the proof.

B.1.2

Empirical Setting

Lemma 4 (Upper Bound on Empirical Resilience). Let P ∗ ∈ Q(X ) be a probability measure, let Pn = Pn 1 i=1 δxi be its empirical measure, and let 0 ≤ α < 1. Define the population and empirical resilience n parameters respectively as: ρ=

sup

Wp (P ∗ , µ)

and

ρn =

sup

Wp (Pn , µ).

1 µ≤ 1−α Pn

1 P∗ µ≤ 1−α

Then, the empirical resilience parameter satisfies: 1 Wp (Pn , P ∗ ). ρn ≤ ρ + 1 + (1 − α)1/p 1 Proof. For any α-trimmed version of Pn satisfying µα ≤ 1−α Pn , the Radon–Nikodym theorem guarantees i h R 1 the existence of a measurable function f : X → 0, 1−α with f dPn = 1 such that:

Z µα (A) =

f dPn A

for all Borel measurable sets A ⊆ X . Let π ∈ Π(Pn , P ∗ ) be an optimal coupling between Pn and P ∗ . We construct a new probability measure

π̄ on X 2 by defining, for any Borel set B ⊆ X 2 : Z π̄(B) =

f (x) dπ(x, y). B

For any Borel set A ⊆ X , the first marginal of π̄ satisfies: Z Z π̄(A × X ) = f (x) dπ(x, y) = f (x) dPn (x) = µα (A). A×X

Letting να denote the second marginal of π̄, we have for any Borel set B ⊆ X : Z 1 P ∗ (B), να (B) = π̄(X × B) = f (x) dπ(x, y) ≤ 1−α X ×B which confirms that να is indeed a feasible α-trimmed version of P ∗ . Using π̄ as a (possibly sub-optimal) coupling between µα and να , we bound their Wasserstein distance as: Wp (µα , να ) =

Z inf

π0 ∈Π(µα ,να )

Z ≤

1/p ∥x − y∥p dπ0 (x, y)

1/p ∥x − y∥ dπ̄(x, y) p

1/p Z 1 p ≤ ∥x − y∥ dπ(x, y) 1−α 1 = Wp (Pn , P ∗ ). (1 − α)1/p

Applying the triangle inequality for the Wasserstein metric, we obtain: Wp (Pn , µα ) ≤ Wp (Pn , P ∗ ) + Wp (P ∗ , να ) + Wp (να , µα ) 1 Wp (Pn , P ∗ ) ≤ Wp (P ∗ , να ) + 1 + (1 − α)1/p 1 ≤ sup Wp (P ∗ , ν) + 1 + Wp (Pn , P ∗ ). 1 (1 − α)1/p P∗ ν≤ 1−α 1 Pn , taking the supremum over all Since this bound holds for any arbitrary α-trimmed measure µα ≤ 1−α such µα yields: 1 ∗ sup Wp (Pn , µ) ≤ sup Wp (P , ν) + 1 + Wp (Pn , P ∗ ), (18) 1 1 (1 − α)1/p µ≤ 1−α Pn ν≤ 1−α P∗

which completes the proof. We are now ready to establish the empirical risk results. Proof of Theorem 3. By setting p = 1 in Lemma 4 and using the assumption that α ≤ 12 , we obtain Pn ∈ W1 (O(ρ + W1 (Pn , P ∗ )), α). Using the triangle inequality, we write W1 (PbWF , P ∗ ) ≤ W1 (PbWF , Pn ) + W1 (Pn , P ∗ ). Since ∥Pen − Pn ∥STV ≤ α, we can apply Lemma 2 by treating Pen as the contaminated distribution Pe and the empirical

measure Pn as the clean target P ∗ . This yields: W1 (PbWF , P ∗ ) ≤ W1 (PbWF , Pn ) + W1 (Pn , P ∗ ) ≲ κPen ,Pn (SWF ) ∨ (ρ + W1 (Pn , P ∗ )) , which can be explicitly written as: ( ∗

W1 (PbWF , P ) ≲ max

inf

1 Pn Pn (SWF \S̄)

µ≤ e

)

∗

W1 PenSWF \S̄ , µ , ρ + W1 (Pn , P ) ,

ej } is the set of uncorrupted samples, satisfying |S̄| = (1 − α)n. Taking the where S̄ ⊆ {xj : j ∈ [n], xj = x en , we get: expectation on both sides with respect to the contaminated data generating distribution P ( ) " # h i ∗ ∗ b e Ee W1 (PWF , P ) ≲ max Ee inf W1 PnS \S̄ , µ , ρ + EP [W1 (Pn , P )] . (19) Pn

1 Pn Pn (SWF \S̄)

µ≤ e

Next, by substituting the effective empirical parameter O(ρ + W1 (Pn , P ∗ )) in place of ρ in the definition of the empirical FELP condition, we can apply the exact same conditioning and projection arguments as in the proof of Theorem 1. This directly implies: e inf W P , µ ≲ ρ + W1 (Pn , P ∗ ). 1 nSWF \S̄ 1 µ≤ e

Pn (SWF \S̄)

en on both sides and substituting this result back into (19) completes Taking the expectation with respect to P the proof. α Lemma 5 (Empirical Lifting under FELP Contamination). For any P ∗ ∈ G and any Pe ∈ CPFELP ∗ 5 , ρ , the following properties hold: 1. First, we have T# Pe|Nρ ≤ P ∗ |S̄ c . 2. Second, let η := P ∗ |S̄ = Pe|S̄ , νloc := Pe|Nρ , νfar := Pe|Eρ , λloc := T# νloc , and λfar := P ∗ |S̄ c − λloc ≥ 0. For any coupling πfar ∈ Π(λfar , νfar ), we define the joint coupling π ∈ Π(P ∗ , Pe) as: π = (Id, Id)# η + (T, Id)# νloc + πfar . ei )ni=1 ∼ π n , we define the event E2 as: Under the i.i.d. sample generation (xi , x   en }, |S+ | = (1 − α)n, S+ ∩ En,ρ = ∅ such that: ∃S+ ⊆ {e x1 , . . . , x            X X 1 1 E2 = . sup W1  δxei , Pen  < W1  δxei , Pen       |S| |S | + S⊆{e x1 ,...,e xn }   |S|=(1−α)n, S∩En,ρ ̸=∅

ei ∈S x

ei ∈S+ x

1 Then, we have π n (E2c ) ≤ δn ≤ 20 . Pn 3 n Furthermore, letting E1 = ei } ≤ αn , we have π (E1 ∩ E2 ) ≥ 4 , and the second (right) i=1 I{xi ̸=x n marginal distribution of the conditional joint measure π (·, · | E1 ∩ E2 ) belongs to DnFELP (P ∗ , α).

Proof. We first bound the probability of the event E1 . By applying Markov’s inequality, we obtain: π n (E1 ) = 1 − π n (E1c ) Pn Eπn ei } i=1 I{xi ̸=x ≥1− αn 4 ≥ , 5 α where the second inequality follows from the assumption that Pe ∈ CPFELP ∗ 5 , ρ and the construction of the e) ≤ α5 . Applying the union bound, we obtain: joint coupling π, which ensures that π(x ̸= x π n (E1 ∩ E2 ) ≥ π n (E1 ) − π n (E2c ) ≥

4 3 − δn ≥ . 5 4

Next, we show that the second (right) marginal of the conditional distribution π n (·, · | E1 ∩ E2 ) belongs e1 , . . . , x en satisfy the to DnFELP (P ∗ , α). To establish this, it suffices to show that the empirical samples x empirical FELP contamination conditions, i.e., Pen ∈ CPFELP (α, ρ). n On the event E1 ∩ E2 , the first two conditions of FELP contamination (the support total variation bound and the far exclusion condition) are guaranteed by the definitions of E1 and E2 , respectively. Thus, we only need to verify the third condition, namely the local projection property. ej ) ∼ To do this, we partition the contaminated empirical support. Let S1 = {e xj : j ∈ [n], (xj , x ej ∈ S1 , we have: (T, Id)# νloc }. For any x d(e xj , supp(Pn )) ≤ d(e xj , xj ) = d(e xj , T (e xj )) ≤ ρ, ej ) ∼ πfar }. For any x ej ∈ S2 , the definition which implies S1 ⊆ Nn,ρ . Conversely, let S2 = {e xj : j ∈ [n], (xj , x ej ∈ Eρ . Consequently, of πfar ensures that x d(e xj , supp(Pn )) ≥ d(e xj , supp(P ∗ )) ≥ ρ, which verifies that S2 ⊆ En,ρ . Since the contaminated support can be decomposed as ez = xz }, S1 ∪ S2 = supp(Pen ) \ {e xz : z ∈ [n], x and since the empirical local and far regions partition the contaminated support such that ez = xz }) ∩ En,ρ = ∅, (Nn,ρ \ {e xz : z ∈ [n], x ez = xz } and S2 = En,ρ . we identify S1 = Nn,ρ \ {e xz : z ∈ [n], x We now construct the empirical local projection map Tn : Nn,ρ → supp(Pn ) by setting: Tn (e xj ) =

( T (e xj ) ej x

ej ∈ S1 , if x ej ∈ Nn,ρ \ S1 . if x

ej ∈ Nn,ρ , and Tn# Pen |Nn,ρ ≤ Pn . By construction, this map satisfies d(e xj , Tn (e xj )) ≤ ρ for all x FELP This confirms that Pen ∈ CPn (α, ρ) holds on E1 ∩ E2 . Consequently, the second marginal distribution of the joint conditional measure π n (·, · | E1 ∩ E2 ) belongs to the empirical FELP family DnFELP (P ∗ , α), completing the proof. We now prove the minimax optimality results in the empirical case.

Proof of Theorem 4. We begin by establishing the upper bound. Taking Tn = PbWF in the definition of the empirical minimax risk, we have: h i R1,n (α, ρ) = inf sup sup EePn W1 (Tn (Pen ), P ∗ ) Tn P ∗ ∈G e FELP (P ∗ ,α) Pn ∈Dn

≤ sup

sup

P ∗ ∈G e Pn ∈D FELP (P ∗ ,α)

h i EePn W1 (PbWF , P ∗ )

≲ ρ + sup EPn [W1 (Pn , P ∗ )] , P ∗ ∈G

where the last inequality follows directly from Theorem 3, which holds uniformly for any empirical FELP en ∈ DFELP (P ∗ , α) and any P ∗ ∈ G. contamination distribution P n Next, we establish the minimax lower bound. By definition of the empirical FELP family, the uncontaminated empirical measure Pn satisfies Pn ∈ DnFELP (P ∗ , α). Thus, we immediately obtain: inf sup EPn [W1 (Tn (Pn ), P ∗ )] ≤ R1,n (α, ρ). Tn P ∗ ∈G

To establish the tight rate, it remains to prove that the population minimax risk is controlled by the empirical minimax risk, i.e., R1,∞ α5 , ρ ≲ R1,n (α, ρ). To achieve this, it suffices to construct a population-level estimator T̄ that satisfies: W1 T̄ (Pe), P ∗ ≲ R1,n (α, ρ). sup sup P ∗ ∈G P e∈C FELP ( α5 ,ρ) P∗ Without loss of generality, we assume that the infimum in the definition of R1,n (α, ρ) is achieved by an empirical estimator T̄n (otherwise, we can proceed with a standard approximation argument and take the limit): h i sup sup EePn W1 T̄n (Pen ), P ∗ ≤ R1,n (α, ρ). P ∗ ∈G e Pn ∈D FELP (P ∗ ,α) n

α For any fixed P ∗ ∈ G and any contaminated population distribution Pe ∈ CPFELP ∗ 5 , ρ , the conditions of Lemma 5 are satisfied. Thus, there exists a joint coupling π ∈ Π(P ∗ , Pe) such that the second (right) marginal e′ , belongs to the empirical FELP distribution of the conditional joint measure π n (·, · | E1 ∩ E2 ), denoted as P n ∗ FELP (P , α). class Dn By the construction of T̄n , we can bound the probability of the estimation error under the product measure Pen as: n o n o e′ W1 T̄n (Pen ), P ∗ ≤ 4R1,n (α, ρ) Pen W1 T̄n (Pen ), P ∗ ≤ 4R1,n (α, ρ) ≥ π n (E1 ∩ E2 ) · P n n o 3 e′ W1 T̄n (Pen ), P ∗ > 4R1,n (α, ρ) ≥ 1−P n 4 h i   EeP′ W1 T̄n (Pen ), P ∗ 3  1− n ≥ 4 4R1,n (α, ρ) 3 1 9 1 ≥ 1− = > , 4 4 16 2 where the second inequality follows from Lemma 5, the third from Markov’s inequality, and the fourth from e′ ∈ DFELP (P ∗ , α). the definition of T̄n and the fact that P n n

Now, we define the following candidate set of clean distributions: n o 1 n e e e W1 T̄n (Pn ), ν ≤ 4R1,n (α, ρ) > Γ(P ) := ν ∈ G : P . 2 The preceding inequality guarantees that P ∗ ∈ Γ(Pe), meaning Γ(Pe) is non-empty. For the given contaminated population Pe, we define our population-level estimator T̄ (Pe) by choosing an arbitrary element from Γ(Pe). By definition of Γ(Pe), we have: n o 1 Pen W1 T̄n (Pen ), T̄ (Pe) ≤ 4R1,n (α, ρ) > , 2 and we already established that: n o 1 Pen W1 T̄n (Pen ), P ∗ ≤ 4R1,n (α, ρ) > . 2 Since both events hold with probability strictly greater than 1/2 under Pen , they must have a non-empty intersection. On this intersection, the triangle inequality yields: W1 P ∗ , T̄ (Pe) ≤ W1 P ∗ , T̄n (Pen ) + W1 T̄n (Pen ), T̄ (Pe) ≤ 8R1,n (α, ρ). Since this bound holds uniformly for any P ∗ ∈ G and Pe ∈ CPFELP ∗

α 5 , ρ , we conclude that:

α 1 1 R1,∞ , ρ ≤ sup sup W1 P ∗ , T̄ (Pe) ≤ R1,n (α, ρ). 8 5 8 P ∗ ∈G Pe∈C FELP ( α ,ρ) ∗ P

Finally, we apply this general result to the class G = Gcov (σ). By Theorem 3.1 of Lei (2020), √ specialized ∗ −1/d we have supP ∗ ∈Gcov (σ) E[W1 (Pn , P )] = O( dn ), while Theorem 3 of Niles-Weed and Berthet (2022) √ provides the corresponding lower bound inf Tn supP ∗ ∈Gcov (σ) E[W1 (Tn (Pn ), P ∗ )] = Ω( dn−1/d ). Further more, Theorem 2 guarantees that R1,∞ α5 , ρσ ≍ ρσ , where the covariance-resilience parameter scales as √ ρσ≍ σ dα (Nietert et al., 2023, Theorem 2). Combining these rates yields the matching minimax rate √ √ Θ σ dα + dn−1/d , which is achieved by the proposed filter-based estimator PbWF .

B.2

Convergence of the Algorithm

In this section, we analyze the convergence properties of the proposed Wasserstein Filter (WF) algorithm and provide the proof of Theorem 5. Proof of Theorem 5. Let p = σ(b) denote the filtered probability vector. We recall the dual formulation of the discrete W1 optimal transport problem: Ψ(p) := W1 (Pn , Pp ) =

max

u,v∈Rn ui +vj ≤Cij

⟨u, 1/n⟩ + ⟨v, p⟩.

Under Condition 2, the optimal dual potential v∗ (p) is unique. Consequently, Danskin’s theorem implies that Ψ(p) is differentiable with gradient: ∇Ψ(p) = v∗ (p). For the penalty term, Condition 3 ensures that pi ̸= uα for all i ∈ [n], which guarantees differentiability.

The gradient of the penalty with respect to p is given by: " n # X ∇p β (pi − uα )+ = βm(p), where

mi (p) = I{pi >uα } .

i=1

By applying the chain rule, we obtain the gradient of the objective function F (b) with respect to the filtered probability vector σ(b): ∇σ(b) F (b) = v∗ (σ(b)) − βm(σ(b)). Therefore, the full gradient of F with respect to the parameter vector b is: ∇F (b) =

∂F (b) ∂σ(b) = Jσ (b) (v∗ (σ(b)) − βm(σ(b))) , ∂σ(b) ∂b

where Jσ (b) = diag(σ(b)) − σ(b)σ(b)⊤ is the Jacobian matrix of the softmax function σ(b). To analyze the Lipschitz properties of this gradient, we define the following shorthand notation: Aσ (b) := v∗ (σ(b)) − βm(σ(b)), and introduce the following supremum and Lipschitz constants over the compact set K: Lσ := LipK (σ),

LJ := LipK (Jσ ),

MJ := sup ∥Jσ (b)∥,

and

MA := sup ∥Aσ (b)∥.

b∈K

Since the softmax function σ is smooth, both σ and its Jacobian Jσ are Lipschitz continuous and bounded on the compact set K. Furthermore, by Conditions 3 and 4, the vector Aσ (b) is bounded, ensuring that MJ , MA , Lσ , and LJ are all finite. Now, for any b, c ∈ K with corresponding filtered vectors p = σ(b) and q = σ(c), we bound the gradient difference as: ∥∇F (b) − ∇F (c)∥ = ∥[Jσ (b) − Jσ (c)] Aσ (b) + Jσ (c) [Aσ (b) − Aσ (c)]∥ ≤ ∥[Jσ (b) − Jσ (c)] Aσ (b)∥ + ∥Jσ (c) [v∗ (p) − v∗ (q)]∥ ≤ LJ MA ∥b − c∥ + MJ ∥v∗ (p) − v∗ (q)∥ ≤ (LJ MA + MJ Lσ Lv∗ ) ∥b − c∥, where the first inequality follows from Condition 3 (which guarantees that m(σ(b)) = m0 remains locally constant on K), and the third inequality follows from the Lv∗ -Lipschitz continuity of the optimal dual potential v∗ assumed in Condition 4. Thus, the gradient ∇F (b) is LF -Lipschitz continuous on K with Lipschitz constant LF := LJ MA + MJ Lσ Lv∗ . By the standard descent (ascent) lemma, this Lipschitz property implies: LF ∥br+1 − br ∥2 F (br+1 ) ≥ F (br ) + ⟨∇F (br ), br+1 − br ⟩ − 2 LF γ 2 = F (br ) + γ − ∥∇F (br )∥2 . 2 2

Since the step size satisfies 0 < γ < L2F , the coefficient γ − LF2γ is strictly positive, guaranteeing that the objective values {F (br )} are non-decreasing. Summing this inequality from iteration r = r0 to r = r0 +R −1

yields: r0 +R−1 X

∥∇F (br )∥2 ≤

F (br0 +R ) − F (br0 ) γ − LF2γ

r=r0

≤

maxi,j∈[n] ∥xi − xj ∥ − F (br0 ) γ − LF2γ

where we used the fact that the maximum possible value of the W1 distance (and thus F (b)) is bounded by the diameter of the empirical support. It follows immediately that: v u max u i,j∈[n] ∥xi − xj ∥ − F (br0 ) , min ∥∇F (br )∥ ≤ t 2 r∈{r0 ,...,r0 +R−1} γ − LF2γ R which completes the proof.

Additional Numerical Experiment Results

C.1

Two-Dimensional Synthetic Data

Figure A.3 shows the two-moon and circle data examples.

Table 4: Results of SinkWF and SlicedWF on 2-D data using projection implementation. Weak and strong contamination implies the signal of corruption strength. The mean of 50 times repetition are recorded and the corresponding standard error is recorded in parenthesis right side.

SlicedWF SinkWF Twomoon data

SlicedWF SinkWF

SlicedWF SinkWF Circles data

SlicedWF SinkWF

Weak Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.51(0.04) 0.50(0.11) 0.06(0.02) 0.18(0.05) 0.67(0.12) 0.90(0.07) 0.18(0.15) 0.73(0.16) Strong Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.67(0.25) 0.60(0.27) 0.40(0.45) 0.42(0.39) 0.69(0.05) 0.79(0.04) 0.24(0.11) 0.49(0.11) Weak Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.53(0.05) 0.52(0.11) 0.07(0.03) 0.19(0.05) 0.63(0.06) 0.72(0.03) 0.14(0.06) 0.35(0.05) Strong Contamination AUC-ROC AUC-PR α = 0.05 α = 0.15 α = 0.05 α = 0.15 0.64(0.21) 0.58(0.25) 0.31(0.34) 0.38(0.34) 0.69(0.04) 0.78(0.06) 0.22(0.09) 0.45(0.13)

DIF

SinkWF

SlicedWF

SinkWF

MDE

0 2

SlicedWF

MDE

COPOD

SinkMarg

COPOD

SinkMarg

(a) α = 0.15 with weak contamination, corrupted samples are gathered around (−0.5, −0.5).

MDE

COPOD

SinkMarg 0

2 0

SinkMarg 0

SlicedWF

0 2

0 0

COPOD

0 2

0 0

SinkWF

MDE

0 2

2 0

SlicedWF

0 2

SinkWF

0 0

DIF 0

2 2

0 0

DIF

(b) α = 0.15 with strong contamination, corrupted samples are gathered around (−2.5, −2.5).

Figure A.3: The two-moon and circle data examples. Green and red points are normal and corrupted samples classified by algorithm.

Table 5: Hyperparameters setting in 2-D data example. (p) means handle constraint with projection implementation while (r) means regularization implementation. In MDE, δ is the threshold for maximum eigenvalue of covariance matrix, µ is the factor that (µα)n samples with largest scores for random filtering. Parameters notation in DIF are consistent with its corresponding paper. COPOD is tuning free. Algorithms DIF MDE SlicedWF (p) SlicedWF (r) SinkWF (p) SinkWF (r) SinkMarg

Parameter Search Scope r ∈ {10, 50}, t ∈ {6, 10}, n ∈ {128, 256} δ ∈ {0.1, 0.4, 0.7}, µ ∈ {2, 3, 4} R ∈ {100, 300}, γ ∈ {1, 10−1 , 10−2 , 10−3 }, S = 3000 R ∈ {100, 300}, γ ∈ {1, 10−1 , 10−2 , 10−3 }, S = 3000, β ∈ {1, 10, 100} R = 100, λ ∈ {10−1 , 10−2 , 10−3 }, γ ∈ {10−1 , 10−2 , 10−3 , 10−4 } R = 100, λ ∈ {10−1 , 10−2 , 10−3 }, γ ∈ {10−1 , 10−2 , 10−3 , 10−4 }, β ∈ {1, 10, 100} λ ∈ {10−1 , 10−2 , 10−3 }

C.2

Benchmark Datasets

Table 6 below give the full performance results of the methods considered in this work for the graph benchmark datasets.

Table 6: Full results of graph benchmark datasets.

Graph

Dataset NR-AR NR-ALBD NR-AhR NR-Aro NR-ER NR-ELBD NR-gamma SR-ARE SR-ATAD5 SR-HSE SR-MMP SR-p53 mean wins

(n, d, α) (7823, 300, 3.94%) (7823, 300, 3.03%) (7823, 300, 9.82%) (7823, 300, 3.83%) (7823, 300, 10.11%) (7823, 300, 4.46%) (7823, 300, 2.38%) (7823, 300, 12.04%) (7823, 300, 3.37%) (7823, 300, 4.76%) (7823, 300, 11.73%) (7823, 300, 5.41%)

COPOD 0.71 0.75 0.39 0.62 0.47 0.55 0.54 0.53 0.44 0.54 0.51 0.57 0.55 0.00%

DIF 0.71 0.75 0.44 0.65 0.51 0.60 0.56 0.57 0.50 0.57 0.57 0.61 0.59 25.00%

Dataset NR-AR NR-ALBD NR-AhR NR-Aro NR-ER NR-ELBD NR-gamma SR-ARE SR-ATAD5 SR-HSE SR-MMP SR-p53 mean wins

COPOD 0.09 0.08 0.07 0.06 0.10 0.06 0.03 0.13 0.03 0.05 0.13 0.08 0.08 16.67%

DIF 0.09 0.07 0.08 0.06 0.11 0.06 0.03 0.13 0.03 0.05 0.14 0.08 0.08 16.67%

AUC-ROC MDE SlicedWF 0.50 0.56 0.50 0.51 0.50 0.51 0.50 0.53 0.50 0.56 0.50 0.56 0.50 0.52 0.50 0.54 0.50 0.52 0.50 0.50 0.50 0.59 0.50 0.55 0.50 0.54 0.00% 8.33% AUC-PR MDE SlicedWF 0.04 0.05 0.03 0.03 0.10 0.10 0.04 0.04 0.10 0.11 0.04 0.05 0.02 0.02 0.12 0.13 0.03 0.04 0.05 0.05 0.12 0.15 0.05 0.07 0.06 0.07 8.33% 16.67%

SinkWF 0.76 0.77 0.51 0.65 0.57 0.62 0.56 0.56 0.53 0.55 0.60 0.61 0.61 66.67%

SinkMarg 0.56 0.54 0.48 0.58 0.47 0.48 0.58 0.54 0.52 0.57 0.49 0.62 0.54 25.00%

SinkWF 0.16 0.13 0.10 0.06 0.13 0.08 0.03 0.14 0.04 0.05 0.16 0.07 0.10 83.33%

SinkMarg 0.05 0.03 0.09 0.05 0.09 0.05 0.03 0.14 0.04 0.06 0.12 0.09 0.07 41.67%

Table 7: Full results of tabular benchmark datasets with projection implementation and adaptive α on penalty implementation.

Tabular

Dataset vertebral yeast annthyroid breastw cardio tocography Hepatitis Lymph shuttle pendigits satellite WBC smtp optdigits mean

Tabular

Dataset vertebral yeast annthyroid breastw cardio tocography Hepatitis Lymph shuttle pendigits satellite WBC smtp optdigits mean

AUC-ROC SinkWF SinkAda 0.58 0.70 0.52 0.60 0.55 0.59 0.97 0.75 0.62 0.56 0.60 0.78 0.76 0.65 0.83 0.65 0.61 0.87 0.51 0.85 0.55 0.69 0.89 0.87 0.50 0.64 0.53 0.73 0.64 0.71 AUC-PR SlicedWF SinkWF SinkAda 0.18 0.19 0.25 0.42 0.36 0.45 0.14 0.09 0.11 0.98 0.93 0.51 0.12 0.22 0.15 0.59 0.39 0.54 0.22 0.43 0.25 0.04 0.20 0.16 0.90 0.10 0.26 0.08 0.02 0.11 0.34 0.35 0.54 0.22 0.47 0.29 0.00 0.00 0.00 0.04 0.03 0.29 0.31 0.27 0.28 SlicedWF 0.67 0.62 0.60 0.99 0.60 0.86 0.57 0.48 0.97 0.72 0.52 0.77 0.50 0.67 0.68

Table 8: Full Results of graph benchmark datasets with projection implementation and adaptive α on penalty implementation.

Graph

Dataset NR-AR NR-ALBD NR-AhR NR-Aro NR-ER NR-ELBD NR-gamma SR-ARE SR-ATAD5 SR-HSE SR-MMP SR-p53 mean

Graph

Dataset NR-AR NR-ALBD NR-AhR NR-Aro NR-ER NR-ELBD NR-gamma SR-ARE SR-ATAD5 SR-HSE SR-MMP SR-p53 mean

AUC-ROC SinkWF SinkAda 0.50 0.77 0.53 0.78 0.51 0.56 0.51 0.68 0.51 0.57 0.53 0.64 0.50 0.59 0.50 0.56 0.50 0.55 0.52 0.54 0.52 0.60 0.50 0.62 0.51 0.62 AUC-PR SlicedWF SinkWF SinkAda 0.06 0.04 0.17 0.04 0.03 0.15 0.12 0.10 0.11 0.06 0.04 0.06 0.13 0.10 0.12 0.06 0.05 0.08 0.03 0.02 0.04 0.14 0.12 0.13 0.04 0.03 0.04 0.05 0.05 0.05 0.13 0.12 0.15 0.06 0.05 0.08 0.08 0.06 0.10 SlicedWF 0.66 0.58 0.58 0.64 0.61 0.61 0.52 0.57 0.55 0.51 0.54 0.58 0.58

Table 9: Full results of time series benchmark datasets with projection implementation and adaptive α on penalty implementation.

Timeseries

Dataset ECG200 FordA FordB GunPoint Power Surface1 Surface2 TLECG Wafer mean

(n, d, α) (200, 320, 33.50%) (4921, 320, 48.65%) (4446, 320, 49.15%) (200, 320, 50.00%) (1096, 320, 49.91%) (621, 320, 43.80%) (980, 320, 38.37%) (1162, 320, 50.00%) (7164, 320, 10.64%)

Timeseries

Dataset ECG200 FordA FordB GunPoint Power Surface1 Surface2 TLECG Wafer mean

(n, d, α) (200, 320, 33.50%) (4921, 320, 48.65%) (4446, 320, 49.15%) (200, 320, 50.00%) (1096, 320, 49.91%) (621, 320, 43.80%) (980, 320, 38.37%) (1162, 320, 50.00%) (7164, 320, 10.64%)

AUC-ROC SinkWF SinkAda 0.79 0.57 0.50 0.51 0.49 0.51 0.57 0.59 0.53 0.70 0.54 0.68 0.49 0.54 0.66 0.74 0.57 0.63 0.57 0.61 AUC-PR SlicedWF SinkWF SinkAda 0.45 0.59 0.37 0.50 0.48 0.49 0.51 0.49 0.50 0.77 0.60 0.59 0.85 0.52 0.69 0.36 0.46 0.62 0.35 0.37 0.41 0.44 0.68 0.72 0.12 0.14 0.20 0.48 0.48 0.51 SlicedWF 0.66 0.55 0.53 0.70 0.80 0.37 0.28 0.24 0.54 0.52

Table 10: Hyperparameters setting in benchmark datasets. (p) means handle constraint with projection implementation while (r) means regularization implementation. In MDE, we take the quantile of eigenvalues of covariance matrix as the maximum eigenvalue threshold, so here δ means the quantile level, µ is the factor that (µα)n samples with largest scores for random filtering. Parameters notation in DIF are consistent with its corresponding paper. COPOD is tuning free. Algorithms DIF MDE SlicedWF (p) SlicedWF (r) SinkWF (p) SinkWF (r) SinkMarg

Parameter Search Scope r ∈ {10, 50, 90}, t ∈ {6, 10, 14}, n ∈ {64, 128, 256} δ ∈ {0.5, 0.6, 0.7, 0.8}, µ ∈ {2, 3, 4, 5} R = 100, γ ∈ {10−1 , 10−3 , 10−5 , 10−7 }, S = 1000 R = 100, γ ∈ {10−1 , 10−3 , 10−5 , 10−7 }, S = 1000, β ∈ {30, 50, 90} R = 100, λ ∈ {10−1 , 10−2 , 10−3 }, γ ∈ {10−1 , 10−3 , 10−5 , 10−7 } R = 100, λ ∈ {10−1 , 10−2 , 10−3 }, γ ∈ {10−1 , 10−3 , 10−5 , 10−7 }, β ∈ {30, 50, 90} λ ∈ {10−1 , 10−2 , 10−3 }

C.3

Robust Generative Learning

Table 11: Result of DDPM training on MNIST with projection implementation. b0 = 1 for both SinkWF and SlicedWF, other settings are the same as penalty implementation.

SlicedWF SinkWF

α=0 12.09 13.72

α=0 8.94 15.77

Weak contamination FID score AUC-ROC α = 0.05 α = 0.15 α = 0.05 α = 0.15 7.17 7.63 1.00 0.98 22.99 23.48 0.87 0.71 Strong contamination FID score AUC-ROC α = 0.05 α = 0.15 α = 0.05 α = 0.15 20.77 4.83 1.00 1.00 16.74 4.20 1.00 1.00

AUC-PR α = 0.05 α = 0.15 0.97 0.88 0.57 0.33 AUC-PR α = 0.05 α = 0.15 1.00 1.00 1.00 1.00

Table 12: Hyperparameters setting for MNIST data example.

SlicedWF (p) SlicedWF (r) SinkWF (p) SinkWF (r) SinkMarg

parameter (R, S, γ) (R, S, γ, β) (R, λ, γ) (R, λ, γ, β) (λ)

SlicedWF (p) SlicedWF (r) SinkWF (p) SinkWF (r) SinkMarg

parameter (R, S, γ) (R, S, γ, β) (R, λ, γ) (R, λ, γ, β) (λ)

Weak contamination α=0 α = 0.05 α = 0.15 (100, 3000, 10−4 ) (100, 3000, 10−4 ) (100, 3000, 10−4 ) (100, 3000, 10−2 , 1) (100, 3000, 10−2 , 1) (100, 3000, 10−1 , 1) (100, 10−3 , 10−5 ) (100, 10−3 , 10−5 ) (100, 10−3 , 10−3 ) −2 −3 −2 −3 (100, 10 , 10 , 100) (100, 10 , 10 , 100) (100, 10−2 , 10−1 , 100) Strong contamination α=0 α = 0.05 α = 0.15 −5 −5 (100, 3000, 10 ) (100, 3000, 10 ) (100, 3000, 10−5 ) −1 −1 (100, 3000, 10 , 1) (100, 3000, 10 , 1) (100, 3000, 10−1 , 1) (100, 10−2 , 10−3 ) (100, 10−2 , 10−3 ) (100, 10−2 , 10−3 ) −1 −3 −1 −3 (100, 10 , 10 , 100) (100, 10 , 10 , 100) (100, 10−1 , 10−3 , 100) -

References Adam, L. and Mácha, V. (2022). Projections onto the canonical simplex with additional linear inequalities. Optimization Methods and Software 37 451–479. Arjovsky, M., Chintala, S. and Bottou, L. (2017). Wasserstein generative adversarial networks. In International conference on machine learning. Pmlr. Balaji, Y., Chellappa, R. and Feizi, S. (2020). Robust optimal transport with applications in generative modeling and domain adaptation. Advances in Neural Information Processing Systems 33 12934–12944. Caffarelli, L. A. and McCann, R. J. (2010). Free boundaries in optimal transport and monge-ampere obstacle problems. Annals of mathematics 673–730.

Chao, P. and Dobriban, E. (2023). Statistical estimation under distribution shift: Wasserstein perturbations and minimax theory. arXiv preprint arXiv:2308.01853 . Chizat, L., Peyré, G., Schmitzer, B. and Vialard, F.-X. (2018). Unbalanced optimal transport: Dynamic and kantorovich formulations. Journal of Functional Analysis 274 3090–3123. Clark, K. M. and McNicholas, P. D. (2024). Finding outliers in gaussian model-based clustering. Journal of Classification 41 313–337. Cuturi, M. (2013). Sinkhorn distances: Lightspeed computation of optimal transport. Advances in neural information processing systems 26. Diakonikolas, I., Kamath, G., Kane, D., Li, J., Moitra, A. and Stewart, A. (2019). Robust estimators in high-dimensions without the computational intractability. SIAM Journal on Computing 48 742–864. Donoho, D. L. and Liu, R. C. (1988). The “automatic” robustness of minimum distance functionals. The Annals of Statistics 552–586. Feydy, J., Séjourné, T., Vialard, F.-X., Amari, S.-i., Trouve, A. and Peyré, G. (2019). Interpolating between optimal transport and mmd using sinkhorn divergences. In The 22nd International Conference on Artificial Intelligence and Statistics. Figalli, A. (2010). The optimal partial transport problem. Archive for rational mechanics and analysis 195 533–560. Flamary, R., Courty, N., Gramfort, A., Alaya, M. Z., Boisbunon, A., Chambon, S., Chapel, L., Corenflos, A., Fatras, K., Fournier, N., Gautheron, L., Gayraud, N. T., Janati, H., Rakotomamonjy, A., Redko, I., Rolet, A., Schutz, A., Seguy, V., Sutherland, D. J., Tavenard, R., Tong, A. and Vayer, T. (2021). Pot: Python optimal transport. Journal of Machine Learning Research 22 1–8. Han, S., Hu, X., Huang, H., Jiang, M. and Zhao, Y. (2022). Adbench: Anomaly detection benchmark. Advances in neural information processing systems 35 32142–32159. Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B. and Hochreiter, S. (2017). Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems 30. Ho, J., Jain, A. and Abbeel, P. (2020). Denoising diffusion probabilistic models. Advances in neural information processing systems 33 6840–6851. Huber, P. J. (1964). Robust estimation of a location parameter. Ann. Math. Statist. 35 73–101. Humbert, P., Le Bars, B. and Minvielle, L. (2022). Robust kernel density estimation with median-ofmeans principle. In International Conference on Machine Learning. PMLR. Jaeger, S., Fulle, S. and Turk, S. (2018). Mol2vec: unsupervised machine learning approach with chemical intuition. Journal of chemical information and modeling 58 27–35. Kim, J. and Scott, C. D. (2012). Robust kernel density estimation. The Journal of Machine Learning Research 13 2529–2565. Kingma, D. P. and Ba, J. (2014). arXiv:1412.6980 .

Adam: A method for stochastic optimization.

arXiv preprint

Lei, J. (2020). Convergence and concentration of empirical measures under wasserstein distance in unbounded functional spaces. Bernoulli 26 767–798. Li, Z., Zhao, Y., Botta, N., Ionescu, C. and Hu, X. (2020). Copod: copula-based outlier detection. In 2020 IEEE international conference on data mining (ICDM). IEEE. Liero, M., Mielke, A. and Savaré, G. (2018). Optimal entropy-transport problems and a new hellinger– kantorovich distance between positive measures. Inventiones mathematicae 211 969–1117. Liu, H. and Gao, C. (2019). Density estimation with contamination: minimax rates and theory of adaptation. Electronic Journal of Statistics 13. Loh, P.-L. (2025). A theoretical review of modern robust statistics. Annual Review of Statistics and Its Application 12 477–496. Luise, G., Rudi, A., Pontil, M. and Ciliberto, C. (2018). Differential properties of sinkhorn approximation for learning with wasserstein distance. Advances in Neural Information Processing Systems 31. Ma, Y., Liu, H., La Vecchia, D. and Lerasle, M. (2025). Inference via robust optimal transportation: theory and methods. International Statistical Review . Mukherjee, D., Guha, A., Solomon, J. M., Sun, Y. and Yurochkin, M. (2021). Outlier-robust optimal transport. In International Conference on Machine Learning. PMLR. Nguyen, Q. M., Nguyen, H. H., Zhou, Y. and Nguyen, L. M. (2023). On unbalanced optimal transport: Gradient methods, sparsity and approximation error. Journal of Machine Learning Research 24 1–41. Nietert, S., Cummings, R. and Goldfeld, Z. (2023). Robust estimation under the wasserstein distance. arXiv preprint arXiv:2302.01237 . Nietert, S., Goldfeld, Z. and Shafiee, S. (2024). Robust distribution learning with local and global adversarial corruptions. In The Thirty Seventh Annual Conference on Learning Theory. PMLR. Niles-Weed, J. and Berthet, Q. (2022). Minimax estimation of smooth densities in wasserstein distance. The Annals of Statistics 50 1519–1540. Peyré, G., Cuturi, M. et al. (2019). Computational optimal transport: With applications to data science. Foundations and Trends® in Machine Learning 11 355–607. Pham, K., Le, K., Ho, N., Pham, T. and Bui, H. (2020). On unbalanced optimal transport: An analysis of sinkhorn algorithm. In International Conference on Machine Learning. PMLR. Ramsundar, B., Eastman, P., Walters, P. and Pande, V. (2019). Deep learning for the life sciences: applying deep learning to genomics, microscopy, drug discovery, and more. O’Reilly Media. Sinkhorn, R. (1964). A relationship between arbitrary positive matrices and doubly stochastic matrices. The Annals of Mathematical Statistics 35 876–879. Steinhardt, J., Charikar, M. and Valiant, G. (2018). Resilience: A criterion for learning in the presence of arbitrary outliers. In 9th Innovations in Theoretical Computer Science Conference (ITCS 2018). Schloss Dagstuhl–Leibniz-Zentrum für Informatik. Villani, C. et al. (2009). Optimal transport: old and new, vol. 338. Springer.

Xu, H., Pang, G., Wang, Y. and Wang, Y. (2023). Deep isolation forest for anomaly detection. IEEE Transactions on Knowledge and Data Engineering 35 12591–12604. Zhu, B., Jiao, J. and Steinhardt, J. (2022). Generalized resilience and robust statistics. The Annals of Statistics 50 2256–2283.

Wasserstein Filtering: A Sample Selection Method for Robust Distribution Learning

Analyze & explore related research in Conceptio

Related documents