Deploying machine learning systems in the real world requires both high accuracy on clean data and robustness to naturally occurring corruptions. While architectural advances have led to improved accuracy, building robust models remains challenging, involving major changes in training procedure and datasets.   Prior work has argued that there is an inherent trade-off between robustness and accuracy, as exemplified by standard data augmentation techniques such as Cutout, which improves clean accuracy but not robustness, and additive Gaussian noise, which improves robustness but hurts accuracy. We introduce Patch Gaussian, a simple augmentation scheme that adds noise to randomly selected patches in an input image.   Models trained with Patch Gaussian achieve state of the art on the CIFAR-10 and ImageNet Common Corruptions benchmarks while also maintaining accuracy on clean data. We find that this augmentation leads to reduced sensitivity to high frequency noise (similar to Gaussian) while retaining the ability to take advantage of relevant high frequency information in the image (similar to Cutout). We show it can be used in conjunction with other regularization methods and data augmentation policies such as AutoAugment.   Finally, we find that the idea of restricting perturbations to patches can also be useful in the context of adversarial learning, yielding models without the loss in accuracy that is found with unconstrained adversarial training. Patch Gaussian augmentation overcomes the accuracy/robustness tradeoff observed in other augmentation strategies. Larger σ of Patch Gaussian (→) improves mean corruption error (mCE) and maintains clean accuracy, whereas larger σ of Gaussian (→) and patch size of Cutout (→) hurt accuracy or robustness. More robust and accurate models are down and to the right. Modern deep neural networks can achieve impressive performance at classifying images in curated datasets (Karpathy, 2011; Krizhevsky et al., 2012; Tan & Le, 2019 ). Yet, they lack robustness to various forms of distribution shift that typically occur in real-world settings. For example, neural networks are sensitive to small translations and changes in scale (Azulay & Weiss, 2018) , blurring and additive noise (Dodge & Karam, 2017) , small objects placed in images (Rosenfeld et al., 2018) , and even different images from a distribution similar to the training set (Recht et al., 2019; . For models to be useful in the real world, they need to be both accurate on a high-quality held-out set of images, which we refer to as "clean accuracy," and robust on corrupted images, which we refer to as "robustness." Most of the literature in machine learning has focused on architectural changes (Simonyan & Zisserman, 2015; Szegedy et al., 2015; He et al., 2016; Szegedy et al., 2017; Han et al., 2017; Hu et al., 2017; Liu et al., 2018) to improve clean accuracy but interest has recently shifted toward robustness as well. Research in neural network robustness has tried to quantify the problem by establishing benchmarks that directly measure it (Hendrycks & Dietterich, 2018; Gu et al., 2019) and comparing the performance of humans and neural networks (Geirhos et al., 2018b; Elsayed et al., 2018) . Others have tried to understand robustness by highlighting systemic failure modes of current methods. For instance, networks exhibit excessive invariance to visual features (Jacobsen et al., 2018) , texture bias (Geirhos et al., 2018a) , sensitivity to worst-case (adversarial) perturbations (Goodfellow et al., 2014) , and a propensity to rely on non-robust, but highly predictive features for classification (Doersch et al., 2015; Ilyas et al., 2019) . Of particular relevance, Ford et al. (2019) has established connections between popular notions of adversarial robustness and some measures of distribution shift considered here. Another line of work has attempted to increase model robustness performance, either by projecting out superficial statistics (Wang et al., 2019) , via architectural improvements (Cubuk et al., 2017) , pretraining schemes (Hendrycks et al., 2019) , or with the use of data augmentations. Data augmentation increases the size and diversity of the training set, and provides a simple way to learn invariances that are challenging to encode architecturally (Cubuk et al., 2017) . Recent work in this area includes learning better transformations (DeVries & Taylor, 2017; Zhang et al., 2017; Zhong et al., 2017) , inferring combinations of them (Cubuk et al., 2018) , unsupervised methods (Xie et al., 2019) , theory of data augmentation (Dao et al., 2018) , and applications for one-shot learning (Asano et al., 2019) . Despite these advances, individual data augmentation methods that improve robustness do so at the expense of reduced clean accuracy. Further, achieving robustness on par with the human visual system is thought to require major changes in training procedures and datasets: the current state of the art in robustness benchmarks involves creating a custom dataset with styled-transferred images before training (Geirhos et al., 2018a) , and still incurs a significant drop in clean accuracy. The ubiquity of reported robustness/accuracy trade-offs in the literature have even led to the hypothesis that these trade-offs may be inevitable (Tsipras et al., 2018) . Because of this, many recent works focus on improving either one or the other (Madry et al., 2017; Geirhos et al., 2018a) . In this work we propose a simple data augmentation method that overcomes this trade-off, achieving improved robustness while maintaining clean accuracy. Our contributions are as follows: • We characterize a trade-off between robustness and accuracy in standard data augmentations Cutout and Gaussian (Section 2.1). • We describe a simple data augmentation method (which we term Patch Gaussian) that allows us to interpolate between the two augmentations above (Section 3.1). Despite its simplicity, Patch Gaussian achieves a new state of the art in the Common Corruptions robustness benchmark (Hendrycks & Dietterich, 2018) , while maintaining clean accuracy, indicating current methods have not reached this fundamental trade-off (Section 4.1). • We demonstrate that Patch Gaussian can be combined with other regularization strategies (Section 4.2) and data augmentation policies (Section 4.3). • We perform a frequency-based analysis (Yin et al., 2019) of models trained with Patch Gaussian and find that they can better leverage high-frequency information in lower layers, while not being too sensitive to them at later ones (Section 5.1). • We show a similar method can be used in adversarial training, suggesting under-explored questions about training distributions' effect on out-of-distribution robustness (Section 5.2). In an attempt to understand Patch Gaussian's performance, we perform a frequency-based analysis of models trained with various augmentations using the method introduced in Yin et al. (2019) . First, we perturb each image in the dataset with noise sampled at each orientation and frequency in Fourier space. Then, we measure changes in the network activations and test error when evaluated with these Fourier-noise-corrupted images: we measure the change in 2 norm of the tensor directly after the first convolution, as well as the absolute test error. This procedure yields a heatmap, which indicates model sensitivity to different frequency and orientation perturbations in the Fourier domain. Each image in Fig 4 shows first layer (or test error) sensitivity as a function of frequency and orientation of the sampled noise, with the middle of the image containing the lowest frequencies, and the edges of the image containing highest frequencies. For CIFAR-10 models, we present this analysis for the entire Fourier domain, with noise sampled with norm 4. For ImageNet, we focus our analysis on lower frequencies that are more visually salient add noise with norm 15.7. Note that for Cutout and Gaussian, we chose larger patch sizes and σs than those selected with the method in Section 3.2 in order to highlight the effect of these augmentations on sensitivity. Heatmaps of other models can be found in the Appendix (Figure 11 ). In this work, we introduced a simple data augmentation operation, Patch Gaussian, which improves robustness to common corruptions without incurring a drop in clean accuracy. For models that are large relative to the dataset size (like ResNet-200 on ImageNet and all models on CIFAR-10), Patch Gaussian improves clean accuracy and robustness concurrently. We showed that Patch Gaussian achieves this by interpolating between two standard data augmentation operations Cutout and Gaussian. Finally, we analyzed the sensitivity to noise in different frequencies of models trained with Cutout and Gaussian, and showed that Patch Gaussian combines their strengths without inheriting their weaknesses. Our method is much simpler than previous state of the art, and can be used in conjunction with other regularization and data augmentation strategies, indicating it is generally useful. We end by showing that applying perturbations in patches can be a powerful method to vary training distributions in the adversarial setting. Our results indicate current methods have not reached a fundamental robustness/accuracy trade-off, and that future work is needed to understand the effect of training distributions in o.o.d. robustness.
Simple augmentation method overcomes robustness/accuracy trade-off observed in literature and opens questions about the effect of training distribution on out-of-distribution generalization.
{"src": "scitldr-AIC_train", "paper_id": "HkxWXkStDB"}