Venue: ICLR 2022 Conference

Reviews:

final_score: rating: null
review_content: Dear AC, dear reviewers,

The authors have addressed my concerns in a satisfactory manner:

1. They have provided a study on standard CNNs greater vulnerability to patch-based image perturbation in comparison to ViTs. This makes the interpretation of ViTs being insensitive to patch-based losses less subjective and puts it better in perspective.
2. They convinced me of the sufficiency of the experiments of Fig 3. Although I would have still preferred the experiment I suggested, the explanation provided I deemed sufficient.
3. The standard-deviation on experiments was shown to be sufficiently low
4. A final-take away was provided. However, I would have preferred a more conclusive tone (e.g like the comment given to j5h2 to Q1).

I urge the authors to include these results into the next revision of the paper in order to improve it.

A point provided by other reviewers that concern me. Both reviewer rziK and j5h2 raise the valid point on how negative augmentation affect other transformer architectures (swin transformers, multi-scale, overlapping patches). If other SotA transformer architectures do not exhibit the same issue of invariance to patch-based image transformation, then perhaps it may be better to switch to those architectures instead of attempting to "fix" ViTs.

However, it is important to note that there is a limit to how much one can investigate in one paper. I argue that despite the prior shortcoming, there is sufficient enough new knowledge contained in this submission which is of value to the community. The authors achieve what they originally set out to do: Investigating and improving robustness of ViTs. Therefore I agree with the authors to leave further investigation on other architectures to future work. 

In conclusion, I stand by my original rating of recommending acceptance but make a note that further investigation on other architectures is crucial to get a full picture on the improvements of negative augmentations.
review_title: Discussion on author feedback

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper presents that Visual Transformers (ViTs) are not sensitive to patch transformations (e.g. shift, rotation). It thus presents an idea that patch transformations can be used as negative augmentations to train the Visual Transformers (ViTs) to improve robustness similar to human perception. Three losses are thus applied to regularize the model training from being too confident to patch transformed images. A number of experiments on ImageNet-series datasets are presented to prove the finding of the authors.
main_review: Strengths:

+ The proposed idea is simple and easy to understand.

+ The illustrations and presentations are clear and easy to follow.

+ Most of the experiments are reasonable and the settings are clear.


Weaknesses:

- The paper concludes that the proposed method can significantly improve the out-of-distribution performance of ViTs. However, from the experimental results it is observed that the improvements led by the two losses, Uniform and L2, are limited. Only the contrastive loss leads to clear improvements to some extent, however,

- Contrastive loss is known to be very useful in improving the model training from the metric learning way, which helps to learn compact representations in class distributions in the learned representation feature space. Regarding this, the contribution of the contrastive loss is not clearly ablated in the proposed method. A fair baseline with contrastive loss should also be compared, that is, with only the clean images or positively augmented images for training, how about also appending the contrastive loss along with the classification loss, where in the contrastive loss all the anchors, positive examples, and negative examples are from the labeled clean images or positively augmented images?

- From Fig. 2 it is hard to conclude that ViTs are insensitive to patch transformations. The authors extends a lot on the range of the vertical axis to make the changes appeared to be narrow. However, from the figure it can still be observed that patch transformations significantly decrease the performance by up to more than 20%. This is hard to be understood as "insensitive".

- In Eq. (3) the loss is negative. Will it cause problems in optimization?

- Does the same finding also hold on CNNs?
summary_of_the_review: I appreciate the authors' work from an interesting point of view. However, I think the statement of "ViTs are insensitive to patch transformations" does not hold, and the contribution of the contrastive loss is not clear. These two points make the current paper not reliable.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper empirically investigates robustness properties of vision transformers (ViT) towards image augmentation strategies that destroy the semantic meaning of the image. The authors experimentally demonstrate that ViTs achieve high test set accuracies on ImageNet where the test data was transformed with patch-based transformations (I refer to these collectively as P-corrupted) which render the images unrecognizable to humans. They show that by emphasizing this property of ViT, it leads to detrimental effects to generalization to out-of-distribution (OoD) datasets. 
As a remedy, the authors introduce several data augmentation techniques, termed negative augmentation, to alleviate ViTs tendencies to learn features that are robust to patch-based transformations
Extensive experimental results on ImageNet-(1k, A, C, R) ablate the proposed approach to extract the most effect hyperparameters and demonstrate the effectiveness of the proposed method
main_review: Strength
------------
1. Thorough analysis of the hypothesis of patch-based robustness of ViTs and its detrimental effects on generalizability and robustness to image corruption (however, please see weaknesses). This provides further insight into properties of ViTs and complements existing work that investigates “positive” robustness of ViTs.
2. The proposed approaches on alleviating the detrimental effects are simple, intuitive and interesting. 
3. Thorough investigation on approaches on how to alleviate this detrimental effect. These approaches are categorized as negative augmentations. The authors ablate the proposed method under a wide range of settings that provides insight and value to the research community.
4. Expanding on the previous point, the authors test negative augmentation in combination with positive augmentation and with larger datasets, both which may already solve the problem on their own but are shown to still improve in the presence of negative augmentation.
5. The paper is well-written and easy to read.

Weaknesses
-----------------
1. Experiments of Fig 2: This experiment is performed to demonstrate the robustness of ViTs towards patch-based transformations. This is done by running a trained ViT on ImageNet testing data on P-corrupted images and reporting the test accuracy. But for P-Shuffle and P-Infill, the accuracy of the ViTs clearly degrades (e.g ViT-B/32, P-Infill: ~80% -> 42%). Yet, these experiments of Fig 2 are used to empirically claim robustness. Whereas I tend to agree, I argue that a more non-subjective measure would be needed. I believe that repeating these experiments with a standard non-transformer CNN whose performance should degrade much faster would strengthen the argument being made for Fig 2.
2.  Experiments of Fig 3: This experiment is performed to emphasize features that are preserved by the patch-based transformations and to demonstrate that these aforementioned features are non-robust to out-of-distribution images. This is performed by training ViTs on P-corrupted images and evaluating them on non-corrupted OoD data. The resulting ViTs perform clearly worse and the authors use this as empirical evidence to support their hypothesis that the learned features are not generalizable. However, a degradation of performance is to be expected as the model has observed only P-corrupted images. Hence it is not clear whether the degradation comes from the non-robustness of the features or because of the shift in domain (from corrupted to non-corrupted). I believe that having an additional result, where the test data is corrupted in accordance with training data corruption would shed more light, as it would remove the parameter of domain shift (corrupted -> non-corrupted) from the equation. This would strengthen the author's argument.
3. All experiments seem to have been performed once and are being used to draw conclusions. As some improvements reside in the smaller ranges, I wonder how stable these results are when re-run. Hence, I would have liked to see some statistical significance testing, as the entire paper relies heavily on empirical results.
4. The authors propose three different corruption types and three different negative augmentation types. With all the tables and numbers, I’m missing a final conclusion on which combination is suggested by the authors to work the best and hence recommended.

Questions / Comments
--------------
1. For P-Rotate, is each patch rotated randomly by the same rotation degree or is a new rotation degree sampled for each?
2. Experiments of Fig 2: Are these re-trained by the authors or taken directly from Dosovitskiy et al? If the latter, it may be better to re-train them, as the experiments of Fig 3 use re-trained models to make sure minor differences in training code does not affect results
3. Do the experiments of Fig 2/3 use positive data augmentation and is the training set for both ImageNet (as opposed to ImageNet-1k)?
4. Out of curiosity, how would the authors extend the negative data augmentation to regression tasks?
5. Page 7: (...) and Steiner et al. (2021) have the similar observation -> have “made” similar observations
6. Have combinations of the P-corruptions been tried? E.g P-shuffle with P-rotate?

summary_of_the_review: In summary, I enjoyed reading the paper. The authors perform thorough analysis of the hypothesis as well as their proposed approach. The weaknesses I mention are not minor and I would like to see them addressed. My biggest worry is the statistical analysis of the results, as  the entire paper relies heavily on experimentation.
Nevertheless, it did not dampen my positivity about the paper and therefore I feel comfortable recommending acceptance.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper investigates the robustness of vision transformers. They first found that ViTs heavily use features that survived patch-based transformations but are generally not indicative of the semantic class to humans. However, these features are non-robust and the authors propose to use the images transformed with our patch-based operations as negatively augmented views and offer losses to regularize the training away from using non-robust features. Experiments on ImageNet show that patch-based negative augmentation consistently improves the robustness of ViTs.
main_review: 1. The exploration is novel: ViTs heavily use features that survived patch-based transformations but are generally not indicative of the semantic class to humans.
2. The experiments can support this paper’s claim and the designed patch-based negative augmentation is effective.

summary_of_the_review: My concerns are mainly focused on the experiments.

1. This paper only conducts experiments on the ViT while there are other SOTA vision transformer structures, e.g. swin-transformer [a]. The authors should conduct experiments with more transformer structures to demonstrate the generalization of the exploration and the proposed negative augmentation strategy.
[a] Swin transformer: Hierarchical vision transformer using shifted windows, ICCV2021

2. The authors only conduct experiments on one dataset, ImageNet. Although ImageNet is large enough, I wonder if the experiments’ results can be reproduced on the dataset of CIFAR-10-C and CIFAR-100-C which are utilized in AugMix.

3. The authors have tried with the transformation of patch-wise shuffle, rotation, and infill. How about other commonly utilized transformations in data augmentation? E.g., horizontal and vertical flip.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper draws motivations from the observations that ViTs are insensitive towards patch-based transformations. Through detailed analysis by evaluating the models on such transformed inputs, the authors find a relatively stable accuracy, and term such features as **useful** but **non-robust** feature.  In order to push ViTs from these undesired features, patch-based negative augmentation and losses are proposed, which consistently improve the robustness of ViTs. 
main_review: **Strengths**

 - The stemming observations of this work is very interesting, where ViTs give stable predictions over those human-unrecognizable transformed samples. The author also provide extensive comparisons to support this findings. 

 - While negative data augmentations have been explored in self-/unsupervised representation learning, they are rarely visited in vision transformers and from the robust perspective. Based on the paper motivation and experiment results, the proposed method looks promising. 


**Weakness**

 - The incorporated loss function contains 3 individual components of a uniform loss, a L2 loss, as well as a contrastive loss. While comparisons in terms of accuracies are made, there exists no clear conclusion about the best choice or some detailed difference between them. In consequence, the message/contribution about the three losses is made uncertain. Further analysis or experiments that can support the statement in Sec 4 are expected.

 - Major experiments are conducted on the original ViT, or the ones with RandAug and AugMix. As has conveyed in the paper, the proposed negative augmentation is complementary to positive augmentations. Thus it's crucial to see the results where applying the proposed method to better models such as DeiT, since the training strategy adopted by DeiT is still ``positive''.

 - The transformer architecture used across most experiments is ViT-B/16, which uses a $16 \times 16$ token input. Will the transformer architectures that use a more fine-grained token representations, such as $8 \times 8$, produce dissimilar results? It's interesting to study the difference between them. Also, how do different scales of patch augmentation influence the results? 

 - Recent progress in vision transformers cover modifications towards the tokenization process, where multi-scale or overlapping token embeddings are incorporated. Do you think the high confidence predictions towards unrecognizable images come from the non-overlapping token embedding in ViTs? If not, can such observations and augmentations apply to transformers architecture that uses overlapping token embeddings?
summary_of_the_review: This paper provide some interesting findings on ViTs and propose patch-level negative augmentation. The authors also conduct experiments to validate the contribution of the augmentation and losses in details. However, the approach is only validated on the naive ViT-B/16 architecture and not convincingly enough. Moreover, additional analysis on losses and different architectures are expected.
review_title: null

Meta-review: The reviews are split. The most significant concern seems to be the narrow focus of the paper: insensitivity of a very specific architecture, ViT to some patch-based transformations of the image. The paper aims to "understand and improve" the behavior of ViTs in this respect, but as the reviewers point out, the understanding (what exactly is the mechanism for this insensitivity) is lacking. Furthermore, there is a good reason to believe that other transformer architectures might not have a similar behavior. Ultimately both the lack of depth and the lack of breadth of the investigation suggest that the impact may be limited. I think this is not a good fit for ICLR.
Decision: Reject