Title: DIVIDEMIX: LEARNING WITH NOISY LABELS AS SEMI-SUPERVISED LEARNING

Abstract: Deep neural networks are known to be annotation-hungry. Numerous efforts have been devoted to reducing the annotation cost when learning with deep networks. Two prominent directions include learning with noisy labels and semi-supervised learning by exploiting unlabeled data. In this work, we propose DivideMix, a novel framework for learning with noisy labels by leveraging semi-supervised learning techniques. In particular, DivideMix models the per-sample loss distribution with a mixture model to dynamically divide the training data into a labeled set with clean samples and an unlabeled set with noisy samples, and trains the model on both the labeled and unlabeled data in a semi-supervised manner. To avoid confirmation bias, we simultaneously train two diverged networks where each network uses the dataset division from the other network. During the semi-supervised training phase, we improve the MixMatch strategy by performing label co-refinement and label co-guessing on labeled and unlabeled samples, respectively. Experiments on multiple benchmark datasets demonstrate substantial improvements over state-of-the-art methods. Code is available at https://github.com/LiJunnan1992/DivideMix.

1. INTRODUCTION:

The remarkable success in training deep neural networks (DNNs) is largely attributed to the collection of large datasets with human annotated labels. However, it is extremely expensive and time-consuming to label extensive data with high-quality annotations. On the other hand, there exist alternative and inexpensive methods for mining large-scale data with labels, such as querying commercial search engines (Li et al., 2017a) , downloading social media images with tags (Mahajan et al., 2018) , leveraging machine-generated labels (Kuznetsova et al., 2018) , or using a single annotator to label each sample (Tanno et al., 2019) . These alternative methods inevitably yield samples with noisy labels. A recent study (Zhang et al., 2017) shows that DNNs can easily overfit to noisy labels and results in poor generalization performance.

Existing methods on learning with noisy labels (LNL) primarily take a loss correction approach. Some methods estimate the noise transition matrix and use it to correct the loss function (Patrini et al., 2017; Goldberger & Ben-Reuven, 2017) . However, correctly estimating the noise transition matrix is challenging. Some methods leverage the predictions from DNNs to correct labels and modify the loss accordingly (Reed et al., 2015; Tanaka et al., 2018) . These methods do not perform well under high noise ratio as the predictions from DNNs would dominate training and cause overfitting. To overcome this, Arazo et al. (2019) adopt MixUp (Zhang et al., 2018) augmentation. Another approach selects or reweights samples so that noisy samples contribute less to the loss (Jiang et al., 2018; Ren et al., 2018) . A challenging issue is to design a reliable criteria to select clean samples. It has been shown that DNNs tend to learn simple patterns first before fitting label noise (Arpit et al., 2017) . Therefore, many methods treat samples with small loss as clean ones (Jiang et al., 2018; Arazo et al., 2019) . Among those methods, Co-teaching (Han et al., 2018) and Co-teaching+ (Yu et al., 2019) train two networks where each network selects small-loss samples in a mini-batch to train the other.

Another active area of research that also aims to reduce annotation cost is semi-supervised learning (SSL). In SSL, the training data consists of unlabeled samples in addition to the labeled samples. Significant progress has been made in leveraging unlabeled samples by enforcing the model to produce low entropy predictions on unlabeled data (Grandvalet & Bengio, 2004) or consistent predictions on perturbed input (Laine & Aila, 2017; Tarvainen & Valpola, 2017; Miyato et al., 2019) . Recently, Berthelot et al. (2019) propose MixMatch, which unifies several dominant SSL approaches in one framework and achieves state-of-the-art performance.

Despite the individual advances in LNL and SSL, their connection has been underexplored. In this work, we propose DivideMix, which addresses learning with label noise in a semi-supervised manner. Different from most existing LNL approaches, DivideMix discards the sample labels that are highly likely to be noisy, and leverages the noisy samples as unlabeled data to regularize the model from overfitting and improve generalization performance. The key contributions of this work are:

• We propose co-divide, which trains two networks simultaneously. For each network, we dynamically fit a Gaussian Mixture Model (GMM) on its per-sample loss distribution to divide the training samples into a labeled set and an unlabeled set. The divided data is then used to train the other network. Co-divide keeps the two networks diverged, so that they can filter different types of error and avoid confirmation bias in self-training. • During SSL phase, we improve MixMatch with label co-refinement and co-guessing to account for label noise. For labeled samples, we refine their ground-truth labels using the network's predictions guided by the GMM for the other network. For unlabeled samples, we use the ensemble of both networks to make reliable guesses for their labels. • We experimentally show that DivideMix significantly advances state-of-the-art results on multiple benchmarks with different types and levels of label noise. We also provide extensive ablation study and qualitative results to examine the effect of different components.

2. RELATED WORK:

2.1 LEARNING WITH NOISY LABELS Most existing methods for training DNNs with noisy labels seek to correct the loss function. The correction can be categorized in two types. The first type treats all samples equally and correct loss either explicitly or implicitly through relabeling the noisy samples. For relabeling methods, the noisy samples are modeled with directed graphical models (Xiao et al., 2015) , Conditional Random Fields (Vahdat, 2017) , knowledge graph (Li et al., 2017b) , or DNNs (Veit et al., 2017; Lee et al., 2018) . However, they require access to a small set of clean samples. Recently, Tanaka et al. (2018) and Yi & Wu (2019) propose iterative methods which relabel samples using network predictions. For explicit loss correction. Reed et al. (2015) propose a bootstrapping method which modifies the loss with model predictions, and Ma et al. (2018) improve the bootstrapping method by exploiting the dimensionality of feature subspaces. Patrini et al. (2017) Contrary to all aforementioned methods, our method discards the labels that are highly likely to be noisy, and utilize the noisy samples as unlabeled data to regularize training in a SSL manner. Ding et al. (2018) and Kong et al. (2019) have shown that SSL method is effective in LNL. However, their methods do not perform well under high levels of noise, whereas our method can better distinguish and utilize noisy samples. Besides leveraging SSL, our method also introduces other advantages.

Compared to self-training methods (Jiang et al., 2018; Arazo et al., 2019) , our method can avoid the confirmation bias problem (Tarvainen & Valpola, 2017) by training two networks to filter error for each other. Compared to Co-teaching (Han et al., 2018) and Co-teaching+ (Yu et al., 2019) , our method is more robust to noise by enabling the two networks to teach each other implicitly at each epoch (co-divide) and explicitly at each mini-batch (label co-refinement and co-guessing). its per-sample loss distribution with a GMM to divide the dataset into a labeled set (mostly clean) and an unlabeled set (mostly noisy), which is then used as training data for the other network (i.e. co-divide). At each mini-batch, a network performs semi-supervised training using an improved MixMatch method. We perform label co-refinement on the labeled samples and label co-guessing on the unlabeled samples.

2.2. SEMI-SUPERVISED LEARNING:

SSL methods aim to improve the model's performance by leveraging unlabeled data. Current state-of-the-art SSL methods mostly involve adding an additional loss term on unlabeled data to regularize training. The regularization falls into two classes: consistency regularization (Laine & Aila, 2017; Tarvainen & Valpola, 2017; Miyato et al., 2019) enforces the model to produce consistent predictions on augmented input data; entropy minimization (Grandvalet & Bengio, 2004; Lee, 2013) encourages the model to give high-confidence predictions on unlabeled data. Recently, Berthelot et al. (2019) propose MixMatch, which unifies consistency regularization, entropy minimization, and the MixUp (Zhang et al., 2018) regularization into one framework.

3. METHOD:

In this section, we introduce DivideMix, our proposed method for learning with noisy labels. An overview of the method is shown in Figure 1 . To avoid confirmation bias of self-training where the model would accumulate its errors, we simultaneously train two networks to filter errors for each other through epoch-level implicit teaching and batch-level explicit teaching. At each epoch, we perform co-divide, where one network divides the noisy training dataset into a clean labeled set (X ) and a noisy unlabeled set (U), which are then used by the other network. At each mini-batch, one network utilizes both labeled and unlabeled samples to perform semi-supervised learning guided by the other network. Algorithm 1 delineates the full algorithm.

3.1. CO-DIVIDE BY LOSS MODELING:

Deep networks tend to learn clean samples faster than noisy samples (Arpit et al., 2017) , leading to lower loss for clean samples (Han et al., 2018; Chen et al., 2019) . Following Arazo et al. (2019) , we aim to find the probability of a sample being clean by fitting a mixture model to the per-sample loss distribution. Formally, let D = (X , Y) = {(xi, yi)} N i=1 denote the training data, where x i is an image and yi ∈ {0, 1} C is the one-hot label over C classes. Given a model with parameters θ, the cross-entropy loss (θ) reflects how well the model fits the training samples:

EQUATION

where p c model is the model's output softmax probability for class c. Arazo et al. (2019) fit a two-component Beta Mixture Model (BMM) to the max-normalized loss to model the distribution of clean and noisy samples. However, we find that BMM tends to produce undesirable flat distributions and fails when the label noise is asymmetric. Instead, Gaussian Mixture Model (GMM) (Permuter et al., 2006) can better distinguish clean and noisy samples due to its flexibility in the sharpness of distribution. Therefore, we fit a two-component GMM to using the Expectation-Maximization algorithm. For each sample, its clean probability w i is the posterior probability p(g| i ), where g is the Gaussian component with smaller mean (smaller loss).

We divide the training data into a labeled set and an unlabeled set by setting a threshold τ on w i . However, training a model using the data divided by itself could lead to confirmation bias (i.e. the Algorithm 1: DivideMix. Line 4-8: co-divide; Line 17-18: label co-refinement; Line 20: label co-guessing.

Input: θ (1) and θ (2) , training dataset (X , Y), clean probability threshold τ , number of augmentations M , sharpening temperature T , unsupervised loss weight λu, Beta distribution parameter α for MixMatch.

θ (1) , θ (2) = WarmUp(X , Y, θ (1) , θ (2) )

// standard training (with confidence penalty) while e < MaxEpoch do

W (2) = GMM(X , Y, θ (1) )

// model per-sample loss with θ (1) to obtain clean proabability for θ (2)

W (1) = GMM(X , Y, θ (2) )

// model per-sample loss with θ (2) to obtain clean proabability for θ (1) for k = 1, 2 do // train the two networks one by one

X (k) e = {(xi, yi, wi)|wi ≥ τ, ∀(xi, yi, wi) ∈ (X , Y, W (k) )} // labeled training set for θ (k) U (k) e = {xi|wi < τ, ∀(xi, wi) ∈ (X , W (k) )} // unlabeled training set for θ (k)

for iter = 1 to num iters do model is prone to confirm its mistakes (Tarvainen & Valpola, 2017) ), as noisy samples that are wrongly grouped into the labeled set would keep having lower loss due to the model overfitting to their labels. Therefore, we propose co-divide to avoid error accumulation. In co-divide, the GMM for one network is used to divide training data for the other network. The two networks are kept diverged from each other due to different (random) parameter initialization, different training data division, different (random) mini-batch sequence, and different training targets. Being diverged offers the two networks distinct abilities to filter different types of error, making the model more robust to noise.

Confidence Penalty for Asymmetric Noise. For initial convergence of the algorithm, we need to "warm up" the model for a few epochs by training on all data using the standard cross-entropy loss. The warm up is effective for symmetric (i.e. uniformly random) label noise. However, for asymmetric (i.e. class-conditional) label noise, the network would quickly overfit to noise during warm up and produce over-confident (low entropy) predictions, which leads to most samples having near-zero normalized loss (see Figure 2a ). In such cases, the GMM cannot effectively distinguish clean and noisy samples based on the loss distribution. To address this issue, we penalize confident predictions from the network by adding a negative entropy term, -H (Pereyra et al., 2017) , to the cross-entropy loss during warm up. The entropy of a model's prediction for an input x is defined as:

EQUATION

By maximizing the entropy, becomes more evenly distributed (see Figure 2b ) and easier to be modeled by the GMM. Furthermore, in Figure 2c we show when the model is trained with DivideMix for 10 more epochs after warm up. The proposed method can significantly reduce the loss for clean samples while keeping the loss larger for most noisy samples. To account for label noise, we make two improvements to MixMatch which enable the two networks to teach each other. First, we perform label co-refinement for labeled samples by linearly combining the ground-truth label y b with the network's prediction p b (averaged across multiple augmentations of x b ), guided by the clean probability w b produced by the other network:

3.2. MIXMATCH:

EQUATION

Then we apply a sharpening function on the refined label to reduce its temperature:

EQUATION

Second, we use the ensemble of predictions from both networks to "co-guess" the labels for unlabeled samples (algorithm 1, line 20), which can produce more reliable guessed labels.

Having acquired X (and Û) which consists of multiple augmentations of labeled (unlabeled) samples and their refined (guessed) labels, we follow MixMatch to "mix" the data, where each sample is interpolated with another sample randomly chosen from the combined mini-batch of X and Û. Specifically, for a pair of samples (x 1 , x 2 ) and their corresponding labels (p 1 , p 2 ), the mixed (x , p ) is computed by:

EQUATION

EQUATION

EQUATION

EQUATION

MixMatch transforms X and Û into X and U . Equation 6 ensures that X are "closer" to X than Û.

The loss on X is the cross-entropy loss and the loss on U is the mean squared error:

EQUATION

EQUATION

Under high levels of noise, the network would be encouraged to predict the same class to minimize the loss. To prevent assigning all samples to a single class, we apply the regularization term used by Tanaka et al. (2018) and Arazo et al. (2019) , which uses a uniform prior distribution π (i.e. π c = 1/C) to regularize the model's average output across all samples in the mini-batch:

EQUATION

Finally, the total loss is:

EQUATION

In our experiments, we set λ r as 1 and use λ u to control the strength of the unsupervised loss.

4. EXPERIMENTS:



4.1. DATASETS AND IMPLEMENTATION DETAILS:

We extensively validate our method on four benchmark datasets, namely CIFAR-10, CIFAR-100 (Krizhevsky & Hinton, 2009) , Clothing1M (Xiao et al., 2015) , and WebVision (Li et al., 2017a) . Both CIFAR-10 and CIFAR-100 contain 50K training images and 10K test images of size 32 × 32. Following previous works (Tanaka et al., 2018; Li et al., 2019) , we experiment with two types of label noise: symmetric and asymmetric. Symmetric noise is generated by randomly replacing the labels for a percentage of the training data with all possible labels. Note that there is another criterion for symmetric label noise injection where the true labels cannot be maintained (Jiang et al., 2018; Wang et al., 2018) , for which we also report the results (Table 6 in Appendix). Asymmetric noise is designed to mimic the structure of real-world label noise, where labels are only replaced by similar classes (e.g. deer→horse, dog↔cat).

We use an 18-layer PreAct Resnet (He et al., 2016) and train it using SGD with a momentum of 0.9, a weight decay of 0.0005, and a batch size of 128. The network is trained for 300 epochs. We set the initial learning rate as 0.02, and reduce it by a factor of 10 after 150 epochs. The warm up period is 10 epochs for CIFAR-10 and 30 epochs for CIFAR-100. We find that most hyperparameters introduced by DivideMix do not need to be heavily tuned. For all CIFAR experiments, we use the same hyperparameters M = 2, T = 0.5, and α = 4. τ is set as 0.5 except for 90% noise ratio when it is set as 0.6. We choose λ u from {0, 25, 50, 150} using a small validation set.

Clothing1M and WebVision 1.0 are two large-scale datasets with real-world noisy labels. Clothing1M consists of 1 million training images collected from online shopping websites with labels generated from surrounding texts. We follow previous work (Li et al., 2019) and use ResNet-50 with ImageNet pretrained weights. WebVision contains 2.4 million images crawled from the web using the 1,000 concepts in ImageNet ILSVRC12. Following previous work (Chen et al., 2019) , we compare baseline methods on the first 50 classes of the Google image subset using the inception-resnet v2 (Szegedy et al., 2017) . The training details are delineated in Appendix B.

4.2. COMPARISON WITH STATE-OF-THE-ART METHODS:

We compare DivideMix with multiple baselines using the same network architecture. Here we introduce some of the most recent state-of-the-art methods: Meta-Learning (Li et al., 2019) proposes a gradient based method to find model parameters that are more noise-tolerant; Joint-Optim (Tanaka et al., 2018) and P-correction (Yi & Wu, 2019) jointly optimize the sample labels and the network parameters; M-correction (Arazo et al., 2019) Note that none of these methods can consistently outperform others across different datasets. Mcorrection excels at symmetric noise, whereas Meta-Learning performs better for asymmetric noise.

Table 1 shows the results on CIFAR-10 and CIFAR-100 with different levels of symmetric label noise ranging from 20% to 90%. We report both the best test accuracy across all epochs and the averaged test accuracy over the last 10 epochs. DivideMix outperforms state-of-the-art methods by a large margin across all noise ratios. The improvement is substantial (∼10% in accuracy) for the more challenging CIFAR-100 with high noise ratios. Appendix A shows comparison with more methods in Table 6 . The results on CIFAR-10 with asymmetric noise is shown in Table 2 . We use 40% because certain classes become theoretically indistinguishable for asymmetric noise larger than 50%.

Method Best Last:

Cross-Entropy 85.0 72.3 F-correction (Patrini et al., 2017) 87.2 83.1 M-correction (Arazo et al., 2019) 87.4 86.3 Iterative-CV (Chen et al., 2019) 88.6 88.0 P-correction (Yi & Wu, 2019) 88.5 88.1 Joint-Optim (Tanaka et al., 2018) 88.9 88.4 Meta-Learning (Li et al., 2019) 89.2 88.6 DivideMix 93.4 92.1

Table 2 : Comparison with state-of-the-art methods in test accuracy (%) on CIFAR-10 with 40% asymmetric noise. We re-implement all methods under the same setting.

Table 3 and Table 4 show the results on Clothing1M and WebVision, respectively. DivideMix consistently outperforms state-of-the-art methods across all datasets with different types of label noise. For WebVision, we achieve more than 12% improvement in top-1 accuracy.

:



Figures and Tables:

Figure 1: DivideMix trains two networks (A and B) simultaneously. At each epoch, a network models

a mini-batch {(x b , y b , w b ); b ∈ (1, ..., B)} From U (k) e , draw a mini-batch {u b ; b ∈ (1, ..., B)} for b = 1 to B do for m = 1 to M do xb,m = Augment(x b ) // apply m th round of augmentation to x b ûb,m = Augment(u b ) // apply m th round of augmentation to u b end p b = 1 M m p model (x b,m ; θ (k) ) // average the predictions across augmentations of x b ȳb = w b y b + (1 -w b )p b // refine ground-truth label guided by the clean probability produced by the other network ŷb = Sharpen(ȳ b , T ) // apply temperature sharpening to the refined label qb = 1 2M m p model (û b,m ; θ (1) ) + p model (û b,m ; θ (2) ) // co-guessing: average the predictions from both networks across augmentations of u b q b = Sharpen(q b , T ) // apply temperature sharpening to the guessed label end X = {(x b,m , ŷb ); b ∈ (1, ..., B), m ∈ (1, ..., M )} // augmented labeled mini-batch Û = {(û b,m , q b ); b ∈ (1, ..., B), m ∈ (1, ..., M )} // augmented unlabeled mini-batch LX , LU = MixMatch( X , Û) // apply MixMatch L = LX + λuLU + λrLreg // total loss θ (k) = SGD(L, θ (k) ) // update model parameters end end end

Figure 2: Training on CIFAR-10 with 40% asymmetric noise, warm up for 10 epochs. (a) Standard training with cross-entropy loss causes the model to overfit and produce over-confident predictions, making difficult to be modeled by the GMM. (b) Adding a confidence penalty (negative entropy) during warm up leads to more evenly-distributed . (c) Training with DivideMix can effectively reduce the loss for clean samples while keeping the loss larger for most noisy samples.

WITH LABEL CO-REFINEMENT AND CO-GUESSING At each epoch, having divided the training data, we train the two networks one at a time while keeping the other one fixed. Given a mini-batch of labeled samples with their corresponding one-hot labels and clean probability, {(x b , y b , w b ); b ∈ (1, ..., B)}, and a mini-batch of unlabeled samples {u b ; b ∈ (1, ..., B)}, we exploit MixMatch (Berthelot et al., 2019) for SSL. MixMatch utilizes unlabeled data by merging consistency regularization (i.e. encourage the model to output same predictions on perturbed unlabeled data) and entropy minimization (i.e. encourage the model to output confident predictions on unlabeled data) with the MixUp (Zhang et al., 2018) augmentation (i.e. encourage the model to have linear behaviour between samples).

models sample loss with BMM and applies MixUp. Comparison with state-of-the-art methods in test accuracy (%) on CIFAR-10 and CIFAR-100 with symmetric noise. Methods marked by * denote re-implementations based on public code.

Table content: <table><tr><td>Dataset</td><td>CIFAR-10</td><td colspan="2">CIFAR-100</td><td/></tr><tr><td>Method/Noise ratio</td><td>20% 50% 80% 90%</td><td colspan="3">20% 50% 80% 90%</td></tr><tr><td>Cross-Entropy</td><td>Best 86.8 79.4 62.9 42.7 Last 82.7 57.9 26.1 16.8</td><td colspan="3">62.0 46.7 19.9 10.1 61.8 37.3 8.8 3.5</td></tr><tr><td>Bootstrap</td><td>Best 86.8 79.8 63.3 42.9</td><td colspan="3">62.1 46.6 19.9 10.2</td></tr><tr><td>(Reed et al., 2015)</td><td>Last 82.9 58.4 26.8 17.0</td><td>62.0 37.9</td><td>8.9</td><td>3.8</td></tr><tr><td>F-correction</td><td>Best 86.8 79.8 63.3 42.9</td><td colspan="3">61.5 46.6 19.9 10.2</td></tr><tr><td colspan="2">(Patrini et al., 2017) Last 83.1 59.4 26.2 18.8</td><td>61.4 37.3</td><td>9.0</td><td>3.4</td></tr><tr><td>Co-teaching+  *</td><td>Best 89.5 85.7 67.4 47.9</td><td colspan="3">65.6 51.8 27.9 13.7</td></tr><tr><td>(Yu et al., 2019)</td><td>Last 88.2 84.1 45.5 30.1</td><td colspan="2">64.1 45.3 15.5</td><td>8.8</td></tr><tr><td>Mixup</td><td>Best 95.6 87.1 71.6 52.2</td><td colspan="3">67.8 57.3 30.8 14.6</td></tr><tr><td colspan="2">(Zhang et al., 2018) Last 92.3 77.6 46.7 43.9</td><td colspan="2">66.0 46.6 17.6</td><td>8.1</td></tr><tr><td>P-correction  *</td><td>Best 92.4 89.1 77.5 58.9</td><td colspan="3">69.4 57.5 31.1 15.3</td></tr><tr><td>(Yi &amp; Wu, 2019)</td><td>Last 92.0 88.7 76.5 58.2</td><td colspan="2">68.1 56.4 20.7</td><td>8.8</td></tr><tr><td>Meta-Learning  *</td><td>Best 92.9 89.3 77.4 58.7</td><td colspan="3">68.5 59.2 42.4 19.5</td></tr><tr><td>(Li et al., 2019)</td><td>Last 92.0 88.8 76.1 58.3</td><td colspan="3">67.7 58.0 40.1 14.3</td></tr><tr><td>M-correction</td><td>Best 94.0 92.0 86.8 69.1</td><td colspan="3">73.9 66.1 48.2 24.3</td></tr><tr><td>(Arazo et al., 2019)</td><td>Last 93.8 91.9 86.6 68.7</td><td colspan="3">73.4 65.4 47.6 20.5</td></tr><tr><td>DivideMix</td><td>Best 96.1 94.6 93.2 76.0 Last 95.7 94.4 92.9 75.4</td><td colspan="3">77.3 74.6 60.2 31.5 76.9 74.2 59.6 31.0</td></tr></table>

Peer review (iclr2020):
This paper proposes an algorithm that learns with noisy labels that achieves state-of-the-art results. Their algorithm tries to exploit the noisy samples by assigning a ‘correct’ label through MixMatch. It borrows the idea from both semi-supervised learning and learning with label noise. Suggestions: 1. When the author talked about “correct the loss function”, there are in fact two types of corrections: the first type tries to correct the loss function by equally treating all the samples, e.g., classical Huber loss, or F-correction. The second type tries to either re-weight samples or separate clean and noisy samples explicitly, which also results in correcting the loss function. It would be more clear if Section 2.1 can emphasize the difference between the two. 2. Also, there are other papers providing different but insightful ideas to label noise problem. The authors addressed the idea of using co-learning to avoid confirmation bias. However, it should be noted that this is not the only way to avoid confirmation bias, and their are other methods without using two networks [1-2], both providing some theoretical insights to the problem. It would be good to include them in the related work as well. 3. I would like to see a comparison of running time other than the accuracy, understanding the efficiency of each algorithm is important from a practical perspective. [1] Learning with Bad Training Data via Iterative Trimmed Loss Minimization, Yanyao Shen, Sujay Sanghavi, ICML 2019. [2] Robust Learning from Untrusted Sources,Nikola Konstantinov, Christoph H. Lampert, ICML 2019