SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Shuo Chen $^{1,3*}$  Jindong Gu $^{2*}$  Zhen Han $^{1\dagger}$  Yunpu Ma $^{1,3}$  Philip Torr $^{2}$  Volker Tresp $^{1,4}$
$^{1}$ Institute of Informatics, LMU Munich  $^{2}$ Department of Engineering Science, University of Oxford
$^{3}$  Siemens AG Munich Center for Machine Learning (MCML)
shuo.chen@campus.lmu.de, jindong.gu@eng.ox.ac.uk, hanzhen02111@163.com
Various adaptation methods, such as LoRA, prompts, and adapters, have been proposed to enhance the performance of pre-trained vision-language models in specific domains. As test samples in real-world applications usually differ from adaptation data, studying the robustness of these adaptation methods against distribution shifts is essential. In this study, we assess the robustness of 11 widely-used adaptation methods across 4 vision-language datasets under multimodal corruptions. Concretely, we introduce 7 benchmark datasets, including 96 visual and 87 textual corruptions, to investigate the robustness of different adaptation methods, the impact of available adaptation examples, and the influence of trainable parameter size during adaptation. Our analysis reveals that: 1) Adaptation methods are more sensitive to text corruptions than visual corruptions. 2) Full fine-tuning does not consistently provide the highest robustness; instead, adapters can achieve better robustness with comparable clean performance. 3) Contrary to expectations, our findings indicate that increasing the number of adaptation data and parameters does not guarantee enhanced robustness; instead, it results in even lower robustness. We hope this study could benefit future research in developing robust multimodal adaptation methods. The benchmark, code, and dataset used in this study can be accessed at https://adarobustness.github.io.
Employing large-scale pre-training of vision-language (VL) models has become the standard for work on VL tasks [38, 70, 39, 71, 70, 2, 71, 77]. These models are typically trained in a self-supervised manner on unlabeled web-scale datasets in a general domain [54, 1]. To address the domain-specific challenges and improve performance on downstream tasks, various model adaptation methods have been proposed [29, 46, 43, 33, 36, 25, 63, 76, 30].
Although adaptation methods can achieve promising results on various VL benchmark datasets, real-world applications often introduce various distribution shifts that differ from the conditions encountered during model adaptation [44]. For instance, these shifts can manifest as variations in lighting conditions in images and typos in texts. Therefore, it is critical to ensure model robustness against distribution shifts, particularly in safety-critical applications where unexpected wrong decisions can have severe consequences, such as self-driving systems [67, 56, 44] and clinical diagnostics [35, 47]. However, robustness research for multimodal models is still rare, leaving many essential questions unanswered: Which adaptation methods perform better on which tasks in terms of both performance and robustness? How robust are the various multimodal adaptation methods against
† corresponding author
Figure 1: Multimodal adaptation methods are sensitive to image and text corruptions. The two rows show image captioning and visual question answering predicted by Adapter [29], respectively. Blue boxes contain the original image and query text. Orange boxes present the corrupted images, texts and model output.
visual corruptions, language corruptions, or both? Will more examples or more trainable parameters assure better robustness?
To this end, this work investigates the robustness of various adaptation methods on VL models to answer the above research questions. Concretely, we introduce a diverse set of 96 visual corruptions, including impulse noise, snow etc., and 87 textual corruptions encompassing text addition, back translation, etc. Moreover, extensive experiments have been conducted on 11 adaptation methods across 4 VL datasets, including VQAv2 [20], GQA [31], NLVR² [61] and MSCOCO Caption [5]. While several studies have explored the robustness of VL models, our work represents a significant advancement as it provides the first large-scale benchmark robustness analysis of existing adaptation methods on VL models. We limit the models and tasks to those related to images, specifically, multimodal-to-text models, e.g., CLIP-BART [62]. Video-language models are outside the scope of this research.
Our analysis reveals several interesting findings: 1) Adaptation methods demonstrate a higher degree of sensitivity towards text corruptions compared to visual corruptions. 2) Full fine-tuning does not consistently yield the best relative robustness, whereas an adapter can achieve better robustness with comparable performance. 3) Surprisingly, our experiments reveal that a large quantity of adaptation data and model parameters do not guarantee improved robustness. In fact, increasing the amount of adaptation data might even lead to decreased robustness. 4) There is no single adaptation method that surpasses others across all tasks and corruptions. To summarize, our contributions are as follows:
- We construct a suite of 7 large-scale robustness benchmark datasets including 96 visual corruptions and 87 textual corruption methods.
- We evaluate the robustness of 11 adaption methods on VL models based on massive experiments.
- We release the benchmark, code, as well as a leaderboard to the community to facilitate future research on the robustness of multimodal adaptation methods.
Vision-language Models. Pre-trained VL models [41, 60, 7, 45, 40, 64, 13, 79] have shown outstanding performance on various VL tasks. Some use contrastive learning to align visual features with language representations and achieve surprising zero-shot performance [42, 54]. However, contrastive learning-based methods are limited to close-ended tasks and are inflexible. Another line of work follows BERT's [11] pretrain-then-finetune paradigm [41, 60, 7, 64]. They treat object features extracted using pre-trained object detectors [18] as visual words sent to language models [11]. For example, VL-BART [7] uses BART [37] or T5 [55] as the text encoder and Faster-RCNN [18] as the visual backbone. Unlike other methods, VL-BART unifies VL tasks via a single text generation task. CLIP-BART [62] follows the same idea as VL-BART but adopts the CLIP [54] image encoder
to extract pixel-level features. Recent approaches [66, 14, 1] follow such a unified view and freeze large language models (LLMs) to utilize the in-context learning ability of LLMs. However, as shown in [62], LM fine-tuning is still crucial to achieve competitive performance on various downstream VL tasks. In this study, we follow the work in [62] that benchmarks model adaptation methods. CLIP-BART [62] is selected as our VL model, given its generation flexibility and unified architecture.
Model Adaptation Methods. To enhance the performance of pre-trained VL models on downstream tasks and avoid infeasible computation, various adaptation methods have been proposed. Existing methods can be classified into three categories [62]: (1) adding a few trainable parameters while freezing other model parts [29, 46, 43, 33, 36]; (2) updating a few model parameters sparsely [25, 63, 76]; and (3) low-rank factorization of parameters to be updated, such as in LoRA [30]. Adapters [29] belong to the first category and have been widely used in vision, language, and multimodal models [29, 78, 6]. Other representative methods in the first category include Hyperformers [46], Compactors [33], and prompt-tuning [36, 3]. Although numerous adaptation methods have been proposed and widely adopted, their robustness against distribution shifts remains understudied.
Natural Robustness. The robustness of deep learning models against distribution shifts is critical for real-world applications [17, 26, 16]. Regarding vision robustness, researchers have investigated image classification models [26, 16, 28, 57, 21, 22], semantic segmentation [32, 24], object detection [48], video classification [75], and transformer-based architectures [12, 51, 52, 23, 73]. In the field of natural language processing (NLP), many robustness analysis toolboxes [58, 59, 72, 19], and various methods [15, 10, 50, 9] are available. The robustness investigation on multimodal models is gaining more attention but related studies are lacking. The literature includes the robustness of multimodal fusion models [74], audio-visual models [65], text-to-image generative models [8], text-to-video retrieval models [4], as well as image-text models [53].
In contrast to all the works above, our study focuses on the robustness of adaptation methods integrated into large pre-trained vision-language models. Understanding their robustness on different VL tasks will facilitate the design of more robust adaptation methods for multimodal models.
3 Preliminaries of Model Adaptation Methods
The pretrain-then-finetune paradigm on large models has shown dominant performance on multimodal tasks [41, 11, 54], yet the prohibitive costs of full fine-tuning have spurred intensive research efforts towards developing parameter-efficient adaptation methods [62, 30, 36, 29, 46, 33]. As the transformer architecture [68] is used for most state-of-the-art large pre-trained models, adaptation methods mainly focus on tweaking the input or the intermediate layers of the attention layers inside the large models. Formally, given a pre-trained large-scale model  $F$  parameterized by  $\theta$ , we need to adapt  $F$  on a task-specific dataset  $\mathcal{D}$ , e.g., a VQA dataset, to get the adapted model  $F'$ . Then, we can obtain the output  $\mathbf{y} = F'(\mathbf{x}; \theta)$  by providing an input  $\mathbf{x} = \{x_1, \ldots, x_n\}$  with  $n$  tokens from  $\mathcal{D}$ . Adaptation methods differ in how they interact with  $F(\mathbf{x}; \theta)$  (Fig. 2). In general, full fine-tuning updates all  $\theta$ . Prompt [36] concatenates the input  $\mathbf{x}$  with an extra prefix. LoRA [30] introduces modifications to the update mechanism of the model parameters  $\theta$  and adapters [29, 46, 33] modify the intermediate output and input of  $\theta$ .
Full fine-tuning directly updates the whole  $\theta$  on  $\mathcal{D}$  and becomes prohibitive due to the rapidly growing model size. Therefore, the following adaptation methods have been developed to achieve comparable performance while optimizing only a few parameters.
Prompt-based adaptation concatenates the input  $\mathbf{x}$  with either a trainable prefix (soft prompt) [36] or a manually designed prefix [3]. For the given input  $\mathbf{x} = \{x_{1},\dots,x_{n}\}$  with  $n$  tokens, the pre-trained model will first form an embedding matrix  $\mathbf{X}\in \mathbb{R}^{n\times d}$  where  $d$  is the dimension of the embedding space. Soft-prompts [36] are then represented as a learnable parameter  $\mathbf{P}\in \mathbb{R}^{p\times d}$ , where  $p$  is the length of the prompt. Next,  $\mathbf{P}$  is concatenated with the original embedded input  $\mathbf{X}$  to form a new single matrix defined as  $[\mathbf{P}\colon \mathbf{X}]\in \mathbb{R}^{(p + n)\times d}$ . During adaptation, the model is trained to maximize the probability of the desired output while only updating  $\mathbf{P}$ .
LoRA [30] utilizes low-rank decomposition matrices to update parameters. For intermediate model parameters  $\pmb{\theta}_0\in \mathbb{R}^{d\times k}$ , such as the parameters from a self-attention module in the transformer architecture, its update  $\Delta \pmb{\theta}_0$  is represented by a low-rank decomposition  $\Delta \pmb{\theta}_0 = \mathbf{B}\mathbf{A},\mathbf{B}\in \mathbb{R}^{d\times r},\mathbf{A}\in \mathbb{R}^{r\times k},r\ll min(d,k)$ . During adaptation,  $\pmb{\theta}_0$  is frozen while  $\mathbf{B}$  and  $\mathbf{A}$  are updated.
Figure 2: Illustration of adaptation methods used in our study. Green areas indicate trainable parameters whereas frozen parameters are in blue. The input is the concatenation of image and text embedding  $[emb_{img} : emb_{text}]$  and the output is the generated text.
Adapter-based adaptation inserts sub-networks with a few learnable parameters into the large model. Adapter [29] consists of a pair of downsampling and upsampling layers as well as a residual connection. Suppose the original input to an intermediate layer  $\theta_0$  in model  $F$  is  $\mathbf{x}_0\in \mathbb{R}^{d_0}$ , adapters insert a downsampling layer  $\pmb{\theta}^{D}\in \mathbb{R}^{d_{0}\times d_{1}}$  and an upsampling layer  $\pmb{\theta}^{U}\in \mathbb{R}^{d_{1}\times d_{0}}$ , where  $d_0,d_1$  are dimensions of the hidden embeddings, respectively. The output after injecting adapters is defined as  $\pmb {h} = f_{\pmb{\theta}^U}$  ( $\sigma (f_{\pmb{\theta}^D}(\mathbf{x}_0))) + \mathbf{x}_0$ , where  $f_{\pmb{\theta}^U}$  denotes a function parameterized by  $\pmb{\theta}^{U}$  and  $\sigma (\cdot)$  is an activation function such as GELU [27]. To further reduce redundant parameters in adapters, Compacter [33] decomposes parameter matrices. It introduces parameterized hypercomplex multiplication (PHM) layers  $\pmb{\theta}^{D} = \sum_{i = 1}^{k}\mathbf{A}_{i}\otimes \mathbf{B}_{i},\mathbf{A}_{i}\in \mathbb{R}^{k\times k},\mathbf{B}_{i}\in \mathbb{R}^{\frac{d_0}{k}\times \frac{d_1}{k}}$ , which decompose the layer in the adapter by Kronecker products. Compacter also shares the parameter of  $A_{i}$  across all layers and decomposes  $B_{i}$  even further with low-rank decomposition. However, as found in [62], such sharing and further decomposition severely decreases the VL performance. In our study, we only use PHM layers. Hyperformer [46] relies on a hyper-network shared across tasks to generate the weights in adapters given a task index and a layer index. The hyperformer maintains learnable embeddings for each task and each layer. For  $N_{T}$  tasks and  $N_L$  layers, the learnable embeddings in the hyperformer is denoted as  $t_1,\dots ,t_{N_T}\in \mathbb{R}^{d_e}$  and  $l_{1},\ldots ,l_{N_{L}}\in \mathbb{R}^{d_{e}}$ , respectively. The hyperformer consists of a task projector  $\pmb{\theta}^{T}\in \mathbb{R}^{(d_{e} + d_{e})\times d_{p}}$  and a hyper-network  $\pmb{\theta}^{H}\in \mathbb{R}^{d_{p}\times (d_{0}\times d_{1} + d_{1}\times d_{0})}$ , and generates an adapter's weights in the  $i^{th}$  layer for the  $j^{th}$  task following  $\left[\pmb{\theta}^{D},\pmb{\theta}^{U}\right] = f_{\pmb{\theta}^{H}}\left(f_{\pmb{\theta}^{T}}([t_{j},l_{i}])\right)$ .
Adaptation shared over tasks [62] further reduces redundant parameters by exploiting similar information shared across multiple tasks. In a multi-VL-task setting, an intuitive way is to train the adaptation modules per task using: Multiple Adapters, Multiple Compactors, Multiple LoRA, and Multiple Prompts. Additionally, We can train only one set of adapter layers for all tasks, and we have Single Adapter, Single Compacter, Single LoRA, and Single Prompt. Besides, Half-shared adapter [62] only shares the upsampling layers or downsampling layers across different tasks. Detailed information is presented in Appendix B.2.
4 Corruption Methods
Image Corruptions. We use the corruption methods from ImageNet-C [26] and [4, 53]. A blank method is also added, which is used to examine the importance of visual information to VL models. Blank corruption turns the original image into a blank picture by setting all pixel values to 255. All image corruptions can be categorized into five groups: noise, blur, weather, digital, and extra. Specifically, we use 20 image corruption methods, (1) noise: impulse noise, Gaussian noise, shot noise, speckle noise; (2) blur: zoom blur, defocus blur, motion blur, frosted glass blur, Gaussian blur; (3) digital: JPEG compression, contrast, elastic, spatter, saturate, pixelate; (4) weather: snow, frost, fog, brightness; and (5) extra: blank. We follow the severity convention in ImageNet-C [26] and define 5 levels of severity for each method, except for blank corruption. In total, we have 96 types of visual corruption and we leave the details in the Appendix A.1. By applying all image corruptions to 4 datasets used in this study, i.e., VQAv2 [20], GQA [31], NLVR² [61] and MSCOCO Caption [5], we construct 4 out-of-distribution (OOD) benchmark datasets.
Table 1: Dataset Statistics.
VQAv2	GQA	NLVR²	MSCOCO Caption
The Number of Training set	Images 113.2K	QA pairs 605.1K	Images 72.1K	QA pairs 943.0K	Images 103.2K	QA pairs 86.4K	Images 113.2K	Captions 566.8K
Validation set	5.0K	26.7K	10.2K	132.1K	8.1K	7.0K	5.0K	5.0K
Test set	5.0K	26.3K	398	12.6K	8.1K	7.0K	5.0K	5.0K
Text Corruptions. In addition to visual feature shifts, text corruptions are also essential for evaluating the robustness of vision-language models [4, 53]. We have incorporated a total of 35 corruption methods, inspired by the approaches presented in [72, 53, 4]. These methods can be categorized into three groups based on the level of corruption: character-level, word-level, and sentence-level. Furthermore, they are further subdivided into six sub-categories, namely character modification, text style modification, text addition, dropping text based on POS, positional drop, and text swap. To name a few examples, the category text style transforms sentences to desired styles such as passive, formal, or double negative. Text addition inserts extra words, like adverbs in InsertAdv. Text drop modifies words based on POS tagging, dropping nouns (DropNN) or verbs (DropVB). For detailed information, please refer to Appendix A.2. In addition to the above corruptions, Qiu et al. proposed in [53] that we should ensure that the corrupted text has the same semantics as the original one to make sure the image-text pairs remain meaningful. We follow this setting and use the same fidelity guarantee mechanism as [53]. Various severity levels for text corruptions are also introduced in the benchmark, including 5 severity levels on character-level corruptions and some word-level corruptions. For sentence-level corruptions, only one perturbation is available. In total, we have 87 different perturbations. After applying all text corruptions on VQAv2 [20], GQA [31], and NLVR² [61], we construct another 3 OOD benchmark datasets. In the end, we have constructed 7 OOD robustness benchmark datasets to fully investigate the robustness of adaptation methods on vision-language models.
5 Experimental Settings
Tasks and Datasets. The popular representative VL tasks (visual question answering, visual reasoning, and image captioning) and 4 well-known VL datasets are applied in this work. For visual question answering, VQAv2 [20] and GQA [31] are adopted. Additionally, we incorporate NLVR $^2$  [61] for visual reasoning and MSCOCO [5] for image captioning. The statistics are shown in Table 1.
Models. CLIP-BART (T5) [62] serves as our base model. Because the model adaptation on VL models is mainly on language model components and the encoder-decoder architecture can tackle VL tasks via a unified text-generation task [62]. CLIP-BART (T5) utilizes a single-stream fusion scheme, where the language model takes the concatenation of visual representations and text representations as input. The single-stream approach enables the model to effectively integrate visual and textual information, leveraging the complementary strengths of both modalities. Specifically, CLIP-ResNet101 [54] is the vision encoder that receives resized  $224 \times 224$  images, and representations from the last convolutional layer are extracted as the visual features.  $\mathrm{BART}_{\text{base}}$  [37] and  $\mathrm{T5}_{\text{base}}$  [55] deal with the downstream text generation task.
Model Adaptation Methods. We investigate the robustness of four mainstream adaptation methods: full fine-tuning, soft prompt [36], LoRA [30], and adapter-based methods, including Adapter [29], Hyperformer [46], and Compacter [33]. To better understand their robustness, shared adaptation methods are also investigated. Specifically, for soft prompt, i.e., LoRA, and Compacters, we conduct experiments in both single and multiple manners and the half-shared manner for Adapter (Section 3). See Appendix B.2 for detailed information, e.g., training strategy and hyperparameters.
VL Task Evaluation Metrics. Accuracy on the Karpathy-test split is evaluated for VQAv2. For GQA, accuracy on the test-dev split is evaluated, and accuracy on the test-P split is used for NLVR<sup>2</sup>. In image captioning, we use CIDEr [69] on the Karpathy-test split.
Robustness Evaluation Protocol. The model performance  $P_{I}$  on  $D_{I}$  (i.e., in-distribution test datasets) and  $P_{O}$  on  $D_{O}$  (i.e., out-of-distribution test datasets) are first evaluated, where  $P$  is the corresponding evaluation metric for each task, such as CIDEr [69] for image caption. Then, the
Table 2: Clean performance and relative robustness (RR) of adaptation methods based on CLIP-BART against image (up) and text (down) corruptions. RR and the corresponding standard deviation are averaged and calculated over all image or text corruption methods. The percentage of trainable parameters for each adaptation method is also reported. We strike out those high RRs with quite low performance. The best RR for each column is in bold.
Adaptation method	Updated	VQAv2	GQA	NLVR2	MSCOCO Caption
Image Corruptions	Params	Acc (%)	RR (%)	Acc (%)	RR (%)	Acc (%)	RR (%)	CIDEr	RR (%)
Full Fine-tuning	100%	66.75	84.86±5.17	55.04	89.20±0.04	73.01	90.34±0.04	115.03	68.40±0.14
Multiple Adapters	12.22%	65.30	85.33±4.90	53.39	86.16±0.04	69.41	92.02±0.04	114.47	68.72±0.14
Half-shared Adapters	8.36%	65.20	85.18±5.01	52.96	89.37±0.04	70.03	91.72±0.04	114.50	68.45±0.14
Single Adapter	4.18%	65.35	85.76±5.32	54.14	82.49±0.04	73.89	90.04±0.05	115.04	68.68±0.14
Hyperformer	5.79%	65.38	85.38±4.84	52.52	90.05±0.04	72.21	90.13±0.05	114.89	68.74±0.14
Multiple Compactors	7.05%	64.91	85.65±4.81	52.75	88.89±0.04	69.45	91.33±0.04	115.16	68.67±0.13
Single Compacter	2.70%	64.47	85.47±4.96	52.90	82.62±0.04	69.94	92.04±0.04	113.06	69.92±0.13
Multiple LoRA	17.72%	65.44	84.78±4.86	52.05	91.15±0.04	51.32	-	115.41	68.47±0.14
Single LoRA	5.93%	65.34	84.78±4.81	53.19	82.58±0.04	73.58	90.05±0.04	114.54	69.26±0.13
Multiple Prompts	4.53%	46.81	-	34.01	-	49.87	-	108.62	67.70±0.14
Single Prompt	2.00%	44.00	-	37.54	-	51.95	-	103.70	68.56±0.13
Adaptation method	Updated	VQAv2	GQA	NLVR2
Text Corruptions	Params	Acc (%)	RR (%)	Acc (%)	RR (%)	Acc (%)	RR (%)
Full Fine-tuning	100%	66.75	73.65±22.38	55.04	66.92±24.14	73.01	87.06±11.00
Multiple Adapters	12.22%	65.30	76.62±20.66	53.39	66.93±22.43	69.41	90.14±10.19
Half-shared Adapters	8.36%	65.20	76.78±20.79	52.96	68.20±24.78	70.03	89.16±10.12
Single Adapter	4.18%	65.35	77.64±21.09	54.14	67.47±20.03	73.89	88.49±10.87
Hyperformer	5.79%	65.38	75.06±21.29	52.52	70.30±23.13	72.21	87.27±11.27
Multiple Compactors	7.05%	64.91	77.10±20.85	52.75	67.39±23.29	69.45	90.00±9.76
Single Compacter	2.70%	64.47	77.17±20.40	52.90	67.90±20.33	69.94	90.10±9.81
Multiple LoRA	17.72%	65.44	74.04±21.97	52.05	68.77±22.76	51.32	-
Single LoRA	5.93%	65.34	74.50±21.42	53.19	63.94±20.99	73.58	87.64±11.04
Multiple Prompts	4.53%	46.81	-	34.01	-	49.87	-
Single Prompt	2.00%	44.00	-	37.54	-	51.95	-
Relative Robustness  $RR = 1 - \Delta P / P_I$  [53, 4] is computed based on the clean performance  $P_I$  and corrupted performance  $P_O$ , where  $\Delta P = (P_I - P_O)$ .  $RR$  is a score ranging from 0 to 1, where  $RR = 1$  indicates that  $F$  is totally robust and  $R = 0$  means that  $F$  is not robust at all. The RR with severity 5 is reported across the main paper; detailed scores on others are in Supplementary.
6 Results and Analysis