SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Sec. 6.1 examines the robustness of each adaptation method and tries to answer the first question: Which adaptation methods perform better on which tasks with respect to both performance and robustness? Sec. 6.2 compares the robustness sensitivity on image and text corruptions and looks for the answer to how robust are the various multimodal adaptation methods against visual corruptions, language corruptions, or both? In Section 6.3, we analyze the influence on robustness given different sizes of adaptation data and trainable parameters. Especially, we aim to answer will more examples or more parameters ensure better adaptation robustness?
6.1 Robustness of Multimodal Adaptation Methods
Full fine-tuning, prompt-tuning, LoRA, and adapter-based methods are four types of adaptation methods investigated in this study, and their relative robustness against image and text corruptions are presented in Table 2. The reported relative robustness is the average value across all images or text corruption methods. Although full fine-tuning generally achieves higher clean performance, our analysis reveals that its robustness is comparatively weaker than other adaptation methods. In many cases, the adapter and hyperformer achieve better robustness with much fewer parameters and comparable clean performance. For instance, full fine-tuning's RR against text corruptions on the VQAv2 dataset is the smallest, for both CLIP-BART and CLIP-T5. Prompt tuning, despite exhibiting
high robustness, fails to perform well on the clean test dataset. The same conclusions can be drawn on corrupted data with different corruption levels, as shown in Supplementary. Please note that we have excluded robustness scores associated with very low task performance in Table 2.
Single Adapter vs Full Fine-tuning. Previous research [62] has shown that a single adapter can achieve comparable performance on the four tasks with significantly fewer parameters than full fine-tuning. When it comes to robustness, a single adapter is comparable to or slightly better than full fine-tuning on VQAv2, NLVR², and MSCOCO Caption given image corruptions. The same goes for text corruption. For example, as shown in the 4th row and 1st row in Table 2 (lower panel), a single adapter on CLIP-BART achieves an average RR of  $77.64\%$  against text corruptions on VQAv2, while full fine-tuning's RR is  $73.65\%$ . However, on GQA, a single adapter is less robust than full fine-tuning. Full fine-tuning achieves an average RR of  $89.20\%$  against image corruptions, while the RR of a single adapter is only  $82.49\%$ . Also, a single adapter's clean accuracy on GQA is lower than full fine-tuning's  $55.04\%$ . In contrast, multiple and half-shared adapters have more parameters but achieve better robustness on the four tasks than a single adapter. In conclusion, a single adapter can achieve similar or better robustness on VQAv2, NLVR², and MSCOCO Caption compared to full fine-tuning. On GQA, multiple and half-shared adapters are better.
Adapter-based Methods. Although training multiple tasks with one set of adapter layers has the least number of parameters, such a single setting might hinder the robustness on certain tasks. For instance, Single Adapter's robustness on GQA against image corruptions  $(82.49\%)$  is lower than that of the half-shared  $(89.37\%)$  and multiple settings  $(86.16\%)$ . This also applies to Single LoRA and Single Compacter. An explanation could be that the half-shared mechanism does not only learn more general representation across tasks; it also maintains task-specific knowledge. On GQA, Single LoRA's robustness against image corruptions is lower by  $8.57\%$  compared to Multiple LoRA's, and the robustness against text corruptions is lower by  $4.83\%$ . However, compared with multiple settings of LoRA and Adapter, the Hyperformer has relatively fewer parameters but achieves comparable or better robustness. Hyperformer on CLIP-T5 also obtains the best robustness results against image corruptions on all four tasks.
Robustness against Natural Dataset Distribution Shift. To provide a more realistic assessment of the robustness, an additional natural distribution shift corruption is included in our work. VQA-RAD [34] is a manually constructed dataset where clinicians asked naturally occurring questions about radiology images and provided reference answers. The images in VQA-RAD
Figure 3: The accuracy results on VQA-RAD [34] which include 11 adaptation methods on CLIP-BART (left) and 6 on CLIP-T5 (right).
are shown neither in model pre-training nor in adaptation and can be seen as a natural out-of-distribution dataset. Results in Fig. 3 are relatively low but adapters perform relatively well, such as the Single Adapter in CLIP-BART and Multiple Adapters in CLIP-T5. Full finetuning fails to generalize well in CLIP-BART compared to other adaptation methods whereas the performance of CLIP-T5 with full finetuning is the second best.
Vision-language Tasks. Among all datasets, MSCOCO Caption is the most vulnerable one against image corruptions, where all adaptation methods have decreased on average more than  $30\%$ . This is plausible as it only relies on visual information, whereas other tasks provide both visual and language information. Besides, GQA is the task with the lowest robustness performance against text corruptions. Moreover, on GQA, the extreme single-module setting fails to achieve good robustness, such as Single Adapter, Single LoRA, and Single Compacter. This indicates that information sharing with the other two datasets may hinder the robustness on GQA. To overcome such an issue, one can adopt the multiple-module manner or Hyperformer. Adaptation methods show better robustness on  $\mathrm{NLVR}^2$  compared to the other three tasks on both corruptions.
Figure 4: Relative robustness (\%) of adaptation methods based on CLIP-BART (left) and CLIP-T5 (middle) against blank corruption. We group MSCOCO Caption results from CLIP-BART and CLIP-T5 together in the right sub-figure. We omit two bars in  $\mathrm{NLVR}^2$  from the middle figure as multiple adapters and multiple compacters did not perform well.
6.2 Robustness Sensitivity to Image Corruptions and Text Corruptions
This work introduces both image and text corruptions to examine the robustness of various adaptation methods. Our experimental findings suggest a potential vulnerability of adaptation methods on multimodal VL models to text corruptions, particularly those at the character level. Across all three tasks, the adaptation methods exhibit lower robustness indicators against text corruptions. For instance, Single Adapter based on CLIP-BART has the best robustness result of  $85.76\%$  against image corruptions on VQAv2. However, although it is still the most robust adaptation method against text corruptions, the relative robustness is  $77.64\%$ . Among image corruptions, zoom blur drops the robustness the most, and within text corruptions, char-level methods are most challenging to these VL adaptation methods. Detailed analysis is in Supplementary Section 6.
Blank Image Corruption. Blank corruption evaluates the influence on the robustness of visual information in VL tasks. All datasets used in this study rely on visual information and only the MSCOCO Caption contains no language information. In blank corruption, we set the pixel values of testing image data to 255, i.e. transforming the original image into a blank image. The results are shown in Fig. 4. The relative robustness on MSCOCO Caption is the lowest among all four datasets. This is plausible since image captioning relies only on visual information and is not supposed to perform well given a blank image. Apart from image captioning, adaptation methods on all three datasets could secure relative robustness exceeding  $50\%$  in the absence of useful visual information. Several questions within the VL tasks can be accurately answered without relying on visual information, suggesting that language information plays a more significant role than visual information. This also explains the higher sensitivity to text perturbations compared to the sensitivity to image corruptions.
Compounding Effects of Multimodal Corruptions. To assess the impact of compounding distribution shifts on both the visual and text modalities, we selected a subset of corruption methods from each category and presented the results in Fig. 5. Specifically, for text corruption methods, we selectedOCR at the character level, swap syn word embed at the word level, and back translation at the sentence level. For visual corruption methods, we selected Gaussian noise in the noise category, zoom blur in the blur category, JPEG in the digital category, and snow in the weather category. We tested the full fine-tuning and single adapter on CLIP-BART and CLIP-T5. The results demonstrate that combining corruptions from two modalities can lead to a greater drop in robustness. Additionally, the results show similar trends as the single-modal corruptions. Character-level corruptions still lead to the most severe performance drop compared
Figure 5: The average performance drop given both visual and text corruptions. A darker color indicates a severe performance drop.
Figure 6: The first row represents the clean performance and relative robustness of full fine-tuning and single adapter on CLIP-BART given the different sizes of the adaptation dataset. Green lines stand for performance in each task and the orange is robustness. The second row is relative robustness given the different sizes of the adaptation dataset. The X-axis shows the random subset ratio of the training dataset during adaptation, ranging from  $20\%$  to  $100\%$ .
to sentence- and word-level corruptions. Zoom blur still drops the robustness the most among image corruptions.
6.3 The Influence of Adaptation Data Size and Parameter Size on Robustness
Adaptation Data Size. Adaptation methods are gaining more attention due to their efficient fine-tuning manner compared to full fine-tuning. We take a further step and evaluate their performance and robustness given different sizes of training data during adaptation. Fig. 6 compares the performance and robustness of full fine-tuning and single adapter. Given more adaptation data, performance in all tasks has a steady increase, and in most cases, the performance of full fine-tuning surpasses single adapter's performance, while the latter can achieve comparable performance given the whole adaptation data. Only on MSCOCO Caption, single adapter outperforms full fine-tuning given a subset of adaptation data. Single adapter achieves better RR compared to full fine-tuning against both image and text corruptions but has a robustness drop on GQA. Fig. 6 also demonstrates the robustness of other adaptation methods. All lines present a steady declining tendency, which indicates that increasing the size of the adaptation data does not consistently enhance relative robustness. Besides, the blue full fine-tuning lines take the lowest position on all three datasets given text corruptions and on VQAv2, NLVR², and MSCOCO Caption given image corruptions. In comparison to other adaptation methods, full fine-tuning has relatively lower relative robustness, despite having the most trainable parameters. The last conclusion is that there is no single adaptation method that surpasses others across all tasks and corruptions and all methods share a similar robustness fluctuation given a different size of the adaptation dataset.
Adaptation Parameter Size. Fig. 7 presents RR and clean performance of prompt-tuning given different soft prompt lengths added to the concatenated embeddings. There is a steady increase in the performance on four tasks with longer prompt lengths which proves that prompt methods perform better given more parameters. Regarding relative robustness, such a steady increase does not apply to all tasks, and longer soft prompts do not ensure better relative robustness. Fig. 7 also shows the experimental results from the other 4 adaptation methods given different sizes of trainable parameters. The results demonstrate that more parameters do not ensure enhanced robustness and some even reduce it, such as the single compacter and single adapter on GQA.
This study focuses on the robustness of adaptation methods on pre-trained vision-language models and provides 7 benchmark datasets containing 96 visual and 87 textual corruptions. We systematically inspect the robustness of 11 adaptation methods on 4 popular VL datasets and conclude that: 1) these adaptation methods are more sensitive towards text corruptions compared to visual corruptions, 2) full fine-tuning does not achieve the best robustness; instead, adapters demonstrate better robustness while maintaining comparable performance, 3) surprisingly, more adaptation data and more parameters do
Figure 7: The top row shows the clean performance and relative robustness from prompt adaptations with different prompt lengths on CLIP-BART. Blue lines stand for performance on each task and purple lines represent relative robustness. The bottom row shows the relative robustness given the different number of parameters in 4 adaptation methods. Different colors stand for different embedding sizes and larger numbers are with more parameters.
not ensure a better robustness. In fact, it can even lead to worse robustness, 4) there is currently no adaptation method achieving both the best performance and best robustness across all corruptions and all tasks. The main limitation of this work is that the analysis is on a limited number of multimodal models due to the availability of usable code, model weights, and massive experiments. Potential future work includes investigating more diverse pre-trained VL models, designing more robust adaptation methods, and integrating future model adaptation methods to make our benchmark up-to-date.
This work is partially supported by the UKRI grant: Turing AI Fellowship EP/W002981/1 and EPSRC/MURI grant: EP/N019474/1. We would also like to thank the Royal Academy of Engineering and FiveAI. We also gratefully acknowledge the computational and data resources provided by the Leibniz Supercomputing Centre (www.lrz.de).
[1] Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. Advances in Neural Information Processing Systems, 35:23716-23736, 2022.
[2] Hangbo Bao, Wenhui Wang, Li Dong, Qiang Liu, Owais Khan Mohammed, Kriti Aggarwal, Subhojit Som, Songhao Piao, and Furu Wei. Vlmo: Unified vision-language pre-training with mixture-of-modality-experts. Advances in Neural Information Processing Systems, 35:32897-32912, 2022.
[3] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
[4] Madeline Chantry, Shruti Vyas, Hamid Palangi, Yogesh Rawat, and Vibhav Vineet. Robustness analysis of video-language models against visual and language perturbations. Advances in Neural Information Processing Systems, 35:34405-34420, 2022.
[5] Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dólar, and C Lawrence Zitnick. Microsoft coco captions: Data collection and evaluation server. arXiv preprint arXiv:1504.00325, 2015.
[6] Zhe Chen, Yuchen Duan, Wenhai Wang, Junjun He, Tong Lu, Jifeng Dai, and Yu Qiao. Vision transformer adapter for dense predictions. arXiv preprint arXiv:2205.08534, 2022.
[7] Jaemin Cho, Jie Lei, Hao Tan, and Mohit Bansal. Unifying vision-and-language tasks via text generation. In International Conference on Machine Learning, pages 1931-1942. PMLR, 2021.
[71] Wenhui Wang, Hangbo Bao, Li Dong, Johan Bjorck, Zhiliang Peng, Qiang Liu, Kriti Aggarwal, Owais Khan Mohammed, Saksham Singhal, Subhojit Som, et al. Image as a foreign language: Beit pretraining for all vision and vision-language tasks. arXiv preprint arXiv:2208.10442, 2022.
[72] Xiao Wang, Qin Liu, Tao Gui, Qi Zhang, et al. Textflint: Unified multilingual robustness evaluation toolkit for natural language processing. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing: System Demonstrations, pages 347-355, Online, aug 2021. Association for Computational Linguistics.
[73] Boxi Wu, Jindong Gu, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu. Towards efficient adversarial training on vision transformers. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XIII, pages 307-325. Springer, 2022.
[74] Karren Yang, Wan-Yi Lin, Manash Barman, Filipe Condessa, and Zico Kolter. Defending multimodal fusion models against single-source adversaries. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3340-3349, 2021.
[75] Chenyu Yi, Siyuan Yang, Haoliang Li, Yap-peng Tan, and Alex Kot. Benchmarking the robustness of spatial-temporal models against corruptions. arXiv preprint arXiv:2110.06513, 2021.
[76] Elad Ben Zaken, Shauli Ravfogel, and Yoav Goldberg. Bitfit: Simple parameter-efficient fine-tuning for transformer-based masked language-models. arXiv preprint arXiv:2106.10199, 2021.
[77] Yan Zeng, Xinsong Zhang, Hang Li, Jiawei Wang, Jipeng Zhang, and Wangchunshu Zhou.  $X^{2}$ -vlm: All-in-one pre-trained model for vision-language tasks. arXiv preprint arXiv:2211.12402, 2022.
[78] Renrui Zhang, Rongyao Fang, Wei Zhang, Peng Gao, Kunchang Li, Jifeng Dai, Yu Qiao, and Hongsheng Li. Tip-adapter: Training-free clip-adapter for better vision-language modeling. arXiv preprint arXiv:2111.03930, 2021.
[79] Ce Zhou, Qian Li, Chen Li, Jun Yu, Yixin Liu, Guangjing Wang, Kai Zhang, Cheng Ji, Qiben Yan, Lifang He, et al. A comprehensive survey on pretrained foundation models: A history from bert to chatgpt. arXiv preprint arXiv:2302.09419, 2023.
A Corruption Details
A.1 Image Corruption Methods
We have incorporated 20 image corruption methods (Fig. 8) following [26, 4, 53] which can be categorized into 5 categories noise, blur, weather, digital, and extra. We also introduce 5 levels of severity (Fig. 9) to image corruption methods except for blank corruption.
Noise There are 4 different noises used in this study, namely Impulse, Gaussian, Shot, and Speckle. Impulse noise mimics the corruption caused by bit errors by introducing a mixture of salt and pepper noise, with varying intensities such as 0.03, 0.06, 0.09, 0.17, and 0.27. Gaussian noise simulates corruptions due to low-lighting conditions by pixel value normalization and normal noise addition. The intensity of this noise is scaled according to severity, with values of 0.08, 0.12, 0.18, 0.26, and 0.38. Shot noise simulates electronic noise caused by discrete light and is also called Poisson noise. Speckle noise is an additive noise where larger noise will be added if the original pixel value is larger.
Blur Zoom blur is observed when the camera swiftly moves toward an object. It blurs toward the center of the frame. Defocus blur occurs when the image is out of focus and its severity is defined by the disk radius convolved over the image ranging from (3, 0.1), (4, 0.5), (6, 0.5), (8, 0.5), (10, 0.5). Motion blur occurs when the camera is moving quickly. The blurring effect is created by a kernel with different radius and sigma ranging from (10, 3), (15, 5), (15, 8), (15, 12), (20, 15). Frosted Glass blur occurs when the glass of windows or panels frosts. Gaussian blur generates blurred pixels by a weighted average of its neighbors. The farther the neighbors are, the lower the weight in the average is.
Digital JPEG is a lossy image compression format that converts the original picture to JPEG format with quality ranging from 25, 18, 15, 10, 7 given different severity. Contrast simulates corruptions caused by the lighting conditions and object's color. Elastic stretches small image regions for stretching effects. Spatter appears when the lens is occluded by rain or mud. Pixelate transforms the original images into a small number of large pixels.
Weather Snow mimics the visual obstruction caused by precipitation. Frost occurs when lenses are covered by ice crystals. Fog obscures the object and is rendered by the diamond-square algorithm. Brightness adds a bright effect to the image simulating daylight.
Extra we introduce a new corruption method called blank that sets all pixel values to 255, i.e. turning the original image into a blank picture.
A.2 Text Corruption Methods
We have included 35 text corruptions methods following [72, 53, 4] which corrupt on 3 levels (e.g. character, word, and sentence level) and can be categorized into 3 main categories, 6 sub-categories.
Character Modification. Character modification simulates common mistakes during typing and corrupts the text on a character level and contains 9 methods, namely OCR, Punct, Typos, Keyboard, Spelling Error, char random insert, char random replace, char random swap, char random delete. OCR replaces a character based on common Optical Character Recognition (OCR) errors. Keyboard substitutes original characters based on keyboard distance.
Text Style Transformation. Methods in the text style category modify the text on a sentence level and transform the sentence style to a target one, such as turning the original sentence to passive, formal, causal, to double negative, and changing the tense.
Text Addition. Text addition inserts additional words to the original text. InsertAdv adds an adverb before each verb. AppendIrr adds irrelevant phrases to the original texts. Random Insert randomly inserts token [UNK] to the original texts.
Figure 8: We introduce 20 corruption methods to image data following the methods in [26]. Except for the blank corruption, each type of corruption has five levels of severity. In total, there are 96 different corruptions, as shown in Appendix 3
Figure 9: Examples of image and text corruptions. The top row shows an original image from GQA and images corrupted by zoom blur with 5 levels of severity. The second row presents text corruptions on the original texts where the red sign indicates the corrupted parts. More examples are shown in supplementary material.
Text Drop based on POS. Text drop transforms the text on a word level based on POS tagging [72]. There are methods of dropping nouns (DropNN), verbs (DropVB), dropping both nouns and verbs (Drop VB & NN), dropping random nos and verbs (Drop Rand NN, Drop Rand VB), keeping only nouns (Only NN), keeping only verbs (Only VB), keeping both (Only NN & VB).
Text Drop based on Position. According to the word position, there are methods of dropping the first (Drop First), dropping the last (Drop Last), dropping both the first and the last (Drop First and Last), shuffling word order (Shuffle Order), and randomly removing words (Random Delete).
Text Swap. Under the category of text swap, we can replace words randomly or with synonyms by word embedding (SwapSyn Word Embd) and WordNet [49] (SwapSyn WordNet). We also deploy back translation (Back Trans) from [72], which first translates English into French and then translates it back to English. Random Swap randomly swaps words position.
Table 3: Image Corruption Methods
Category	Corruption Method	Severity
Noise	Impulse	5
Gaussian	5
Shot	5
Speckle	5
Blur	Zoom	5
Defocus	5
Motion	5
Frosted Glass	5
Gaussian Blur	5
Digital	JPEG	5
Contrast	5
Elastic	5
Saturate	5
Spatter	5
Pixelate	5
Weather	Snow	5
Frost	5
Fog	5
Brightness	5
Extra	Blank	1
5 Category	20 Methods	96 Severity
In addition to the above corruptions, Qiu et al. proposed in [53] that we should ensure the corrupted text has the same semantics as the original one to make sure the image-text pairs remain meaningful. We follow this setting and use the same fidelity guarantee mechanism as [53].
B Model Implementations
B.1 CLIP-BART/T5