SlowGuess/NeurIPS_2023_OCR huggingface dataset:
our analysis, we suggest that this principle explains the model's under-fitting on HFC: the model prioritizes utilizing LFC with higher information entropy to improve its capacity for fitting unknown data, leading to the observed under-fitting in high frequencies. To address under-fitting in HFC, we aim to increase the amount of information, and the maximum entropy principle offers a solution.
Theorem 2 Given the prior data  $\xi$ , and its corresponding probability distribution  $p(\xi)$ , the principle of maximum entropy consider the following optimization:  $\hat{p} = \{\arg \max_{p \in \mathbb{P}} H(p) \mid p(\xi) \geq 0, \int_{\Omega} p(\xi) d\xi = 1, \int_{\Omega} p(\xi) r_i(\xi) d\xi = \alpha_i, i = 1, \dots, m\}$ . Without considering the moment constraints, the uniform distribution  $p(\xi) = \frac{1}{\xi_h - \xi_l} 1_{[\xi_l, \xi_h]}(\xi)$  satisfies the principle of maximum entropy.
Theorem 2 demonstrates that a uniform distribution with balanced information adheres to the maximum entropy principle when fitting an unknown distribution. Intuitively, this corresponds to fair learning for tail classes, which has been extensively studied in deep long-tailed learning to improve tail class generalization using techniques like re-weighting or re-sampling. This insight drives us to tackle the under-fitting issue of HFC by redistributing spectral energy through a balanced sampling strategy.
4 Methodology and Experiments
4.1 Balanced Spectrum Sampling (BaSS)
Previous analyses encourage us to HFC learning by balancing the power spectral density. Nonetheless, it is essential to consider the potential negative effects of noise present in the image while implementing a balanced spectrum. Noise components, often found in ultra-high-frequency parts, have been proven less beneficial for classification tasks [39, 29]. Moreover, uniformly allocating noise and other frequency components may (i) amplify noise influence on model learning, and (ii) allocate less energy to remaining frequency bands, both negatively impacting model learning. To address these challenges and achieve spectral balance, we propose a spectral sampling strategy in this subsection.
$$
\hat {\pi} _ {i} = \frac {\log_ {\tau} A I \left(r _ {i}\right)}{\sum_ {j = 1} ^ {B} \log_ {\tau} A I \left(r _ {j}\right)} \tag {4}
$$
Sampling Strategy. For the  $i^{\mathrm{th}}$  frequency band, we sample the power spectral density according to Eq. 4 with a probability of  $\hat{\pi}_i$ , where  $\tau \geq 1$  denotes the base and  $B$  is the maximum frequency band of the spectrum. Our approach is inspired by two background pieces of knowledge: solutions for the long-tail distribution of image categories and image sampling. The solution for the class-wise long-tail distribution adjusts the sampling frequency of samples with different class quantities through the inverse weighting of category quantities. However, features in images (like spatial pixels and spectral density) can not usually be directly chosen via the sampling theorem. Therefore, we refer to the method of sampling image pixels in the spatial domain: (i) discretizing image features that corresponds to the spectrum obtained from the Fourier transform; (ii) selecting and combining feature values from different regions: we re-weight features at different frequency bands based on the sampling probability  $\hat{\pi}_i$  and obtain a new image through the inverse Fourier transform.
Specifically, we employ a logarithmic function to: (i) establish a smooth connection between the power density of head and tail parts, mitigating the impact of ultra-high frequency components on the overall distribution, and (ii) adjust spectral power values in the head part to a reasonable range, while diminishing the power disparity between head and tail frequency bands, yielding a more balanced distribution overall.
4.2 Working Mechanism Exploration of BaSS
In this subsection, we validate the potential of the Balanced Spectrum Sampling strategy (BaSS). Specifically, we examine two paradigms for utilizing the sampled images: (i) Data augmentation, where each training image is performed by BaSS with a probability of  $\gamma$ . In this paradigm, the model will be validated on a test set comprised only of natural images. (ii) New dataset, where both the training and testing sets consist entirely of sampled images.
Experiments Settings. We refer to the dataset performing BaSS on CIFAR10 [25] as CIFAR10-B. For different values of  $\gamma$ , we obtain a set of ResNet-18 [19] models with standard training. We
(b)
Figure 3: Results of exploring potentiation of BaSS. (a) clean data accuracy, (b) robust accuracy evaluated on CIFAR10-C, (c) robust accuracy against PGD attack with 20 steps, and (d) clean and robust acc comparison on CIFAR10 and CIFAR10-B
(a)  $\gamma = 0.25$
Figure 4: Visualization of Loss Landscape on models that training with CIFAR10-B as data augmentation at a ratio of  $\gamma$ . The black star symbol represents model parameters  $\theta$ .
(c)  $\gamma = 0.75$
use clean accuracy, corruption robustness and adversarial robustness as the metric to measure the potential of BaSS strategy. Specifically, (i) the clean accuracy is evaluated on both CIFAR10 and CIFAR10-B test set. (ii) To evaluate the corruption robustness, we first construct a corruption version for CIFAR10-B, referring to the construction method of CIFAR10-C [20] and denotes as CIFAR10-B-C. We then calculate the mean accuracy across 19 corruption types and 5 severities from CIFAR10-C and CIFAR10-B-C. (iii) We perform PGD attack [30] with 20 steps and  $\ell_{\infty}$  constraint  $\epsilon = 1 / 255, 2 / 255, 4 / 255, 8 / 255$  to evaluate adversarial robustness.
CIFAR10-B as Data Augmentation. The results in Fig. 4 indicate that as the proportion of CIFAR10-B images increases (from Fig. 4(a) to Fig. 4(c)), the model converges more on the high-frequency components (the black stars are closer to the local minimum). The results from Fig. 3(a), Fig.3(b) and Fig. 3(c) indicate that the data-augmented model achieves a better trade-off between robustness and accuracy. Specially, the corruption robustness is improved across all categories, further achieving a more balanced performance. The enhancement of adversarial robustness under small perturbation (e.g.,  $\epsilon = 1 / 255$ , 2/55) is quite significant, with the improvement magnitude positively correlated with the mixing ratio. However, the issue of model robustness under large perturbations still remains.
CIFAR10-B as an New Dataset. The naturally trained model achieves a better robustness-accuracy trade-off on the CIFAR10-B than on the CIFAR-10 dataset, as shown in Fig.3(d). What attracts us is the improvement in adversarial robustness. From the more detailed results in the Appendix F.2.1, the performance of CIFAR10-B is superior to that of CIFAR-10 and all mixed datasets. Based on the analysis shown in the Appendix F.2.1, we observed that the model trained on the CIFAR10-B dataset has a more balanced gradient distribution across different frequency domains. This indicates that when facing adversarial attacks, the model's vulnerabilities aren't concentrated in the high-frequency direction of the image. As a result, the adversarial attack process needs to generate adversarial noise containing patterns from multiple frequency domains. This insight suggests that we use the CIFAR10-B dataset in place of the original dataset during the adversarial training process.
4.3 BaSS Working in Conjunction with Adversarial Training
Adversarial Training has been the most successful defense strategy, where models are explicitly trained to be robust in the presence of adversarial attacks [30, 2, 34, 45]. In this subsection, We utilize the BaSS strategy to modify the input image and train the models in conjunction with PGD-AT [30], TRADES [45] and MART [40].
Table 1: Clean and Robust Accuracy(%) on CIFAR10 and CIFAR100.
CIFAR10	ResNet-18	WRN-34	CIFAR100	ResNet-18	WRN-34
Clean	PGD20	AA	Clean	PGD20	AA	Clean	PGD20	AA	Clean	PGD20	AA
PGD-AT	83.50	52.72	48.90	86.71	55.13	51.98	PGD-AT	56.33	29.29	24.88	61.78	30.48	27.93
+BaSS	89.22	59.61	55.90	91.08	63.65	60.91	+BaSS	63.91	31.61	27.95	67.07	34.87	32.21
Δ	+5.72	+6.89	+7.00	+4.37	+8.52	+8.93	Δ	+7.58	+2.32	+3.07	+5.29	+4.39	+4.28
TRADES	82.15	52.50	49.05	85.66	56.54	53.77	TRADES	58.30	29.90	25.52	61.06	31.83	27.09
+BaSS	87.20	60.01	56.27	91.20	65.38	62.69	+BaSS	64.17	32.94	27.77	69.01	37.03	33.03
Δ	+5.05	+7.51	+7.22	+5.54	+8.84	+8.92	Δ	+5.87	+3.04	+2.25	+7.95	+5.20	+5.94
MART	81.38	54.74	49.48	83.78	56.75	51.42	MART	57.80	30.73	26.26	58.10	33.46	28.36
+BaSS	88.75	60.43	56.93	89.63	63.71	59.09	+BaSS	63.94	32.95	28.01	64.02	37.79	32.20
Δ	+7.37	+5.69	+7.45	+5.85	+6.96	+7.67	Δ	+6.14	+2.22	+1.75	+5.92	+4.33	+3.84
Table 2: State-of-the-art performance on CIFAR10 and CIFAR100.
Method	CIFAR10	CIFAR100
Clean	AA	Clean	AA
DAJAT[2]	88.71	58.04	68.75	31.85
PORT[34]	86.68	60.27	65.93	31.15
Ours	91.20	62.69	69.01	33.03
Table 3: Clean and Robust Accuracy(%) on Restricted-ImageNet.
Method	Restricted-ImageNet
PGD-AT	+BaSS	TRADES	+BaSS
Clean	65.13	66.76	64.79	66.90
\( PGD^{20} \)	49.44	57.63	51.71	57.96
AA	33.37	41.77	35.50	42.80
Experiment Settings: We conducted experiments on the following three datasets: CIFAR10, CIFAR100 [25] and Restricted-ImageNet [12], using ResNet-18, WideResNet-34-10 [44] and ResNet-50 [19] as backbone. We compare the performance of our method with the baseline defenses PGD-AT [30], TRADES [45], MART [40], and also state-of-the-art defenses DAJAT [2] and PORT [34] from the Robust Bench leaderboard [10]. To fairly evaluate each model, we assessed (a) clean accuracy (i.e., clean test data), robust accuracy under (b)  $PGD^{20}$  attack, the PGD attack [30] with 20 steps and (c) AutoAttack(AA) [11]. The  $\ell_{\infty}$  attack perturbation was bounded to  $\epsilon = 8 / 255$  with a step size of 2/255 in both the training and test processes of CIFAR-10 and CIFAR-100. For Restricted-ImageNet,  $\epsilon = 4 / 255$  with a step size of 1/255. Detailed settings are available in the Appendix F.2.2.
Results. As shown in Tab. 1 and Tab. 2, by processing the dataset with BaSS strategy, our method consistently achieves a better robust-accuracy trade-off across datasets and architectures. Moreover, as shown in Tab. 3, our approach trained with WRN-34-10 achieves state-of-the-art performance compared with existing defenses on CIFAR10 and CIFAR100. Adversarial training has been observed to exhibit a more pronounced data hunger compared to natural training [2]. Existing defense methods that are capable of improving both generalization and robustness performance typically involve adversarial training on an enlarged training set [41, 18], which is accompanied by a substantial training overhead. It is worth noting that BaSS strategy barely increases the training cost (including the training time and the data size, comparison details are available in the Appendix F.2.2), and achieve a competitive performance. This further demonstrates the effectiveness of BaSS.
4.4 BaSS Working in Conjunction with AugMix
AugMix [21] generates complex and diverse images through data augmentation, improving the model's robustness to different types of corruption. Specifically, for the original data  $x$ ,  $x_{augmix}$  are generated by combining multiple simple data augmentation, then a consistency constraint is applied to the  $x_{augmix}$  and  $x$  during the training process. Experiments typically involve two AugMix processes to obtain  $x_{augmix1}$  and  $x_{augmix2}$ . To verify that our method of increasing data information, BaSS can be combined with the AugMix method, we perform BaSS operations on one of the augmented input data  $x$  to obtain  $x^b$  and then perform AugMix to obtain  $x_{augmix1}^b$ . The model training process constrains the consistency of  $x$ ,  $x_{augmix1}^b$ , and  $x_{augmix2}$ .
Experiment Settings: We conduct experiments on CIFAR10 and CIFAR100, and utilize CIFAR10-B and CIFAR100-B in training process as mentioned above. We use various architectures including ResNet-50, WideResNet-40-2, DenseNet-29 [22], and ResNeXt [42]. During the testing phase, we
Table 4: AugMix improves both clean accuracy and corruption robustness combined with BaSS.
Dataset	Model	Method	Clean(%)	Robust Acc (%)
Noise	Blur	Weather	Digital	Mean
CIFAR10	WRN-40-2	AugMix	95.66	84.62	91.31	91.95	90.90	89.91
+BaSS	95.83	88.66	91.37	93.04	90.77	90.96
DenseNet	AugMix	95.79	83.08	90.54	91.72	90.00	89.05
+BaSS	95.99	88.36	91.47	93.14	90.53	90.87
ResNeXt-29	AugMix	96.29	82.99	91.63	92.62	91.38	89.94
+BaSS	96.08	89.37	92.10	93.43	90.94	91.44
ResNet-50	AugMix	95.95	85.15	91.56	92.21	91.37	90.29
+BaSS	96.00	89.85	91.90	93.27	91.53	91.64
CIFAR100	WRN-40-2	AugMix	77.53	55.43	69.08	68.24	67.13	65.41
+BaSS	77.90	60.38	69.07	70.74	66.92	66.91
DenseNet	AugMix	77.46	51.83	67.74	67.49	65.19	63.53
+BaSS	78.44	59.08	68.89	70.31	65.93	66.19
ResNeXt-29	AugMix	78.68	55.93	70.12	68.82	67.92	66.16
+BaSS	80.17	60.02	71.27	72.47	68.38	68.24
ResNet-50	AugMix	79.01	58.90	71.26	69.95	69.74	67.90
+BaSS	80.83	64.95	72.24	73.33	69.96	70.21
evaluated the clean accuracy on the test sets of CIFAR10 and CIFAR100, and assessed the corruption robustness on CIFAR10-C and CIFAR100-C [20] datasets.
Results. Our method further improves the performance of AugMix as shown in Tab. 4, achieving a better trade-off between generalization and robustness across all model structures. Different classes of corruption usually have their own frequency-domain characteristics [43], thus leads to a bias towards a certain type of corruption in existing defense methods (e.g., adversarial training and AugMix). Notably, our method significantly enhances the model's capabilities in defending against high-frequency patterns corruption (e.g., improving Noise corruption robustness by approximately  $4\%$ ). This improvement enables the model to achieve a more balanced defense, indicating that our method has indeed enhanced in learning HFC.
We noticed that the BaSS strategy did not help the model's robustness in the "Digital" column of the in Tab. 4. Different types of perturbations usually act on different frequency bands of the image[43], bringing the challenge of diversity of frequency domain information. The Fourier heatmaps [43] show that the type of "Digital" corruption have a common feature: irregular range perturbations exist from low to high frequencies in the image. AugMix resists the above-mentioned irregular frequency band perturbations more efficiently by adopting random data augmentation strategies, producing images with better diversity in frequency domain information. The BaSS method we provided replaced one of the random data augmentation branches in AugMix, thus affecting the original performance of AugMix under the "Digital" type perturbations to some extent.
In this paper, we have gained a deeper understanding of the relationship between high frequency components (HFC) and model robustness by defining the frequency long-tailed problem. Observations and analyses have revealed that (i) the high sensitivity to HFC stems from the model's under-fitting behavior of HFC, (ii) the cause of the model's under-fitting behavior is attributes to the limited information content of HFC. Based on these insights, we have proposed a balanced spectrum sampling strategy (BaSS) that effectively improves the trade-off between robustness and accuracy when combined with different training paradigms. Our current results are mainly focused on the image classification tasks while we believe it is also rewarding to develop new techniques to other vision tasks. We also expect that this work could inspire a future explanations and defense method from model perspective such as, exploring model-side improvement that can work with BaSS strategy.
This work is supported by the Beijing Natural Science Foundation (No.JQ20023) and the National Natural Science Foundation of China (No. 61832002).