user: text: Write a concise one-sentence TLDR summary of the scientific paper content below.

Title: Grouping-By-ID: Guarding Against Adversarial Domain Shifts

Paper content:
When training a deep neural network for supervised image classification, one can broadly distinguish between two types of latent features of images that will drive the classification of class Y. Following the notation of Gong et al. (2016), we can divide features broadly into the classes of
(i) “core” or “conditionally invariant” features X^ci whose distribution P(X^ci | Y) does not change substantially across domains and
(ii) “style” or “orthogonal” features X^orth whose distribution P(X^orth | Y) can change substantially across domains.
These latter orthogonal features would generally include features such as position, rotation, image quality or brightness but also more complex ones like hair color or posture for images of persons.
We try to guard against future adversarial domain shifts by ideally just using the “conditionally invariant” features for classification.
In contrast to previous work, we assume that the domain itself is not observed and hence a latent variable.
We can hence not directly see the distributional change of features across different domains.
We do assume, however, that we can sometimes observe a so-called identifier or ID variable.
We might know, for example, that two images show the same person, with ID referring to the identity of the person.
In data augmentation, we generate several images from the same original image, with ID referring to the relevant original image.
The method requires only a small fraction of images to have an ID variable.
We provide a causal framework for the problem by adding the ID variable to the model of Gong et al. (2016).
However, we are interested in settings where we cannot observe the domain directly and we treat domain as a latent variable.
If two or more samples share the same class and identifier, (Y, ID)=(y,i), then we treat those samples as counterfactuals under different style interventions on the orthogonal or style features.
Using this grouping-by-ID approach, we regularize the network to provide near constant output across samples that share the same ID by penalizing with an appropriate graph Laplacian.
This is shown to substantially improve performance in settings where domains change in terms of image quality, brightness, color changes, and more complex changes such as changes in movement and posture.
We show links to questions of interpretability, fairness and transfer learning.
Deep neural networks (DNNs) have achieved outstanding performance on prediction tasks like visual object and speech recognition BID24 BID15 BID18 .
Issues can arise when the learned representations rely on dependencies that vanish in test distributions (e.g. see BID11 and references therein).
Such domain shifts can be caused by changing conditions, e.g. color, background or location changes arising when deploying the machine learning (ML) system in production.
Predictive performance is then likely to degrade.
For instance, the "Russian tank legend" is an example where the training data was subject to sampling biases that were not replicated in the real world.
Concretely, the story relates how a machine learning system was trained to distinguish between Russian and American tanks from photos.
The accuracy was very high but only due to the fact that all images of Russian tanks were of bad quality while the photos of American tanks were not.
The system learned to discriminate between images of different qualities but would have failed badly in practice BID12 1 .Hidden
confounding factors like in the example above between image quality and the origin of the tank give rise to indirect associations. These
are arguably one reason why deep learning requires large sample sizes as large sample sizes tend to ensure that the effect of the confounding factors averages out (although a large sample size is clearly not per se a guarantee that the confounding effect will become weaker). A large
sample size is also required if one is trying to achieve invariance to known factors like translation, point of view, and rotation by using data augmentation. Another
related example where human and artificial cognition deviate strongly are adversarial examplesimperceptibly but intentionally perturbed inputs that are misclassified by a ML model (Szegedy et al., 2014; . Adversarial
examples do not fool humans and in general we only need to see one rotated example of the same object to achieve invariance to rotations in our perception. Our starting
point is the question whether we can in a simple way mimic the human ability to learn desired invariances from a few instances of the same object and whether we can better align the features DNNs exploit with human cognition.Considerations of fairness and discrimination might be another reason why we are interested in controlling that certain characteristics of the input data are not included in the learned representations and thus have no impact on the resulting decisions BID3 BID21 . Unfortunately
, existing biases in datasets used for training ML algorithms tend to be replicated in the estimated models BID7 . For instance
, in June 2015 Google's photo app tagged two non-white people as "gorillas"-most likely because the training examples for "people" were mainly photos of white persons, making "color" predictive for the class label BID10 BID12 . A human would
not make the same mistake after only seeing one instance of a non-white person.Addressing the issues outlined above, we propose counterfactual regularization (CORE) to control what latent features an estimator extracts from the input data. Conceptually,
we take a causal view of the data generating process and categorize the latent data generating factors into 'conditionally invariant' (core) and 'orthogonal' (style) features, as in BID14 . It is desirable
that a classifier uses only the core features as they pertain to the target of interest in a stable and coherent fashion. CORE yields an
estimator which is invariant to factors of variation corresponding to style features. Consequently,
it is robust with respect to adversarial domain shifts, arising through arbitrarily strong interventions on the style features. CORE relies on
the fact that for certain datasets we can observe "counterfactuals" in the sense that we observe the same object under different conditions. Rather than pooling
over all examples, CORE exploits knowledge about this grouping, i.e. that a number of instances relate to the same object.The remainder of this manuscript is structured as follows: §2 starts with two motivating examples, showing how CORE can reduce the need for data augmentation and help predictive performance in small sample size settings. In §3 we review related
work and in §4 we formally introduce counterfactual regularization, along with the CORE estimator and theoretical insights for the logistic regression setting. In §5 we further evaluate
the performance of CORE in a variety of experiments.
Distinguishing the latent features in an image into core and style features, we have proposed counterfactual regularization (CORE) to achieve robustness with respect to arbitrarily large interventions on the style or conditionally invariant features.
The main idea of the CORE estimator is to exploit the fact that we often have instances of the same object in the training data.
By demanding invariance of the classifier amongst a group of instances that relate to the same object, we can achieve invariance of the classification performance with respect to adversarial interventions on style features such as image quality, fashion type, color, or body posture.
The training also works despite sampling biases in the data.There are two main applications areas.
If the style features are known explicitly, we can achieve the same classification performance as standard data augmentation approaches but using fewer instances which, on top, do not have to be carefully balanced in the training data.
Perhaps more interestingly, if the style features are unknown, the regularization of CORE avoids usage of them automatically by penalizing features that vary strongly between different instances of the same object in the training data.An interesting line of work would be to use larger models such as Inception or large ResNet architectures BID15 BID19 .
These models have been trained to be invariant to an array of explicitly defined style features.
In §B.1 we include results which show that using Inception V3 features does not guard against interventions on more implicit style features.
We would thus like to assess what benefits CORE can bring for training Inception-style models end-to-end, both in terms of sample efficiency and in terms of generalization performance.While we showed some examples where the necessary grouping information is available, an interesting possible future direction would be to use video data since objects display temporal constancy and the temporal information can hence be used for grouping and counterfactual regularization.
Potentially an analogous approach could also help to debias word embeddings.

assistant: text: This paper aims at robust image classification against adversarial domain shifts and the goal is achieved by avoiding using the changing style features.