DEFENDING AGAINST IMAGE CORRUPTIONS THROUGH ADVERSARIAL AUGMENTATIONS
Year: 2021

Abstract:
Modern neural networks excel at image classification, yet they remain vulnerable to common image corruptions such as blur, speckle noise or fog. Recent methods that focus on this problem, such as AugMix and DeepAugment, introduce defenses that operate in expectation over a distribution of image corruptions. In contrast, the literature on `p-norm bounded perturbations focuses on defenses against worst-case corruptions. In this work, we reconcile both approaches by proposing AdversarialAugment, a technique which optimizes the parameters of image-to-image models to generate adversarially corrupted augmented images. We theoretically motivate our method and give sufficient conditions for the consistency of its idealized version as well as that of DeepAugment. Classifiers trained using our method in conjunction with prior methods (AugMix & DeepAugment) improve upon the state-of-the-art on common image corruption benchmarks conducted in expectation on CIFAR-10-C and also improve worst-case performance against `p-norm bounded perturbations on both CIFAR-10 and IMAGENET.

heading: 1 INTRODUCTION
text: By following a process known as Empirical Risk Minimization (ERM) (Vapnik, 1998), neural networks are trained to minimize the average error on a training set. ERM has enabled breakthroughs in a wide variety of fields and applications (Goodfellow et al., 2016; Krizhevsky et al., 2012; Hinton et al., 2012), ranging from ranking content on the web (Covington et al., 2016) to autonomous driving (Bojarski et al., 2016) via medical diagnostics (De Fauw et al., 2018). ERM is based on the principle that the data used during training is independently drawn from the same distribution as the one encountered during deployment. In practice, however, training and deployment data may differ and models can fail catastrophically. Such occurrence is commonplace as training data is often collected through a biased process that highlights confounding factors and spurious correlations (Torralba et al., 2011; Kuehlkamp et al., 2017), which can lead to undesirable consequences (e.g., http://gendershades.org).
As such, it has become increasingly important to ensure that deployed models are robust and generalize to various input corruptions. Unfortunately, even small corruptions can significantly affect the performance of existing classifiers. For example, Recht et al. (2019); Hendrycks et al. (2019) show that the accuracy of IMAGENET models is severely impacted by changes in the data collection process, while imperceptible deviations to the input, called adversarial perturbations, can cause neural networks to make incorrect predictions with high confidence (Carlini & Wagner, 2017a;b; Goodfellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014). Methods to counteract such effects, which mainly consist of using random or adversarially-chosen data augmentations, struggle. Training against corrupted data only forces the memorization of such corruptions and, as a result, these models fail to generalize to new corruptions (Vasiljevic et al., 2016; Geirhos et al., 2018).
Recent work from Hendrycks et al. (2020b) (also known as AugMix) argues that basic pre-defined corruptions can be composed to improve the robustness of models to common corruptions. Another line of work, DeepAugment (Hendrycks et al., 2020a), corrupts images by passing them through two specific image-to-image models while distorting the models’ parameters and activations using an extensive range of manually defined heuristic operations. While both methods perform well on average on the common corruptions present in CIFAR-10-C and IMAGENET-C, they generalize poorly to the adversarial setting. Most recently, Laidlaw et al. (2021) proposed an adversarial training
method based on bounding a neural perceptual distance (i.e., an approximation of the true perceptual distance), under the acronym of PAT for Perceptual Adversarial Training. Their method performs well against five diverse adversarial attacks, but, as it specifically addresses robustness to pixel-level attacks that directly manipulate image pixels, it performs worse than AugMix on common corruptions. In this work, we address this gap. We focus on training models that are robust to adversarially-chosen corruptions that preserve semantic content. We go beyond conventional random data augmentation schemes (exemplified by Hendrycks et al., 2020b;a) and adversarial training (exemplified by Madry et al., 2018; Gowal et al., 2019; Laidlaw et al., 2021) by leveraging image-to-image models that can produce a wide range of semantically-preserving corruptions; in contrast to related works, our method does not require the manual creation of heuristic transformations. Our contributions are as follows:
• We formulate an adversarial training procedure, named AdversarialAugment (or AdA for short) which finds adversarial examples by optimizing over the weights of any pre-trained image-to-image model (i.e. over the weights of arbitrary autoencoders).
• We give sufficient conditions for the consistency of idealized versions of our method and DeepAugment, and provide PAC-Bayesian performance guarantees, following Neyshabur et al. (2017). Our theoretical considerations highlight the potential advantages of AdA over previous work (DeepAugment), as well as the combination of the two. We also establish links to Invariant Risk Minimization (IRM) (Arjovsky et al., 2020), Adversarial Mixing (AdvMix) (Gowal et al., 2019) and Perceptual Adversarial Training (Laidlaw et al., 2021).
• We improve upon the known state-of-the-art on CIFAR-10-C by achieving a mean corruption error (mCE) of 7.83% when using our method in conjunction with others (vs. 23.51% for Perceptual Adversarial Training (PAT), 10.90% for AugMix and 8.11% for DeepAugment). On IMAGENET we show that our method can leverage 4 pre-trained image-to-image models simultaneously (VQVAE (van den Oord et al., 2017), U-Net (Ronneberger et al., 2015), EDSR (Lim et al., 2017) & CAE (Theis et al., 2017)) to yield the largest increase in robustness to common image corruptions, among all evaluated models.
• On `2 and `∞ norm-bounded perturbations we significantly improve upon previous work (DeepAugment & AugMix) using AdA (EDSR), while slightly improving generalization performance on both IMAGENET-V2 and on CIFAR-10.1.

heading: 2 RELATED WORK
text: Data augmentation. Data augmentation has been shown to reduce the generalization error of standard (non-robust) training. For image classification tasks, random flips, rotations and crops are commonly used (He et al., 2016a). More sophisticated techniques such as Cutout of DeVries & Taylor (2017) (which produces random occlusions), CutMix of Yun et al. (2019) (which replaces parts of an image with another) and mixup of Zhang et al. (2018a); Tokozume et al. (2018) (which linearly interpolates between two images) all demonstrate extremely compelling results. Guo et al. (2019) improved upon mixup by proposing an adaptive mixing policy. Works, such as AutoAugment (Cubuk
et al., 2019) and the related RandAugment (Cubuk et al., 2020), learn augmentation policies from data directly. These methods are tuned to improve standard classification accuracy and have been shown to work well on CIFAR-10, CIFAR-100, SVHN and IMAGENET. However, these approaches do not necessarily generalize well to larger data shifts and perform poorly on benign corruptions such as blur or speckle noise (Taori et al., 2020).
Robustness to synthetic and natural data shift. Several works argue that training against corrupted data only forces the memorization of such corruptions and, as a result, models fail to generalize to new corruptions (Vasiljevic et al., 2016; Geirhos et al., 2018). This has not prevented Geirhos et al. (2019); Yin et al. (2019); Hendrycks et al. (2020b); Lopes et al. (2019); Hendrycks et al. (2020a) from demonstrating that some forms of data augmentation can improve the robustness of models on IMAGENET-C, despite not being directly trained on these common corruptions. Most works on the topic focus on training models that perform well in expectation. Unfortunately, these models remain vulnerable to more drastic adversarial shifts (Taori et al., 2020).
Robustness to adversarial data shift. Adversarial data shift has been extensively studied (Goodfellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2019; Papernot et al., 2016; Madry et al., 2018). Most works focus on the robustness of classifiers to `p-norm bounded perturbations. In particular, it is expected that a robust classifier should be invariant to small perturbations in the pixel space (as defined by the `p-norm). Goodfellow et al. (2015) and Madry et al. (2018) laid down foundational principles to train robust networks, and recent works (Zhang et al., 2019; Qin et al., 2019; Rice et al., 2020; Wu et al., 2020; Gowal et al., 2020) continue to find novel approaches to enhance adversarial robustness. However, approaches focused on `p-norm bounded perturbations often sacrifice accuracy on non-adversarial images (Raghunathan et al., 2019). Several works (Baluja & Fischer, 2017; Song et al., 2018; Xiao et al., 2018; Qiu et al., 2019; Wong & Kolter, 2021b; Laidlaw et al., 2021) go beyond these analytically defined perturbations and demonstrate that it is not only possible to maintain accuracy on non-adversarial images but also to reduce the effect of spurious correlations and reduce bias (Gowal et al., 2019). Unfortunately, most aforementioned approaches perform poorly on CIFAR-10-C and IMAGENET-C.

heading: 3 DEFENSE AGAINST ADVERSARIAL CORRUPTIONS
text: In this section, we introduce AdA, our approach for training models robust to image corruptions through the use of adversarial augmentations while leveraging pre-trained autoencoders. In Appendix A we detail how our work relates to AugMix (Hendrycks et al., 2020b), DeepAugment (Hendrycks et al., 2020a), Invariant Risk Minimization (Arjovsky et al., 2020), Adversarial Mixing (Gowal et al., 2019) and Perceptual Adversarial Training (Laidlaw et al., 2021).
Corrupted adversarial risk. We consider a model fθ : X → Y parametrized by θ. Given a dataset D ⊂ X × Y over pairs of examples x and corresponding labels y, we would like to find the parameters θ which minimize the corrupted adversarial risk:
E(x,y)∼D [
max x′∈C(x)
L(fθ(x ′), y) ] , (1)
where L is a suitable loss function, such as the 0-1 loss for classification, and C : X → 2X outputs a corruption set for a given example x. For example, in the case of an image x, a plausible corruption set C(x) could contain blurred, pixelized and noisy variants of x. In other words, we seek the optimal parameters θ∗ which minimize the corrupted adversarial risk so that fθ∗ is invariant to corruptions; that is, fθ∗(x′) = fθ∗(x) for all x′ ∈ C(x). For example if x is an image classified to be a horse by fθ∗ , then this prediction should not be affected by the image being slightly corrupted by camera blur, Poisson noise or JPEG compression artifacts.
AdversarialAugment (AdA). Our method, AdA, uses image-to-image models to generate adversarially corrupted images. At a high level, this is similar to how DeepAugment works: DeepAugment perturbs the parameters of two specific image-to-image models using heuristic operators, which are manually defined for each model. Our method, instead, is more general and optimizes directly over perturbations to the parameters of any pre-trained image-to-image model. We denote these
image-to-image models as corruption networks. We experiment with four corruption networks: a vector-quantised variational autoencoder (VQ-VAE) (van den Oord et al., 2017); a convolutional U-Net (Ronneberger et al., 2015) trained for image completion (U-Net), a super-resolution model (EDSR) (Lim et al., 2017) and a compressive autoencoder (CAE) (Theis et al., 2017). The latter two models are used in DeepAugment as well. Additional details about the corruption networks are provided in the Appendix in section C.
Formally, let cφ : X → X be a corruption network with parameters φ = {φi}Ki=1 which, when its parameters are perturbed, acts upon clean examples by corrupting them. Here each φi corresponds to the vector of parameters in the i-th layer, and K is the number of layers. Let δ = {δi}Ki=1 be a weight perturbation set, so that a corrupted variant of x can be generated by c{φi+δi}Ki=1(x). With a slight abuse of notation, we shorten c{φi+δi}Ki=1 to cφ+δ . Clearly, using unconstrained perturbations can result in exceedingly corrupted images which have lost all discriminative information and are not useful for training. For example, if cφ is a multi-layer perceptron, trivially setting δi = −φi would yield fully zero, uninformative outputs. Hence, we restrict the corruption sets by defining a maximum relative perturbation radius ν > 0, and define the corruption set of AdA as C(x) = {cφ+δ(x) | ‖δ‖2,φ ≤ ν}, where the norm ‖ · ‖2,φ is defined as ‖δ‖2,φ = maxi∈{1,...,K} ‖δi‖2/‖φi‖2.
Finding adversarial corruptions. For a clean image x with label y, a corrupted adversarial example within a bounded corruption distance ν is a corrupted image x′ = cφ+δ(x) generated by the corruption network c with bounded parameter offsets ‖δ‖2,φ ≤ ν which causes fθ to misclassify x: fθ(x′) 6= y. Similarly to Madry et al. (2018), we find an adversarial corruption by maximizing a surrogate loss L̃ to L, for example, the cross-entropy loss between the predicted logits of the corrupted image and its clean label. We optimize over the perturbation δ to c’s parameters φ:
max ‖δ‖2,φ≤ν L̃(fθ(cφ+δ(x)), y). (2)
In practice, we solve this optimization problem (approximately) using projected gradient ascent to enforce that perturbations δ lie within the feasible set ‖δ‖2,φ ≤ ν. Examples of corrupted images obtained by AdA are shown in Figure 1.
Adversarial training. Given the model f parameterized by θ, minimizing the corrupted adversarial risk from (1) results in parameters θ∗ obtained by solving the following optimization problem:
θ∗= arg min θ
E(x,y)∼D [
max ‖δ‖2,φ≤ν
L̃(fθ(cφ+δ(x)), y) ] . (3)
We also provide a full algorithm listing of our method in Appendix B.
Meaningful corruptions. A crucial element of AdA is setting the perturbation radius ν to ensure that corruptions are varied enough to constitute a strong defense against common corruptions, while still being meaningful (i.e., without destroying semantics). We measure the extent of corruption induced by a given ν through the structural similarity index measure (SSIM) (Wang et al., 2004) between clean and corrupted images (details on how SSIM is computed can be found in section E).We plot the distributions of SSIM over various perturbation radii in Figure 2 for corrupted images produced by AdA using two backbones (EDSR and CAE) on CIFAR-10. We find that a relative perturbation radius of ν = .015 yields enough variety in the corruptions for both EDSR and CAE. This is demonstrated for EDSR by having a large SSIM variance compared to, e.g. ν = 0.009375, without destroying semantic meaning (retaining a high mean SSIM). We guard against unlikely but too severe corruptions (i.e. with too low SSIM) using an efficient approximate line-search procedure (details can be found Appendix E). A similar approach for restricting the SSIM values of samples during adversarial training was used by Hameed (2020); Hameed & György (2021).

heading: 4 THEORETICAL CONSIDERATIONS
text: In this section, we present conditions under which simplified versions of our approach (AdA) and previous work (DeepAugment), are consistent (i.e., as the data size grows, the expected error of the learned classifier over random corruptions converges to zero). The role of this section is two-fold: (1) to show that our algorithm is well-behaved (i.e., it converges); and (2) to introduce and to reason about sufficient assumptions for convergence.
In this section we assume that the classification problem we consider is binary (rather than multiclass). Thus, denoting the parameter space for θ and φ by Θ and Φ, we assume that there exists a ground-truth binary classifier fθ∗ for some parameter θ∗ ∈ Θ. We further assume that the clean input samples come from a distribution µ over X . To start with, we consider the case when the goal is to have good average performance on some future corruptions; as such, we assume that these corruptions can be described by an unknown distribution α of corruption parameters φ over Φ. Then, for any θ ∈ Θ, the expected corrupted risk is defined as
R(fθ, α) = Ex∼µ,φ∼α [L([fθ ◦ cφ](x), fθ∗(x))] , (4) which is the expected risk of fθ composed with a random corruption function cφ, φ ∼ α. Since α is unknown, we cannot directly compute the expected corrupted risk. DeepAugment overcomes this problem by proposing a suitable replacement distribution β and instead scores classification functions by approximating R(fθ, β) (rather than R(fθ, α)). In contrast, AdA searches over a set, which we denote by Φβ ⊆ Φ of corruptions to find the worst case, similarly to the adversarial training of Madry et al. (2018).
DeepAugment. The idealized version of DeepAugment (which neglects optimization issues) is defined as θ̂(n)DA = arg minθ∈Θ 1 n ∑n i=1 L([fθ ◦ cφi ](xi), yi), where φi ∼ β for i = 1, 2, . . . , n. The following assumption provides a formal description of a suitable replacement distribution. Assumption 1. (Corruption coverage) There exists a known probability measure β over Φ such that α is absolutely continuous with respect to β (i.e., if α(W ) > 0 for someW ⊂ Φ then β(W ) > 0) and for all x, fθ∗(x) = fθ∗(cφ(x)) for all φ ∈ ess supp(β), where ess supp(β) is the essential support of the distribution β (that is, Prφ∼β [fθ∗(x) = fθ∗(cφ(x))] = 1).
Assumption 1 says that while we do not know α, we do know another distribution β over corruption functions and that β has support at least as broad as that of α. Furthermore, any corruption functions sampled from β leave the ground-truth label unchanged. Otherwise, there would exist a possible set of corruptions with positive (α-) probability such that changing the ground-truth label here would not change the expected corrupted risk, but would force any classifier to make a mistake with positive probability.
Given Assumption 1, the problem reduces to learning under covariate shift and, since θ∗ ∈ Θ, empirical risk minimization yields a consistent solution to the original problem (Sugiyama et al., 2007, footnote 3), that is, the risk of θ̂(n)DA converges to the minimum of (4). Thus, the idealized version of DeepAugment is consistent.
AdversarialAugment. An idealized version of AdA is defined as
θ̂ (n) AdA = arg min
θ∈Θ
1
n n∑ i=1 ess supφ∼β L([fθ ◦ cφ](xi), yi). (5)
The essential supremum operation represents our ability to solve the difficult computational problem of finding the worst case corruption (neglecting corruptions of β-measure zero, or in other words,
taking supremum over ess supp(β)L([fθ ◦ cφ](xi), yi)). Assuming that we can compute (5), and the aforementioned essential support of the loss is C(xi), the consistency of AdA (i.e., that the error of θ̂(n)AdA converges to the minimum of (1)) is guaranteed by the fact that θ
∗ ∈ Θ. Furthermore, as the expected loss of the learned predictor converges to zero for the supremum loss (over the corruptions), so does R(f
θ̂ (n) AdA , β), and also R(f θ̂ (n) AdA , α) since ess supp(α) ⊆ ess supp(β) (based on
Assumption 1).
Discussion. In Appendix D we also analyze these algorithms using the PAC-Bayesian view. For parity with previous works that tackle robustness to image corruptions (like Hendrycks et al., 2020a; Lee et al., 2020; Rusak et al., 2020) we constrain capacity and use the ResNet50 architecture for all our models, but note that larger models can achieve better mCE: e.g., Hendrycks et al. (2020a) train a very large model (RESNEXT-101 32× 8d; Xie et al., 2016) with AugMix and DeepAugment to obtain 44.5% mCE on IMAGENET-C.
In Figure 3 we explore how well Assumption 1 holds in practice, i.e., how well are the corruptions in CIFAR-10-C covered by the corruptions functions used in AdA. The figure shows how well the 15 corruptions present in the CIFAR-10-C benchmark can be approximated by two corruption functions: EDSR and CAE. For each image pair (of a corrupted and clean image) in a random 640-image subset of CIFAR-10-C and CIFAR-10, we optimize the perturbation to the corruption network parameters that best transform the clean image into its corrupted counterpart by solving maxδ SSIM(cφ+δ(x), x′) − 10−5‖δ‖22, where δ is the perturbation to the corruption network’s parameters, x is the clean example and x′ is its corrupted counterpart; we also apply `2 regularization with a constant weight (as shown above) to penalize aggressive perturbations. We use the Adam optimizer (Kingma & Ba, 2014) to take 50 ascent steps, with a learning rate of 0.001. Finally, we average the residual SSIM errors across all five severities for each corruption type. Note that both models can approximate most corruptions well, except for Brightness and Snow. Some corruption types (e.g. Fog, Frost, Snow) are better approximated by CAE (0.84± 0.16 overall SSIM) while most are better approximated by EDSR (0.91± 0.26 overall SSIM)

heading: 5 EMPIRICAL RESULTS
text: In this section we compare the performance of classifiers trained using our method (AdA) and competing state-of-the-art methods (AugMix of Hendrycks et al., 2020b, DeepAugment of Hendrycks et al., 2020a) on (1) robustness to common image corruptions (on CIFAR-10-C & IMAGENET-C); (2) robustness to `p-norm bounded adversarial perturbations; and (3) generalization to distribution shifts on other variants of IMAGENET and CIFAR-10. For completeness, on CIFAR-10, we also compare with robust classifiers trained using four well-known adversarial training methods from the literature, including: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang et al., 2019), Adversarial Weight Perturbations (AWP) (Wu et al., 2020) as well Sharpness Aware Minimization (SAM) (Foret et al., 2021). Additional results are provided in Appendix F.
Overview. On CIFAR-10-C we set a new state-of-the-art mCE of 7.83% by combining1 AdA (EDSR) with DeepAugment and AugMix. On IMAGENET (downsampled to 128× 128) we demon-
1Appendix C details how methods are combined.
strate that our method can leverage 4 image-to-image models simultaneously to obtain the largest increases in mCE. Specifically, by combining AdA (All) with DeepAugment and AugMix we can obtain 62.90% mCE – which improves considerably upon the best model from the literature that we train (70.05% mCE, using nominal training with DeepAugment with AugMix). On both datasets, models trained with AdA gain non-trivial robustness to `p-norm perturbations compared to all other models, while showing slightly better generalization to non-synthetic distribution shifts.
Experimental setup and evaluation. For CIFAR-10 we train pre-activation ResNet50 (He et al., 2016b) models (as in Wong et al. (2020)) on the clean training set of CIFAR-10 (and evaluate on CIFAR-10-C and CIFAR-10.1); our models employ 3× 3 kernels for the first convolutional layer, as in previous work (Hendrycks et al., 2020b). For IMAGENET we train standard ResNet50 classifiers on the training set of IMAGENET with standard data augmentation but 128× 128 re-scaled image crops (due to the increased computational requirements of adversarial training) and evaluate on IMAGENET{C,R,v2}. We summarize performance on corrupted image datasets using the mean corruption error (mCE) introduced in Hendrycks & Dietterich (2019). mCE measures top-1 classifier error across 15 corruption types and 5 severities from IMAGENET-C and CIFAR-10-C. For IMAGENET only, the top-1 error for each corruption is weighted by the corresponding performance of a specific AlexNet classifier; see (Hendrycks & Dietterich, 2019). The mCE is then the mean of the 15 corruption errors. For measuring robustness to `p-norm bounded perturbations, on CIFAR-10 we attack our models with one of the strongest available combinations of attacks: AutoAttack & MultiTargeted as done in Gowal et al. (2020); for IMAGENET we use a standard 100-step PGD attack with 10 restarts. Omitted details on the experimental setup and evaluation are provided in Appendix C.
Common corruptions. On CIFAR-10, models trained with AdA (coupled with AugMix) obtain very good performance against common image corruptions, as shown in Table 1 (left) and Table 8, excelling at Digital and Weather corruptions. Combining AdA with increasingly more complex methods results in monotonic improvements to mCE; i.e., coupling AdA with AugMix improves mCE from 15.47% to 9.40%; adding DeepAugment further pushes mCE to 7.83%, establishing a new state-of-the-art for CIFAR-10-C. Compared to all adversarially trained baselines, we observe that AdA (EDSR) results in the most robustness to common image corruptions. Vanilla adversarial training (trained to defend against `2 attacks) also produces classifiers which are highly resistant to common image corruptions (mCE of 17.42%).
On IMAGENET, in Table 2 (left) and Table 9 we see the same trend, where combining AdA with increasingly more methods results in similar monotonic improvements to mCE. The best method combination leverages all 4 image-to-image models jointly (AdA (All)), obtaining 62.90% mCE. This constitutes an improvement of more than 19% mCE over nominal training and 7.15% mCE over the best non-AdA method (DeepAugment + AugMix). These observations together indicate that the corruptions captured by AdA, by leveraging arbitrary image-to-image models, complement the corruptions generated by both DeepAugment and AugMix.
We observe that neither VQ-VAE nor CAE help improve robustness on CIFAR-10-C while they are both very useful for IMAGENET-C. For example, training with AdA (VQ-VAE) and AdA (CAE) results in 26.77% and 29.15% mCE on CIFAR-10-C respectively, while AdA (All) on IMAGENET obtains the best performance. We suspect this is the case as both VQ-VAE and CAE remove high-frequency information, blurring images (see Figure 1 (c)) which results in severe distortions for the small 32× 32 images even at very small perturbation radii (see Figure 2).
Adversarial perturbations. For CIFAR-10, in the adversarial setting (Table 1, right) models trained with AdA using any backbone architecture perform best across all metrics. Models trained with AdA gain a limited form of robustness to `p-norm perturbations despite not training directly to defend against this type of attack. Interestingly, combining AdA with AugMix actually results in a drop in robustness across all four `p-norm settings for all backbones except U-Net (which increases in robustness). However, further combining with DeepAugment recovers the drop in most cases and increases robustness even more across the majority of `∞ settings. Unsurprisingly, the adversarially trained baselines (AT, TRADES & AWP) perform best on `2- and `∞-norm bounded perturbations, as they are designed to defend against precisely these types of attacks. AdA (EDSR) obtains stronger robustness to `p attacks compared to SAM, while SAM obtains the best generalization to CIFAR-10.1.
On IMAGENET, as shown in Table 2 (right), the AdA variants that use EDSR obtain the highest robustness to `p-norm adversarial perturbations; note that top-1 robust accuracy more than doubles from AdA (CAE) to AdA (EDSR) across all evaluated `p-norm settings. As for CIFAR-10, combining the best AdA variant with DeepAugment results in the best `p robustness performance.
By themselves, neither AugMix nor DeepAugment result in classifiers resistant to `2 attacks for either dataset (top-1 robust accuracies are less than 4% across the board), but the classifiers have non-trivial resistance to `∞ attacks (albeit, much lower than AdA trained models). We believe this is because constraining the perturbations (in the `2-norm) to weights and biases of the early layers of the corruption networks can have a similar effect to training adversarially with input perturbations (i.e., standard `p-norm adversarial training). But note that AdA does not use any input perturbations.
Generalization. On CIFAR-10 (Table 1, center), the models trained with AdA (U-Net) and AdA (EDSR) alone or coupled with AugMix generalize better than the other two backbones to CIFAR-10.1, with the best variant obtaining 90.60% top-1 accuracy. Surprisingly, coupling AdA with DeepAugment can reduce robustness to the natural distribution shift captured by CIFAR-10.1. This trend applies to IMAGENET results as well (Table 2, center) when using AdA (All), as combining it with AugMix, DeepAugment or both, results in lower accuracy on IMAGENET-V2 than when just using AdA (All). These observations uncover an interesting trade-off where the combination of methods that should be used depends on the preference for robustness to image corruptions vs. to natural distribution shifts.

heading: 6 LIMITATIONS
text: In this section we describe the main limitations of our method: (1) the performance of AdA when used without additional data augmentation methods and (2) its computational complexity.
As can be seen from the empirical results (Tables 1 & 2), AdA performs best when used in conjunction with other data augmentations methods, i.e. with AugMix and DeepAugment. However, when AdA is used alone, without additional data augmentation methods, it does not result in increased corruption robustness (mCE) compared to either data augmentation method (except for one case, cf. rows 6 and 7 in Table 2). AdA also does not achieve better robustness to `p-norm bounded perturbations when compared to adversarial training methods. However, this is expected, as the adversarially trained baselines (AT, TRADES and AWP) are designed to defend against precisely these types of attacks.
Our method is more computationally demanding than counterparts which utilize handcrafted heuristics. For example, AugMix specifiesK image operations, which are applied stochastically at the input (i.e. over images). DeepAugment requires applying heuristic stochastic operations to the weights and activations of an image-to-image model, so this requires a forward pass through the image-to-image model (which can be computed offline). But AdA must optimize over perturbations to the parameters of the image-to-image model; this requires several backpropagation steps and is similar to `p-norm adversarial training (Madry et al., 2018) and related works. We describe in detail the computational and memory requirements of our method and contrast it with seven related works in subsection B.1.
We leave further investigations into increasing the mCE performance of AdA when used alone, and into reducing its computational requirements for future work.

heading: 7 CONCLUSION
text: We have shown that our method, AdA, can be used to defend against common image corruptions by training robust models, obtaining a new state-of-the-art mean corruption error on CIFAR-10-C. Our method leverages arbitrary pre-trained image-to-image models, optimizing over their weights to find adversarially corrupted images. Besides improved robustness to image corruptions, models trained with AdA substantially improve upon previous works’ (DeepAugment & AugMix) performance on `2- and `∞-norm bounded perturbations, while also having slightly improved generalization to natural distribution shifts.
Our theoretical analysis provides sufficient conditions on the corruption-generating process to guarantee consistency of idealized versions of both our method, AdA, and previous work, DeepAugment. Our analysis also highlights potential advantages of our method compared to DeepAugment, as well as that of the combination of the two methods. We hope our method will inspire future work into theoretically-supported methods for defending against common and adversarial image corruptions.

heading: A RELATIONSHIPS WITH RELATED WORK
text: Relationship to DeepAugment & AugMix. AugMix is a data augmentation method which stochastically composes standard image operations which affect color (e.g., posterize, equalize, etc.) and geometry (e.g., shear, rotate, translate) (Hendrycks et al., 2020b). Classifiers trained with AugMix excel at robustness to image corruptions, and AugMix (when used with a Jensen-Shannon divergence consistency loss) sets the known state-of-the-art on CIFAR-10-C of 10.90%, prior to our result herein.
DeepAugment is a data augmentation technique introduced by Hendrycks et al. (2020a). This method creates novel image corruptions by passing each clean image through two specific pre-defined imageto-image models (EDSR and CAE) while distorting the network’s internal parameters as well as intermediate activations. An extensive range of manually defined heuristic operations (9 for CAE and 17 for EDSR) are stochastically applied to the internal parameters, including: transposing, negating, zero-ing, scaling and even convolving (with random convolutional filters) parameters randomly. Activations are similarly distorted using pre-defined operations; for example, random dimensions are permuted or scaled by random Rademacher or binary matrices. Despite this complexity, classifiers trained with DeepAugment, in combination with AugMix, set the known state-of-the-art mCE on IMAGENET-C of 53.6%.
Any method which relies on image-to-image models (e.g., AdA or DeepAugment) will inherit the limitations of the specific image-to-image models themselves. In this paper we focus on local image corruptions, but one might want to train classifiers robust to global image transformations – and it is known that most image-to-image models are not well suited for capturing global image transformations (Richardson & Weiss, 2021). For modeling global image transformations, one could, for example, consider using an image-to-image model consisting of a single spatial transformer layer (Jaderberg et al., 2015). Applied at the input layer, the spatial transformer differentiably parameterizes a global image transformation. Leveraging such an image-to-image model would allow AdA to find adversarial examples by optimizing over the global image transformation. But, using such a model with DeepAugment would first require manually defining heuristic weight transformations for this specific image-to-image model.
Similarly to both AugMix and DeepAugment, AdA is also “specification-agnostic”, i.e., all three methods can be used to train classifiers to be robust to corruptions which are not known in advance
(e.g., CIFAR-10-C, IMAGENET-C). Both DeepAugment and AdA operate by perturbing the parameters of image-to-image models. DeepAugment constrains parameter perturbations to follow pre-specified user-defined directions (i.e., defined heuristically); AdA bounds perturbation magnitudes automatically and prevents severe distortions (by approximately constraining the minimum SSIM deviation of the corrupted examples). To be able to define heuristic operations, DeepAugment relies on in-depth knowledge of the internals of the image-to-image models it employs; our method, AdA, does not. Instead, our method requires a global scalar threshold ν to specify the amount of allowed relative parameter perturbation. AugMix requires having access to a palette of pre-defined useful input transformations; our method only requires access to a pre-trained autoencoder.
We believe the generic framework proposed in our paper, which (at a minimum) requires an autoencoder and a scalar perturbation radius, is applicable to other domains beyond images. We leave further investigations to future work.
Relationship to Invariant Risk Minimization. Invariant Risk Minimization (IRM) proposed by Arjovsky et al. (2020) considers the case where there are multiple datasets De = {xi, yi}ni=1 drawn from different training environments e ∈ E . The motivation behind IRM is to minimize the worst-case risk
max e∈E E(x,y)∈De [L(fθ(x), y)] . (6)
In our work, the environments are defined by the different corruptions x′ resulting from adversarially choosing the parameter offsets δ of φ. Given a dataset {xi, yi}ni=1, we can rewrite the corrupted adversarial risk shown in (1) as (6) by setting the environment set E to
E = {{cφ+δ(xi), yi}ni=1|‖δ‖2,φ ≤ ν}. (7)
This effectively creates an ensemble of datasets for all possible values of δ for all examples. The crucial difference between IRM and AdA is in the formulation of the risk. In general, we expect AdA to be more risk-averse than IRM, as it considers individual examples to be independent from each other.
Relationship to Adversarial Mixing. Gowal et al. (2019) formulate a similar adversarial setup where image perturbations are generated by optimizing a subset of latents corresponding to pre-trained generative models. In our work, we can consider the parameters of our image-to-image models to be latents and could formulate Adversarial Mixing (AdvMix) in the AdA framework. Unlike AdvMix, we do not need to rely on a known partitioning of the latents (i.e., disentangled latents), but do need to restrict the feasible set of parameter offsets δ.
Relationship to Perceptual Adversarial Training. Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) finds adversarial examples by optimizing pixel-space perturbations, similar to works on `p norm robustness, e.g. (Madry et al., 2018). The perturbed images are constrained to not exceed a maximum distance from the corresponding original (clean) images measured in the LPIPS metric (Zhang et al., 2018b). Their setup requires a complex machinery to project perturbed images back to the feasible set of images (within a fixed perceptual distance). AdA, by construction, uses a well-defined perturbation set and projecting corrupted network’s parameters is a trivial operation. This is only possible with our method because perturbations are defined on weights and biases rather than on input pixels.

heading: B ALGORITHM DETAILS & COMPUTATIONAL AND SPACE COMPLEXITY
text: Algorithm 1 contains the algorithm listing for our proposed method. We illustrate our algorithm using SGD for clarity. In practice, we batch training examples together and use the Adam optimizer (Kingma & Ba, 2014) to update the classifier’s parameters θ. We still compute adversarial examples for each training sample individually using projected FGSM (Goodfellow et al., 2015) steps.
Algorithm 1 AdA, our proposed method.
1: Inputs: training dataset D; classifier’s (fθ) initial parameters θ(0); corruption network cφ; corruption network’s pretrained parameters φ; relative perturbation radius over the corruption network’s parameters ν; number of layers of the corruption network K; learning rate ηf and number of gradient descent steps N for the outer optimization; learning rate ηc and number of projected gradient ascent steps M for the inner optimization. 2: for t = 1 . . . N do . Outer optimization over θ. 3: (x, y) ∼ D 4: for i = 1 . . .K do . Initialize δ perturbation. 5: r ∼ U(0, ν ‖φi‖2) 6: δ(0)i = uniformly random vector of the same shape as φi with length equal to r 7: for j = 1 . . .M do . Inner optimization over δ using PGD. 8: δ(j) = δ(j−1) + ηc sign[∇δL̃(fθ(cφ+δ(x)), y)] ∣∣∣ δ=δ(j−1)
. FGSM step. 9: for i = 1 . . .K do . Project δi to lie in ν-length `2-ball around φi.
10: if ‖δ(j)i ‖2 > ν ‖φi‖2 then 11: δ(j)i = δ (j) i
‖δ(j)i ‖2 · ν‖φi‖2
12: x′ = cφ+δ(M)(x) . The adversarial example x′. 13: x′ = SSIMLineSearch(x, x′) . Approx. SSIM line-search: App. E. 14: θ(t) = θ(t−1) − ηf ∇θL̃(fθ(x′), y) ∣∣∣ θ=θ(t−1) . Update classifier parameters. 15: Return optimized classifier parameters θ(N)
B.1 COMPUTATIONAL COMPLEXITY AND MEMORY REQUIREMENTS.
Table 3 lists the computational and memory requirements of our method and of related works. We primarily compare to similar methods which perform iterative optimization to find adversarial examples: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang et al., 2019), Adversarial Weight Perturbations (AWP) (Wu et al., 2020) and Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021). For completeness, we also compare to related methods which do not perform adversarial optimization: Sharpness Aware Minimization (SAM) Foret et al. (2021), DeepAugment (Hendrycks et al., 2020a) and AugMix (Hendrycks et al., 2020b). We characterize the number of passes (forward and backward, jointly) through the main classifier network (fθ) and, where applicable, through an auxiliary neural network (cφ) separately. For methods using adversarial optimization we also describe the cost of the projection steps used for keeping perturbations within the feasible set. Taken together, these costs represent the computational complexity of performing one training step with each method.
Note that for our method, the auxiliary network corresponds to the corruption network (i.e. the imageto-image model); for PAT it corresponds to the network used to compute the LPIPS (Zhang et al., 2018b) metric. We characterize the PAT variant which uses the Lagrangian Perceptual Attack in the externally-bounded case and the default bisection method for projecting images into the LPIPS-ball.
Computational complexity. For each input example, AdA randomly initializes weight perturbations in O(|φ|) time. It then adversarially optimizes the perturbation using M PGD steps. These steps amount to M forward and M backward steps through the main classifier (fθ) and the corruption network (cφ). At the end of each iteration, the weight perturbation is projected back onto the feasible set by layer-wise re-scaling in O(|φ|) time. After the PGD iterations, an additional forward pass is done through the corruption network, using the optimized perturbation, to augment the input example. Finally, the SSIM safe-guarding step (see App. E) takes time proportional to O(|x|). Similar to AdA, PAT performs multiple forward and backward passes through both the main classifier and an auxiliary network. PAT searches for a suitable Lagrange multiplier using S steps, and for each candidate multiplier it performs an M -step inner optimization. This results in (at most) S times more forward and backward passes through the two networks when compared to AdA. The projection step
of PAT is considerably more expensive, requiring N+1 forward passes through the auxiliary network; however, it is applied only once at the end of the optimization, rather than at every iteration as in AdA.
AT, TRADES and AWP perform M PGD steps, with forward and backward passes done only through the main classifier network – they do not use an auxiliary network. Hence, these methods have reduced computational complexity compared to PAT and AdA.
DeepAugment augments each data sample by passing it through an auxiliary network while stochastically perturbing the network’s weights and intermediate activations (using a pre-defined set of operations); this amounts to one (albeit modified) forward pass through the auxiliary network for each input example. AugMix stochastically samples and composes standard (lightweight) image operations; it does not pass images through any auxiliary network. AugMix applies at most 3 · K image operations for each input image; K is set to 3 by default (Hendrycks et al., 2020b, Section 3). Methods which use adversarial training, AT, TRADES, PAT as well as AdA, have higher computational complexity than both DeepAugment or AugMix, as they specifically require multiple iterations (M ) of gradient ascent to construct adversarial examples.
Memory requirements. Compared to AT, TRADES & PAT which operate on input perturbations, AdA has higher memory requirements as it operates on weight perturbations (φ) instead. Similar to AT, TRADES and PAT, AdA also operates on each input example independently. For a mini-batch of inputs, naively, this would require storing the corresponding weight perturbations for each input at the same time in memory. This could amount to considerable memory consumption, as the storage requirements grow linearly with the batch size and the number of parameters in the corruption network. Instead, we partition each mini-batch of inputs into multiple smaller “nano-batches”, and find adversarial examples one “nano-batch” at a time. In practice, on each accelerator (GPU or TPU), we use 8 examples per “nano-batch” for CIFAR-10 and 1 for IMAGENET. This allows us to trade-off performance (i.e. parallelization) with memory consumption.
In contrast to AWP, which computes perturbations to the weights of the main classifier (θ) at the mini-batch level, AdA computes perturbations to the weights of the corruption network (φ) for each input example individually.
DeepAugment samples weight perturbations whose storage grows linearly with the number of parameters in the auxiliary network (O(|φ|)), matching AdA’s output storage requirements. But note
that all methods which use adversarial optimization (AdA included), must also store intermediate activations during each backward pass.
For each input sample AugMix updates an input-sized array using storage proportional to O(|x|), having the same storage requirements as AT or PAT.
Our method must keep the weights of the image-to-image models in memory. This does not incur a large cost as all models that we use are relatively small: the U-Net model has 58627 parameters (0.23MB); the VQ-VAE model has 762053 parameters (3.05MB); the EDSR model has 1369859 parameters (5.48MB) and the CAE model has 2241859 parameters (8.97MB).

heading: C EXPERIMENTAL SETUP DETAILS
text: Training and evaluation details. For CIFAR-10 we train pre-activation ResNet50 (He et al., 2016b) models (as in Wong et al. (2020)); as in previous work (Hendrycks et al., 2020b) our models use 3 × 3 kernels for the first convolutional layer. We use a standard data augmentation consisting of padding by 4 pixels, randomly cropping back to 32× 32 and randomly flipping left-to-right. We train all robust classifiers ourselves using the same training strategy and architecture as for our own method (as described above); we use a perturbation radius of 0.5 for `2 robust training and of 8/255 for `∞ robust training. For both `2 and `∞ robust training, we sweep over AWP step sizes of 0.005, 0.001, 0.0005 and 0.0001; we further evaluate the two models which obtained the best robust train accuracy (for `2 this is the model which uses an AWP step size of 0.001, and for `∞ it is the model which uses one of 0.0005). Similarly, for SAM we train five models sweeping over the step size (0.2, 0.15, 0.1, 0.05, 0.01) and further evaluate the one obtaining the best robust train accuracy (which uses a step size of 0.05).
For IMAGENET we use a standard ResNet50 architecture for parity with previous works. We use a standard data augmentation, consisting of random left-to-right flips and random crops. Due to the increased computational requirements of training models with AdA (due to the adversarial training formulation) we resize each random crop (of size 224×224) to 128×128 using bilinear interpolation. We perform standard evaluation by using the central image crop resized to 224× 224 on IMAGENET, even though we train models on 128× 128 crops. All methods are implemented in the same codebase and use the same training strategy (in terms of standard data augmentation, learning rate schedule, optimizers, etc.).
Outer minimization. We minimize the corrupted adversarial risk by optimizing the classifier’s parameters using stochastic gradient descent with Nesterov momentum (Polyak, 1964; Nesterov, 1983). For CIFAR-10 we train for 300 epochs with a batch size of 1024 and use a global weight decay of 10−4. For IMAGENET we train for 90 epochs with a batch size of 4096 and use a global weight decay of 5 · 10−4. We use a cosine learning rate schedule (Loshchilov & Hutter, 2017), without restarts, with 5 warm-up epochs, with an initial learning rate of 0.1 which is decayed to 0 at the end of training. We scale all learning rates using the linear scaling rule of Goyal et al. (2017), i.e., effective LR = max(LR × batch size/256,LR). In Algorithm 1 the effective learning rate of the outer optimization is denoted by ηf .
Inner maximization. Corrupted adversarial examples are obtained by maximizing the crossentropy between the classifier’s predictions on the corrupted inputs (by passing them through the corruption network) and their labels. We initialize the perturbations to the corruption network parameters randomly within the feasible region. We optimize the perturbations using iterated fastgradient sign method (FGSM) steps (Goodfellow et al., 2015; Kurakin et al., 2016)2. We project the optimization iterates to stay within the feasible region. We use a step size equal to 1/4 of the median perturbation radius over all parameter blocks (for each backbone network individually). In Algorithm 1 this step size is denoted by ηc. For CIFAR-10 we use 10 steps; for IMAGENET we use only 3 steps (due to the increased computational requirements) but we increase the step size by a factor of 10/3 to compensate for the reduction in steps. When AdA is specified to use multiple
2We also experimented with Adam, SGD and normalized gradient ascent but we obtained the best results using FGSM.
backbones simultaneously (e.g., “AdA (All)” which uses four image-to-image models) each backbone is used for finding adversarial examples for an equal proportion of examples in each batch.
Combining data augmentation methods. We view the process of combining data augmentation methods as a data pipeline, where the output from each stage is fed as input to the next stage. We first draw random samples either from the clean training dataset or from the DeepAugment-processed training set if DeepAugment is used, as in Hendrycks et al. (2020a). Then we apply standard data augmentation (random pad and crop for CIFAR-10, random left-right flip and resized crop for IMAGENET). When AdA is used, we apply it now in the pipeline, followed by the SSIM line-search procedure. When AugMix is used, we apply it as the final step in the data pipeline.
Corruption networks. We train a separate VQ-VAE and U-Net model on the training set of each of CIFAR-10 and IMAGENET (for a total of four models). We train VQ-VAE models using the standard VQ-VAE loss (van den Oord et al., 2017, Eq. 3) with 128 (base) convolutional filters, a 2-layer residual stack (with 32 convolutional filters); we use a vector quantisation embedding dimension of 512, a commitment cost of 0.25 and use exponential moving averages to update the embedding vectors.
We train U-Net models on an image completion task; i.e. we zero-out 2-35% random pixels of each input image and train the U-Net to fill-in the deleted pixels. We use an image reconstruction loss which is the sum of the mean absolute pixel differences and the mean squared pixel differences (with the latter being scaled by 0.5 · 0.1). The U-Net architecture we use has a two-layer encoder (with 16 and 32 filters respectively) and a three-layer decoder (with 64, 32 and 16 filters respectively).
We train all four image-to-image models for 90 epochs, with a batch size of 1024 for IMAGENET and of 16384 for CIFAR-10. We use the Adam optimizer (Kingma & Ba, 2014) with an initial learning rate of 0.0003 for IMAGENET and 0.003 for CIFAR-10, which we decay throughout training using the linear scaling rule of Goyal et al. (2017).
For both EDSR and CAE we use the same model architectures and pre-trained weights as the ones used by DeepAugment (which are available online).

heading: D PAC-BAYESIAN ANALYSIS.
text: We can also reason about the idealized AdA and DeepAugment algorithms (from Section 4 in the main manuscript) using the PAC-Bayesian view. If random perturbations are introduced to the parameter θ of the classifier fθ, the following bound holds (see, e.g., Neyshabur et al., 2017):3 Given a prior distribution P over Θ, which is independent of the training data, for any η ∈ (0, 1), with probability at least 1− η,
E [R(fθ, α)] ≤ E ,φ∼α[R̂(fθ)] + 4
√ KL(θ + ‖P ) + log 2nη
n , (8)
where R̂(fθ) = 1n ∑n i=1 L([fθ ◦ cφ](xi), yi) and KL(θ + ‖P ) is the KL divergence between the parameter distribution θ + (given θ) and P .4 Defining P and to have spherically invariant normal distributions with variance σ2 in every direction, the KL term becomes ‖θ‖ 2 2
2σ2 , and so the second term goes to zero as the number of samples increases (and θ does not grow fast). An idealistic choice (recommended, e.g., by Neyshabur et al., 2017) is to choose the perturbation of each parameter to be proportional to the parameter value itself, by setting the standard deviation of j (the jth coordinate
of ) and the corresponding coordinate of P as σj = σ|θj |+ b, making the KL term equal to ∑ j θ2j 2σ2j
. Note, however, that since fθ depends on the training data, this choice makes the bound in (8) invalid, hence, in our experiment we choose i to be proportional to the average norm of the weights in each layer when trained on a different (but similar) dataset. Note that minimizing the first term on the
3Experimental results presented in Table 4 show that if the variance of is small enough, the performance of the classifier only changes very slightly.
4To obtain this bound, one can think of the randomized classifier as the compound classifier fθ ◦ cφ having parameters both θ and φ, and the prior on φ is α, which then cancels from the KL term.
right hand side of (8) is not straightforward during training, since we have no access to corruptions sampled from α. DeepAugment tries to remedy this situation by using samples from β; however, the effectiveness of this depends on how well β approximates α, more directly on the importance sampling ratios α(W )/β(W ) for W ⊂ Φ with α(W ) > 0 (see Assumption 1). On the other hand, AdA minimizes the worst-case loss over ess supp(β), which dominates the worst-case loss over ess supp(α) under Assumption 1, which minimizes the expected loss over α, which is the first term. Thus, AdA minimizes an upper bound on the first term, while DeepAugment only minimizes a proxy.5
We have assumed that θ∗ ∈ Θ implying that the classifier is over-parameterized. This is a common assumption in the literature which often holds in practice (Zhang et al., 2016).
Performance under stochastic parameter perturbations In Table 4, we show that the performance of an AdA-trained classifier gradually degrades under increasingly larger perturbations to its parameters, providing experimental support for the PAC-Bayes analysis.
Let w denote a block of parameters (e.g., the set of convolutional filters of a layer) and wj be the j-th coordinate of the parameter block; then, j is the stochastic perturbation we add to the individual scalar parameter wj . We draw the perturbation j from a 0-mean Gaussian with standard deviation proportional to the `∞ norm (i.e., the maximum absolute value) of the enclosing parameter block: j ∼ N (0, η ‖w‖∞) , where η denotes the standard deviation scaling factor. We vary η from 0.00 (0% noise; i.e., nominally evaluated model) to 0.10 (10% noise) in increments of 0.02 (2% noise at a time), as shown in the first column of Table 4. We sample stochastic parameter perturbations (for all of fθ’s parameters) 50 times per dataset example and average the model’s predicted probabilities (i.e., we average the softmax predictions and then compare the averaged prediction with the ground-truth label).
We observe a gradual degradation in mCE and clean error when increasing the expected magnitude of parameter perturbations. Performance on mCE is maintained up to and including a noise level of 2%, and on clean error up to a noise level of 4% respectively.

heading: E APPROXIMATE SSIM LINE-SEARCH PROCEDURE
text: The adversarial examples produced by AdA can sometimes become too severely corrupted (i.e., left-tail of densities in Figure 2 of the main manuscript). We guard against these unlikely events by using an efficient, approximate line-search procedure. We set a maximum threshold, denoted by t, on the SSIM distance between the clean example and the AdA adversarial example.
Denote by xγ the linear combination of the clean example, x, and the corrupted example output by AdA, x̂: xγ = (1− γ)x+ γ x̂. When the deviation in SSIM between the clean and the corrupted example is greater than the threshold (SSIM(x, x̂) > t), we find a scalar γ∗ ∈ [0, 1] such that the deviation between the corrected example, x∗γ , and the clean example, x, is t: SSIM(x, x ∗ γ) = t. We take 9 equally-spaced γ values in [0, 1]
5Note that this is a calibrated proxy in the sense that the minimum of both the proxy and the original target is assumed at the same value θ∗.
and evaluate the SSIM distance between the clean example and xγ for each considered γ. We fit a quadratic polynomial in γ to all the pairs of γ and the threshold-shifted SSIM deviation from the clean example SSIM(x, xγ)− t. We then find the roots of this polynominal, clip them to [0, 1], and take the γ closest to 1 as the desired γ∗. This corresponds to returning the most corrupted variant of x along the ray between x and x̂ which obeys the SSIM threshold. The procedure is very efficient on accelerators (GPUs, TPUs) as it requires no iteration. It is approximate, however, because the quadratic polynomial can underfit.
In practice, we use a maximum SSIM threshold (t) of 0.3 for CIFAR-10 experiments and one of 0.7 for IMAGENET experiments.
Computing the SSIM distance. For computing the SSIM distance we follow the original paper (Wang et al., 2004) and use an isotropic Gaussian weighting function of 11 × 11 with a 1.5 standard deviation (normalized), and regularization parameters K1 = 0.01, K2 = 0.03.

heading: F ADDITIONAL EXPERIMENTS AND COMPARISONS
text: Comparison to previous work on CIFAR-10. Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) proposes an adversarial training method based on bounding a neural perceptual distance (LPIPS). Appendix G (Table 10) of the PAT article shows the performance of various models on common image corruptions. However, performance is summarized using relative mCE, whereas we use absolute mCE throughout. The authors kindly provided us6 with the raw corruption errors of their models at each severity and we reproduce their results in (the top half of) Table 5. We observe that PAT has overall lower robustness to common image corruptions (best variant obtains 23.54% mCE) than AugMix (10.90% mCE) and than our best AdA-trained model (7.83% mCE).
PAT however, performs very well against other adversarial attacks7, including `p-norm bounded perturbations. The best PAT model obtains 28.7% robust accuracy against `∞ attacks ( = 8/255) and 33.3% on `2 attacks ( = 1) while our best AdA-variant obtains less robust accuracy in each case (0.99% against `2 attacks and 13.88% against `∞ attacks with = 4/255). This difference in performance against `p-norm attacks is not surprising, as PAT addresses robustness to pixel-level attacks (i.e., it manipulates image pixels directly); whereas AdA applies adversarial perturbations to the corruption function parameters (and not to the image pixels directly).
In similar spirit to PAT, Kireev et al. (2021) introduce an efficient relaxation of adversarial training with LPIPS as the distance metric. Their best model, with a smaller architecture, RESNET18, obtains 11.47% mCE on CIFAR-10-C. The authors of Kireev et al. (2021) also show that models trained adversarially against `p-norm bounded perturbations can act as a strong baseline for robustness to common image corruptions.
The strongest known8 adversarially trained model against `p-norm bounded perturbations on common image corruptions is that of Gowal et al. (2020) which obtains 12.32% mCE (training against `2-norm bounded perturbations with = 0.5 while using extra-data).
In Wong & Kolter (2021a), the authors first train generative models to represent image corruptions by feeding them a subset of the common image corruptions (from CIFAR-10-C). In a second stage, they train classifiers using samples (adversarial or random) coming from these pre-trained generative models. Despite having this additional knowledge of the test set corruptions, the robust classifiers they train only achieve between 9.5% and 9.7 mCE%.
To the best of our knowledge, our best performing model (AdA (EDSR) coupled with AugMix and DeepAugment) is more robust to common image corruptions on CIFAR-10 than all previous methods, obtaining a new state-of-the-art mCE of 7.83%.
Number of inner optimization steps. We show the effect of changing the number of inner optimization steps (i.e. the number of PGD steps for finding adversarial examples) for AdA (EDSR) on CIFAR-10 in Table 6. We sweep a number of PGD steps from 0 to 10 where 10 is the default
6Personal communication. 7See Table 2 of Laidlaw et al. (2021) for full details. 8See the ROBUSTBENCH (Croce et al., 2020) leaderboard: https://robustbench.github.io.
for CIFAR-10. As described in section C, we compensate for the decrease in number of PGD steps (from 10) by proportionally scaling up the step size (i.e. effective ηc = ηc·10num steps ). Zero (0) PGD steps correspond to only performing the random initialization of perturbations to the corruption network’s parameters (i.e. lines 5-6 in Algorithm 1). We observe that performance on common image corruptions in aggregate (mCE) and for individual groups, in general, increases with the number of inner optimization PGD steps. We note that adversarial training appears to be necessary for training the most robust models, and randomly sampling the parameter perturbations is not sufficient.
Perturbation radius. We show the effect of changing the corruption network parameters perturbation radius in AdA on CIFAR-10 in Table 7. We perform a sweep on the perturbation radius by scaling the radius (ν = 0.015) of the best performing model, AdA (EDSR) + DeepAugment + AugMix (from Table 1 in the main manuscript), by {0.5, 0.75, 1.0, 1.25, 1.5}. We observe that the robustness performance varies minimally across a small range of perturbation radii.
Performance on image corruptions through training. We visualize the performance of AdA trained models (best AdA-combination from Table 1 and Table 2 from the main manuscript) during training in Figure 4. Due to adversarial training, we expect the performance on each of the *-C corruptions to improve as training progresses, and this is indeed what we observe. On both datasets, the AdA-trained classifiers perform consistently best on Brightness, especially at the beginning of training. On IMAGENET performance increases more slowly on the Blur-type corruptions than on all others.
Extended results on individual image corruptions. We provide supplemental details to Tables 1 and 2 (from the main manuscript) on individual corruption types in Table 8 and Table 9, respectively.
0 25 50 75 100 Training progress (%)
Gaussian Noise
Shot Noise Impulse Noise
Defocus Blur Frosted Glass Blur
Motion Blur Zoom Blur
Snow Frost
Fog Brightness
Contrast
Elastic
Pixelate JPEG Compression
Gaussian Blur
Saturate
Spatter Speckle Noise
Accuracy
0 25 50 75 100 Training progress (%)
Column-normalized accuracy (each column sums to 1)
0 25 50 75 100 Training progress (%)
Row-normalized accuracy (each row sums to 1)
(a) CIFAR-10
0 25 50 75 100 Training progress (%)
Gaussian Noise
Shot Noise
Impulse Noise
Defocus Blur
Glass Blur
Motion Blur
Zoom Blur
Snow
Frost
Fog
Brightness
Contrast
Elastic Transform
Pixelate
JPEG Compression
Gaussian Blur
Spatter
Speckle Noise
Accuracy
0 25 50 75 100 Training progress (%)
Column-normalized accuracy (each column sums to 1)
0 25 50 75 100 Training progress (%)
Row-normalized accuracy (each row sums to 1)
(b) IMAGENET
Figure 4: Performance on image corruptions through training. These plots visualize the performance of the best AdA combination on each of the common and extra *-C corruptions as training progresses. Each individual rectangle plots top-1 accuracy. Brighter is better. The accuracies are visualized raw (plots to the left), normalized over the columns (middle plots) or over the rows (plots to the right). Normalizing over the columns visualizes which corruption’s performance is best at that point in training. Normalizing over the rows visualizes at which stage the classifier performs best on a given corruption.

Review summaries:
The authors propose a new data augmentation technique, called AdversarialAugment, to increase robustness of image classification models. The proposed method optimizes the parameters of image-to-image models to generate adversarially corrupted images, where they also show sufficient conditions for the consistency in the simple setting. They empirically show that AdversarialAugment improves common corruption robustness on CIFAR-10-C as well as worst-case performance against lp-norm bounded perturbations on CIFAR-10 and ImageNet. 

The main contribution of the paper is the proposed AdversarialAugment (AdA) method. AdA generates augmented versions of an input by passing the input through an corruption network (such as a pretrained image-to-image model) while adding a worst-case perturbation to the _weights_ of this pretrained network. The paper thus aims at using worst-case perturbations for increasing average case out-of-distribution generalization such as common corruption robustness. Tuning the weight perturbation radius of the corruption network is done based on controlling the SSIM of the augmented to the clean input.  The paper provides theoretical considerations that state assumptions under which AdA is well-behaved (converges) and how it is related to prior work such as DeepAugment.  The paper presents an extensive evaluation on common corruption benchmarks (CIFAR10-C and ImageNet-C), domain shift (ImageNet-R), resampled test sets (CIFAR-10.1 and ImageNet-v2), and worst-case robustness against $\ell_p$ perturbations. 

This paper provides a data augmentation method that augments samples by perturbing parameters of a generative model. The perturbations are found by an adversarial loss, and are constrained based on a perceptual similarity distance to guard from the outliers. In addition to thorough empirical evaluations, this paper provides formalization of their method and a closely related one (deep augment), adding theoretical insights , and provide interesting convergence properties and PAC-Bayesian analysis.