On Interaction Between Augmentations and Corruptions in Natural Corruption Robustness

1 Introduction . Robustness to distribution shift , i.e . when the train and test distributions differ , is an important feature of practical machine learning models . Among many forms of distribution shift , one particularly relevant category for computer vision are image corruptions . For example , test data may come from sources that differ from the training set in terms of lighting , camera quality , or other features . Postprocessing transforms , such as photo touch-up , image filters , or compression effects are commonplace in real-world data . Models developed using clean , undistorted inputs typically perform dramatically worse when confronted with these sorts of image corruptions [ 8 , 13 ] . The subject of corruption robustness has a long history in computer vision [ 1 , 6 , 28 ] and recently has been studied actively with the release of benchmark datasets such as ImageNet-C [ 13 ] . One particular property of image corruptions is that they are low-level distortions in nature . Corruptions are transformations of an image that affect structural information such as colors , textures , or geometry [ 5 ] and are typically free of high-level semantics . Therefore , it is natural to expect that data augmentation techniques , which expand the training set with random low-level transformations , can help learn robust models . Indeed , data augmentation has become a central technique in several recent methods [ 14 , 20 , 25 ] that achieve large improvements on ImageNet-C and related benchmarks . One caveat for data augmentation based approaches is the test corruptions are expected to be unknown at training time . If the corruptions are known , they may simply be applied to the training set as data augmentations to trivially adapt to the test distribution . Instead , an ideal robust model needs to be ∗This work completed as part of the Facebook AI residency program . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . robust to any valid corruption , including ones unseen in any previous benchmark . Of course , in practice the robustness of a model can only be evaluated approximately by measuring its corruption error on a representative corruption benchmark . To avoid trivial adaptation to the benchmark , recent works manually exclude test corruptions from the training augmentations . However , with a toy experiment presented in Figure 1 , we argue that this strategy alone might not be enough and that visually similar augmentation outputs and test corruptions can lead to significant benchmark improvements even if the exact corruption transformations are excluded . This observation raises two important questions . One , how exactly does the similarity between train time augmentations and corruptions of the test set affect the error ? And two , if the gains are due to the similarity , they may not translate into better robustness to other possible corruptions , so how well will data augmentations generalize beyond a given benchmark ? In this work , we take a step towards answering these questions , with the goal of better understanding the relationship between data augmentation and test-time corruptions . Using a feature space on image transforms and a new measure called Minimal Sample Distance ( MSD ) on this space , we are able to quantify the distance between augmentation schemes and classes of corruption transformation . With our approach , we empirically show an intuitive yet surprisingly overlooked finding : Augmentation-corruption perceptual similarity is a strong predictor of corruption error . Based on this finding , we perform additional experiments to show that data augmentation aids corruption robustness by increasing perceptual similarity between a ( possibly small ) fraction of the training data and the test set . To further support our claims , we introduce a set of new corruptions , called CIFAR/ImageNet-C , to test the degree to which common data augmentation methods generalize from the original CIFAR/ImageNet-C. To choose these corruptions , we expand the set of natural corruptions and sample new corruptions that are far away from CIFAR/ImageNet-C in our feature space for measuring perceptual similarity . We then demonstrate that augmentation schemes designed specifically to improve robustness show significantly degraded performance on CIFAR/ImageNet-C . Some augmentation schemes still show some improvement over baseline , which suggests meaningful progress towards general corruption robustness is being made , but different augmentation schemes exhibit different degrees of generalization capability . As an implication , caution is needed for fair robustness evaluations when additional data augmentation is introduced . These results suggest a major challenge that is often overlooked in the study of corruption robustness : generalization is often poor . Since perceptual similarity can predict performance , for any fixed finite set of test corruptions , improvements on that set may generalize poorly to dissimilar corruptions . We 3Example transforms are for illustrative purpose only and are exaggerated . Base image © Sehee Park . hope that these results , tools , and benchmarks will help researchers better understand why a given augmentation scheme has good corruption error and whether it should be expected to generalize to dissimilar corruptions . On the positive side , our experiments show that generalization does emerge among perceptually similar transforms , and that only a small fraction of sampled augmentations need to be similar to a given corruption . Section 6 discusses these points in more depth . 2 Related Work . Corruption robustness benchmarks and analysis . ImageNet-C [ 13 ] is a corruption dataset often used as a benchmark in robustness studies . Other corruption datasets [ 15 , 27 ] collect corrupted images from real world sources and thus have a mixture of semantic distribution shifts and perceptual transforms . Corruption robustness differs from adversarial robustness [ 31 ] , which seeks invariance to small , worst case distortions . One notable difference is that improving corruption robustness often slightly improves regular test error , instead of harming it . Yin et al . [ 38 ] analyzes corruption robustness in the context of transforms ’ frequency spectra ; this can also influence corruption error independently from perceptual similarity . Here we study the relationship between augmentations and corruptions more generically , and explore the relationship between perceptual similarity and generalization to new corruptions . Dao et al . [ 3 ] and Wu et al . [ 36 ] study the theory of data augmentation for regular test error . Hendrycks et al . [ 15 ] and Taori et al . [ 33 ] study how the performance on synthetic corruption transforms generalizes to performance on corruption datasets collected from the real world . Here we do not address this issue directly but touch upon it in the discussion . Improving corruption robustness . Data augmentations designed to improve robustness include AugMix [ 14 ] , which composites common image transforms , Patch Gaussian [ 20 ] , which applies Gaussian noise in square patches , and ANT [ 25 ] , which augments with an adversarially learned noise distribution . AutoAugment [ 2 ] learns augmentation policies that optimize clean error but has since been shown to improve corruption error [ 38 ] . Mixup [ 40 ] can improve robustness [ 18 ] , but its label augmentation complicates the dependence on image augmentation . Stylized-ImageNet [ 9 ] , which applies style transfer to input images , can also improve robustness . DeepAugment [ 15 ] , which applies augmentations to a deep representation of an image , can also give large improvements in robustness . Noisy Student [ 37 ] and Assemble-ResNet [ 18 ] combine data augmentation with new models and training procedures and greatly enhance corruption robustness . In addition to training-time methods , there are approaches that adapt to unseen corruptions at test time , e.g . using self-supervised tasks [ 30 ] , entropy minimization [ 35 ] , or with a focus on privacy and data transmission efficiency [ 19 ] . While we do not directly address these approaches here , our methods potentially provide tools that could be used to measure shifting distributions in an online regime . 3 Perceptual similarity for augmentations and corruptions . First , we study the importance of similarity between augmentations and corruptions for improving performance on those corruptions . To do so , we need a means to compare augmentations and corruptions . Both types of transforms are perceptual in nature , meaning they affect low-level image structure while leaving high-level semantic information intact , so we expect a good distance to be a measure of perceptual similarity . Then , we need to find the appropriate measure of distance between the augmentation and corruption distributions . We will argue below that distributional equivalence is not appropriate in the context of corruption robustness , and instead introduce the minimal sample distance , a simple measure that does capture a relevant sense of distribution distance . Measuring similarity between perceptual transforms . We define a perceptual transform as a transform that acts on low-level image structure but not high-level semantic information . As such , we expect two transforms should be similar if their actions on this low-level structure are similar , independent of algorithmic or per-pixel differences between them . A closely related , well-studied problem is the perceptual similarity between images . A common approach is to train a neural network on a classification task and use intermediate layers as a feature space for measuring distances [ 42 ] . We adapt this idea to obtain a feature space for measuring distances between perceptual transforms . We start with a feature extractor for images , which we call f̂ ( x ) . To train the model from which we will extract features , we assume access to a dataset D of image label pairs ( x , y ) associated with a classification task . The model should be trained using only default data augmentation for the task in question so that the feature extractor is independent of the transforms we will use it to study . In order to obtain a very simple measure , we use just the last hidden layer of the network as a feature space . A perceptual transform t ( x ) may be encoded by applying it to all images in D , encoding the transformed images , and averaging the features over these images . For efficiency , we find it sufficient to average over only a randomly sampled subset of images DS in D. In Section 4.1 we discuss the size of DS . The random choice of images is a property of the feature extractor , and so remains fixed when encoding multiple transforms . This reduces variance when computing distances between two transforms . The transform feature extractor is given by f ( t ) = Ex∈DS [ f̂ ( t ( x ) ) − f̂ ( x ) ] . The perceptual similarity between an augmentation and a corruption can be taken as the L2 distance on this feature space f . Minimal sample distance . We now seek to compare the distribution of an augmentation scheme pa to a distribution of a corruption benchmark pc . If the goal was to optimize error on a known corruption distribution , exact equivalence of distributions is the correct measure to minimize . But since the goal is robustness to general , unknown corruption distributions , a good augmentation scheme should be equivalent to no single corruption distribution . To illustrate this behavior , consider a toy problem where we have access to the corruption transforms at training time . A very rough , necessary-but-insufficient measure of distributional similarity is dMMD ( pa , pc ) = ||Ea∼pa [ f ( a ) ] − Ec∼pc [ f ( c ) ] || . This is the maximal mean discrepancy on a fixed , finite feature space , so for brevity we will refer to it as MMD . We still employ the featurization f ( t ) , since we are comparing transforms and not images , unlike in typical domain adaptation . Consider two corruption distributions , here impulse noise and motion blur , and an augmentation scheme that is a mixture of the two corruption distributions . Figure 2b shows MMD between the augmentation and impulse noise corruption scales linearly with mixing fraction , but error on impulse noise remains low until the mixing fraction is almost 0 % impulse noise . This implies distributional similarity is a poor predictor of corruption error . Indeed , low dMMD with any one corruption distribution suggests the augmentation overlaps it significantly , so the augmentation is unlikely to aid dissimilar corruptions . Our expectation for the behavior of the error in Figure 2b is that networks can often successfully memorize rare examples seen during training , so that only a very small fraction of sampled images need impulse noise augmentations to perform well on impulse noise corruptions . An appropriate distance should then measure how close augmentation samples can come to the corruption distribution , even if the density of those samples is low . We thus propose a very simple measure called minimal sample distance ( MSD ) , which is just the perceptual similarity between an average corruption and the closest augmentation from a finite set of samples A ∼ pa : dMSD ( pa , pc ) = min a∈A∼pa ||f ( a ) − Ec∼pc [ f ( c ) ] || . ( 1 ) Minimal Sample Distance C or ru pt io n Er ro r 0.2 0.4 0.6 0.8 0.4 0.8 1.2 1.6 Elastic Transform , Frost , 12 14 16 18 20 12 16 20 24 1.0 1.5 2.0 2.5 3.0 20 30 40 50 Zoom Blur , 0.4 0.8 1.2 1.6 10 15 20 25 Gaussian Noise , 6.0 6.5 7.0 7.5 0.10 0.14 0.18 0.22 Brightness , 10 15 20 25 0.6 0.8 1.0 1.2 Contrast , Minimal Sample Distance C or ru pt io n Er ro r 0.2 0.4 0.6 0.8 0.4 0.8 1.2 1.6 Elastic Transform , Frost , 12 14 16 18 20 12 16 20 24 1.0 1.5 2.0 2.5 3.0 20 30 40 50 Zoom Blur , 0.4 0.8 1.2 1.6 10 15 20 25 Gaussian Noise , 6.0 6.5 7.0 7.5 0.10 0.14 0.18 0.22 Brightness , 10 15 20 25 0.6 0.8 1.0 1.2 Contrast , Minimal Sample Distance C or ru pt io n Er ro r 0.2 0.4 0.6 .8 0.4 0.8 1.2 1.6 Elastic Transform , Frost , 12 14 16 18 20 12 16 20 24 1.0 1.5 2.0 2.5 3.0 20 30 40 50 Zoom Blur , 0.4 0.8 .2 1.6 10 15 20 25 Gaussian Noise , 6.0 6.5 7.0 7.5 0.10 0.14 0.18 0.22 Brightness , 10 15 20 25 0.6 0.8 1.0 1.2 Contrast , Minimal Sample Distance C or ru pt io n Er ro r 0.2 0.4 0.6 0.8 0.4 0.8 1.2 1.6 Elastic Transform , Frost , 12 14 16 18 20 12 16 20 24 1.0 1.5 2.0 2.5 3.0 20 30 40 50 Zoom Blur , 0.4 0.8 1.2 1.6 10 15 20 25 Gaussian Noise , 6.0 6.5 7.0 7.5 0.10 0.14 0.18 0.22 Brightness , 10 15 20 25 0.6 0.8 1.0 1.2 Contrast , Figure 3 : Example relationships between MSD and corruption error . ρ is the Spearman rank correlation . MSD correlates well with error across all four categories of corruption in CIFAR-10-C. For completeness , we also show brightness , a negative example where correlation is poor . A schematic comparison of MMD and MSD is shown in Figure 2a . While both MMD and MSD are small for an augmentation scheme that is distributionally similar to a corruption distribution , only MSD remains small for a broad distribution that occasionally produces samples near multiple corruption distributions . Figure 2b shows MSD , like test error , is small for most mixing fractions in the toy problem described above . Note the measure ’ s need to accommodate robustness to general , unknown corruption distributions has led it to be asymmetric , so it differs from more formal distance metrics that may be used to predict generalization error , such as the Wasserstein distance [ 43 ] .

Summary: The paper introduces a metric, the Minimal Sample Distance (MDS), that quantifies the distance between the distribution of samples augmented with a certain augmentation and samples affected by a certain corruption. The authors show a correlation between the MDS and the corruption error, and use this metric to show that existing corruption benchmarks, e.g. ImageNet-C, are not broad enough to properly evaluate the robustness of image classifiers. Thus, they expand ImageNet-C with further corruptions that are not perceptually similar to those already available.