Increasing the Coverage and Balance of Robustness Benchmarks by Using Non-Overlapping Corruptions

1 INTRODUCTION . Neural Networks perform poorly when they deal with images that are drawn from a different distribution than their training samples . Indeed , neural networks are sensitive to adversarial examples ( Szegedy et al. , 2014 ) , background changes ( Xiao et al. , 2020 ) , and common corruptions ( Hendrycks & Dietterich , 2019 ) . Common corruptions are perturbations that change the appearance of images without changing their semantic content . For instance , neural networks are sensitive to noises ( Koziarski & Cyganek , 2017 ) , blurs ( Vasiljevic et al. , 2016 ) or lighting condition variations ( Temel et al. , 2017 ) . Contrary to adversarial examples ( Szegedy et al. , 2014 ) , common corruptions are not artificial perturbations especially crafted to fool neural networks . They naturally appear in industrial applications without any human interfering , and can significantly reduce the performances of neural networks . A neural network is robust to a corruption c , when its performances on samples corrupted with c are close to its performances on clean samples . Some methods have been recently proposed to make neural networks more robust to common corruptions ( Geirhos et al. , 2019 ; Hendrycks * et al. , 2020 ; Rusak et al. , 2020 ) . To determine whether these approaches are effective , it is required to have a method to measure the neural network robustness to common corruptions . The most commonly used method consists in evaluating the performances of neural networks on images distorted by various kinds of common corruptions : ( Hendrycks & Dietterich , 2019 ; Karahan et al. , 2016 ; Geirhos et al. , 2019 ; Temel et al. , 2017 ) . In this study , we call the group of perturbations used to make the robustness estimation a corruption benchmark . We also use this term to refer to a set of test images that have been corrupted with these various corruptions . We identify two important factors that should be taken into account when building a corruption benchmark : the balance and the coverage . In this paper , we consider that a corruption c is covered by a benchmark , when increasing the robustness of a network to all the corruptions of this benchmark , also increases the robustness of the network to c. For instance , a benchmark that contains a camera shake blur corruption covers the defocus blur corruption , because the robustnesses towards these two corruptions are correlated ( Vasiljevic et al. , 2016 ) . The coverage of a benchmark is defined as the number of corruptions covered by this benchmark . The more a benchmark covers a wide range of common corruptions , the more it gives a complete view of the robustness of a neural network . At the same time , we consider a benchmark as balanced when it gives the same importance to the robustness to every corruption it contains . For instance , according to a balanced benchmark , being robust to noises is as important as being robust to brightness variations . We argue that most of the existing corruption benchmarks are unbalanced : they give too much importance to the robustness to some corruptions compared to others . The coverage and balance of corruption benchmarks are related to the notion of corruption overlappings . We say that two corruptions overlap when the robustnesses of neural networks towards these corruptions are correlated . The contribution of this paper is fourfold : 1 . We propose the first method to estimate to what extent two corruptions overlap . 2 . We show that building corruption benchmarks with non-overlapping corruptions make them more balanced and able to cover a wider range of corruptions . 3 . We propose a method to build benchmarks that contain only non-overlapping corruptions . 4 . We use this method to build from ImageNet , a benchmark of Non-Overlapping Corruptions called ImagNet-NOC , to estimate the robustness of image classifiers to common corruptions . We show that ImagNet-NOC is balanced and covers corruptions that are not covered by ImageNet-C : a reference corruption benchmark ( Hendrycks & Dietterich , 2019 ) . 2 BACKGROUND AND RELATED WORKS . 2.1 ESTIMATING THE ROBUSTNESS OF NETWORKS WITH OUT-OF-DISTRIBUTION SAMPLES . Studying the performances of neural networks on samples that lie outside training distributions , is a widely studied domain . Being able to understand out-of-distribution ( o.o.d ) samples is essential to guarantee that neural networks are reliable in real-world applications . Several benchmarks and methods have been proposed to study this field . For instance , ImageNet-A ( Dan Hendrycks & Song , 2019 ) is a simple benchmark for ImageNet classifiers that contains samples drawn from a different source than the one used to build ImageNet . Adversarial examples , are samples that have been slightly modified to fool neural networks ( Szegedy et al. , 2014 ) . Making sure that models are robust to these kinds of o.o.d samples is essential in terms of security . Artistic renditions ( Hendrycks et al. , 2020 ) or sketches ( Haohan et al. , 2019 ) , can also be useful to determine if neural networks understand the abstract concepts we want them to learn . Methods to study how classifiers are affected by background changes have also been recently proposed ( Beery et al. , 2018 ; Xiao et al. , 2020 ) . Another important aspect of the robustness of neural networks to o.o.d samples , is the robustness to common corruptions . This aspect of the robustness is generally estimated by gathering several commonly encountered corruptions , and by testing the performances of neural networks on images corrupted with these corruptions . Diverse selections of common corruptions have been proposed to make a robustness estimation ( Karahan et al. , 2016 ; Laugros et al. , 2019 ; Geirhos et al. , 2019 ) . In particular , ImageNet-C is a popular benchmark used to measure the robustness of ImageNet classifiers ( Hendrycks & Dietterich , 2019 ) . Different common corruption benchmarks have also been proposed in the context of object detection ( Michaelis et al. , 2019 ) , scene classification ( Tadros et al. , 2019 ) or , eye-tracking ( Che et al. , 2020 ) . It is worth noting that some transformations that are in between adversarial attacks and common corruptions have been recently proposed to measure the robustness of image classifiers ( Kang et al. , 2019 ; Dunn et al. , 2019 ; Liu et al. , 2019 ) . 2.2 CORRUPTION OVERLAPPINGS IN BENCHMARKS . It has been noticed that fine-tuning a model with camera shake blur helps it to deal with defocus blur and conversely ( Vasiljevic et al. , 2016 ) . The robustnesses to diverse kinds of noises have also been shown to be closely related ( Laugros et al. , 2019 ) . Even for two corruptions that do not look similar to the human eye , increasing the robustness of a model to one of these corruptions , can imply increasing the robustness to the other corruption ( Kang et al. , 2019 ) . In general , it has been shown that the robustnesses to the corruptions that distort the high-frequency content of images are correlated ( Yin et al. , 2019 ) . In the context of adversarial examples , it is known that the robustness towards one adversarial attack can be correlated with the robustness to another attack ( Tramer & Boneh , 2019 ) . So , it is generally recommended to evaluate the adversarial robustness with attacks that are clearly different from each other ( Carlini et al. , 2019 ) . The experiments carried out in this paper suggest that this recommendation should also be followed in the context of common corruption robustness estimation . 3 CORRUPTION OVERLAPPING . 3.1 THE CORRUPTION OVERLAPPING SCORE . We consider that two corruptions overlap when the robustness to one of these corruptions is correlated with the robustness to the other corruption . In this section , we propose a methodology to estimate to what extent two corruptions overlap . The Robustness Score . To determine whether two corruptions overlap , we first need to introduce a metric called the robustness score . This score gives an estimation of the robustness of a model m to a corruption c. It is computed with the following formula : Rmc = Ac Aclean . Aclean is the accuracy of m on an uncorrupted test set and Ac is the accuracy of m on the same test set corrupted with c. The higher Rmc is , the more robust m is . Please note that using this metric requires to monitor Aclean and make sure it is relatively high . Otherwise , an untrained model for which Ac equals Aclean , would be considered as robust for example . In this study , this metric is used only in the methodology we propose to estimate the overlapping between two corruptions . The Corruption Overlapping Score . We consider two neural networks m1 and m2 and two corruptions c1 and c2 . m1 and m2 are identical , and trained with exactly the same settings except that their training sets are respectively augmented with the corruptions c1 and c2 . A standard model is trained the same way but only with non-corrupted samples . We propose a method to measure to what extent c1 and c2 overlap . The idea of the method is to see if a data augmentation with c1 makes a model more robust to c2 and conversely . To determine this , m1 , m2 , and a test set are used to compute the following expression : ( Rm2c1 −Rstandardc1 ) + ( Rm1c2 −Rstandardc2 ) ( 1 ) The first term of ( 1 ) measures whether a model that fits exactly c2 is more robust to c1 than the standard model . Symmetrically , the second term measures whether a model that fits exactly c1 is more robust than the standard model to c2 . The more making a model fit c1 implies being more robust to c2 and reciprocally , and the more we can suppose that the robustnesses to c1 and c2 are correlated in practice . In other words , the expression ( 1 ) gives an estimation of the overlapping between c1 and c2 . To be more convenient , we would like to build a corruption overlapping score equal to 1 when c1 = c2 , and equal to 0 when the robustnesses to c1 and c2 are not correlated at all . We propose a new expression that respects both conditions : Oc1 , c2 = max { 0 , 1 2 ∗ ( Rm1c2 −Rstandardc2 Rm2c2 −Rstandardc2 + Rm2c1 −Rstandardc1 Rm1c1 −Rstandardc1 ) } ( 2 ) The expression ( 2 ) is a normalized version of ( 1 ) . It measures the overlapping between two corruptions while respecting the conditions mentioned above . Indeed , if a data augmentation with c1 does not increase the robustness to c2 at all and conversely , then the ratios in ( 2 ) are null or negative , so the whole overlapping score is maximized to zero . In other words , when c1 and c2 do not overlap at all , the overlapping score is equal to 0 . Besides , when c1 = c2 , Rm1c2 = R m2 c2 and R m2 c1 = R m1 c1 , so both ratios of ( 2 ) are equal to 1 . Then , Oc1 , c2 = 1 when c1 and c2 completely overlap . How to compute an overlapping score . To get the overlapping score between c1 and c2 , we follow the method illustrated in Figure 1 . This method has six steps , and requires to have a training set , a test set and three untrained models that share the same architecture ( m1 , m2 and standard ) . The step ( 1 ) , consists in using the corruptions c1 and c2 to get two training sets , each corrupted with one corruption . Then , the obtained corrupted sets are used to train the models m1 and m2 in step ( 2 ) . The standard model is also trained during this step but only with non-corrupted samples . In step ( 3 ) , similarly to step ( 1 ) , we use c1 and c2 to get two corrupted versions of the test set . The accuracies of the three models on the three test sets are computed in step ( 4 ) . The scores obtained are used in step ( 5 ) , to get the robustness scores of each model for the corruptions c1 and c2 . The results obtained are used to compute the overlapping score between c1 and c2 in step ( 6 ) .

Summary: The paper considers the problem of measuring the robustness of image classification models to common image perturbations. Datasets of corrupted images, such as ImageNet-C, have been created for this purpose. However, these datasets have been created from an ad-hoc, heuristic selection of perturbations. The present paper proposes a systematic approach to select types of perturbations in a way that spans a large variety of perturbations and assigns similar importance to each perturbation. Similarity of perturbations is measured based on how much training on one perturbations confers robustness against another perturbation. The paper provides an algorithm for selecting perturbations to include, and uses the algorithm to create a variant of ImageNet-C with improved coverage and balance.