Deep k-NN for Noisy Labels

1 INTRODUCTION . Machine learned models can only be as good as the data they were used to train on . With increasingly large modern datasets and automated and indirect labels like clicks , it is becoming ever more important to investigate and provide effective techniques to handle noisy labels . We revisit the classical method of filtering out suspicious training examples using k-nearest neighbors ( k-NN ) ( Wilson , 1972 ) . Like Papernot & McDaniel ( 2018 ) , we apply k-NN on the learned intermediate representation of a preliminary model , which adds robustness . In fact , the k-nearest neighbor approach has recently been receiving attention for its robustness properties ( Wang et al. , 2018 ; Reeve & Kaban , 2019 ) and as an auxiliary strategy for modern machine learning ( Jiang et al. , 2018 ) . The main contributions of this paper are : • Experimentally showing that identifying mislabeled examples by k-NN executed on an intermediate layer of a preliminary deep model works well compared to state-of-art methods for handling noisy labels across noise levels , and is robust to the choice of k. • Theoretically showing that k-NN ’ s predictions will only identify a training example as clean if its label is the Bayes-optimal label . We also provide finite-sample analysis in terms of the margin and how spread out the corrupted labels are ( Theorem 1 ) , rates of convergence for the margin ( Theorem 2 ) and rates under Tsybakov ’ s noise condition ( Theorem 3 ) with all rates matching minimax-optimal rates in the noiseless setting . Our work shows that even though the preliminary neural network is trained with corrupted labels , it still yields intermediate representations that are useful for k-nearest neighbor filtering . Given labels which are in high disagreement , one can either automatically remove them and retrain on the remaining , or send to a human operator for further review . This strategy is also be useful in human-in-the-loop systems where one can warn the human annotator that a label is suspicious , and automatically propose new labels based on its nearest neighbors ’ labels . In addition to strong empirical performance , deep k-NN filtering has a couple of advantages . Firstly , many methods require a clean set of samples whose labels can be trusted . Here we show that the k-NN based method is robust and does not require such a clean set of samples . Second , while k-NN does introduce the hyperparameter k , we will show that deep k-NN filtering is stable to the choice of k : such robustness to hyperparameters is highly desirable as optimal tuning for this problem is often not available in practice ( i.e . when no clean validation set is available ) . 2 RELATED WORK . We review relevant prior work in training on noisy labels and related k-NN theory . 2.1 TRAINING WITH NOISY LABELS . Methods to handle label noise can be classified into two main strategies : ( i ) explicitly identify and remove the noisy examples , and ( ii ) indirectly handle the noise with robust training methods . Data Cleaning This proposal fits into the broad family of data cleaning methods , in that our proposal detects and filters dirty data ( see Chu et al . ( 2016 ) for a recent survey ) . The use of k-NN to “ edit ” training data has been popular since Wilson ( 1972 ) used it to throw away training examples that were not consistent with their k = 3 nearest neighbors . The idea of using a preliminary model to help identify mislabeled examples dates to at least Guyon et al . ( 1994 ) , who proposed using the model to compute an information gain for each example and then suspecting ones with high gain . Other early work used a cross-validation set-up to train a classifier on part of the data , then use it to make a prediction on held-out training examples , and remove any examples if the prediction disagrees with the label ; ensembles of models can also be used for the predictions . ( Brodley & Freidl , 1999 ) . Noise Corruption Estimation For multi-class problems , a popular approach is to account for noisy labels by applying a confusion matrix after the model ’ s softmax layer ( Sukhbaatar et al. , 2014 ) . Such methods rely on a confusion matrix which is often unknown and must be estimated . Patrini et al . ( 2017 ) suggest deriving it from the softmax distribution of the model trained on noisy data while Goldberger & Ben-Reuven ( 2016 ) ; Jindal et al . ( 2016 ) ; Han et al . ( 2018 ) give alternatives . Accurate estimates are generally hard to attain when only untrusted data is available . Hendrycks et al . ( 2018 ) achieves more accurate estimates in the setting where some amount of known clean , trusted data is available . Xiao et al . ( 2015 ) ; Khetan et al . ( 2017 ) ; Vahdat ( 2017 ) use EM-type algorithms to estimate the clean label distribution . Noise-Robust Training Natarajan et al . ( 2013 ) propose a method to make any surrogate loss function noise-robust given knowledge of the corruption rates . Ghosh et al . ( 2017 ) proves that losses like mean absolute error ( MAE ) are inherently robust under symmetric or uniform label noise while Zhang & Sabuncu ( 2018 ) shows that training with MAE results in poor convergence and accuracy . They propose a new loss function based on the negative Box-Cox transformation that trades off the noise-robustness of MAE with the training efficiency of cross-entropy . Lastly , the ramp , unhinged , and savage losses have been proposed and theoretically justified to be noise-robust for support vector machines ( Brooks , 2011 ; Van Rooyen et al. , 2015 ; Masnadi-Shirazi & Vasconcelos , 2009 ) . Rolnick et al . ( 2017 ) empirically shows that deep learning models are robust to noise when there are enough correctly labeled examples and when the model capacity and training batch size are sufficiently large . Auxiliary Models Veit et al . ( 2017 ) propose learning a label cleaning network on trusted data by predicting the differences between clean and noisy labels . Li et al . ( 2017 ) suggests training on a weighted average between noisy labels and distilled predictions of an auxiliary model trained on trusted data . Example Weighting Here we make a hard decision about whether to keep a training example , but one can also adapt the weights on training examples based on the confidence in their labels . Liu & Tao ( 2015 ) provides an importance-weighting scheme for binary classification . Ren et al . ( 2018 ) suggests upweighting examples whose loss gradient is aligned with those of trusted examples at every step in training . Jiang et al . ( 2017 ) investigates a recurrent network that learns a sample weighting scheme to give to the base model . 2.2 k-NEAREST NEIGHBOR THEORY The theory of k-nearest neighbor classification has a long history , for example : Fix & Hodges Jr ( 1951 ) ; Cover ( 1968 ) ; Stone ( 1977 ) ; Devroye et al . ( 1994 ) ; Chaudhuri & Dasgupta ( 2014 ) . Much of the prior work focuses on k-NN ’ s statistical consistency properties . However , with the growing interest in adversarial examples and learning with noisy labels , there have recently been analyses of k-nearest neighbor methods in these settings . Wang et al . ( 2018 ) analyze the robustness of k-NN classification and provide a robust variant of 1-NN classification where their notion of robustness is that predictions of nearby points should be similar . Gao et al . ( 2016 ) provides an analysis of the k-NN classifier under noisy labels and like us , show that k-NN can attain similar rates in the noisy setting as in the noiseless setting . Gao et al . ( 2016 ) assumes a noise model where labels are corrupted uniformly at random , while we assume an arbitrary corruption pattern and provide results based on a notion of how spread out the corrupted points are . Moreover , we provide finite-sample bounds borrowing recent advances in k-NN convergence theory in the noiseless setting ( Jiang , 2019 ) while the guarantees of Gao et al . ( 2016 ) are asymptotic . Reeve & Kaban ( 2019 ) provide stronger guarantees on a robust modification of k-NN proposed by Gao et al . ( 2016 ) . To the best of our knowledge , we provide the first finite-sample rates of consistency for the classical k-NN method in the noisy setting with very little assumptions on the label noise . 3 ALGORITHM . We first define the k-nearest neighbor classifier : Definition 1 ( k-NN ) . Let the k-NN radius of x ∈ X be rk ( x ) : = inf { r : |B ( x , r ) ∩X| ≥ k } where B ( x , r ) : = { x′ ∈ X : |x − x′| ≤ r } and the k-NN set of x ∈ X be Nk ( x ) : = B ( x , rk ( x ) ) ∩ X . Then for all x ∈ X , the k-NN classifier function w.r.t . X has discriminant function ηk ( y ; x ) : = 1 |Nk ( x ) | n∑ i=1 1 [ yi = y , xi ∈ Nk ( x ) ] , with prediction ηk ( x ) : = arg maxy ηk ( y ; x ) . Our method Algorithm 1 assumes a dataset Dnoisy with potentially noisy labels , along with a dataset Dclean consisting of clean or trusted labels . Note that we allow Dclean to be empty ( i.e . in instances where no such trusted data is available ) . We have found that having Dclean becomes important when Dnoisy has a high corruption rate ; otherwise the representations learned by training on Dnoisy alone are often reasonable enough . The procedure begins by training on eitherDnoisy∪Dclean orDclean . For our experiments , we partition Dclean into a training set Dct and validation set Dcv and train models on Dct and Dnoisy ∪ Dct and choose the one that performs better on Dcv . We then filter examples that disagree with the k-NN classifier prediction , where the k-NN is computed on the final logit layer of the trained model ( i.e . the layer right before softmax ) . Algorithm 1 Filtering datapoints via deep k-NN . Inputs : Dnoisy , Dclean , k Train modelM on either Dnoisy ∪ Dclean or Dclean . Let N be the activations of Dnoisy ∪ Dclean on the logit layer ofM . Dfiltered : = { ( x , y ) ∈ N : ηk ( x ) = y } , where ηk is computed w.r.t . N . Train final model on Dfiltered ∪ Dc . 4 THEORETICAL ANALYSIS . For the theoretical analysis , we assume the binary classification problem with the features defined on compact set X ⊆ RD . We assume that points are drawn according to distribution F as follows : the features come from distribution PX on X and the labels are distributed according to the measurable conditional probability function η : X → [ 0 , 1 ] . That is , a sample ( X , Y ) is drawn from F as follows : X is drawn according to PX and Y is chosen according to P ( Y = 1|X = x ) = η ( x ) . The goal will be to show that given corrupted examples , the k-NN disagreement method is still able to identify the examples whose labels do not match that of the Bayes-optimal label . We will make a few regularity assumptions for our analysis to hold . The first regularity assumption ensures that the support X does not become arbitrarily thin anywhere . This is a standard nonparametric assumption ( e.g . Singh et al . ( 2009 ) ; Jiang ( 2019 ) ) . Assumption 1 ( Support Regularity ) . There exists ω > 0 and r0 > 0 such that Vol ( X ∩B ( x , r ) ) ≥ ω · Vol ( B ( x , r ) ) for all x ∈ X and 0 < r < r0 , where B ( x , r ) : = { x′ ∈ X : |x− x′| ≤ r } . Let pX be the density function corresponding to PX . The next assumption ensures that with a sufficiently large sample , we will obtain a good covering of the input space . Assumption 2 ( pX bounded from below ) . pX,0 : = infx∈X pX ( x ) > 0 . Finally , we make a smoothness assumption on η , as done in other analyses of k-NN classification ( e.g . Chaudhuri & Dasgupta ( 2014 ) ; Reeve & Kaban ( 2019 ) ) Assumption 3 ( η Hölder continuous ) . There exists 0 < α ≤ 1 and Cα > 0 such that |η ( x ) − η ( x′ ) | ≤ Cα|x− x′|α for all x , x′ ∈ X . We propose a notion of how spread out a set of points is based on the minimum pairwise distance between the points . This will be a quantity in the finite-sample bounds we will present . Intuitively , the more spread out a contaminated set of points is , the less clean samples we will be needed to overcome the contamination of that set . Definition 2 ( Minimum pairwise distance ) . S2 ( C ) : = min x , x′∈C , x6=x′ |x− x′| . Also define the ∆-interior region of X where there is at least ∆ margin in the probabilistic label : Definition 3 . Let ∆ ≥ 0 . Define X∆ : = { x ∈ X : ∣∣ 1 2 − η ( x ) ∣∣ ≥ ∆ } . We now state the result , which says that with high probability uniformly on X∆ when ∆ > 0 is known , we have that the label disagrees with the k-NN classifier if and only if the label is not the Bayes-optimal prediction . Due to space , all of the proofs have been deferred to the Appendix . Theorem 1 ( Fixed ∆ ) . Let ∆ , δ > 0 and suppose Assumptions 1 , 2 , and 3 hold . There exists constants Kl , Ku > 0 depending only on F such that the following holds with probability at least 1 − δ . Let X [ n ] be n ( uncorrupted ) examples drawn from the F and C be a set of points with corrupted labels and denote our sample X : = X [ n ] ∪ C. Suppose k lies in the following range Kl · 1 ∆2 · log2 ( 1/δ ) · log n ≤ k ≤ Ku ·min { S2 ( C ) D , ∆D/α } · n , then the following holds uniformly over x ∈ X∆ : the k-NN prediction computed w.r.t . X agrees with the label if and only if the label is the Bayes-optimal label η∗ ( x ) : = 1 [ η ( x ) ≥ 12 ] . In the last result , we assumed that ∆ was fixed . We next show how we can make a similar guarantee but show that we can take ∆ → 0 as we choose k , n → ∞ appropriately and provide rates of convergence . Theorem 2 ( Rates of convergence for ∆ ) . Let δ > 0 and suppose Assumptions 1 , 2 , and 3 hold . There exist constants Kl , Ku , K > 0 depending only on F such that the following holds with probability at least 1 − δ . Let X [ n ] be n ( uncorrupted ) examples drawn from F , and C be a set of points with corrupted labels and denote our sample X : = X [ n ] ∪C . Suppose k lies in the following range Kl · log2 ( 1/δ ) · n α α+D ≤ k ≤ Ku · S2 ( C ) D · n , then the following holds uniformly over x ∈ X∆ : the k-NN prediction computed w.r.t . X agrees with the label if and only if the label is the Bayes-optimal label η∗ ( x ) : = 1 [ η ( x ) ≥ 12 ] where ∆ = K · ( √ log n+ log ( 1/δ ) k + ( k n ) α/D ) . Remark 1 . Choosing k = O ( n2α/ ( 2α+D ) ) in the above result gives us ∆ = Õ ( n−α/ ( 2α+D ) ) . This rate for ∆ is the minimax-optimal rate for k-nearest neighbor classification on X∆ given a sample of size n ( Chaudhuri & Dasgupta , 2014 ) in the uncorrupted setting . Thus , our analysis is tight up to logarithmic factors . We next give results with an additional margin assumption , also known as Tsybakov ’ s noise condition ( Mammen et al. , 1999 ; Tsybakov et al. , 2004 ) : Assumption 4 ( Tsybakov Noise Condition ) . The following holds for someCβ and β and all ∆ > 0 : PX ( x 6∈ X∆ ) ≤ Cβ ·∆β . Theorem 3 ( Rates under Tsybakov Noise Condition ) . Let δ > 0 and suppose Assumptions 1 , 2 , 3 and 4 hold . There exists constants Kl , Ku , K , K ′ > 0 depending only on F such that the following holds with probability at least 1 − δ . Let X [ n ] be n ( uncorrupted ) examples drawn from the F and C be a set of points with corrupted labels and denote our sample X : = X [ n ] ∪C . Suppose k lies in the following range Kl · log2 ( 1/δ ) · n α α+D ≤ k ≤ Ku · S2 ( C ) D · n , and define ηk ( x ) : = arg maxy ηk ( y ; x ) . Then , P ( ηk ( x ) 6= η∗ ( x ) ) ≤ K · ( √ log n+ log ( 1/δ ) k + ( k n ) α/D ) β , RX −R∗ ≤ K ′ · ( √ log n+ log ( 1/δ ) k + ( k n ) α/D ) β+1 where RX : = EF [ gk ( x ) 6= y ] and R∗ : = EF [ g∗ ( x ) 6= y ] denote the risk of the k-NN method and Bayes optimal classifier , respectively . Remark 2 . Choosing k = O ( n2α/ ( 2α+D ) ) in the above gives us a rate of Õ ( n−α ( β+1 ) / ( 2α+D ) ) for the excess risk . This matches the lower bounds of Audibert et al . ( 2007 ) up to logarithmic factors .

Summary: This paper provided "an empirical study showing that a simple k-nearest neighbor-based filtering approach on the logit layer of a preliminary model can remove mislabeled training data and produce more accurate models than some recently proposed methods". Even though it has many theoretical analysis and experiments, the paper itself is poorly written. There is no intuitive discussion on what is missing in existing methods, why the proposed method can be better, and when the proposed method may also fail.