Increasing the Coverage and Balance of Robustness Benchmarks by Using Non-Overlapping Corruptions

1 INTRODUCTION . Neural Networks perform poorly when they deal with images that are drawn from a different distribution than their training samples . Indeed , neural networks are sensitive to adversarial examples ( Szegedy et al. , 2014 ) , background changes ( Xiao et al. , 2020 ) , and common corruptions ( Hendrycks & Dietterich , 2019 ) . Common corruptions are perturbations that change the appearance of images without changing their semantic content . For instance , neural networks are sensitive to noises ( Koziarski & Cyganek , 2017 ) , blurs ( Vasiljevic et al. , 2016 ) or lighting condition variations ( Temel et al. , 2017 ) . Contrary to adversarial examples ( Szegedy et al. , 2014 ) , common corruptions are not artificial perturbations especially crafted to fool neural networks . They naturally appear in industrial applications without any human interfering , and can significantly reduce the performances of neural networks . A neural network is robust to a corruption c , when its performances on samples corrupted with c are close to its performances on clean samples . Some methods have been recently proposed to make neural networks more robust to common corruptions ( Geirhos et al. , 2019 ; Hendrycks * et al. , 2020 ; Rusak et al. , 2020 ) . To determine whether these approaches are effective , it is required to have a method to measure the neural network robustness to common corruptions . The most commonly used method consists in evaluating the performances of neural networks on images distorted by various kinds of common corruptions : ( Hendrycks & Dietterich , 2019 ; Karahan et al. , 2016 ; Geirhos et al. , 2019 ; Temel et al. , 2017 ) . In this study , we call the group of perturbations used to make the robustness estimation a corruption benchmark . We also use this term to refer to a set of test images that have been corrupted with these various corruptions . We identify two important factors that should be taken into account when building a corruption benchmark : the balance and the coverage . In this paper , we consider that a corruption c is covered by a benchmark , when increasing the robustness of a network to all the corruptions of this benchmark , also increases the robustness of the network to c. For instance , a benchmark that contains a camera shake blur corruption covers the defocus blur corruption , because the robustnesses towards these two corruptions are correlated ( Vasiljevic et al. , 2016 ) . The coverage of a benchmark is defined as the number of corruptions covered by this benchmark . The more a benchmark covers a wide range of common corruptions , the more it gives a complete view of the robustness of a neural network . At the same time , we consider a benchmark as balanced when it gives the same importance to the robustness to every corruption it contains . For instance , according to a balanced benchmark , being robust to noises is as important as being robust to brightness variations . We argue that most of the existing corruption benchmarks are unbalanced : they give too much importance to the robustness to some corruptions compared to others . The coverage and balance of corruption benchmarks are related to the notion of corruption overlappings . We say that two corruptions overlap when the robustnesses of neural networks towards these corruptions are correlated . The contribution of this paper is fourfold : 1 . We propose the first method to estimate to what extent two corruptions overlap . 2 . We show that building corruption benchmarks with non-overlapping corruptions make them more balanced and able to cover a wider range of corruptions . 3 . We propose a method to build benchmarks that contain only non-overlapping corruptions . 4 . We use this method to build from ImageNet , a benchmark of Non-Overlapping Corruptions called ImagNet-NOC , to estimate the robustness of image classifiers to common corruptions . We show that ImagNet-NOC is balanced and covers corruptions that are not covered by ImageNet-C : a reference corruption benchmark ( Hendrycks & Dietterich , 2019 ) . 2 BACKGROUND AND RELATED WORKS . 2.1 ESTIMATING THE ROBUSTNESS OF NETWORKS WITH OUT-OF-DISTRIBUTION SAMPLES . Studying the performances of neural networks on samples that lie outside training distributions , is a widely studied domain . Being able to understand out-of-distribution ( o.o.d ) samples is essential to guarantee that neural networks are reliable in real-world applications . Several benchmarks and methods have been proposed to study this field . For instance , ImageNet-A ( Dan Hendrycks & Song , 2019 ) is a simple benchmark for ImageNet classifiers that contains samples drawn from a different source than the one used to build ImageNet . Adversarial examples , are samples that have been slightly modified to fool neural networks ( Szegedy et al. , 2014 ) . Making sure that models are robust to these kinds of o.o.d samples is essential in terms of security . Artistic renditions ( Hendrycks et al. , 2020 ) or sketches ( Haohan et al. , 2019 ) , can also be useful to determine if neural networks understand the abstract concepts we want them to learn . Methods to study how classifiers are affected by background changes have also been recently proposed ( Beery et al. , 2018 ; Xiao et al. , 2020 ) . Another important aspect of the robustness of neural networks to o.o.d samples , is the robustness to common corruptions . This aspect of the robustness is generally estimated by gathering several commonly encountered corruptions , and by testing the performances of neural networks on images corrupted with these corruptions . Diverse selections of common corruptions have been proposed to make a robustness estimation ( Karahan et al. , 2016 ; Laugros et al. , 2019 ; Geirhos et al. , 2019 ) . In particular , ImageNet-C is a popular benchmark used to measure the robustness of ImageNet classifiers ( Hendrycks & Dietterich , 2019 ) . Different common corruption benchmarks have also been proposed in the context of object detection ( Michaelis et al. , 2019 ) , scene classification ( Tadros et al. , 2019 ) or , eye-tracking ( Che et al. , 2020 ) . It is worth noting that some transformations that are in between adversarial attacks and common corruptions have been recently proposed to measure the robustness of image classifiers ( Kang et al. , 2019 ; Dunn et al. , 2019 ; Liu et al. , 2019 ) . 2.2 CORRUPTION OVERLAPPINGS IN BENCHMARKS . It has been noticed that fine-tuning a model with camera shake blur helps it to deal with defocus blur and conversely ( Vasiljevic et al. , 2016 ) . The robustnesses to diverse kinds of noises have also been shown to be closely related ( Laugros et al. , 2019 ) . Even for two corruptions that do not look similar to the human eye , increasing the robustness of a model to one of these corruptions , can imply increasing the robustness to the other corruption ( Kang et al. , 2019 ) . In general , it has been shown that the robustnesses to the corruptions that distort the high-frequency content of images are correlated ( Yin et al. , 2019 ) . In the context of adversarial examples , it is known that the robustness towards one adversarial attack can be correlated with the robustness to another attack ( Tramer & Boneh , 2019 ) . So , it is generally recommended to evaluate the adversarial robustness with attacks that are clearly different from each other ( Carlini et al. , 2019 ) . The experiments carried out in this paper suggest that this recommendation should also be followed in the context of common corruption robustness estimation . 3 CORRUPTION OVERLAPPING . 3.1 THE CORRUPTION OVERLAPPING SCORE . We consider that two corruptions overlap when the robustness to one of these corruptions is correlated with the robustness to the other corruption . In this section , we propose a methodology to estimate to what extent two corruptions overlap . The Robustness Score . To determine whether two corruptions overlap , we first need to introduce a metric called the robustness score . This score gives an estimation of the robustness of a model m to a corruption c. It is computed with the following formula : Rmc = Ac Aclean . Aclean is the accuracy of m on an uncorrupted test set and Ac is the accuracy of m on the same test set corrupted with c. The higher Rmc is , the more robust m is . Please note that using this metric requires to monitor Aclean and make sure it is relatively high . Otherwise , an untrained model for which Ac equals Aclean , would be considered as robust for example . In this study , this metric is used only in the methodology we propose to estimate the overlapping between two corruptions . The Corruption Overlapping Score . We consider two neural networks m1 and m2 and two corruptions c1 and c2 . m1 and m2 are identical , and trained with exactly the same settings except that their training sets are respectively augmented with the corruptions c1 and c2 . A standard model is trained the same way but only with non-corrupted samples . We propose a method to measure to what extent c1 and c2 overlap . The idea of the method is to see if a data augmentation with c1 makes a model more robust to c2 and conversely . To determine this , m1 , m2 , and a test set are used to compute the following expression : ( Rm2c1 −Rstandardc1 ) + ( Rm1c2 −Rstandardc2 ) ( 1 ) The first term of ( 1 ) measures whether a model that fits exactly c2 is more robust to c1 than the standard model . Symmetrically , the second term measures whether a model that fits exactly c1 is more robust than the standard model to c2 . The more making a model fit c1 implies being more robust to c2 and reciprocally , and the more we can suppose that the robustnesses to c1 and c2 are correlated in practice . In other words , the expression ( 1 ) gives an estimation of the overlapping between c1 and c2 . To be more convenient , we would like to build a corruption overlapping score equal to 1 when c1 = c2 , and equal to 0 when the robustnesses to c1 and c2 are not correlated at all . We propose a new expression that respects both conditions : Oc1 , c2 = max { 0 , 1 2 ∗ ( Rm1c2 −Rstandardc2 Rm2c2 −Rstandardc2 + Rm2c1 −Rstandardc1 Rm1c1 −Rstandardc1 ) } ( 2 ) The expression ( 2 ) is a normalized version of ( 1 ) . It measures the overlapping between two corruptions while respecting the conditions mentioned above . Indeed , if a data augmentation with c1 does not increase the robustness to c2 at all and conversely , then the ratios in ( 2 ) are null or negative , so the whole overlapping score is maximized to zero . In other words , when c1 and c2 do not overlap at all , the overlapping score is equal to 0 . Besides , when c1 = c2 , Rm1c2 = R m2 c2 and R m2 c1 = R m1 c1 , so both ratios of ( 2 ) are equal to 1 . Then , Oc1 , c2 = 1 when c1 and c2 completely overlap . How to compute an overlapping score . To get the overlapping score between c1 and c2 , we follow the method illustrated in Figure 1 . This method has six steps , and requires to have a training set , a test set and three untrained models that share the same architecture ( m1 , m2 and standard ) . The step ( 1 ) , consists in using the corruptions c1 and c2 to get two training sets , each corrupted with one corruption . Then , the obtained corrupted sets are used to train the models m1 and m2 in step ( 2 ) . The standard model is also trained during this step but only with non-corrupted samples . In step ( 3 ) , similarly to step ( 1 ) , we use c1 and c2 to get two corrupted versions of the test set . The accuracies of the three models on the three test sets are computed in step ( 4 ) . The scores obtained are used in step ( 5 ) , to get the robustness scores of each model for the corruptions c1 and c2 . The results obtained are used to compute the overlapping score between c1 and c2 in step ( 6 ) .

Summary: This paper points out that ImageNet-C, the de facto standard for measuring robustness to natural corruptions for ImageNet classification models, contains correlated corruptions, so a mean robustness score over the ImageNet-C corruptions is biased in favor of certain classes of corruptions. It proposes two metrics: robustness score and overlapping score, and uses them to specify desirable characteristics of a robustness benchmark: coverage and balance. It specifies an algorithm for selecting a set of corruptions that optimize for these characteristics, and introduces a new benchmark (ImageNet-NOC) built using this algorithm and evaluates some models that performed well on ImageNet-C on ImageNet-NOC to see if they still perform well.