When Covariate-shifted Data Augmentation Increases Test Error And How to Fix It

1 INTRODUCTION . Adversarial training improves the robustness of neural networks to perturbations , commonly referred to as adversarial examples ( Goodfellow et al. , 2015 ; Szegedy et al. , 2014 ; Biggio et al. , 2013 ) . However , adversarial training also causes an undesirable increase in the error on the unperturbed images ( test error ) . How do we obtain both robust and accurate networks ? At the core , adversarial training is a form of data augmentation where we augment the training set with worst-case perturbations of each training image within a ball defined by the attack model . In this work , we study the general question of how to train classifiers on augmented training data without causing an increase in test error , while simultaneously preserving the benefits of augmentation such as robustness . First , we analyze why some forms of data augmentation such as with adversarial ` ∞ perturbations increase error . Previous works ( Tsipras et al. , 2019 ; Zhang et al. , 2019 ; Fawzi et al. , 2018 ; Nakkiran , 2019 ) provide simple constructions to explain the increase in test error with adversarial perturbations , but rely on assumptions , such as incorrect labeling of the adversarial perturbations or insufficient complexity of the hypothesis class , that we do not expect to hold in practice . We seek a simple theoretical setup that can shed light on why augmentation , even with label-preserving perturbations in a well-specified setting , causes an increase in test error . On the surface , it seems like we have only added information about the label distribution , so why does the test error increase ? In this work , we theoretically study minimum norm interpolation in well-specified linear regression , and show that data augmentation with label-preserving perturbations can increase the test error in some regimes , even when the targets are noiseless . For example , Figure 1 ( a ) illustrates a function interpolation problem via cubic splines which exemplifies this phenomenon . Without data augmentation , the estimated predictor ( dashed blue ) is a line that captures the global structure and obtains low error . Data augmentation with local perturbations ( crosses ) encourages the predictor to fit the local structure of the high density points but compromises the global structure on the tail ( solid orange ) ( Figure 1 ( b ) ) . We show that this tension between local and global fit stems from the estimator having the wrong inductive bias . In particular , the minimum norm estimator minimizes a generic parameter norm while the test error is measured by a possibly different norm on the parameter error vector which depends on the data distribution ( Section 4.1 ) . Further , one might expect augmentation to be most helpful in low data settings . We show that in linear regression , this is also exactly the regime where augmentation can be most harmful . On real datasets , we similarly observe that data augmentation can be more detrimental with a smaller original training set ( Section 5 ) . Motivated by our analysis of interpolation in linear regression , we propose a new estimator for data augmentation based on X-regularization ( Section 6 ) . X-regularization encourages the data augmented interpolant to stay close to the original interpolant while fitting the extra augmented points . We prove that X-regularization eliminates the increase in test error upon data augmentation in the case of noiseless linear regression . See Figure 1 ( c ) for its effect on the spline interpolation problem . X-regularization naturally extends to more general losses and complex models and is closely related to self-training ( Scudder , 1965 ) , the classical semisupervised learning algorithm . For the particular setting of robustness , X-regularization applied to adversarial training takes the form of robust self-training ( RST ) that was recently proposed in ( Carmon et al. , 2019 ; Najafi et al. , 2019 ; Uesato et al. , 2019 ) . The previous works view RST as a way to beat the sample complexity barrier of robustness . By showing that RST is an instantiation of X-regularization , we motivate RST as an appropriate data dependent regularizer that improves both standard accuracy and robustness . We evaluate the effect of RST on standard and robust accuracy with different adversarial training losses and perturbations on CIFAR-10 in Section 6.3 . With ` ∞ perturbations , we find that RST improves standard accuracy by 4−6 % while maintaining or even improving the robustness achieved by the vanilla adversarial training counterpart . With random and adversarial rotations , RST improves standard accuracy by∼1 % and robust accuracy by 1−3 % . Our experiments suggest that RST , and more broadly using unlabeled data with X-regularization , is a promising approach to mitigate the undesirable drop in standard accuracy when training robust networks . 2 RELATED WORK . The detrimental effect of data augmentation has been previously studied in the context of a “ tradeoff ” between accuracy and robustness . Understanding the tradeoff . In an attempt to explain the tradeoff between robustness and accuracy , Tsipras et al . ( 2019 ) ; Zhang et al . ( 2019 ) ; Fawzi et al . ( 2018 ) ; Nakkiran ( 2019 ) provide simple constructions that showcase an inherent tension between these objectives even in the limit of infinite data . These constructions rely on either non-label-preserving perturbations or insufficient model complexity to express a robust and accurate classifier . However , in practice , we typically augment with “ imperceptible ” perturbations that do not change the label , and we assume large neural networks used in practice to be expressive enough to contain a robust and accurate classifier . We address both these insufficiencies by studying covariate-shifted data augmentation where the extra data is labeled according to the same predictive distribution as the original data , and well-specified linear regression . Mitigating the tradeoff . Existing proposals to mitigate the observed increase in standard error caused by adversarial augmentations are based on finding better architectures via Neural Architecture Search ( Cubuk et al. , 2017 ) or changing the neural net training algorithm ( Lamb et al. , 2019 ) . While these methods have shown some success , they are restricted to neural networks . We complement this line of work by studying this tradeoff more generally and also provide some theoretical justification . 3 SETUP . 3.1 COVARIATE-SHIFTED DATA AUGMENTATION .. Let Pxy denote the underlying distribution of ( x , y ) pairs , Px its marginal on Rd , and Py ( · | x ) the conditional distribution of the targets given inputs . We refer to the training data from the underlying distribution Pxy by standard training data . Formally , we have n pairs ( xi , yi ) ∼ Pxy forming the measurement matrix Xstd = [ x1 , x2 , ... xn ] > ∈Rn×d and target vector ystd = [ y1 , y2 , ... yn ] > ∈Rn . Analogously , we consider augmenting the training set with “ extra ” training points denoted by Xext = [ x̃1 , x̃2 , ... x̃m ] > ∈Rm×d with associated targets yext = [ ỹ1 , ỹ2 , ... ỹm ] > ∈Rm . We focus on covariate-shifted data augmentations which includes most forms of data augmentations used in practice . Here , the targets yext are drawn from the same underlying predictive distribution Py ( · | x ) as the standard data , while the extra inputsXext could be arbitrary . Examples . Typically , the “ extra ” training points are constructed as follows : x̃i = T ( xi ) , ỹi = yi , where T is some label-preserving transformation thereby enforcing that the extra targets are as if sampled from Py ( · |x ) . Example transformations include translations , horizontal flips , small rotations , small ` ∞ perturbations in vision , and replacing words with their synonyms in NLP . However , our treatment of data augmentation in this work is more general where Xext is not necessarily obtained via transformations of Xstd . Empirically , our main focus is on mitigating the increase in test error upon adversarial training . Most popular forms of adversarial training are instances of covariate-shifted data augmentation . Consider projected gradient adversarial training ( PG-AT ) ( Madry et al. , 2018 ) which confers robustness to adversarial examples ( Szegedy et al. , 2014 ) but also causes an increase in standard test error . PG-AT can be viewed as a form of iterative data augmentation that falls in our framework above . Formally , letB ( x ) be the set of perturbations of x that we would like to be robust against . We assume that the label is constant overB ( x ) . The transformation at step t of the training for data point xi is Tt ( xi ) = argmax x∈B ( xi ) ` ( θ̂t , xi , yi ) , where θ̂t are the model parameters at time step t. The worst-case ( max loss ) perturbation is approximated via the projected gradient method . 3.2 MINIMUM NORM INTERPOLATION IN WELL-SPECIFIED LINEAR REGRESSION . Consider a regression task where the targets y ∈ R are drawn from the conditional distribution Py ( · |x ) =N ( x > θ ? , σ ) , for some vector θ ? ∈Rd . Our goal is to learn a linear predictor fθ ( x ) =x > θ . In this work , we focus on interpolating estimators , which draws motivation from modern machine learning models that achieve near zero training loss ( on both standard and extra augmented points ) . Interpolating estimators for linear models are analyzed in many recent works ( Ma et al. , 2018 ; Belkin et al. , 2018 ; Hastie et al. , 2019 ; Liang & Rakhlin , 2018 ; Bartlett et al. , 2019 ) . We present our results for interpolating linear regression estimators with minimum Euclidean norm , but our analysis directly applies to more general Mahalanobis norms via suitable rotations . See Appendix A . Given inputs X∈Rn×d and corresponding targets Y ∈Rn as training data , we define the following minimum norm interpolation estimator as θ̂=argmin θ { ‖θ‖2 : Xθ=Y } . ( 1 ) In particular , we compare the following estimators : ( i ) the standard estimator θ̂std which has [ Xstd , ystd ] as training data and ( ii ) the data augmented estimator θ̂aug with X = [ Xstd ; Xext ] , Y = [ ystd ; yext ] as training data : θ̂std =argmin θ { ‖θ‖2 : Xstdθ=ystd } and θ̂aug =argmin θ { ‖θ‖2 : Xstdθ=ystd , Xextθ=yext } . ( 2 ) 4 BIAS AND VARIANCE OF MINIMUM NORM INTERPOLANTS . We evaluate the two estimators described in Equation 2 using the error on a random sample xtest drawn from Px . Let Σ be the covariance of Px . We focus on the error conditioned on Xstd , Xext , which decomposes into a bias and variance term as follows R ( θ̂ ) =E [ ( x > test ( θ̂−θ ? ) ) 2 ] =E [ ( θ̂−θ ? ) > Σ ( θ̂−θ ? ) ] = ( E [ θ̂ ] −θ ? ) > Σ ( E [ θ̂ ] −θ ? ) ︸ ︷︷ ︸ Bias B ( θ̂ ) +tr ( Cov ( θ̂ ) Σ ) ︸ ︷︷ ︸ Variance V ( θ̂ ) , ( 3 ) where the expectation is taken over the randomness in xtest and targets ystd , yext conditioned on Xstd , Xext . In this section , we treat Xstd , Xext as fixed quantities . However , since Xstd consists of samples from Px , the number of samples dictates some structure onXstd . We touch upon this aspect in Section ? ? where we study how the effect of augmentation varies with the number of samples in the original training set , both theoretically and empirically .

Summary: This paper studies data augmentation in the regime where labels for the augmented datapoints are known. Special emphasis is put on the study of overparametrised linear models with minimum Euclidean norm of the regression weights (a.k.a. ridgeless regression). The results of this study are then used to motivate their “X-regularization” method, a semi-supervised learning algorithm which they test on the task of improving accuracy of adversarially trained models. The authors report improvement in accuracy of adversarially trained classifiers on CIFAR-10 when X-regularization is applied.