Understanding the Interaction of Adversarial Training with Noisy Labels

1 INTRODUCTION . In practice , the process of data labeling is usually noisy . Thus , it seems inevitable to learn with noisy labels ( Natarajan et al. , 2013 ) . To combat noisy labels , researchers have designed robust label-noise learning methods , such as sample selection ( Jiang et al. , 2018 ) and loss/label correction ( Patrini et al. , 2017 ; Nguyen et al. , 2019 ) . Meanwhile , safety-critical areas ( e.g. , medicine and finance ) require deep neural networks to be robust against adversarial examples ( Szegedy et al. , 2014 ; Nguyen et al. , 2015 ) . To combat adversarial examples , adversarial training methods empirically generate adversarial data on the fly for updating the model ( Madry et al. , 2018 ; Zhang et al. , 2019a ) . An interesting fact is that , the research community is exploring label-noise learning and adversarial training independently . For example , Ding et al . ( 2020 ) and Zhang et al . ( 2021b ) demonstrated that the non-robust data that are close to the nearest class boundary are easy to be attacked : their adversarial variants easily cross over the decision boundary . To fine-tune the decision boundaries for adversarial robustness , Ding et al . ( 2020 ) adaptively optimized small margins for non-robust data , while Zhang et al . ( 2021b ) gave more weights on them . However , both methods in adversarial training explored the adversarial robustness with an implicit assumption that data have clean labels . Obviously , it is not realistic in practice . To this end , we figure out the interaction of adversarial training with noisy labels . We discover that when noisy labels occur in adversarial training ( the right panel of Figure 1 ) , incorrect data ( square points ) are more likely to be non-robust ( i.e. , the predicted labels of their adversarial variants disagree with the given labels ) . Specifically , Figure 1 compares the difference between standard training ( ST ( Zhang et al. , 2017 ) ) and adversarial training ( AT ( Madry et al. , 2018 ) ) with noisy labels . Commonly , a small number of incorrect data ( square points ) are surrounded by a large number of correct data ( round points ) . In ST , deep networks shape two small clusters ( the left panel of Figure 1 ) around the two incorrect data due to memorization effects ( Zhang et al. , 2017 ) . In contrast , AT has strong smoothing effects , i.e. , smoothing out the small clusters around incorrect data and letting incorrect data alone ( the right panel of Figure 1 ) . To explain the above phenomenon in AT , we believe that the adversarial counterparts generated by ( majority ) correct data can help to smooth the local neighborhoods of correct data , which encourages deep networks to be locally constant within the neighborhood ( Papernot et al. , 2016 ) . Therefore , in AT , it becomes difficult for deep networks to form small but separated clusters around each incorrect data . Consequently , these incorrect data are non-robust , which echos the parallel findings that robust training avoids memorization of label noise ( Sanyal et al. , 2021 ) . Furthermore , we make quantitative comparisons between ST and AT in the presence of label noise . Zhang et al . ( 2017 ) showed that ST indeed overfits noisy labels , which definitely degrade the generalization performance of deep networks . From Figure 3 , it can be seen that the training accuracy of deep networks on incorrect data is obviously lower than that on correct data in AT . Nonetheless , the performance gap totally disappeared in ST . Therefore , compared to ST , AT can always distinguish correct data and incorrect data . Observing Figure 4 , the test accuracy of deep networks first increases then decreases in ST . Nonetheless , such a trend has been largely alleviated or totally eliminated in AT . Therefore , AT can mitigate negative effects of noisy labels , since the smoothing effects of AT can prevent memorizing such incorrect data . Moreover , under noisy labels , we realize that AT provides a new measure—how difficult it is to attack data to generate adversarial variants whose predictive labels are different from the given labels— which can distinguish correct/incorrect data ( Figures 7 ( a ) and 7 ( b ) ) and typical/rare data ( Figure 8 ) well . This new measure can be approximately realized by the number of projected gradient descent ( PGD ) steps ( Madry et al. , 2018 ) , i.e. , how many PGD iterations we need to generate misclassified adversarial variants . Compared with the commonly used measure , i.e. , the loss value ( Jiang et al. , 2018 ; Han et al. , 2018 ) , we find that the number of PGD steps could be an alternative or even better measure in AT ( Figures 7 ( a ) and 7 ( b ) ) . In addition , we discover that this new measure can easily pick up rare ( atypical ) data among typical data ( Figure 8 ) , where modern datasets often follow long-tailed distributions ( Feldman & Zhang , 2020 ) . Main contributions . To sum up , our contributions can be summarized in three aspects as follows . 1 . We explore the in-depth interaction of AT with noisy labels . Namely , we take a closer look at the smoothing effects of AT under label noise ( Section 3 ) . Subsequently , we conduct quantitative comparisons : compared with ST , AT can always distinguish correct and incorrect data and mitigate negative effects of label noise ( Section 4 ) . 2 . We realize that AT naturally provides a new measure called the number of PGD steps , i.e. , how many PGD iterations are needed to generate misclassified adversarial examples . Such a new measure can clearly differentiate the correct/incorrect data and typical/rare data ( Section 5 ) . 3 . We provide two simple examples of the applications of our new measure : a ) we develop a robust annotator , which can robustly annotate unlabeled ( U ) data considering that U data could be adversarially perturbed ( Section 6.1 ) ; b ) our new measure could be an alternative to the predictive probability for providing the confidence of annotated labels ( Section 6.2 ) . 2 BACKGROUND AND RELATED WORK . Adversarial training ( AT ) . As one of the primary defenses against adversarial examples ( Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ; Athalye et al. , 2018 ) , AT has been widely studied to improve the adversarial robustness of deep neural networks ( DNNs ) ( Cai et al. , 2018 ; Wang et al. , 2020b ; a ; Jiang et al. , 2020b ; Wu et al. , 2020 ; Chen et al. , 2020 ; Bai et al. , 2021 ; Chen et al. , 2021 ; Tian et al. , 2021 ) . The key objective of AT is to minimize the training loss on the adversarial variants of training data . We review the details of AT ( Madry et al. , 2018 ) used in this paper . Let ( X , d∞ ) denote the input feature space X with the infinity distance metric dinf ( x , x′ ) = ‖x− x′‖∞ , and B [ x ] = { x′ ∈ X | dinf ( x , x′ ) ≤ } be the closed ball of radius > 0 centered at x in X . S = { ( xi , yi ) } ni=1 is a dataset and ( xi , yi ) are i.i.d . from an underlying distribution , where xi ∈ X , yi ∈ Y = { 0 , 1 , . . . , C − 1 } , and C denotes the number of classes . The objective function of AT is min fθ∈F 1 n n∑ i=1 ` ( fθ ( x̃i ) , yi ) , ( 1 ) where x̃i is an adversarial variant of input data xi within the -ball centered at x and fθ ( · ) : X → RC is a score function . ` : RC × Y → R is a loss function which is a composition of a base loss ` B : ∆ C−1 × Y → R ( e.g. , the cross-entropy loss ) and an inverse link function ` L : RC → ∆C−1 ( e.g. , the soft-max activation ) , in which ∆C−1 is the corresponding probability simplex—in other words , ` ( fθ ( · ) , y ) = ` B ( ` L ( fθ ( · ) ) , y ) . To generate the adversarial variants x̃ for natural data x , AT employs the PGD method ( Madry et al. , 2018 ) . Given a starting point x ( 0 ) ∈ X and step size α > 0 , PGD works as follows : x ( t+1 ) = ΠB [ x ( 0 ) ] ( x ( t ) + α sign ( ∇x ( t ) ` ( fθ ( x ( t ) ) , y ) ) ) , ( 2 ) until a certain stopping criterion is satisfied . In the above equation , t ∈ N , ` is the loss function , x ( 0 ) refers to natural data or natural data perturbed by a small Gaussian or uniform random noise , y is the corresponding label for natural data x , x ( t ) is an adversarial data point at step t , and ΠB [ x0 ] ( · ) is the projection function that projects the adversarial data back into the -ball centered at x ( 0 ) if necessary . It is common to use PGD to generate adversarial variants x̃ in AT methods ( Wang et al. , 2019 ; Zhang et al. , 2020 ) . Recently , Zhang et al . ( 2021b ) explored adversarial robustness by giving more weights on the non-robust data with the assumption that all labels are correct . Specifically , the non-robust data are geometrically close to the class boundaries , which can easily go across the class boundaries by a small perturbation . To approximate the distance between the data and the class boundaries , they proposed the geometry-aware projected gradient descent ( GA-PGD ) to calculate the geometry value κ , which is the least number of iterations that PGD needs to find misclassified adversarial variants of input data . In this paper , we utilize the geometry value κ to represent our proposed measure ( i.e. , the number of PGD steps ) ; we further explore its applications such as selecting correct/incorrect and typical/rare data ( Section 5 ) , assisting to develop a robust annotator ( Section 6.1 ) and providing the annotation confidence ( Section 6.2 ) . Label-noise learning . We consider a training set with X = ( x1 , . . . , xN ) and its associated labels Y = ( y1 , . . . , yN ) , where yi ∈ Y is the one-hot label for the instance xi and ( xi , yi ) are drawn i.i.d . from some unknown distribution . In the setting of label noise , we observe noisy labels Ỹ = ( ỹ1 , . . . , ỹN ) where ỹi ∈ Ỹ might be different from the corresponding ground-truth label yi ∈ Y . In this paper , we mainly focus on typical class-conditional noise : 1 ) symmetric-flipping noise ( Van Rooyen et al. , 2015 ) , where noisy labels are corrupted at random with the uniform distribution ; 2 ) pair-flipping noise ( Han et al. , 2018 ) , where noisy labels are corrupted between adjacent classes that are prone to be mislabeled . Note that pair-flipping noise is an extremely hard case of asymmetric-flipping noise ( Patrini et al. , 2017 ) . To combat noisy labels , researchers have designed robust label-noise learning methods , such as sample selection ( Malach & Shalev-Shwartz , 2017 ; Jiang et al. , 2020a ; Han et al. , 2020a ) , loss correction ( Han et al. , 2020b ; Liu & Guo , 2020 ) , and label correction ( Wang et al. , 2018 ) . Among them , sample selection is emerging due to its simplicity . The key idea of sample selection is to back-propagate clean samples ( regarded as correct data ) during training . Since DNNs learn simple patterns first ( Zhang et al. , 2017 ; Arpit et al. , 2017 ) , the loss value is used as a general criterion for selecting clean samples ( Han et al. , 2018 ; Yao et al. , 2020 ) . Specifically , the data with small-loss values are considered as clean samples , which are used to update the model . In contrast , the data with large-loss values are considered as noisy samples , which should be discarded or utilized in another way ( Han et al. , 2020a ) . Note that this paper proposes a new criterion—the number of PGD steps—for sample selection ( Section 5 ) . Co-existence of adversarial examples and noisy labels ( NL ) . Some work has previously studied adversarial examples and noisy labels ( NL ) jointly . Alayrac et al . ( 2019 ) empirically showed that NL negatively affects AT ’ s performance , but AT ’ s robust accuracy apparently suffers less than AT ’ s natural accuracy . Sanyal et al . ( 2021 ) empirically found that AT can avoid the memorization of NL . Damodaran et al . ( 2019 ) proposed to use Wasserstein adversarial regularization to combat NL for benefiting ST ’ s generalization . In contrast , we advocate the AT ’ s smoothing effect by making quantitative comparisons between AT and ST under NL . Specifically , ST has a memorization effect that gradually memorizes NL and degrades generalization in the end , while AT has a smoothing effect that avoids the memorization of NL and combats NL for benefiting generalization . In addition , we propose a new measure called the number of PGD steps for sample selection , which can differentiate the correct/incorrect data and typical/rare data , and we provide two exemplar applications for our new measure . Furthermore , in Appendix A , we provide extensive comparisons between our study and the existing literature .

Summary: This submission empirically studies the efficacy of adversarial training for mitigating the effect of label noise in training data. Their findings are as follows: 1) "Smoothing effect" of adversarial training: 	a) on a 2-dimensional synthetic binary classification dataset where two points are incorrectly labeled, they show that vanilla training yields a classifier that memorizes the bad labels by forming "clusters" around the incorrectly labeled points, whereas adversarial training does not yield such clusters 	b) for CIFAR injected with 20/40% random label noise, they ran vanilla and adversarial training on the noisy data and found that if you look at the distribution over labels within the neighborhood of a random incorrectly labeled point, on average the entropy of that distribution is higher for the classifier obtained by adversarial training than by vanilla training 2) For vanilla training on CIFAR (also MNIST) injected with label noise, the gap between accuracy on the correctly labeled training data and the incorrectly labeled data closed over the course of training, whereas this gap does not close or seems to close much more slowly for adversarial training. 3) Over these same noisy datasets, adversarial training seems to mitigate the impact of noisy training data on (clean) test accuracy, unlike vanilla training for which generalization degrades as label noise increases 4) They consider a quantity they call the "geometry value" of a data point (x,y), which corresponds to the number of PGD steps needed to find a differently labeled point in the neighborhood of x. This quantity was originally introduced by [Zhang et al. 2021b], and in the present paper they find that: 	a) compared to loss(x,y), it appears to be a more effective way to effective way to distinguish correctly labeled data from incorrectly labeled training data, as well rare data from typical data 5) They propose a "robust annotator" for labeling unlabeled data that has possibly been subject to adversarial perturbations. The algorithm repeatedly alternates between 1) identifying training data points with high loss and low geometry value and re-labeling them according to the current classifier and 2) running a step of adversarial training. It appears to do slightly better than a PGD-based annotator baseline when trained over CIFAR injected with label noise. They also note that the geometry value can provide some kind of "confidence score" to go along with the label annotations.