Wasserstein Adversarial Regularization (WAR) on label noise
Authors: Bharath Damodaran
Kilian Fatras
Sylvain Lobry
Rémi Flamary
Devis Tuia
Nicolas Courty
Venue:  (2020)
Keywords: Label Noise
Adversarial regularization
Wasserstein

Abstract: Noisy labels often occur in vision datasets, especially when they are obtained from crowdsourcing or Web scraping. We propose a new regularization method, which enables learning robust classifiers in presence of noisy data. To achieve this goal, we propose a new adversarial regularization scheme based on the Wasserstein distance.  Using this distance allows taking into account specific relations between classes by leveraging the geometric properties of the labels space.  Our Wasserstein Adversarial Regularization (WAR) encodes a selective regularization, which promotes smoothness of the classifier between some classes, while preserving sufficient complexity of the decision boundary between others. We first discuss how and why adversarial regularization can be used in the context of label noise and then show the effectiveness of our method on five datasets corrupted with noisy labels: in both benchmarks and real datasets, WAR outperforms the state-of-the-art
competitors.

Under review as a conference paper at ICLR 2020
WASSERSTEIN ADVERSARIAL (WAR) ON LABEL NOISE
REGULARIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Noisy labels often occur in vision datasets. especially when they are obtained from crowdsoureing or Web scraping. We propose new regularization method, which enables learning robust classifiers in presence of noisy data. To achieve this goal, we propose a new adversarial regularization scheme based on the Wasserstein dis- tance. Using this distance allows taking into account specific relations between classes by leveraging the geometric properties of the labels space. Our Wasser- stein Adversarial Regularization (WAR) encodes selective regularization, which promotes smoothness of the classifier between some classes, while preserving suf- ficient complexity of the decision boundary between others. We first discuss how and why adversarial regularization can be used in the context of label noise and then show the effectiveness of our method on five datasets corrupted with noisy la- bels: in both benchmarks and real datasets, WAR outperforms the state-of-the-urt competitors.
INTRODUCTION
Deep neural networks require large amount of accurately annotated training samples to achieve good generalization performances. Unfortunately, annotating large datasets is a challenging and costly task, which is practically impossible to do perfectly for every task at hand. It is then most likely that datasets will contain incorrectly labeled data, which induces noise in those datasets and can hamper learning. This problem is often referred to as learning with label noise or noisy labels. The probability of facing this problem increases when the dataset contains several fine grained classes that are difficult to distinguish (Schroff et al.) 2011:: Krause et al. 2016: Dubey et al. (2018). As pointed out in (Zhang al. 2017), deep convolutional neural networks have huge memorization abilities and can learn very complex functions. That is why training with noisy data labels can lead to poor generalization (Arpit al.) [017]] Wang et al., 20188) Choi et al. al.] 2018). Hence in this paper we propose method tackling the problem of overfitting noisy labels, and this without access to a clean validation dataset.
This problem has been considered in recent literature, mainly in three ways. First are data clean- ing methods: (Vahdat) 2017 Xiao et al. 2015) Li et al. (017) learn relations between noisy and clean labels before estimating new labels for training. In (Lee et al., 2018), few human verified labels were necessary to detect noisy labels and adapt learning. In (Jiang et al. 2018 Ren et al, meta-gradient updates re-weight training sets and downweight samples with noisy labels. Second are Transition probability- methods: (Sukhbaatar & Fergus 2014: Patrini al. 2017 Hendrycks al. 2018) estimate a probability for each label to be flipped to another class and use these estimations to build a noise transition matrix. In (Sukhbaatar Fergus 2014). the authors add an extra linear layer to the softmax in order to learn the noise transition matrix itself, while (Hendrycks et al. 2018) uses small set of clean validation data to estimate (Patrini et al. 2017) proposes a forward/backwarr loss correction method, which exploits the noise transition matrix to correct the loss function itself. Third are regularization-base methods. In (Reed et al.) 2015 Ma et al., 2018), the authors use a mixture between the noisy labels and network predictions. In (Tanaka et al. 2018), the regularization is achieved by alternatively op- timizing the network parameters and estimating the true labels while the authors of (Han et al. 2018 Yu al. 2019) propose peer networks feedbacking each other about predictions for the noisy labels. Song et al. (2019) proposes to replace noisy labels in the mini batch by the consistent network pre- dictions during training, while al. (2099) proposes noisy voss-validation to identify samples
2018), the methods rely either on curriculum

---

Under review as a conference paper at ICLR 2020
that have correct labels. In (Wang et al. 2019 Zhang & Sabuncu 2018 Ghosh al. 2017). robust loss functions are proposed to overcome limitations of cross entropy loss function.
In contrast to those works, propose to regularize predictions in areas of the feature space close to the decision boundary of conflicting classes, therefore mitigating the influence of noisy labels. To do so, we the adversarial regularization (AR) framework (Goodfellow et al., 2015 Miyato et al. 2018) on the noisy label problem. We use AR to reduce the discrepancy between the prediction of true input sample and the one obtained by a near-by adversarial sample. To reduce this discrepancy, we use a loss based on the Wasserstein distance computed with respect to a ground cost encoding class similarities. This ground cost provides the flexibility to regularize with different strengths pairs of classes. This strength can depend on semantic relations, classes similarities, or prior knowledge (e-g. on annotators' mistakes). This way, the classifier can discriminate non-similar objects robustly under the presence of noise and class overlap. We name our proposed method Wasserstein Adversarial Regularization (WAR). WAR allows incorporating specific knowledge about the potential degree of mixing of classes through ground cost that can be designed w.r.f the problem at hand. Nevertheless, this knowledge might be unknown or difficult to craft. In this paper, use distances between word embeddings of the class names derive semantic ground cost. Experiments in five datasets Frashon-MNISS CIFARIO, CIFAR100 and real life examples on clothing classification and a remote sensing semantic segmentation dataset) under label noise conditions show that WAR outperforms the state-of-the-ard in providing robust class predictions.
2 WASSERSTEIN ADVERSARIAL REGULARIZATION FOR LABEL NOISE
Given a set of labeled data {ar,, Jimt....... we are interested in learning a classifier pe defined by set of parameters 0. Data m, are usually elements of TR.,, while ye E C are one-hot vectors encoding the belonging to one of C' classes. The empirical risk minimization principle is used to learn pg. Given a loss function L, the optimal set of parameters for the classifier is given by
arg ming Σm L(x;, yi. po). Without loss of generality, we will consider that L is the cross-entropy
loss: LeE(2; ys) Po) E. (c) log po (o).
The considered label noise problem arises whenever some elements y! do not match the real class of x;. Several scenarii exist: in the symmetric label noise, labels can be flipped uniformly across all the classes, whereas in the asymmetric label noise, labels y in the training set can be flipped with higher probability toward specific classes. We note that the first scenario, while thoroughly studied in the literature, is highly improbable in real situations: for example, it is more likely that an annotator mislabels two breeds of dogs than a dog and a car. Hence, noise in labels provided by human annotators is not symmetric since annotators make mistakes depending class similarities (Misra et al. 2016))
To prevent classifier to overfit noisy labels, would like to regularize its decision function in areas where the local uniformity of training labels is broken. To achieve such desired local unifor- mity, robust optimization can be used. This amounts enforce that predicted labels are uniform in a local neighborhood U4 of data point Φ;. This changes the total loss function in the following way:
arg min
Σ
max L(x;, yi, Po)
x. EMI:
2.1 ADVERSARIAL REGULARIZATION
Because the robust optimization problem in equation 1 is hard to solve exactly, adversarial train- ing (Goodfellow et al.) 2015) Shaham et al.) 2015) was proposed as a possible surrogate. In- stead of solving the max inner problem, it suggests to replace it by enforcing uniformity in the direction of maximum perturbation, called the adversarial direction. Mainly used for robustness against adversarial examples, adversarial training is however not adapted to our problem, since it can enforce uniformity around a false label. Following the same reasoning, we propose to cast the problem as regularization term of the initial loss function. The total learning loss is then
2

---

Under review as a conference paper at ICLR 2020
Liot(a Dc. ( vr) + (Ran(2 po), where RAR is regularization term reading:
RaR pp) = ( + (o),po(a (m:) with r² argmax D(po(a;; + ro),)o(a)))..
(2)
Basically, it minimizes an isotropic divergence D between the probability output po(a; + +*) and po(x.). sound choice for can the Kullback-Leibler (KI.) divergence. RAR can be seen as (negative) measure of local smoothness, of æ, with respect to the metric D, hence a measure of complexity of the function. RAR promotes local uniformity in the predictions without using the potentially noisy label y;: therefore, it reduces the influence of noisy labels, since is computed from the prediction po(x,) that can be correct when the true label is not. RAR shares strong similarities with the Virtual Adversarial Training (VAT) from Miyato et al. (2018), at the notable exception that we do not consider a semi-supervised learning problem and that regularize the labeled training positions Bi where VAT is applied on unlabeled samples.
also as Local Lipschitz constant in the neighborhood
can be shown (proof in the supplementary material A. that this regularization acts as label smoothing technique:
Lemma 1 Let D be the Ballback-Leiblee divergence. Let = be the predicted (smooth) adversarial label. Let H be the entropy. The regularized learning problem ( Yes Pa) is equivalent to
341 E [0. Let yt = po(a, + r3))
8
Looe (os,
Ltot Vc. po) = LCE(a,, ()y + tey
c...)
This leads the following interpretation: instead of learning over the exact label over mix between the exact label and the network prediction, we learn over an interpolation with the adver- sarial label, while maximizing the entropy of the adversarial label (i.e. blurring the boundaries of the classifier). Related developments can be found in adversarial label smoothing (ALS) (Shafahi et al.) 2018 Goibert Dohmatob 2019). which aims at providing robustness against adversarial attacks.
Yet, one of the major limit of this approach is that the regularization is conducted with the same magnitude everywhere. As consequence, a strong regularization can remove the label noise, but also hinder the ability of the classifier to separate similar classes where complex boundary is needed. To overcome this issue, we propose to replace/ D by a geometry-aware divergence taking into account the specific relationships between the classes.
2.2 WASSERSTEIN ADVERSARIAL REGULARIZATION (WAR)
To make the divergence aware of specific relationships between classes, we replace the isotropic divergence D with a Wasserstein distance computed in the labels space. We name our proposed method Wasserstein Adversarial Regularization. Frogner et al. (2015) already used the Wasserstein distance as a loss in a learning system between the output of the model for multi-label learning. The interest of the Wasserstein distance is to take into consideration the geometry of the label space.
We define the proposed regularization term RWAR as follows:
RWAR(2) (Po((, (x, + -1,), Po (xx))) with rf argmax Opd(po
(3)
OTa is an optimal transport (OT) distance PPyrr & Cuturi 2019). The OT problem seeks an opti-
mal coupling T' E U(a 3) = (TT 0, T1 a,
B between two distributions a, B is the space of joint probability distributions
with respect ground cost E 2=1 U(a, with marginals a and B. OT distances are classically expressed through the Wasserstein distance (a, = min (T, C), where (.,.) the Frobenius product. Unfortunately, this distance (a)
expensive to compute (cubical complexity). In practice, we will use the solution of the sharp entropic variant of the optimal transport problem (Luise et al. 2018):
OT = (TX, C*) with T argmin (T,C) C) - AH(T) (a,
where H denotes the entropy function and the regularization strength. Using this regularized version has several advantages: i) it lowers the computational complexity to quadratic, ii) it turns the
3

---

Under review as a conference paper at ICLR 2020
problem into strongly convex one, for which gradients can be computed efficiently and iii) it allows to vectorize the computation of all Wasserstein distances in a batch, which is particularly appealing for training deep neural nets. Based (Genevay et al., 2018), which approximates the derivative of this regularization with a fixed number of iterations of the Sinkhorn algorithm.
use the AutoDiff framework,
Choice of ground cost. The ground cost C reflects the geometry of the label space. It bridges the gap between AR and WAR. An uninformative 0-1 ground cost, i.e. 0 over the diagonal and everywhere, would give the total variation (TV) loss (Remark 2.26 in (Peyré & Cuturi 2019)), which could also be used D in the AR framework. Below, we refer this special case as RWAR.D.1 To define a C' matrix encoding class relations, multiple choices are possible. We could calculate the Wasserstein distance between classes, but this would be biased as we have noisy labels. We could set it manually (Tuia et al., 2011). but this becomes unpractical when a large set of classes is present. In absence of prior information about the nature of the source of labelling errors, we decided to rely on semantic distances based word embeddings such word2vee (Mikolov et al.] 2013)- Similarities between classes are then defined via Euclidean distances in the embedding space, as proposed in (Frogner et al., 2015). Finally, as method requires large values of the cost between similar classes, we apply the function e-m (where m is the Fuclidean distance between the two class names) element- wise and set the diagonal of C to O.
Function smoothness and ground metric. Now we discuss how the proposed regularization term regularizes the model pe with a smoothness controlled by the ground metric C. It is not possible to extend the label smoothing in Lemma to WAR because the OT distance does not admit a close form solution, but we can still show how RWAR promotes label smoothness. To this end, we look at ( (æ + r)) for given sample x and a pre-computed r. We can
the regularization term OT (f(())) (o prove (see A.2 of the supplementary material) the following lemma:
Lemma 2
Minimizing RWAR with a symmetric cost C such that Ci,i 0, Vi is equivalent to mini- mizing a weighted total variation (TV) norm between po(x) and pa(x + r).
cTV(po (o)) + +r) $ Cxulpo(x); - -oox + r)sl I OTA( (x),, po( + +))
(4)
where Cs mintifk C is the minimal off-diagonal cost for row k of C and g mink S is global minimum out of the diagonal.
By minimizing the proposed RWAR regularization with belonging in small ball around æ, we actually minimize a local approximation of the Lipschitz constant of pa- This has the effect of smoothing-out the model around æ and makes it more robust label noise. One can the effect of the cost matrix in the center term of equation where the values in the ground metric correspond to weighting of total variation, hence controlling the effect of the regularization. Interestingly, the Wasserstein distance can be bounded both below (c) and above (7) by Total Variation and weighted total variation similarly to the equation above. Finally, in practice we minimize the expectation of the OT loss, which means that we will penalize areas of high density similarly to a regularization with the Sobolev norm (i.e. penalizing the expected norm of the model gradient (Mroueh et al., 2018h, while keeping finer control of the class relations, since we use the ground loss C' that promotes anisotropy.
Illustration of the effect of RWAR We illustrate AR and WAR in a simple toy 3 classes classifica- tion problem with noise (F..
Each column of the figure corresponds to a divergence function D. The top row illustrates the values on the simplex, while the bottom row shows the classification predictions when using D as adversarial regularization. From left to right, we compare the effect of training with the cross entropy alone (CCE, no regularization), RWAR with À = 0.1 and À = 0.05, as well as HAR with generated two close classes
TV, KL and L2 divergences as D. For the classification problem, (in orange and red), as well as a third (in black), which is far from the others. Then, we introduced noisy labels (of the black class) in the region of the red class.
On this toy example, CCE overfits the noisy black labels, yet is able to distinguish the red and orange classes. The RAR regularizers, being class agnostic, correct for the noisy black labels in the bottom
4

---

Under review as a conference paper at ICLR 2020
Entropic W, 2-0.1
Entropic W, A-0.05
TV
KL
0
CCE (no reg.)
Figure I: Illustration of the regularization geometry for different losses in the adversarial training. (Top) Regularization values on the simplex of class probabilities. Each corner stands for class. All losses are computed with respect to prediction represented as the green x. Colors are as follows: white is zero while darker is bigger. In the case of WAR, the ground cost is given on the left. (Down) Classification boundaries when using these losses for regularization. The unregularized classifier (CCE) is given on the left.
part, but smooth the complex decision function between the orange and red classes. On the contrary, RwAR uses different cost per pair of classes, illustrated in the top left panel of Figure the smallest cost set between the red and black classes, which has the effect of promoting adversarial examples in that direction. This cost smoothing relation is due to the fact that our problem is minimization of the OT loss: in other words, the higher the cost between the classes, the less the binary decision boundary will be smoothed. Finally, the effect of the global À parameter can also be appreciated in the classification results: while using À = 0.05, the smoothing of the loss is decreased and the final decision boundary between the mixed classes keeps all its complexity.
EXPERIMENTS
We evaluate the proposed approach WAR both image classification and semantic segmentation tasks. We first showcase the performance of WAR on series of image classification benchmarks (Section 3.1). and then consider real world cases: first, the classification of clothing images from online shopping websites (Section 3.2) and then the semantic segmentation of land use in sub-decimeter resolution aerial images (Section 3.3
3.1 IMAGE CLASSIFICATION ON SIMULATED BENCHMARK DATASETS
Datasets and noisy labels simulations. We consider three image classification benchmark datasets: Fashion-MNIST (iiao et al. 2017), and CIFAR- / CIFAR-100 (Krizhevsky) 2009). Fashion-MNIST consists of 60' 000 gray scale images of size 28 x 28 with 10 classes. CIFAR- 10 and CIFAR-100 consist of 50'000 color images of size 32 x 32 covering 10 and 100 classes, respectively. Each dataset also contains 10'000 test images with balanced classes.
Since we want to evaluate robustness to noisy labels, we simulated label noise in the training data only. For all datasets, only asymmetric noise, a class-conditional label noise where each label y: the training set is flipped into Y; with probability P.,j- As described above, asymmetric noise is more common in real world scenarios than symmetric noise, where the labels are flipped uniformly over all the classes. For CIFAR-10 and CIFAR-100,
introduced 0%, 20% and 40% of noise in the labels. We considered
follow the asymmetric noise simulation setting by Patrini et al. 2017). where class labels are swapped only among similar classes with probability (i.e. the noise level). For Fashion-MNIST. we visually inspected the similarity between classes on t-SNE plot of the activations of the model trained on clean data; we then swapped labels between overlapping classes (-x: one-directional swap, ++ mutual swap): DRESS T-SHIRT/TOP. COAT ++ SHIRT, SANDAL SNEAKER, SHIRT - PULLOVER, ANKLE BOOT SNEAKER.
Baselines. We compared the proposed WAR with an informative C matrix based on the word2vec embedding (WARc) against several state-of-the-art methods: Unh Unhinges (Rooyen

---

Under review as a conference paper at ICLR 2020
Test accuracy (%) of different models on Fashion-MNIST. CIFAR-IO, and CIFAR-100 dataset with varying noise rates (0% 40%). The mean accuracies and standard deviations averaged over the last 10 epochs of three runs are reported, and the best results are highlighted in bold.
Table 1:
Datnact
DCR
Backycarl
Forward
Unhings
Bosboll
Oriteaching
Colloetinge
D221
WARg
0%
94,9910.11
94,6610.04
94.5120.14
95.12 2 0.83
04.79
96.28200.04
93.6250.11
94. 94.70220022 94,47
PsOiin-MNIST
30%
50.02+047
58. 84+0.00
91
90.04+ 0.06
88. 17.11
91 01.24-0.06
92.36+0.02
80. 15:01:11
93.77-000
40%
78.55 78.55+00.56
B1. 51.7450.05
$2.65 =0.2
02.32 #0.15
73.44:0.28
86.83-0.10
56.15=0003
78.96:00:25
90.41=0092
05
91.76110.44
91.63 1 0.04
91.59
a 0:00
92.37 1 0.04
91.67 =: 0.03
90.12 -0.04
58.47100144
91.2910002
01.88_00.31
CIFAR-10
20%
85.26:10.99
54.57 1 1.0.1
85,70
1 0:08
$7.09
1: 0.05
85.25
0.3
$6.19 00.07
$2.97.10 24
86.64 1:012
89.12..0.8
40%
76,2310.15
73:49
1 0.14
75,10
0:115
77.54
a.0) 0.1
74.32 8: 0.2
80.87.0.009
72,86
10
73.12 1:0.3
$4.55_0.76
05
68
60. 53+0000
70. 12:4000777
70.54+0000
69.00
65.42-0.06
58. 9++00 14
70.93 +:U02
68, 16-00.1
CIRAR-100
20%
58.51 =0.10
50 00:233+0.08
61 106:000006
58:97=0.06
56 55.55.00000
44 14.88+00 14
60000-000
62.72-10.16
40%
42.45:00112
43.02:00.09
42.17:40.1
42.57::0.07
41.73:00.00
42.73
29 29.94:0..34
42.61=0004
58.86-01211
rank
5.9
5.2
4.5
3,0
6.2
5.2
7.6
5.1
2.2
(noier only)
6,3
5.8
4.8
3,6
7.3
3.8
6.8
et al. 2015). Bootstrapping (Reed et al. 2015). Forward and Backward loss correc-
tion Patrini al.) 2017), di dimeisiinaltty driven learning (D2L) (Ma et al.) 2018).
Co- So-Teaching (Han et al. 2018), and Co-Teaching+ (Yu et al. 2019). Finally, as a baseline
for all the considered methods we also included categori ca cross entropy (CCE)
loss function. All the methods shared the same architecture and training procedures, as detailed in the supplementary material A.4
Model. Similarly other works (Han et al. 2018 Miyato et al. 2018 employed 9-layer CNN architecture, detailed in Table 5 of the supplementary material A.4 For WARC, we set the hyper-parameters [3= 10, x= 0.05, and 0.005 for all the datasets. The hyper-parameters of the baselines are set according to their original papers. The noise transition matrix for the F Forward and Backward method is estimated from the model trained with cross entropy (Patrini al. 2017). The source code of WAR in Py PyTorch (Paszke et al. 2017) will be released upon publication.
Results. Classification accuracies are reported in Table T Results show that WARc consistently
outperforms the competitors by large margins, across noise levels and datasets. In particular, WARc achieved improvements of 4-5% points on fashion-MNISTTCCIFARRI the highest noise level. This demonstrates that the inclusion of class geometric information dur- ing training mitigates the effect of over-fitting to noisy labels. Besides WARC, Unhinged and Co-Teaching also performed well. The Forward and Backward method performed slightly better than CCE, which is most likely due to the burden in accurately estimating the noise tran- sition matrix. It noted that Co-Teachine uses true noise estimate, and the accuracy might drop if the noise ratio is estimated directly from the noisy data. Furthermore, performance of Co So-Teachingg iis surprising lower than the one of Co- To-aechiing on two datasets, in contrast to the observations in (Yu et al. 2019). From our experiments, we observed that Co-Teade ee--Teaching does not perform well when the noise is class-dependent and the model considered has a wide ca- pacity. We provide detailed discussion about Co- To-Thcchin in the supplementary material (section A.7...
and 15% on CIFAR-100 at
Importance of encoding class similarities: Finally, to better assess the significance of including class similarities, we compared WARC with WAR and AR using KI. divergence (Miyato et al.) 2018). For AR, we did not use the papem-paraetter from the original paper, as it would lead to over-fitting on the noisy labels in the later stage of training. Therefore, we used B=5 and 0.005 (similarty to both WAR approaches), and followed the same training procedure as WAR (as detailed in A.4 where sensitivity analysis for 3 is also reported in A.5).
Table 2 reports the performance of WAR and AR, and shows that WARC is consistently better than AR and WAR6-1 (except in one case), and outperformed AR significantly by 2-3% margin at the highest noise level. This demonstrates that including priors about class similarities as done in WARG helps increasing the robustness against label noise.
We used the code provided by the authors: http:://iiiiaaaooomiinnnyuuccont plus

---

Under review as a conference paper at ICLR 2020
Table 2: Comparison of WARc with AR and - with varying noise rates (0% 40%). The mean accuracies and standard deviations averaged over the last 10 epochs of three runs are reported, and the best results are highlighted in bold.
Methods
Fashion MNIST
CIUAR-10
CIFAR-100
0%
20%
40%
0%
20%
40%
0%
20%
40%
AR
+0.09
93. 23.10++0.14
89 19
91.49-0007
88.91-00.09
81.98-0.25
67.83-0.10 0.
65.44-0..11
55.75+0,14
WARg-1 WARC
94.6010.03
30.99.10.07
86.03.10.20
90.94.1.112
86. 16.12:10.21
15.15
65. 68.78-0..15
60.56100144
51.0010.31
94,70+0.02
93.37:+0.08
90.41-0.02
91.88-0.31
89.12=0.48
84.55-0.77
68.16-0.18
62.72+00116
08.86+0.21
Table 3: Test accuracy of different models on Clothing M dataset with ResNet-50.
Methods
CCE
CCE (reproduced)
bootsoft
Forward
D2L
WARc
accuracy 68.80
68.63
68.94
69.84
69.47
70.66
3.2 IMAGE CLASSIFICATION WITH REAL-WORLDS LABEL NOISE
Dataset. In this section, we demonstrate the robustness of WAR on a large scale real world noisy label dataset, Clothing M (Xiao et al. 2013). The Clothing M dataset contains million images of clothing obtained from online shopping websites and has 14 classes. The labels have been obtained from text surrounding the images and are thus extremely noisy. The overall accuracy of the labels has been estimated to 161.54% The dataset also contains additional manually refined clean data for training (50k samples), validation (14k) and testing (10k). However, we did not use the clean training and validation data in this work. Only the testing clean data was used evaluate the performance of the different approach when learning with label noise.
Experimental setup and Results: Similar to (Patrini al., 2017 Wang et al. 2019), we used ResNet-50 pre-trained on ImageNet for fair comparison between methods (more details in A.4
For WARc, the hyperparameters are similar to those of the previous experiment, except E 0.05.
Results are reported in Table 3 where we compared WARc against the competitors from (Patrini et al. 2017] Wang et al. 2019),, and also reproduced the CCE accuracy by our own experiments. As shown in Table our method achieved the highest performance compared to all the baselines.
3.3 SEMANTIC SEGMENTATION OF AERIAL IMAGES
Datasets and noisy labels simulations. In this experiment we consider the task of assigning every pixel of an aerial image to an urban land use category. We considered widely used remote sensing benchmark, the ISPRS Vaihingen semantic labeling d The data consist of 33 tiles (of varying sizes, for total of 168'287'871 pixels) acquired by aircraft at the ground resolution of 9cm. The images are true orthophotos with three spectral channels (near infrared, red, green). A digital surface model (DSM) and a normalized digital surface model (nDSM) input space 5-dimensional. Among the 33 tiles, we used the initial data split (11 tiles for training, 5 for validation and 17 for testing). As ground truth, six land cover classes (impervious surfaces, building, low vegetation, tree, car, background/clutter)) are densely annotated.
also available, making the
We simulated label noise by swapping labels the object level rather than flipping single pixels. An object is the connected component of pixels sharing the same label. We also focused on plausible labeling errors: for instance, a car could be mislabeled an impervious surface, but not building or a tree. Following this methodology. a third of the connected components had the label flipped. An example of the corrupted data shown Figure in the supplementary material (A.6).
Model. We used U-Net architecture (Ronneberger et al., 2015). modified take the 5 channels input data as inputs. More details about the training procedure are reported in the supplementary material A.4 Using this methodology, obtain overall accuracy the clean data of 83.89%. which is close to the state of the art for this dataset.

---

Under review as a conference paper at ICLR 2020
Table Per class Fl scores, average Fl score and overall accuracy (%) on the test Vaihingen. The best results (on the noisy dataset) are highlighted in bold.
Class
CCE
CCE
Bootsoft
CoTeaching
AR
WAR
Training
Clean
Noisy
Buildings
90.29
75.06
88.34
75.1
81.6
89.04
Cars
58.91
14.21
10.98
26.6
21.6
25.78
Impervious surfaces
85.76
62,20
82.66
76.9
70,9
79.01
Low vegetation
76.32
25.92
61.40
57.4
57.8
71.56
Trees
84.72
70.89
80.49
77.5
78.9
82.92
Average F1
79.20
49.65
64.77
63.6
62.2
69.66
Overall accuracy
83.89
63,95
78.87
74.6
77.1
78.43
Sept imgge
Grvendimsh
Croo ostrss
Toorott
AR
CoTtadteg
WARt
Ieporizoo safacc
Raking
Tixe
Semantic segmentation maps obtained on the test set of the ISPRS Vaihingen dataset (tile #12 the original data). The top row shows the full image, and the second row shows a close-up up of the area delineated in orange.
Figure 2:
Results. We compare WABg with standard CCE, Bootsoft, Co- To-TTeachin and AR. The re- sults, computed the full test ground truth (including boundaries) and averaged over 2 runs, reported in Table 4 Note that the classes are unbalanced and, for most of them, the Fl-score is improved using WARc, except for the dominant class (impervious surfaces). This leads much higher average Fl-score using WARc (compared to its competitors), while the overall accuracy is only slightly decreased compared to Boot.soft. This behavior can be seen in the maps shown in Figure We can see in the close-ups that Bootsoft: performs poorly in detecting the cars, which are often confused with generic impervious surfaces.
4 CONCLUSION AND DISCUSSION
In this paper, we proposed Wasserstein Adversarial Regularization (WAR) address the problem of learning with noisy labels. Using ground cost based on class similarites prior knowledge, we are able to change the geometry of the regularization loss according to class similarities. We compare WAR with state of the art algorithms on the Fashion-MNIST, CIFAR-10, CIFAR-100 benchmarks with noisy labels up to 40%. WAR outperformed state of the art results on all benchmarks. Fur- thermore, proved that WAR performs accurately real life problems in both classification and semantic segmentation problems.
Future works will consider exploring other strategies to define the ground cost, beyond the current 'a priori' setting: such cost could be for instance learned from the data structure itself. Moreover, even if in this paper we focused the label noise problem, WAR remains generic regularization scheme that could be applied to other classical learning problems as enforcing adversarial robustness sepi-supervised learning.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
D. Arpit. S.K. Jastrzebski, N. Ballas, D. Krueger, E. Bengio, M.S. Kanwal, T. Maharaj. A. Fischer, A.C. Courville, Y. Bengio, and S. Lacoste-Julien. A closer look at memorization in deep networks. The International Conference on Machine Learning, 2017.
Chen, B.B. Liao, G. Chen, and S. Zhang. Understanding and utilizing deep neural networks trained with noisy labels.
International Conference on Machine Learning, 2019. ||
K. Choi, G. Fazekas, K. Cho, and M. Sandler. The effects of noisy labels on deep convolutional neural networks for music tagging. IEFE Transactions on Emerging Topics Computational Intelligence, 2018. [
M. Cuturi. Sinkhom distances: Lightspeed computation of optimal transport. In Advances in Neural Informa- tion Processing Systems, 2013. 11
A. Dubey, O. Gupta, P. Guo. R. Raskar, R. Farrell, and N. Naik. Pairwise confusion for fine-grained visual classification. In The European Conference on Computer Vision, 2018. [
C. Frogner, C. 7hang, H. Mobahi, M. Araya-Polo, and T.A. Poggio. Learning with a Wasserstein loss. In Advances in Neural Information Processing Systems, 2015. 3
A. Genevay, G. Peyre, and M. Cuturi. Learning generative models with sinkhorn divergences. In The Twenty- First International Conference on Artificial Intelligence and Statistics, 2018. +
A. Ghosh, H. Kumar, and P.S. Sastry. Robust loss functions under label noise for deep neural networks. In Association for the Advancement of Artificial Intelligence, 2017. 2
M. Goibert and E. Dohmatob. Adversarial robustness via adversarial label-smoothing. arXiv. 1906.11567 2019. 3
G.H. Goluh and H.A. van der Vorst, Figenvalue computation in the 20th century. Journal of Computational and Applied Mathematics, 2000. 12
I. Goodfellow, Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. The International Conference on Learning Representations, 2015. 2
B. Han, Q. Yao, Yu, G. Niu, M. Xu, W. Hu, Tsang, and M. Sugiyama. Co-tcaching: Robust training of deep neural networks with extremely noisy labels. In Advances in Neural Information Processing Systems, 2018.
D 6
D. Hendrycks, M. Mazeika, D. Wilson, and Gimpel. Using trusted data train deep networks on labels corrupted by severe noise. In Advances in Neural Information Processing Systems, 2018. [
L. Jiang, Z. Zhou, T. Leung. L.-. Li, and F.F. Li. MentorNet: Learning data-driven curriculum for very deep neural networks on corrupted labels. In The International Conference on Machine Learning, 2018. [
J. Krause, B. Sapp. A. Howard, H. Zhou, A. Toshev, T. Duerig, J. Philbin, and F.-F. Li. The unreasonable effectiveness of noisy data for fine-grained recognition. The European Conference Computer Vision, 2016. [I
A. Krizhevsky, Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. 5
K.H Loc, X. Hc, L. Zhang, and L. Yang. CleanNet: Transfer learning for scalable image classifier training with label noise. In The IEEE Conference Computer Vision and Pattern Recognition, 2018.
Y. Li, J. Yang, Y. Song. L. Cao. J. Luo, and L.-J. Li. Learning from noisy labels with distillation. In The International Conference on Computer Vision, 2017.
G. Luise, Rudi, Pontil, C. Ciliberto. Differential properties of sinkhorn approximation for learning with wasserstein distance. In Advances in Neural Information Processing Systems, 2018. 3
X. Ma. Y. Wang. M.E. Houle, S. Zhou, S. Erfani, S. Xia, S. Wijewickrema, and J. Bailey. Dimensionality-drin learning with noisy labels. The International Conference on Machine Learning. 2018 T
T. Mikolov, I. Sutskever, K. Chen, G.S. Corrado, and J. Dean. Distributed representations of words and phrases and their compositionality. In Advances in Neural Information Processing Systems, 2013.
L. Misra, C.L. Zitnick, M. Mitchell, and R. Girshick. Seeing through the human reporting bias: Visual classifiers from noisy human-centric labels. In The IEFE Conference on Computer Vision and Pattern Recognition, 2016.1 2

---

Under review as a conference paper at ICLR 2020
T. Miyato, S. Maeda, S. Ishii, and M. Koyama. Virtual Adversarial Training: A regularization method for supervised and supe-super learning. IEEE Transactions on Pattern Analysis and Machine Intelligence. 2018. 2 12
Y. Mrouch, C.-L. Li, T. Sercu, A. Raj, and Y. Cheng. Sobolev GAN. In International Conference on Learning Representations, 2018. 4
A. Paszke, S. Gross, S. Chintala, G. Chanan, E. Yang, Z. DeVito, Z. Lin, A. Desmaison, L. Antiga, and A. Lerer. Automatic diffcrentiation in PyTorch, Neural Information Processing Systems (Workshop), 2017.
o
G. Patrini, A. Rozza, Aditya Krishna M., R. Nock, and L. Qu. Making deep neural networks robust to label
noise: A loss correction approach. In The IEEE Conference on Computer Vision and Pattern Recognition, 2017. 5
G. Peyré and M. Cuturi. Computational Optimal Transport: With Applications Data Science. Now Founda- tions and Trends Machine Learning, 2019.
Reed, H. Lec, D. Anguclov, C. Szegedy, D. Erhan, and A. Rabinovich. Training deep neural networks on noisy labels with bootstrapping. In The International Conference on Learning Representations ( (Workshop), 2015. 6
M. Ren, W. Zeng, B. Yang, and R. Urtasun. Learning to reweight examples for robust deep learning. In The International Conference on Machine Learning, 2018.
O. Ronneberger, Fischer, and T. Brox. U-net: Convolutional networks for biomedical image segmentation. In The International Conference on Medical image computing and computer-assister intervention, 2015.
B. Rooyen, A.K. Menon, and R.C. Williamson. Learning with symmetric label noise: The importance of being
unhinged. In Advances in Neural Information Processing Systems, 2015. S
Schroff, A. Criminisi, A. Zisserman. Harvesting image databases from web, IEEE Transactions on Pattern Analysis and Machine Intelligence, 2011.
A. Shafahi, A. Ghiasi, F. Huang, and T. Goldstein. Label smoothing and logit squeczing: A replacement for adversarial training? In The International Conference on Learning Representations, 2018.
3
U. Shaham, Y. Yamada, and S. Negahban. Understanding adversarial training: Increasing local stability of
neural nets through robust optimization. Neurocomputing, 2015. 2
H. Song, M Kim, and J.-G. Lee. SELFIE: Refurbishing unclean samples for robust deep learning. In The International Conference on Machine Learning, 2019. [
S. Sukhbaatar and R. Fergus. Learning from noisy labels with deep neural networks. In The International Conference on Learning Reprexentations (Workshop). 2014. [
D. Tanaka, D. Ikami, T. Yamasaki, and K. Aizawa. Joint optimization framework for learning with noisy labels. In The IEEE Conference on Computer Vision and Pattern Recognition, 2018. []
D. Tuia, J. Muñoz-Mari, M. Kanevski, and G. Camps- Valls.
Valls. Structured output SVM for remote sensing image classification. Journal of Signal Processing Systems, 2011.
A. Vahdat. Toward robustness against label noise in training deep discriminative neural networks. In Advances in Neural Information Processing Systems, 2017. [
E. Wang. L. Chen, C. Li, S. Huang. Y. Chen, C. Qian, and C. Change Loy. The devil of face recognition is in the noise. In The European Conference on Computer Vision, 2018. [
Y. Wang. X. Ma, Z. Chen, Y. Luo, J. Yi, and J. Bailey. Symmetric Cross Entropy for Robust Learning with Noisy Labels. In The International Conference Computer Vision, 2019.
H. Xiao, K. Rasul, and Vollgraf. Rishion-MNISTI a novel image dataset for benchmarking machine learning algorithms. arXiv, 1708.07747, 2017.
T. Xiao, T. Xia, Y. Yang, C. Huang, and X. Wang. Learning from massive noisy labeled data for image classification. In The IEEE Conference on Computer Vision and Pattern Recognition, 2015.
X. Yu, Han, Yao, G. Niu, L.W. Tsang, and M. Sugiyama. How does disagreement help gencralization against label corruption? The International Conference on Machine Learning, 2019.
16
C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals. Understanding deep learning requires rethinking generalization. In The International Conference Learning Representations. 2017.
7. Zhang and M.R. Sabuncu. Generalized cross entropy loss for training deep neural networks with noisy labels. In Advances in Neural Information Processing Systems, 2018.
10

---

Under review as a conference paper at ICLR 2020
A SUPPLEMENTARY MATERIAL
A.1 LINKS BETWEEN AR AND ADVERSARIAL LABEL SMOOTHING
This part gathers the proof for Lemma
The total learning loss for one sample (xr, y) is:
Lao (3F, y Pe) LCE( (2, y, pe) (R
(5)
where Len is the cross entropy loss:
LcE(2,y.Po) = Σv log (x)
(6)
We write the RAR regularization as:
RAR (æ, pa) DxL (po + + po (x()))
where 1 argmax DEL (po + po).))
r
We have that:
Σ polo + + log ps r7)(e)
DeI(po( + 1²)),,, po())
()(
Σ polo + log (r)(() Σ po(x (1))(e) log (o
=- Σ po( + (c) log H (po(( + r")).
(8)
where is the entropy function. Consequently, the total loss can be rewritten as:
Lual (z, y. y.Po)
Σ (c) + Bpo + ())())) - (H(p0(z+11))
(9)
Here 3 ER Let 3= = T with E [0, 1[. We have the following equivalence:
- (1oo) y.Po) Σ ((1 - e) + epe (x + (0)) log po (x ell (po(x +r))
= LcE( (1 c)y + (x )) pe)
H (x + +r)
(10)
Interpolated label
adversarial label entropy
Le. That's why learning with the total loss is equivalent to learn on an interpolated label and maxi- mizing the entropy of adversarial labels.
A.2 LINKS BETWEEN WAR AND LABEL SMOOTHING
In this subsection we aim to prove the following relations
cTV(a, & -
3.l ST
First we recall the definition of the Wasserstein distance
Wc(a,
min TeU
(T,C)
(II)
where ( 33
T > 0, T B}. It is well known and obvious from Cuturi
2013 Luise et al. 2018) that the optimal OT matrix of regularized OT T (Equation 4 leads to larger OT loss than the exact OT solution of the problem above T* this means that
Wc(a,g)= (T', C) < (T) C) OTO
(12)
and the relation is strict when A >

---

Under review as a conference paper at ICLR 2020
Now if we suppose that the cost matrix is symmetric and C,,; 0 and Ct2 0 when i * then solving equation I1 means that the maximum amount of mass on the diagonal of T since it leads to 0 cost. Under constraints U( (3) this maximum amount is equal to TV min(a;; 3d), vi. This implies that for a given row i in T the amount of mass not on the diagonal is for row is max(a; B,, 0) because of the left marginal constraint in U. Note that similar result can be expressed with the column j such that the mass not on the diagonal of column j is Lizj Th = max(3] aj. 0). This obviously means that for a given column/row index is we have Eisk T, + Th. lax Bxl.
Ejæi T5,
Let's write A = Eizkozk Tig Ci.. We have that Wo(a,)) 3) = A1. Now we remark that
A Ab+1
2 2 ax - 3x1
We can write that
A = A1
AA + Ak. Σ km
km
Since AN 0 because CN.N 0, it turns out that A Ex= (Ax Akt1). Lower bounding
every elements of the sum by the previous minoration gives that:
A1 =
Σ (A Ax-1)
(13)
2 Σ Lalax - 3kl
(14)
k=1
2 (T, 9)
(15)
which gives the desired results.
A.3 ADVERSARIAL SAMPLES COMPUTATION FOR WAR
WAR requires an efficient computation of adversarial samples. Following Miyato et al. 2018). we choose the following computation model. One could use the gradient with respect to the input r but because of differentiability, it vanishes in = O. When we approximate OTO in r 0 through the second order Taylor expansion, we have
OTd(pa()), (a + r)) -= " H.r
(16)
However, computing the hessian H, with respect to r = 0 is costly. Instead we use the power iteration method (Golub & van der Vorst 2000) to estimate the dominant hessian's eigenvector that represent the direction in which the classification function will change the most. The algorithm is repeated kimax times, but both the literature and results suggest that only one iteration is sufficient to achieve state of the art results. Once the adversarial direction is defined, one can obtain the adversarial example with r ed/||d||2, by projecting onto the ball of radius E.
A.4 MODEL ARCHITECTURE, IMPLEMENTATION DETAILS AND TRAINING PROCEDURE
A.4.1 BENCHMARK DATASETS
We have used a 9 layer CNN following Han et al. 2018) for the three image classification benchmark datasets: Fashion-MNIST CIFARIO, and CIFARIO0 shown Table Between each layer we use a batch norm layer, a drop-out layer and a leaky-relu activation function with slope of 0.01. We use the Adam optimizer for all our networks with an initial learning rate of 0.001 with coefficient (31,82) (0.9. 0.999) and with mini-batch size of 256. The learning rate is divided by 10 after epochs 20 and 40 for Fashion-MNIST (60 epochs in total), after epochs 40 and 80 for CIFAR-10 (120 epochs in total), and after epochs 80 and 120 for CIFAR-100 (150 epochs in total). While training WAR, we set B =0 for 15 epochs for faster convergence, as we observed that the network does not overfit
noisy labels at early stages of training. The input images scaled between [-1, 1] for Fashion- ANISS,, and mean subtracted for the CIFAR10, and CIFAR100 datasets before feeding into the network. The proposed method WAR, AR, and cross entropy loss functions
12

---

Under review as a conference paper at ICLR 2020
implemented in PyTorch, and for the Co-teaching Co-teaching method used the PyTorch code provided by the authors. For the rest of the state-of-the--e methods (dimensionality driven learning forward and backward loss correction and robust loss functions unhinged and boot strapping) the experiments are conducted using the Keras code provided by respective authors. We used similar layer initialization for all the methods in Pytorch and Keras.
CIFAR-10
CIFAR-100 32x32 x3
28 x3x88x1
32x32x3
3x3 conv, 128 LReLU
3x3 conv, 128 LReLU
3x3 conv, 128 LReLU
2x2 max-pool, stride
dropout, p=0,25
3x3 conv, 256 LReLU
3 conv, 256 LReLU
3x3 conv, 256 LReLU
2x2 max-pool, stride
dropout, p=0.25
x conv, 512 LReLU
x conv, 256 LReLU
xx3 conv, 128 LReLU
avg-pool
dense 128
10
dense 128 10 dense 128 100
Table 5: CNN models used in our experiments on Fashion-MNIST, CIFAR-10 and CIFAR-100.
A.4.2 CLOTHING 1 1M DATASET
Regarding the training procedure for the Clothing 1M dataset give the following details. Data pre-processing includes resizing the image to 256 x 256, center cropping a 224 x 224 patch from the resized image, and performing mean subtraction. We used batch size of 32 and learning rate of 0.0008 to update the network with SGD optimizer with a momentum of 0.9. The learning rate is divided by 10 after epochs (5 epochs in total).
A.4.3 VAIHINGEN DATASET
We now give the training procedure for our U-net the ISPRS Vaihingen semantic labeling dataset. The network was trained for 300 epochs (with 90" 180 or 270 rotations and vertical or horizontal flips data augmentation) using the Adam optimizer with an initial learning rate of 10 10-4 and coefficients (31, 32) = (0.9, 0.999). After 10 epochs, the learning rate is set to 10 5 Furthermore, we predict on the full image using overlapping patches (200 pixels overlap) averaged according to Gaussian kernel centered in the middle of the patch (a = 1).
A.5 SENSITIVITY ANALYSIS OF IN WAR, WAR AND AR
We conducted an experimental study to analysis the sensitivity of the trade-off parameter (3) be- tween the cross entropy and the adversarial regularization term on CIFAR-10 dataset with 40% noise level. The experimental results with different values of 3 are shown in Table 6 and the result reveals that as 3 increases, AR and WAR are robust to the label noise. However for the higher 3, AR does smoothig and decreases the classification accuracy. On the other hand, WAR increases the accuracy as 3 increases. This behaviour shows the capability of our proposed method WAR to preserve the discrimination capability between similar classes. It is noted that WAR points the
hutp://giihu.ccmmbbbaaMllCC-Caat plus
13

---

Under review as a conference paper at ICLR 2020
gradient direction towards the low cost classes, result it does not smooths between the conflicting classes, thus maintaining the discrimination ability. Furthermore, WAR with umin- formative ground cost did not provide better results, and it mostly similar with different values of B. This observation reinstates need having meaningful ground cost to capture the relationship between the classes in the dataset, and to guide gradient direction with respect to the ground cost.
AR
WAR
0.5
77.4910.18
76.80=0.22
77.05
07.25
76.35=0.21
76.90=10.37
81.27=0.21
74.76=0.15
80.16+0.36
10
76.84110.8
74.14:0.116
84.76:10.25
20
57.36:10.10
75.58
86.73+0.20
Table 6: Test accuracy (in %) of adversarial regularization methods: AR, WAR and WAR with different values on CIFAR-I0 dataset with 40% noise level. The average accuracies and standard deviations over last 10 epochs are reported, and experiments are conducted only for one run.
A.6 NOISY LABEL OBJECT SCALE FOR VAIHINGEN DATASET
We give the original and the used ground truth for Vaihingen dataset experiments.
Input image
Original ground truth
Corrupted ground truth
Impervious surface
Building
Car
vegetation
Tree
Figure 3: Comparison the original ground truth and the corrupted ground truth.
A.7 DISCUSSION ON Co- +
In order to analysis low performance Co- To-TeechhigttVV Yu et al.) 2019), we conducted a series of experiments on CIFAR-10 with 40% noise level. Firstly, used similar architecture the one used in their paper (pairflip 45% noise level) and reproduced their results (39%, 43% for Co- Teaching and Co-Teaching+ at 120 epochs). Next we conducted experiments with different settings to analysis sensitiveness of Co- To-Teachingt. and the results are shown in Table 7 When the pairflip noise and 2-layer CNN (one used in Co-Teaching+) is considered, Co-Teaching+ performs better than Co- TeaTehhingg and it is opposite when the noise setting is changed. When the wide capacity model considered, Co- Teaching+ is inferior in both noise settings. To understand this behaviour, observed the pure ratio of the selected instances of both methods, and found that the pure ratio of selected instances decreases after few epochs of Co-Teaching+ loss (Co-Teaching+ uses a warm-up strategy with Co- Teaching method for 20 epochs). For example with CIFAR-10 at 40% noise, the pure ratio of selected instances is approximately around 57%, whereas in To-Thich it around 70%. It is noted that in Yu al. 2019) considered unrealistic noise simulation (Pairflip). which flips the class labels with respect to the successive classes without considering class similarities, where in paper have considered class dependent noise, which flips the label according to the class similar classes (Patrini et al. 2017).
14

---

Under review as a conference paper at ICLR 2020
Table 7: Test accuracy of Co-Teaching and Co- Co-Teaching+ with different model architectures and noise settings on CIFAR-10 10 with 40% noise level.
Model
Noise
Co-Teaching
Co- Co-Tacching+
2 layer CNN
pairflip
47%
52%
class dependent noise
56%
54%
9 layer CNN
pairflip
78%
64 %
class dependent noise
80%
72%
15


Reviews:
[{"review_id": "rylCRiKCYS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "===========\nSummary:\nThis paper proposes a new regularization scheme inspired from (virtual) adversarial training to tackle the problem of learning with noisy labels. While based on the adversarial training (AR), it was found that AR does not directly transferable to deal with noisy labels. The author then proposed the Wasserstein version of AR replacing the KL with the Wasserstein distance and its approximate. This gives the proposed  Wasserstein Adversarial Regularization (WAR) which provide considerable robustness improvement on 5 datasets (both classification and segmentation). The correlation between WAR regularization and boundary smoothing is justified both theoretically and empirically with toy examples. The advantage of WAR regularization over existing methods is the flexibility to incorporate intra-class divergence, making it plausible against asymmetric label noise, which is more common in real-world datasets. The authors have done solid work in this paper. The experiment is complete, in terms of the scale, noise settings and comparison to existing works.\n\nI recommend to accept this paper.\n\nMinor suggestions:\nIt would be interesting to see the performance on the other common type of real-world noise: open-set label noise [1], and may be applied to adversarial training against adversarial examples.\nThe adversarial regularization was also used in a recent adversarial training paper [2]. A similar idea is adversarial logit pairing which is regularization on logits [3].\n\n\nReferences:\n[1] Iterative learning with noisy labels. CVPR 2018\n[2] Theoretically principled trade-off between robustness and accuracy. ICML 2018\n[3] Adversarial logit pairing. arXiv preprint arXiv:1803.06373 (2018).", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "rkeJnoruKS", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes to use the optimal transport distance to smooth the output of algorithms dealing with label noise. More specifically, the smoothness is on a controlled distance to the input instances, achieved by using the idea of adversarial learning (or robust learning). Generally, the paper is well-organized, with a good writing, and with sufficient experiments. However, I have major concerns about the technical contribution and the experiment parts.\n\n1. It seems that the authors employed the existing adversarial learning techniques directly to the label noise problem. The technique contribution is quite limited. I think the challenging and interesting part should be about how to learn the metric C. Currently, the authors use the semantic distances between different class labels to set-up C. This intuitively makes sense but not convincing. We expect the authors to put more effort to study C, which may depend on the label noise rates or the geometric information of the instances. An in-depth study of C will make the technical contribution solid.\n\n2. The experiment part looks sufficient but may be problematic. For example, in the subsection about Clothing1M, the authors directly cited the results from others while the experimental setting could be very different. It is not convincing to make the conclusion that the proposed method has the best performance.", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "BJx9vswatr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\nUpdate after rebuttal:\nThe rebuttal addresses my concerns. The point raised by reviewer 2 regarding other results on Clothing1M is concerning, but the authors' response is reasonable. Moreover, the proposed method is novel and could be complementary with other methods that achieve good results on Clothing1M. I think this paper would generate good discussion, and I recommend acceptance.\n\n----------------------------------------------------------------------------------------\nThis paper presents a novel approach for dealing with asymmetric label noise. There are in fact two methods proposed, Adversarial Regularization (AR) and Wasserstein Adversarial Regularization (WAR), both of which derive from the intuition that model smoothing (in the sense of virtual adversarial training) acts as label smoothing when there are noisy labels. The authors prove two statements formalizing this notion and demonstrate the efficacy of AR and WAR in an extensive evaluation.\n\nWAR is an iteration on AR that uses the optimal transport distance between categorical distributions to allow incorporating a cost matrix that encodes class similarities. The authors obtain these similarities from word embeddings of class names.\n\nThe evaluation demonstrates that the proposed WAR method achieves state-of-the-art results with the largest gains at high noise levels. In no case does it perform substantially worse than competing methods. Moreover, the AR method proposed as an intermediary to WAR also outperforms all prior work at non-zero noise levels, demonstrating the promise of the underlying approach.\n\nThe authors also evaluate on Clothing1M and evaluate on a semantic segmentation dataset for which they synthesize structured, realistic label noise. WAR outperforms prior work on these tasks. Moreover, the semantic segmentation task could act as a useful benchmark for future work.\n\nFor these reasons, I recommend acceptance.\n\nMinor points:\nComparing the second and third columns in Figure 1, it looks like lambda has a large effect, so it would be good to know how much tuning lambda requires for the main tasks.\n\nIn equation 9, shouldn’t there be a beta in front of the entropy term? This does not break the result.\n\nIn equation 10, it looks like you’re multiplying both sides by (1 – epsilon), but you drop the (1 – epsilon) on the left side. This does not break the result.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This article proposes a regularisation scheme to learn classifiers that take into account similarity of labels, and presents a series of experiments. The reviewers found the approach plausible, the paper well written, and the experiments sufficient. At the same time, they expressed concerns, mentioning that the technical contribution is limited (in particular, the Wasserstein distance has been used before in estimation of conditional distributions and in multi-label learning), and that it would be important to put more efforts into learning the metric. The author responses clarified a few points and agreed that learning the metric is an interesting problem. There were also concerns about the competitiveness of the approach, which were addressed in part in the authors' responses, albeit not fully convincing all of the reviewers. This article proposes an interesting technique for a relevant type of problems, and demonstrates that it can be competitive with extensive experiments. ``Although this is a reasonably good article, it is not good enough, given the very high acceptance bar for this year's ICLR. 

Decision: Reject