Driving through the Lens: Improving Generalization of Learning-based Steering using Simulated Adversarial Examples
Authors: Yu Shen
Laura Yu Zheng
Manli Shu
Weizi Li
Tom Goldstein
Ming Lin
Venue:  (2021)
Keywords: model robustness
data augmentation
adversarial training
image quality
autonomous driving
benchmark

Abstract: To ensure the wide adoption and safety of autonomous driving, the vehicles need to be able to drive under various lighting, weather, and visibility conditions in different environments. These external and environmental factors, along with internal factors associated with sensors, can pose significant challenges to perceptual data processing, hence affecting the decision-making of the vehicle. In this work, we address this critical issue by analyzing the sensitivity of the learning algorithm with respect to varying quality in the image input for autonomous driving.  Using the results of sensitivity analysis, we further propose an algorithm to improve the overall performance of the task of ``learning to steer''. The results show that our approach is able to enhance the learning outcomes up to 48%. A comparative study drawn between our approach and other related techniques, such as data augmentation and adversarial training, confirms the effectiveness of our algorithm as a way to improve the robustness and generalization of neural network training for self-driving cars.    

Under review as a conference paper at ICLR 2021
DRIVING THROUGH THE LENS: IMPROVING GENERAL- IZATION OF LEARNING-BASED STEERING USING SIM- ULATED ADVERSARIAL EXAMPLES
Anonymous authors Paper under double-blind review
ABSTRACT
To ensure the wide adoption and safety of autonomous driving, vehicles need to be able to drive under various lighting, weather, and visibility conditions in different environments. These external and environmental factors, along with internal factors associated with sensors, can pose significant challenges to perceptual data processing, hence affecting the recision-makingg of the vehicle. In this work, we address this critical issue by analyzing the sensitivity of the learning algorithm with respect to varying quality the image input for autonomous driving. Using the results of sensitivity analysis, we further propose an algorithm to improve the overall performance of the task of "learning to steer". The results show that our approach is able to enhance the learning outcomes up 48%. A comparative study drawn between our approach and other related techniques, such as data augmentation and adversarial training, confirms the effectiveness of our algorithm as a way to improve the robustness and generalization of neural network training for self-driving cars.
INTRODUCTION
Autonomous driving complex task that requires many software and hardware components to operate reliably under highly disparate and often unpredictable conditions. While on the road, vehicles are likely to experience day and night, clear and foggy conditions, sunny and rainy days, as well as bright cityscapes and dark tunnels. All these external factors can lead to quality variations in image data, which are then served as inputs to autonomous systems. Adding to the complexity are internal factors of the camera (e.g., those associated with hardware), which can also result in sarying-qualin images as input to learning algorithms. One can harden machine learning systems to these degradations by simulating them at train time (Chao al. (019). However, there currently lacks algorithmic tools for analyzing the sensitivity of real-world neural network performance on the properties of simulated training images and, more importantly, mechanism leverage such sensitivity analysis for improving learning outcomes. In this work, we quantify the influence of varying-quality images on the task of "learning steer" and provide systematic approach to improve the performance of the learning algorithm based on quantitative analysis.
Image degradations can often be simulated at training time by adjusting combinations of image quality attributes, including blur, noise, distortion, color representations (such as RGB or CMY) hues, saturation, and intensity values (HSV), etc. However, identifying the correct combination of simulated attribute parameters to obtain optimal performance on real data during training is difficult-ie not impossible- task, requiring exploration of high dimensional parameterized space.
The first goal of this work is to design systematic method for studying, predicting, and quantifying the impact of an image degradation on system performance after training. We do this by measuring the similarity between real-world datasets and simulated datasets with degradations using the well known Fréchet Inception Distance (FID). We find that the FID between simulated and real datasets is good predictor of whether training simulated data will produce good performance in the real world. We also use FID between different simulated datasets as unified metric to parameterize the severity of various image quality degradations on the same FaDeb scale (see Section 3).

---

Under review as a conference paper at ICLR 2021
Our second goal is to borrow concepts from the adversarial training literature (Madry al. 2018 Shafahi et al. 2019 Xie et al. 2020) to build a scalable training scheme to improve the robustness of autonomous driving systems against multi-faceted image degradations, while increasing the overall accuracy of the steering task for self-driving cars. Our proposed method builds a dataset of adversari- ally degraded images by apply evolutionary optimization within the space of possible degredations during training. The method begins by training on a combination of real and simulated/degraded data using arbitrary degradation parameters. On each training iteration, the parameters are updated to generate a new degradation combination so that system performance is (approximately) minimized. The network is then trained on these adversarially simulated images to promote robustness. Our proposed algorithm speeds up the combinatorial degradation updates by discretizing the search space using our FID-based parameterization. See details in Section 4
Experiments show that the algorithm improves the task performance of "learning to steer" up to 48% in mean accuracy over strong baselines. We compare our approach with other related techniques, such as data augmentation and adversarial training. and the results show that our method consistently achieves higher performance. The method also improves the performance on datasets contaminated with complex combinations of perturbations (up to 33%), and additionally boosts performance degradations that are not seen during training, like simulated snow, fog, and frost (up to 29%). as discussed in Section 4. 2
For evaluation, we propose more complete robustness evaluation standard under 4 different scenarios: clean data, single perturbation data, multiple perturbation data, and unseen perturbation data. While previous works usually use one or two scenarios, our work is among the first to test results under all 4 meaningful scenarios that are important for evaluating robustness of algorithms.
We also plan to release "learn to steer under perturbations" datasets for benchmarking. These datasets will contain a base dataset; simulated adversarial datasets with multiple levels of image degradation due to either single or multiple image quality attributes; and simulated adversarial datasets with five levels of combinatorial perturbations due to a different set of unseen factors on images with corruptions in ImageNet-C (Hendrycks & Dietterich 2019). totaling about 1.2M images and 120 datasets in all. (See Section
2 RELATED WORK
The influence of the noise and distortion effects on real images on learning tasks has been explored in the last five years. For example, researchers have examined the impact of optical blur on convolu- tional neural networks and present a fine-tuning method for recovering lost accuracy using blurred images (Vasiljevic et al., 2016). This fine-tuning method resolved lost accuracy when images were distorted instead of blurred (Zhou et al. 2017). While these fine tuning methods are promising. (Dodge & Karam, 201 7b) find that tuning to one type of image quality reduction effect would cause poor generalization to other types of quality reduction effects. Comparison on image classification performance between deep neural networks and humans has been done by (Dodge & Karam 2017al 7)), and found to be similar with images of good quality. However, Deep Neural Networks struggle significantly more than humans low-quality, distorted or noisy images. Color spaces have also been shown to negatively affect performance of learning models. It was observed that perturbations affect learning performance more in the Y channel of YCbCr color space that is analogous to the color space (Pestana et al. 2020).. Another work (Wu et al. (020) studies the effect of Instagram filters, which mostly change the coloring of an image, on learning tasks. In this work, we study nine common factors characterizing image quality, i.e., blur, noise, distortion, three-color Reed-Green-r Green-Blue or RGB) channels, and hues, saturation, and intensity values (HSV). Not only does our study analyze more comprehensive set of image attributes that could influence the learning- but we also parameterize these nine factors into one integrated image-quality space using the Fréchet Inception Distance as the unifiying metric, thus enabling to conduct sensitivity analysis.
steering task,
Researchers have also explored how to improve the robustness of learning algorithms under various image quality degradations. One recent work (Tran et al. (017) provides novel Bayesian formu- lation for data augmentation. Cubuk et al. (2018) 8) proposes an approach to automatically search for improved data augmentation policies. Ghosh et al. (2018) performs analyses the performance of Convolutional Neural Networks on quality degradations due to common causes like compression loss, noise, blur, and contrast, etc. and introduces method to improve the learning outcomes using
2

---

Under review as a conference paper at ICLR 2021
master-slave architecture. Another work (Hendrycks et al. 2019) shows that self-supervision techniques can be used to improve model robustness that exceeds the performance of fully supervised methods. A new method, also by Hendrycks et al., tackles model robustness from data augmentation perspective, where compositions of transformations are used to create new data that is visually and semantically close to the original dataset (Hendrycks al. 2020). [Ga et al. (2020) proposes a tech- nique that re-purposes software testing methods, specifically mutation-base fuzzing, to augment the training data of DNNs, with the objective of enhancing their robustness. A more recent work (Gong et al. 2020) introduces solution to improving model generalization by first augmenting training dataset with random perturbations, and then minimizing worst-case loss over the augmented data. Our work differs from these studies in several regards. First, we simulate adversarial conditions of image factors instead of commonplace image conditions. Second, we conduct a systematic sensitivity analysis for preparing datasets that are representative of image degradations due to multiple factors at different levels. Third, our algorithm for improving the generalization of the learning task can work with the discretized parameter space while generalize well to the continuous parameter space. Another advantage of our approach is that we can augment the training dataset without the derivatives of the factor parameters, which may not exist or are difficult to compute. These differences distinguish our approach from the prior arts and other techniques for improving model robustness, such as data augmentation and adversarial training.
ANALYZING IMAGE QUALITY FACTORS
3.1 EXPERIMENT SETUP
Base Dataset. We build our base dataset using the real-world driving dataset (Chen 2018 which contains about 63,000 images at the resolution 455 x 256. There several good autonomous driving datasets, but not all of them are suitable for the end-to-end learning to steer task. Some datasets (e.g., Waymo (Sun al., 2020). KITTI (Geiger et al., 2013). Cityscapes (Cordts al., 2016), OxfordRohoCar (Maddern et al. 2017), Raincouver (Tung et all 2017). etc) do not contain steering angle labels. Some other datasets contain steering angle labels (c.g.. Audi (Geyer al.
2020), Honda (Ramanishka et al. 2018), nuScenes (Caesar et al., 2019). Ford AV (Agarwal et al.
2020 Canadian Adverse Driving Conditions (Pitropov et al. 2020), etc), but they are not designed
for end-to-end learning to steer task specifically, the driving environment may not be suitable for our end-to-end learning to steer task. For example, driving at intersections (lead confusion for steering), or only very small subset of data containing image data from turning on curved road without branches. There are also several well-known simulators like CARLA (Dsovviskiy et al., 2017) that can generate synthetic dataset, but our work focuses on the real-world driving using real images. Chen's 's datasct is collected specifically for steering task and has a relatively long continuous driving image sequence road without branches and has relatively high turning cases.
Image quality factors. We study nine image attributes in this work, i.e., blur, noise, distortion, three-color Geed-Green-Blut
RGB) channels, and hues, saturation, and intensity values (HSV). Blur, noise, and distortion are among the most commonly used and directly affect image quality. R, G. B, S, V channels are chosen because both RGB and HSV spaces are frequently used represent image color spaces: RGB represent three basic color values of an image, while HSV represent three common metrics of an image. Other color spaces such as HSL or YUV have similar properties, hence are excluded from this study to avoid redundant analysis.
Learning Algorithm. We choose the model by Bojarski al. (2016) as the learning algorithm. The model contains five convolutional layers followed by three dense layers. We select this model, because has been used to steer an AV successfully in both real world (Bojarski et al. 2016 and virtual world (Li et al. 2019).
Evaluation Metric. We use mean accuracy (MA) to evaluate our regression task since can represent the overall performance under different thresholds. We first define the accuracy with respect to a particular threshold T as acc, = count( (Upredicted - Vactuall < r)/n, where n denotes the number of test cases; Upredicted and Vactual indicate the predicted and ground-truth value, respectively. Then, MA is computed as Σ, accrer//TT where T = {1.5, 3.0, 7.5, 15, 75] contains empirically selected thresholds of steering angles. Based on MA, use the maximum MA improvement (denoted as MMAD), the average MA improvement (denoted as AMAD), and mean Corruption Errors (mCH) (Hendrycks & Dietterich 2019) as the evaluation metrics.
3

---

Under review as a conference paper at ICLR 2021
Blur
Noise
Distortion
Deevel
Level
Level 3
Origin LLevel 3
Level
Figure I: Example images of quality degradation. Five levels of quality reduction are simulated using the blur, noise, and distortion effects (Left) and each lighter and darker direction per channel (Right).
3.2 SENSITIVITY ANALYSIS
In this section, we introduce how we conduct sensitivity analysis on the nine image factors, i.e., blur, noise, distortion and R, G, B, H. S, channels, and how we use the sensitivity analysis results to prepare datasets that are representative of image qualities at different levels for further model training.
For simulating blur, noise, and distortion effects, we use Gaussian blur (Bégin & Ferrie 2004), additive white Gaussian noise (AWGN), and radial distortion (Zhang) 2000p, respectively. For representing channel-lewe perturbations, we use linear combination model: denote the value range of one channel as (a, b). in the darker direction, we set Vnew = ab + (1 a)v. The default values are ac = 0 and bc = 255, where C' represents one of the 6 channels. To prevent image being completely dark, we av 10 and by 179.
Unew
+ (1 a));; in the lighter direction,
We adopt the Fréchet Inception Distance (FID) as a unified metric for our sensitivity analysis, instead of using the parameter values of each image factor for three reasons. First, FID can better capture different levels of image qualities than the parameter values of each factor, because the correspondence between the factor parameter values and image quality is not straightforward. For example, if we uniformly sample the parameter space of distortion, most parameter values will result in images with qualities similar the level 4 and level images of distortion datasets shown in Fig. [ This is not ideal since we would like to have representative datasets that enable to study the sensitivity of learning task with respect the gradual degradation of each image attribute. Second, by adopting FID as single metric, we can map the parameter spaces of all factors into one space that better facilitates both the dependency trend and sensitivity analyses. Lastly, FID can naturally serve metric to evaluate the distance between two image datasets. It takes image pixels, image features, and correlations between images into account these are all meaningful factors to interpret the performance of learning ceaseing-based based task.
Starting from pppirrcalll-seleectee parameters of each factor, we 'simulate' perturbed datasets and compute their corresponding mean accuracy (MA) using the trained model the base dataset (Chen) 2018). We then map these correspondences between MAs and the parameter values into the FID space using the FID between each perturbed dataset and the base dataset. Characterizing the influence of each image quality attribute on the task performance, as captured in MA-FID space, we can then re-define parameter value range of each quality factor so that the newly generated perturbed datasets will have similar 'distance gaps' in image quality, as defined by FID. Examples of the resulting images are shown Fig. [ More examples can be found in Appendix A.2 The corresponding parameters of the final perturbed datasets can be found in Appendix A.3 The notation for these
datasets is summarized as follows: R: the base dataset (Chen) 2018): B1, B2, B3, B4, B5: five levels of blur; N1, N2, 3 N4, 5:: five levels of noise; D1, D2, D3. D4, D5: five levels of distortion; RD1, RD2, RD3, RD4, R.D5: five dark levels of the red (R) channel; RL1, R.L,, RL3, RLL, RL5:: five light levels of the red (R) channel; the dark and light levels of the G, B, H, S, V channels have similar naming conventions, i.e., channel label + D/L. (dark/light) + level (from to 5).
The analysis results using the final perturbed datasets at different levels of several sample factors are shown in Fig. 2 The complete numeric results and the figure for all factors can found in Appendix A.6 Note that all factors have some influence on the learning based steering task. Their
4

---

Under review as a conference paper at ICLR 2021
(negative) impact increases, the perturbation level increases. The performance loss due image quality degradation can be as high as more than 50% (see lighter Lv5 the channel), which can introduce very high risks in autonomous driving.
blur noise distortion
Mean Accuracy (%)
Mean Accuracy (%)
100
60
40
20
origin
L1
L5
DL5 DL4
DL3
origin
U1
UL
014
UL
Perturbation Level
Perturbation Level
Figure 2: The relationship between MA and different levels of perturbation: Greater image degradations lead to higher loss of mean accuracy.
The final MA differences in the FID space are visualized Fig- 3 (for blur, noise, distortion, G channel and V channel, see entire figure in Appendix(A.4) Since FID aligns different factors into the same space, we can compare the performance loss due to each factor at various levels. We first observe that the learning-basee stecring task is more sensitive to the channel-level perturbations (i.e., from R, G. B, H, S. channels) than the image-level perturbations (i.e., from blur, noise, distortion effects). Second, within the quality factors analyze, the learning task is least sensitive to blur and noise but most sensitive to the intensity value in V channel. Lastly, for the same color channel, darker and lighter levels appear have different MA trends, i.e., different accuracy loss the same FID values can vary.
noise
distortion
MEAN ACCURACY DIFFERENCE (%)
40
10
0
50
100
150
200
250
300
350
400
450
BETWEEN DATASET PERTURBED DATASETS
Figure 3: The relationship between FID and MA percentage difference. GD/GL denote channel in darker/lighter direction, and VD/VL denote channel in darker/lighter direction.
Compared with other analysis works on learning to steer task, e.g. Tian et al. 2018 and Zhang ct al. (2018), our method is the first work that transfers perturbations from multiple parameter spaces into unified FID space enable the frcstr comparison, e.g., show that our task is more sensitive to V channel perturbation of HSV space than other perturbations.
IMPROVING GENERALIZATION OF LEARNING-BASED STEERING
4.1 METHODOLOGY
In this section, introduce method to improve the generalization of the Ceariin-baseed steering for autonomous driving using the results from the sensitivity analysis.
Our algorithm uses iterative min-max training process: at each iteration, we first choose dataset among all datasets of one factor that can minimize mean accuracy (MA). Then, we combine such datasets of all factors with the base dataset to re-train model while maximizing MA. The algorithm stops when a pre-specified number of iterations is reached or the MA loss is below a certain threshold. The design rationale of our architecture resembles adversarial training: train the
5

---

Under review as a conference paper at ICLR 2021
model to maximize accuracy using the original dataset plus the perturbed datasets with the minimum accuracy in order to improve the robustness of the model. The loss function is the following:
min max M Up),
P
where p represents union of the parameter levels of all analyzed image factors; 0 denotes the model parameters; Up is the training dataset; and MA() is the function computing MA. The overall description of our method shown in Algorithm ! See the overall pipeline figure in Appendix A.I
Our method has several advantages: 1) the training data is augmented without re-training the model, thus achieving efficiency; 2) it provides the flexibility to generate datasets various discretized levels of the factor parameters; 3) it does not require the derivatives of factor parameters, unlike other frameworks that optimize factor parameters in the continuous space where derivatives are difficult to compute; and 4) it can generalize over not only the parameters of a single perturbation factor, but also the composition of the parameters of multiple factors.
Algorithm 1: Improve the generalization of learning- -baed steering
Result: a trained model parameterized by 0
Pre-processing:
Conduct sensitivity analysis and discretize the parameters of n factors into their corresponding
4 = 1,..., n levels;
Generate new datasets for each factor with the discretized values from base dataset B:
{ 2, n 24;
Initialization:
Set t = 0, and initialize the maximum of iterations T and the number of epochs k; Initialize model parameters ((0)
while t v T do
For each factor, select the dataset Di.,, that can minimize the validation mean accuracy,
where Pt arg miny M A(O()) Dij);
Merge all selected datasets Up (Ul=1 DUB
Train the network for epochs and update the parameters ((++1) train(O()), Up k)
maximize M ((((++1)) Up):
Break if stop conditions are met;
Otherwise set + 1;
end
4.2 EXPERIMENTS AND RESULTS
All experiments conducted using Intel(R) Xeon(TM) W-2123 CPU, Nvidia GTX 1080 GPU, and 32G RAM. We use the Adam optimizer (Kingma & Ba 2014) with learning rate 0.0001 and batch size 128 for training. The maximum number of epochs is 1000. Images the base dataset are sampled from videos at 30 frames per second (FPS). For efficiency, we adopt a similar approach as in Bojarski al. 2016) by further downsampling the dataset FPS reduce similarities between adjacent frames. The resulting dataset contains approximately 10,000 images. We randomly split the dataset with about 20:1:2 as training/validationnesst data.
We compare our method with three methods: a baseline method (Bojarski et al. 2016). an adversarial training method (Shu et al. 2020), and naïve data augmentation method. For the naïve data augmentation method, we simply merge all perturbed datasets together to train the model. We test the performance of all methods in four scenarios with increasing complexity:
Scenario 1: Clean data. Test on the base clean dataset only.
Scenario 2: Single Perturbation. Test datasets of each factor at its discretized levels. Specifically, we use five levels for blur, noise, distortion, and ten levels for R, G, B, H, S, V. Hence, we have 75 datasets in total for testing in this scenario.

---

Under review as a conference paper at ICLR 2021
Scenario 3: Combined Perturbation. Test datasets with combinations of all factors at all levels. To be specific, we sample varying levels from each factor, and combine the resulting datasets of all factors into one combined dataset. In total, we have six combined datasets for testing in this scenario. See examples in the second row of Figure 6 and parameters for each dataset in the appendix section A.3
Scenario 4: Unseen Perturbation. Test datasets under previously unseen factors different levels. The unseen factors are "motion blur". "zoom blur". "pixelate", "jpeg compression", "snow", "frost", "fog" from ImageNet-CC (Hendrycks & Dietterich] 2019)). We choose these factors because, specifically, "Motion blur" and "zoom blur" can happen during driving; "pixelate" and "jpeg compression" are possible during image processing; and "snow", "frost", "fog" are natural weather conditions that can affect driving experiences. In addition, all these factors can be possibly "simulated" using the nine image factors analyzed in this work. See examples in Figure
Figure 4: Unseen perturbation examples in our experiments. We use "snow", "frostt" "fog" (left to right; first row), and "motion blur", "zoom blur". "pixelate", "jpeg compression" (left to right; second row) from the corruptions in ImageNet-C (Hendrycks & Dietterich 2019).
We use the maximum MA improvement (denoted as MMAI), the average MA improvement (denoted as AMAI) and mean Corruption Errors (mCE) (Hendrycks & Dietterich 2019) the evaluation metrics. From T we observe that our method outperforms other methods under all metrics in all scenarios. Specifically, our algorithm improves the performance of "learning to steer" up to 48% in MMAL, while reducing mCE down by 50% over the baseline. We have compared our approach with other related techniques, namely data augmentation and adversarial training. The results show that our method achieves consistent better performance. Our method also improves the task performance using the combined datasets (Scenario 3) up 33%. Lastly, when tested on unseen factors (Scenario 4), our algorithm maintains the best performance by 29% in MMAI, while reducing mCE error to 76%.
Scenarios
Clean
Single Perturbation
Combined Perturbation
Unseen Perturbation
Method
AMAII
MMAH
AMAI"
mCEJ
MMAI
AMAII
mCEJ
MMAI1
AMAII
mCEj
Data Augmentation
-0.44
46.88
19.97
$1.34
36.1
11.97
75.84
27.5
7.92
81.51
Adversarial Training
-0.65
30.06
10.61
74.42
17.89
86.82
8.17
89.91
Ours
0.93
48.57
20.74
49.47
33.24
17.74
63.81
29.32
9.06
76.20
Table 1: Performance comparison of different methods in four scenarios against the baseline perfor- mance, using the maximum MA improvement in percentage (denoted MMAI), the average MA improvement in percentage (denoted as AMAI), and mean corruption errors in percentage (mCE). For adversarial training, we use the state-of-the-art method described in (Shu al. 2020). For data augmentation, we simply combine all perturbed datasets into training. As result, our method outperforms the other methods (highest MA improvements and lowest mCEs) nearly all scenarios.
We also illustrate the detailed MA improvements Fig. 5 which shows that our method can achieve improvements in some extreme cases of the channel-face levels and some of the unseen image effects. However, our method fails to improve on "motion blur", which we plan to study in future. More detailed data, results, and analysis can be found in Appendix A.6
7

---

Under review as a conference paper at ICLR 2021
motion blur zoom blur ploslate lpst compression snow frost fog
30
IMA Ingrevement (56
MA Improrement (56)
25
30
20
15
10
DLI
-5
Perturbation
Perturbation Level
Figure 5: MA improvement with our method compared to the baseline. Our method achieve great improvement extreme cases for channel-level factors and unseen weather conditions.
By visualizing the salience map on several combined samples in Fig. 6 we show that our method can assist the network focus on more important areas (e.g., the road front), instead of focusing on random areas on perturbed images.
Comb 1
Comb 2
Comb
Comb 4
Comb 5
Comb
Origin
Perturb
ours baseline
Smap
Smap
Figure 6: Saliency map samples with baseline method and our method, where the model tests on the different combinations of perturbations. Different columns show different combinations of perturbations. The first row shows the original image, the second row shows the perturbed image with the chosen effects, the third row is the saliency map baseline model, and the fourth row the saliency map of our method. It can be seen that, with our method, the network can better focus on the important areas (e.g., the road in front) instead of random areas on the perturbed images, as with baseline model.
4.3
WIDER COMPARISON
To show our method can generalized well in other cases, we show the experiment results on two new datasets (Honda (Ramanishka et al.] 2018) and Audi (Geyer et al. 2020), see dataset setup in Appendix A.5). one new method (Augmix (Hendrycks et al. 2020)), and one new backbone network (comma.aí (annaana & Hotz 2016)) in Table. and Table. 3 As shown in the tables,
method achieves the best performance on most cases. Specifically, our method outperforms on clean and single perturbation data consistently (at least 2.5% better), and does better in most cases of unseen perturbation data. In combined perturbation data, our method performs better when using NVidia backbone network, while AugMix performs better when using comma.ai backbone network.
4.4 GENERALIZATION
In this work, we introduce an efficient and effective computational framework that incorporates sensitivity analysis and systematic mechanism to improve the performance of a learning algorithm for autonomous driving on both the original dataset and the simulated adversarial scenarios due to multiple perturbations defined
influential set of important image attributes. This approach can be easily extended and applied beyond the set of factors and the learning algorithm analyzed in this paper. This method can generalize analyzing any arbitrarily high number of image/input
8

---

Under review as a conference paper at ICLR 2021
Scenarios
Clean
Single Perturbation
Combined Perturbation
Unseen Perturbation
Method
AMAIT
MMAIf
AMAIT
mCE4
MMAI
AMAI
mCEp
MMAIT
AMAIT
mCE]
AugMix+N
-0.12
40.64
10.94
76.48
25.97
16.79
64.41
22.23
5.99
84,95
OurstN
2.48
43.51
13.51
67.78
28.13
17.98
61.12
16.93
6.70
80.92
AugMix+C
-5.25
55.59
9.56
56.31
31.32
0.77
106.1
37.91
7.97
89.99
Ours+C
0.36
62.07
15.68
70.84
38.01
0.74
108.32
42.54
12.15
77.08
Table 2: Comparison on Honda dataset. In "Method" column, "N" means Nvidia backbone network, "C" means comma.ai backbone network. Our method outperforms AugMix in most cases.
Scenarios
Clean
Single Perturbation
Combined Perturhation
Unseen Perturbation
Method
AMAIT
MMAIf
AMAIT
mCE]
MMAI
AMAI
mCE]
MMAIT
AMAI1
mCE)
AugMix+N
.8.24
81.89
32.22
55.27
75.49
50.23
41.98
73.06
27.39
77.51
Ours+N
4.13
94.95
45.78
18.79
80.42
59.31
29.33
75.16
31.91
42.89
AugMix+C
-18.7
57.23
12.71
89.74
36.88
28.17
68.78
37.68
4.15
119.64
Ours+C
-1.33
77.99
30,87
50.81
47.87
23.18
73.14
42.98
14.15
80.42
Table 3: Comparison on Audi dataset. In "Method" column, "N" means Nvidia backbone network, "C" means comma.ai backbone network. Our method outperforms AugMix in most cases.
factors, other learning algorithms, and multimodal sensor data. Furthermore, other autonomous systems where the perception-to-connro functionality plays a key role can possibly benefit from such a technique as well.
4.5 BENCHMARKING DATASETS
We plan to relcase our "learn to steer under perturbations" datasets for benchmarking. The datasets will contain base dataset, datasets with five levels of perturbation in blur, noise, and distortion, ten levels of variations in the channels R, G. B, H. S, V. multiple with combined perturbations over all nine factors, and five levels of each unseen simulated factor, including snow, fog, frost, motion blur, zoom blur, pixelate, and jpeg compression. There are 120 datasets in total, where each dataset contains about 10,000 images (totaling ~ 1,200,000 images in all). The ground-truth steering angles for all images will also be provided for validation, along with the code that generated all simulated perturbations. We detail the parameters used to generate the datasets in Appendix A.3
CONCLUSION AND FUTURE WORK
In this paper, we first analyze how different attributes of image quality influences the performance of the "learning to steer" task for autonomous vehicles, as quantified by mean accuracy (MA). We study three image-level effects (i.e., blur, noise, and distortion) and six channel-level effects (i.e., R, G, B, H. S, V) real images. We observe that image degradation due to all these effects can impact the task performance. By utilizing FID as the unifying metric, we conduct sensitivity analysis on FID-MA space. Next, we propose effective and efficient training method to improve the generalization of the model for learning-baat the task performance on datasets with a mixture of perturbations (up to 48%), as well as unseen adversarial examples including snow, fog, and frost (up 29%). Theses results showing that our model is one of the most general methods in this particular application domain. We will also release the datasets used in this work for benchmarking the evaluation of the robustness of "learning steer" for autonomous driving.
steering under multiple perturbations. Our model not only improves the original dataset, but also achieves significant performance improvement
The implementation of our method currently uses discretization to achieve efficient training, but further implementation optimization is possible. The efficiency can be further improved by utilizing other works like the reweighting strategy et al., 2018). In addition, we believe that the computa- tional framework is generalizable other image factors, learning algorithms. multimodal sensor data, and tasks in other application domains. These are all natural directions worthy of further exploration.

---

Under review as a conference paper at ICLR 2021
REFERENCES
Siddharth Agarwal, Ankit Vora, Gaurav Pandey, Wayne Williams, Helen Kourous, and James McBride. Ford multi-av seasonal dataset. arXiv preprint arXiv:2003.07969, 2020.
Isabelle Bégin and Frank Ferrie. Blind super-resolution using learning-based approach. In Proceedings of the 17th International Conference on Pattern Recognition (ICPR), volume 2, pp. 85-89, 2004.
Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint 1604.0731 2016.
Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh Vora, Venice Erin Liong. Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: multimodal dataset for autonomous driving. arXiv preprini arXiv: 1903. 11027, 2019.
Qianwen Chao, Huikun Bi, Weizi Li, Tianlu Mao, Zhaoqi Wang, Ming C. Lin, and Zhigang Deng. A survey visual traffic simulation: Models, evaluations, and applications in autonomous driving. Computer Graphics Forum, 39(1):287-308, 2019. doi: http:///oi.og//0.11111g1
Sully Chen. collection of labeled car driving datasets, http::/ggihubb.oom//sllll/e//eip datasets, 2018.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 3213-3223, 2016.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint arXiv:1805.095000 2018.
Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recogni- tion performance under visual distortions. In 2017 26th international conference computer communication and networks (ICCCN), pp. 1-7. IEEE, 2017a.
Samuel Dodge and Lina Karam. Quality resilient deep neural networks. arXiv preprint 1733v: 2017b.
Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Proceedings of the 1st Annual Conference on Robot Learning, pp. 1-16, 2017.
Xiang Gao, Ripon K Saha, Mukul R Prasad, and Abhik Roychoudhury. Fuzz testing based data augmentation improve robustness of deep neural networks. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering, pp. 1147-1158, 2020.
Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets roboties: The kitti dataset. International Journal of Robotics Research (IJRR), 2013.
Jakob Geyer, Yohannes Kassahun, Mentar Mahmudi, Xavier Ricou, Rupesh Durgesh, Andrew Chung. Lorenz Hauswald, Viet Hoang Pham, Maximilian Mühlegg, Sebastian Dorn, Tiffany Fernandez, Martin Jänicke, Sudesh Mirashi, Chiragkumar Savani, Martin Sturm, Oleksandr Vorobiov, Martin Oelker, Sebastian Garreis, and Peter Schuberth. A2D2: Audi Autonomous Driving Dataset. 2020. URL ht www. a2d2. audi
S. Ghosh, R. Shet, P. Amon, A. Hutter, and A. Kaup. Robustness of deep convolutional neural networks for image degradations. In 2018 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2916-2920, 2018.
Chengyue Gong, Tongzheng Ren, Mao Ye, and Qiang Liu. MaxUp: A Simple Way to Improve Generalization of Neural Network Training. arXiv e-prints, art. arXiv:2002.09024 February 2020.
10

---

Under review as a conference paper at ICLR 2021
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. arXiv preprint arXiv:1903.1226:1 2019.
Dan Hendryeks. Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self- self-supervised learning can improve model robustness and uncertainty. In Wallach, H. Larochelle, A. Beygelzimer, F. dAlché- Buc, E. Fox, and R. Garnett (eds.), Advances in Neural Information Processing Systems 32, pp. 15663-15674 Curran Associates, Inc., 2019.
Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. In ICLR, 2020.
Diederik P Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint 2014.
Weizi Li, David Wolinski, and Ming C. Lin. ADAPS: Autonomous driving via principled simulations. In IEEE International Conference on Robotics and Automation (ICRA), pp. 7625-7631, 2019. doi:
https://doi.org/10. 0099/cca..01.887992222
Will Maddern, Geoff Pascoe, Chris Linegar, and Paul Newman.
Year. 1000km: The Oxford Robot- Car Dataset. The International Journal of Robotics Research (IJRR), 36(1):3-15, 2017. doi: 10.
11777027883649916679988888 URL http: dx doi wtt.::...rr..111...1111111111//. wtt.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. ICLR, 2018.
Camilo Pestana, Naveed Akhtar, Wei Liu, David Glance, and Ajmal Mian. Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space. arXiv e-prints, art. arXiv:2003.00883, February 2020.
Matthew Pitropov, Danson Garcia, Jason Rebello, Michael Smart, Carlos Wang, Krzysztof Czar- necki, and Steven Waslander. Canadian adverse driving conditions dataset. arXiv preprint arXiv:2001.10111 2020.
Vasili Ramanishka, Yi-Ting Chen, Teruhisa Misu, and Kate Saenko. Toward driving scene under- standing: dataset for learning driver behavior and causal reasoning. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 7699-7707, 2018.
Mengye Ren, Wenyuan Zeng, Bin Yang, and Raquel Urtasun. Learning to reweight examples for robust deep learning, arXiv preprint arXiv:1803.00 000000000. 2018.
Eder Santana and George Hotz. Learning driving simulator. arXiv preprint arXiv: (0w::660..100 01230, 2016.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurIPS, 2019.
Manli Shu, Zuxuan Wu, Micah Goldblum, and Tom Goldstein. preparing for the worst: Making networks less brittle with adversarial batch normalization. arXiv preprint arXiv:2009.08965, 2020.
Pei Sun, Henrik Kretzschmar, Xerxes Dotiwalla, Aurelien Chouard, Vijaysai Patnaik, Paul Tsui, James Guo, Yin Zhou, Yuning Chai, Benjamin Caine, et al. Scalability in perception for autonomous driving: Waymo open dataset. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp.
2020.
Yuchi Tian, Kexin Pei, Suman Ja Jana, and Baishakhi Ray. Deeptest: Automated testing of deep- neural- -etwork-driven autonomous cars. In Proceedings the 40th international conference software engineering, pp. 303-314, 2018.
Toan Tran, Trung Pham, Gustavo Carneiro, Lyle Palmer, and lan Reid. A bayesian data augmentation approach for learning deep models. In Advances in neural information processing systems, pp. 2797-2806, 2017.
11

---

Under review as a conference paper at ICLR 2021
Frederick Tung, Jianhui Chen, Lili Meng, and James Little. The raincouver parsing benchmark for self-driving in adverse weather and at night. IEEE Robotics and Automation Letters, 2(4): 2188-2192 2017.
Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur recognition by convolutional networks. arXiv preprint 1rXiv:1611.05760 2016.
Zhe Wu, Zuxuan Wu, Bharat Singh, and Larry Davis. Recognizing instagram filtered images with feature de-stylization. Proceedings of the AAAI Conference on Artificial Intelligence, 34: 12418-12425, 04 2020. doi: 10.1609/aaai.x44407. 6628.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang. Alan L. Yuille, and Quoe V. Le. Adversarial examples improve image recognition. In CVPR, 2020.
Mengshi Zhang, Yuqun Zhang, Lingming Zhang, Cong Liu, and Sarfraz Khurshid. Deeproad: Gan- based metamorphic testing and input validation framework for autonomous driving systems, In 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE), pp. 132 142. IEEE, 2018.
Zhengyou Zhang. A flexible new technique for camera calibration. IEEE Transactions on pattern analysis and machine intelligence, 22(1 1-11-133344443300 2000.
Yiren Zhou, Sibo Song, and Ngai-Man Cheung. On classification of distorted images with deep convolutional neural networks. In 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1213-1217. IEBE, 2017.
12


Reviews:
[{"review_id": "zu5L-dSYWPd", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "### **Summary**:\n \nThis work proposes a new method to improve the generalization of ML models for the task of vehicle steering using a hybrid of data augmentation and adversarial examples. In a nutshell, the proposed method attempts to increase the accuracy of the model by dynamically adding a selection of candidate datasets during training. Each of these “candidates” is created offline applying a transform (e.g. blur, distortion, and changes in color representation) to the original (base) dataset. During training, the method chooses among the K transformed-datasets those who minimize the mean validation accuracy and based on this selection the steering model is retrained. The approach is evaluated on a driving dataset.\n \n---\n\n# Final evaluation (post-rebuttal)\n\n\nI am increasing the score to \"marginally above the acceptance threshold\" after the discussion with the authors. I thank the authors for including other datasets and considering additional baselines. I still think that Chen's dataset should not be the main dataset to use in the paper, but I am happy to see strong datasets. I also believe that this paper could benefit from using simulation solutions (despite the domain gap) to create controlled experiments. \n\n--- \n# Original evaluation (pre-rebuttal)\n\n\n### **Reasons for score**: \n \nMy current score is *rejection*. \n \nI went through the main idea a few times and I think it is a nice proposal. Using the FID as a proxy to cherry-pick transformed datasets seems plausible and relatively simple to reproduce.\tAfter seeing Figure 3. I started having doubts about the actual correlation between MA and FID, which may turn problematic for this approach, but I didn’t let that discourage me too much. \t\t\t\t\n\nThe real concerns emerged when I reached the experiment section. After reading the experiments I think that the narrative of the paper is not as consistent as it could (should?) be. \nThe paper opens with a clear problem motivation: *“To ensure the wide adoption and safety of autonomous driving, vehicles need to be able to drive under various lighting, weather, and visibility conditions in different environments”*. Also, the title of the paper includes the words *“Improving Generalization”*. \n\nAfter reading this, I --and probably many readers-- automatically shifted to the mindset of generalization analysis in autonomous driving problems. This typically involves multiple datasets featuring variations such as weather conditions, etc., well-chosen training, validation, and test splits, and strong baselines. However, section 4 does not contain these elements.\n\nAll experiments are carried out using Chen’s dataset, and one of the main questions should be, why this dataset? Is this dataset the right one? Honestly, it is hard to tell, because there is not much information about the structure of such dataset. We know that it was collected around Rancho Palos Verdes and San Pedro, (California), but we don’t know much else. How is the dataset split into training, validation, and test? Does it contain strong weather variations? Was the proposed approach tested in a sequence never seen during training or is the method simply overfitting the training routes?\n\nIn short, this doesn’t seem to be the right setup t study the problem of generalization. Instead, I would like to recommend a controlled environment, such as the [CARLA simulator](https://github.com/carla-simulator/carla). There you can create datasets in different visual conditions in different maps, and you can also get the steering angle for free. Recent works, such as [Learning Situational Driving](https://openaccess.thecvf.com/content_CVPR_2020/papers/Ohn-Bar_Learning_Situational_Driving_CVPR_2020_paper.pdf) followed this methodology.\n\n---\n\n### **Strengths**:\n \n* This paper is after an interesting and relevant problem, fundamental for the progress of the autonomous driving field.\n* Using a possible correlation between MA and FID to drive a dynamic “adversarial data augmentation” process is an interesting idea.\n* The paper is well written and simple to reproduce\n\n---\n\n### **Weaknesses**:\n\n* As mentioned above, my main concern is that there are possible flaws in the evaluation protocol. The paper uses Chen’s dataset, but it is not clear if the dataset itself is suitable for the task (besides providing labels for the steering task). I believe that it would be beneficial for the paper to switch to other datasets. Synthetic datasets such as those generated by the CARLA simulator, MS AirSim, or LGSVL simulator should be fine. Real datasets, such as the [AUDI A2D2 dataset](https://www.a2d2.audi/content/dam/a2d2/dataset/a2d2-audi-autonomous-driving-dataset.pdf) could be useful too.\n\n* It seems that strong baselines are not present in the experiments. For instance, I am surprised to see that approaches like [AugMIX](https://arxiv.org/pdf/1912.02781.pdf) or even the original paper by [Hendrycks](https://arxiv.org/pdf/1903.12261.pdf) are not included in the comparison.\n\n---\n\n### **Questions to be discussed during the rebuttal period**:\n\nPlease, I would appreciate it if you could refer to the points I described in the **Weaknesses** section.\n\n---\n\n### **Other considerations**:\n\n* The text uses the term master-slave → primary - secondary?\n\n---\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "wzutYsGrlPV", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThis paper presents an algorithm to improve the model generalization of the task of \"learning to steer\". First, the sensitivity of a baseline learning algorithm to degraded images in varying qualities caused by different factors is carried out. Some empirical insights are gained. Then, a new training algorithm is proposed to solve a min-max optimization problem, where the most difficult datasets are chosen and used for training at each iteration. Experiments are conducted to validate the effectiveness of the proposed method. \n\nPros:\n1) The idea of evaluating the sensitivity of a model to different degradation factors in the same metric space is interesting, providing empirical insights for preparing datasets with different degradation levels. \n2) Inspired by adversarial learning, choosing the most difficult datasets for training at each iteration may be informative and potentially improve the model generalization.\n3) Empirical study on a base dataset for the \"learning to steer\" task is carried out. \n\nCons:\n1) The choice of FID as the unified metric for evaluating the quality of different degraded images caused by different factors is not convincing. Although the authors list some reasons on page 4, it is still unclear how FID could be a fair metric to different factors. Referring to Figure 3, the mean accuracy difference is no so sensitive to blur and noise according to the FID metric. Is it possible that FID is more sensitive to such degradation factors than others? A careful inspection and more discussions are encouraged. Besides, it is recommended to carry out a user study to register the FID or other metrics to the human visual experience. \n\n2) It seems that the sensitivity analysis is only used as an empirical guideline to discretize the parameters of degradation factors into their corresponding levels. However, the effectiveness of such a guideline has not been validated. The authors can compare it with other discretization methods such as uniformly sampling, unevenly sampling towards heavy degradation, or light degradation. Moreover, if the abovementioned user study is carried out, how is the performance using the discretization method based on the human visual experience levels? Besides, will it be helpful to determine the dataset volumes of different factors, i.e., adjusting the ratio (importance) between different factors? And will the ratio have a significant impact on the performance?\n\n3) The proposed method seems to be not limited to the \"learning to steer\" task. Considering that some well-established benchmark datasets such as ImageNet-C and different methods have been proposed for studying the impact of degradation factors, it is recommended to carry out experiments on these datasets and included more representative state-of-the-art methods into the comparison.\n\n4) It is unclear how the training cost is since each dataset should be evaluated separately at each iteration in the proposed algorithm. Detailed analysis and comparison are encouraged.\n\n5) On page 5, it is said that the original dataset is also used for training together with the perturbed datasets. However, in the algorithm, only U_p is used, which is defined as the combination of the selected perturbed datasets. Is it the same as the one in Eq. (1)? Besides, what is the meaning of U in the algorithm?\n\n6) In the Experiments Part, both the baseline method and Scenario 1 are called the baseline, which may be confusing in the following description and discussions.\n\n7) Why the model generates strong responses at the distant areas rather than the near road, e.g., markers and boundaries, in the first three columns of Figure 6? Does the vanishing point serve as a cheap feature for \"steering\"? If so, the structural information of the road should be more useful. Thereby, some degradation factors such as channel perturbations may have a smaller impact on the performance than others such as blur and distortion. However, from Table 2 and Table 3 in the appendix, it seems that distortion and channel perturbations have a larger impact on the generalization performance compared with blur and noise, e.g., at the higher levels. Moreover, the proposed method can effectively deal with the degradation factors that have a smaller impact on structural information such as noise and channel perturbations (i.e., a larger improvement) while being less effective for those structural-related ones (i.e., blur and distortion). Should the degradation factors be divided into different groups, i.e., structural-related ones and structural-irrelevant ones? Will the proposed method have a consistent superiority on the two groups over the common data augmentation technique? More experiments and analysis should be carried out to provide further evidence on the choice of the baseline steering model and benchmark dataset, as well as evaluate the effectiveness of the proposed method comprehensively.", "extra_scores": {}, "extra_text": {}}, {"review_id": "jZ09ycNxGjp", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper aims to generate adversarial examples for self-driving car. It has two fold contributions. First, the paper analyzes the sensitivity of a learning algorithm w.r.t. different image transformation in a realistic scenario. Next, they also propose a technique to learn from the generated images. \n\nThe paper addresses a very important problem. The reported performance also quite good. However, there are some major concern about this work:\n\n1.\tThere are many work along this line in other communities. For example, \na.\tTian, Yuchi, et al. \"Deeptest: Automated testing of deep-neural-network-driven autonomous cars.\" Proceedings of the 40th international conference on software engineering. 2018.\nb.\tZhang, Mengshi, et al. \"DeepRoad: GAN-based metamorphic testing and input validation framework for autonomous driving systems.\" 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2018.\nThe above two papers work on the same premise that the self-driving car learning model is susceptible to many real-world conditions and propose methods to analyze to the sensitivity of the method. Especially, the second paper uses GAN to simulate image close to the original distributions. The paper should compare with these baselines. \n\n2.\t The re-training method using evolutionary optimization is interesting. However, a similar technique is proposed by Gao, Xiang, et al. \"Fuzz testing based data augmentation to improve robustness of deep neural networks.\" Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering. 2020. The author should compare the retraining method with this technique.\n\n3.\tFigure 4 generated images that do not look very real to me.\n\n4.\tOnly tested for one learning model.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "GAKr4_Ra1sl", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposed a novel adaptive data augmentation algorithm that produces random perturbations on the training dataset to train an imitation learning-based self-driving network. It starts with a sensitivity analysis of network performance under different types and levels of perturbations. And a novel automated perturbed training dataset selection mechanism is then proposed to improve the performance. Validation has been conducted over simulated data with both seen and unseen perturbation types. \n\n\nPros:\n* Very practical task. Such problems do exist in real-world self-driving, and having learnable perturbations could potentially reduce the generalization gap.\n* Great efforts to push and simulate perturbations that could be seen in the real-world. \n\nMy primary concern is that there are quite a few very relevant problem settings tackling similar tasks. And the paper should add discussions and comparisons. These include but are not limited to:\n- Learning to reweight different training samples. e.g. [A]\n- Automated data augmentation with perturbations, e.g. [B]\n- Bayes opt for hyper-params search overall, e.g. [C, D]\n\n\"Unseen\" perturbations are also re-assembling of several low-level degradation factors. Thus it's not clear whether such a domain gap is significant or not. It will help to understand the question if there exists similar perturbation in training. This could be done by choosing the most similar perturbation type in training to each unseen perturbation in testing in terms of image similarity score between the same images under two different perturbations. \n\nThe baselines used in the experiment are a bit too weak. Please consider adding the ones as mentioned above. Please consider the \"oracle\" with a training set that reproduces the perturbations used in testing. This is to evaluate whether this proposed method could improve performance when there is no domain gap in perturbation. For instance, could you even perform better on rainy days through a model trained on the proposed training set rather than a dataset of rainy day logs? \n\nThe method was not evaluated on a real dataset. Many real datasets, such as OxfordRoboCar, Raincouver, Canadian Adverse Driving Conditions, contain real-world driving data with challenging weather conditions. Plus, it would be preferable to evaluate perception performance as well, such as detection/segmentation, not only an end-to-end IL driving model, which is less practical at this moment for real-world self-driving. \n\nThe incremental dataset augmentation is greedily selected based on the worst validation performance on that single subset. As a consequence, an over-difficult subset might be preferred. Instead, the subset improves overall performance. Could you comment on that?\n\nMinors:\n* Getting the full validation performance at each step could potentially time-consuming. Have you considered improving the efficiency by early stopping criteria? \n* How many time steps do you run in practice? \n* Does the # of training iterations and controlled to be the same across all competing methods to ensure fairness? \n* How about the additional run-time compared against no dataset selection? \n\n[A] Ren et al. Learning to Reweight Examples for Robust Deep Learning\n[B] Cubuk et al. Autoaugment: Learning augmentation policies from data\n[C] Tran et al. A Bayesian Data Augmentation Approach for Learning Deep Models\n[D] Snoek et al. Practical Bayesian Optimization of Machine Learning Algorithms\n\n\n\n-------------------------------------------------------- Post Rebuttal --------------------------------------------------------------------------------------------\n\nI carefully read the reviewer's comments and the rebuttal. I think the author did not get my major concern on competing algorithms. I acknowledge this proposed method is a novel problem setting and my goal is not to ask for summarizing the difference in problem settings. However, the technical approach, which is based on (batch-)training sample selection and reweighting, could be validated through comparing against more comprehensive baselines, as I pointed out, under similar settings.\n\nFurthermore, I am not convinced by the claim that unseen perturbation cannot be justified if there exists a similar perturbation assemble during training. The reference-based perceptual similarity is a well-studied domain which could be directly adopted to evaluate the overall \"difficulty\" or \"out-of-distribution\"-level. And I am not convinced by the author that the experiments you have tried cannot be shown in paper due to page limit: at least you could include in supplementary, as they are important to justify if your experiment setting really validates generalization ability. \n\nIn sum, I will keep my current rating. \n\n\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This meta-review is written after considering the reviews, the authors’ responses, the discussion, and the paper itself.

The paper has 2 main contributions: 1) analysis of the sensitivity of a deep network predicting steering angle from images w.r.t. different synthetic image perturbations, 2) A training method, based on adaptively adjusted data augmentation, which improves the robustness of a model to seen and previously unseen perturbations.

The reviewers’ opinions are somewhat mixed, leaning towards negative. The reviewers point out that the task is important and the methodology makes sense, but the experiments are limited: only one dataset, only synthetic perturbations, only the steering angle prediction task (which is not necessarily very practical), not strong enough baselines, no results on established datasets like ImageNet-C. The authors addressed some of these issues in the updated version of the paper (more datasets, one more baseline), but most reviewers did not change their evaluation.

Based on all this information and reading the paper itself, I recommend rejection at this point. The paper has interesting ideas, but the experimental evaluation is not sufficient. Moreover, I find the use of the steering prediction task confusing - there does not seem to be anything driving-specific in the method, so using standard datasets (like ImageNet-C) would be more convincing. For driving datasets, using real-world (not synthetic) image perturbations would be advisable. As the paper stands, it looks neither like a proper application paper, nor as a fundamental method/analysis paper, but something inbetween, which is not to its favor.

Decision: Reject