Adversarial AutoAugment
Authors: Xinyu Zhang
Qiang Wang
Jian Zhang
Zhao Zhong
Venue:  (2020)
Keywords: Automatic Data Augmentation
Adversarial Learning
Reinforcement Learning

Abstract: Data augmentation (DA) has been widely utilized to improve generalization in training deep neural networks. Recently, human-designed data augmentation has been gradually replaced by automatically learned augmentation policy. Through finding the best policy in well-designed search space of data augmentation, AutoAugment (Cubuk et al., 2019) can significantly improve validation accuracy on image classification tasks. However, this approach is not computationally practical for large-scale problems. In this paper, we develop an adversarial method to arrive at a computationally-affordable solution called Adversarial AutoAugment, which can simultaneously optimize target related object and augmentation policy search loss. The augmentation policy network attempts to increase the training loss of a target network through generating adversarial augmentation policies, while the target network can learn more robust features from harder examples to improve the generalization. In contrast to prior work, we reuse the computation in target network training for policy evaluation, and dispense with the retraining of the target network. Compared to AutoAugment, this leads to about 12x reduction in computing cost and 11x shortening in time overhead on ImageNet. We show experimental results of our approach on CIFAR-10/CIFAR-100, ImageNet, and demonstrate significant performance improvements over state-of-the-art. On CIFAR-10, we achieve a top-1 test error of 1.36%, which is the currently best performing single model. On ImageNet, we achieve a leading performance of top-1 accuracy 79.40% on ResNet-50 and 80.00% on ResNet-50-D without extra data.

Published as a conference paper at ICLR 2020
ADVERSARIAL AUTOAUGMENT
Xinyu Zhang
Qiang Wang Huawei
Huawei
zhangxinyul hwwpiiyyyy0@@uuuaa wwwuawei.ccomo
wanggiangl
(enggggaangl&@huawweeeea 68@huawei com
Jian Zhang
Zhao Zhong
Huawei
Huawei zorro. .2hoggghacehuaeee.com
shangjiaa1157hhuaeii..
ABSTRACT
Data augmentation (DA) has been widely utilized to improve generalization training deep neural networks. Recently, human-designed data augmentation has been gradually replaced by automatically learned augmentation policy. Through finding the best policy in well-designed search space of data augmentation, Au- toAugment (Cubuk et al.) 2019) can significantly improve validation accuracy on image classification tasks. However, this approach not computationally practi- cal for large-scale problems. In this paper, we develop an adversarial method to arrive a pnrpuutttionally-ffooraab solution called Adversarial AutoAugment. which can simultancously optimize target related object and augmentation pol- icy search loss. The augmentation policy network attempts to increase the train- ing loss of a target network through generating adversarial augmentation policies, while the target network can learn more robust features from harder examples to improve the generalization. In contrast to prior work, we reuse the computation in target network training for policy evaluation, and dispense with the retraining of the target network. Compared to AutoAugment, this leads to about 12x reduc- tion in computing cost and 11x shortening in time overhead on ImageNet. We show experimental results of approach and demonstrate significant performance improvements over state-of-the-art On CIFAR-IO, we achieve top-I test error of 1.36%, which is the currently best per- forming single model. On ImageNet, we achieve a leading performance of top-1 accuracy 79.40% on ResNet-50 and 80. 90.00% on ResNet-50-D without extra data.
CIFAA-IO/CIFAR. 100, ImageNet,
INTRODUCTION
Massive amount of data have promoted the great success of deep learning in academia and industry. The performance of deep neural networks (DNNs) would be improved substantially when more pervised data is available or better data augmentation method is adapted. Data augmentation such rotation, flipping, cropping, etc., is powerful technique of data. Experiments show that the generalization of a neural network can be efficiently improved through manually designing data augmentation policies. However, this needs lots of knowledge of human expert, and sometimes shows the weak transferability across different tasks and datasets in practical applications. Inspired by neural architecture search (NAs) & Le 2016 Zoph al.; 2017 Zhong et al., 20188 b. Guo et al.) 2018). reinforcement learning (RL) (Williams) 1992] method called Autoent is proposed by Cubuk et al. (2019). which can automatically learn the augmentation policy from data and provide an exciting performance improvement image classifi- cation tasks. However, the computing cost is huge for training and evaluating thousands sampled policies in the search process. Although proxy tasks, i.e., smaller models and reduced datasets, are taken to accelerate the searching process, tens thousands of GPU-hours of consumption are still required. In addition, these data augmentation policies optimized proxy tasks not guaranteed to be optimal on the target task, and the fixed augmentation policy is also sub-optimal for the whole training process.
increase the amount and diversity

---

Published as a conference paper at ICLR 2020
Policy Network
Policy
[Ty, Eg Far)
Scarch
Sampled Policies
Maximize Training Loss
Moving Average & Normalize
Pre-process
Large Batch
Minimize Training Loss
Training
Losses
E
Mini-Baich
12
Network
Dataset
K3
Training
Target Network
The overview of our proposed method. We formulate it as a Min-Max game. The data of each batch augmented by multiple pre-processing components with sampled policies {TI, T2... TM/ h. respectively. Then, a target network is trained to minimize the loss of a large batch, which is formed by multiple augmented instances of the input batch. We extract the training losses of a target network corresponding to different augmentation policies as the reward signal. Fi- nally, the augmentation policy network is trained with the guideline of the processed reward signal, and aims to maximize the training loss of the target network through generating adversarial policies.
Figure 1:
In this paper, we propose an efficient data augmentation method to address the problems mentioned above, which can directly search the best augmentation policy the full dataset during training a target network, as shown in Figure | We first organize the network training and augmentation policy search in an adversarial and online manner. The augmentation policy is dynamically changed along with the training state of the target network, rather than fixed throughout the whole training process like normal AutoAugment (Cubuk et al. 2019). Due reusing the computation in policy evaluation and dispensing with the retraining of the target network, the computing cost and time overhead are extremely reduced. Then, the augmentation policy network taken as an adversary to explore the weakness of the target network. We augment the data of each min-batch with various adversarial policies in parallel, rather than the same data augmentation taken in batch augmentation (BA) (Hoffer al. 2019). Then, several augmented instances of each mini-batch are formed into large batch for target network learning. As an indicator of the hardness of augmentation policies, the training losses of the target network are used guide the policy network generate more aggres- sive and efficient policies based on REINFORCE algorithm (Williams) 1992). Through adversarial learning, train the target network more efficiently and robustly.
The contributions can be summarized as follows:
Our method can directly learn augmentation policies target tasks, i.e., target networks and full datasets, with a quite low computing cost and time overhead. The direct policy search avoids the performance degradation caused by the policy transfer from proxy tasks to target tasks.
We propose adversarial framework to jointly optimize target network training and aug- mentation policy search. The harder samples augmented by adversarial policies are con- stantly fed into the target network to promote robust feature learning. Hence, the general- ization of the target network can be significantly improved.
The experiment results show that our proposed method outperforms previous augmentation methods. For instance, we achieve a top-1 test error of 7.36% with PyramidNet+ShakeeDopp (Yamada et al., 2018) on CIFAR-10, which is the state-of-the-a art performance. On Ima- geNet, we improve the top-1 accuracy of ResNet-50 (He et al. (016) from 76.3% to 79.4% without extra data, which even 1.77% better than AutoAugment (Cubuk al. 2019).
2

---

Published as a conference paper at ICLR 2020
2 RELATED WORK
Common data augmentation, which can generate extra samples by some label-preserved transfor- mations, is usually used to increase the size of datasets and improve the generalization of networks, such as on MINST, CIFAR-10 10 and ImageNet (Krizhevsky et al. 2012 Wan et al. 2013; (Zeeedy augmentation policies specified for different datasets.
eet al., 2015). However, numan-designed For example, flipping. the widely used transformation on RAA.RR-OO/IFAR-III 100 and ImageNet, is not suitable for MINST, which will destroy the property of original samples.
Hence, several works (Lemley et al., 2017 Cubuk et al. 2019 Lin et al., 2019 Ho et al. 2019) have attempted to automatically learn data augmentation policies. Lemley et al. (2017) propose a method called Smart Augmentation, which merges two or more samples of a class to improve the generalization of a target network. The result also indicates that an augmentation network can be learned when a target network is being training. Through well designing the search space of data augmentation policies, AutoAugment (Cubuk et al., 2019) takes a recurrent neural network (RNN) as a sample controller to find the best data augmentation policy for selected dataset. To reduce the computing cost, the augmentation policy search is performed on proxy tasks. Population based augmentation (PBA) (Ho et al., 2019) replaces the fixed augmentation policy with dynamic schedule of augmentation policy along with the training process, which is mostly related to our work. Inspired by population based training (PBT) (Jaderberg et al. 2017), the augmentation policy search problem in PBA is modeled as a process of hyperparameter schedule learning. However, the augmentation schedule learning is still performed on proxy tasks. The learned policy schedule should be manually adjusted when the training process of a target network is non-matched with proxy tasks.
Another related topic is Generative Adversarial Networks (GANs) (Goodfellow et al. 2014), which has recently attracted lots of research attention due its fascinating performance, and also been used to enlarge datasets through directly synthesizing new images (Tran et al. [017 Perez & Wang 2017; Antoniou al. 2017, Gurumurthy al. 2017 Frid-Adar et 2018). Although we formulate our proposed method as Min-Max game, there exists an obvious difference with traditional GANs. We want to find the best augmentation policy to perform image transformation along with the training process, rather than synthesize new images. Peng al. (2018) also take such an idea to optimize the training process of a target network in human pose estimation.
3 METHOD
In this section, we present the implementation of Adversarial AutoAugment. First, the motivation for the adversarial relation between network learning and augmentation policy is discussed. Then, we introduce the search space with the dynamic augmentation policy. Finally, the joint framework for network training and augmentation policy search is presented in detail.
3.1 MOTIVATIONS
Although some human- -eeianed data augmentations have been used in the training of DNNs, such as randomly cropping and horizontally flipping CIFAR-1O/CIFAR-I0 and ImageNet, limited randomness will make it very difficult to generate effective samples at the tail end of the training. To struggle with the problem, more randomness about image transformation is introduced into the search space of AutoAugment (Cubuk et al. 2019) (described in Section 3.2). However, the learned policy is fixed for the entire training process. All of possible instances of each example will be send to the target network repeatedly, which still results in an inevitable overfitting in a long-epoch training. This phenomenon indicates that the learned policy not adaptive to the training process of target network, especially found on proxy tasks. Hence, the dynamic and adversarial augmentation policy with the training process is considered as the crucial feature in our search space.
Another consideration is how to improve the efficiency of the policy search. In AutonAugent (Cubuk et al. 2019). to evaluate the performance of augmentation policies, a lot of child models should be trained from scratch nearly to convergence. The computation in training and evaluat- ing the performance of different sampled policies can not be reused, which leads to huge waste of efficient policy search framework
computation resources. In this paper, we propose computing eeffuttnn-efffcient through reusing prior computation in policy evaluation. Only one target network is used to evaluate the performance of different policies with the help of the training losses of corresponding augmented
3

---

Published as a conference paper at ICLR 2020
Epoch 30
Epoch 60
Epoch 90
Epoch 120
Policy
Original
T1
TrunslateX, Posterize,
Posterize, 5 Cutout,
TranslatcX, 9
Rotate, Color,
Cutout,
22
Solarize, Posterine,
Equalize, Invert, 8
Rotate, Sharpness, ?
Rotate, Invert
T3
Color, Constrast, 8
TranslateX, Posterize,
Equalize, 4
ShearY. TranslateX, 8
TranslateX,6
M
Cutouri, ShearX.
TranslateY, Cutout,
TranslateX, Color,
AutoContrast, 3
Posterize, 7
Figure 2: An example of dynamic augmentation policies learned with ResNet-50 on ImageNet.
With the training process of the target network, harder augmentation policies are sampled to combat overfitting. Intuitively, more geometric transformations, such as TranslateX, ShearY and Rotate, picked in sampled policies, which is obviously different from AutoAugment (Cubuk et al. 2019) concentrating on color-based transformations.
instances, The augmentation policy network is learned from the intermediate state of the target net- work, which makes generated augmentation policies more aggressive and adaptive. On the contrary, to combat harder examples augmented by adversarial policies, the target network has to learn more robust features, which makes the training more efficiently.
3.2 SEARCH SPACE
In this paper, the basic structure the search space of AutoAugment (Cubuk et al. 2019) re- served. An augmentation policy defined as that it composed by sub-policies, each sub-policy contains two image operations to be applied orderly, each operation has two corresponding parame- ters, i.e., the probability and magnitude of the operation. Finally, the 5 best policies are concatenated to form a single policy with 25 sub- sub-policies. For each image in a mini-batch, only one sub-policy will be randomly selected to be applied. To compare with AutoAugment (Cubuk et al.) (2019) con- veniently, we just slightly modify the search space with removing the probability of each operation. This is because that we think the stochasticity epochs to take effect, which will detain the feedback of the intermediate state of the target network. There are totally 16 image operations in our search space, including ShearX/Y, TranslateX/Y. Rotate, AutoContrast, Invert, Equalize, Solarize, Posterize, Contrast, Color, Brightness, Sharpness, Cutout (Devries & Taylor (017)) and Sample Pairing (Inoue) (0118). The range of the magnitude is also discretized uniformly into 10 values. To guarantee the convergence during adversarial learning, the magnitude of all the operations are set in moderate range Besides, the randomness during the training process is introduced into our search space. Hence, the search space of the policy in each epoch has S = (16 x 10) 10 x 1.1 x 1022 possibilities. Considering the dynamic policy, the number of possible policies with the whole training process can be expressed as | #epochs An example of dynamically learning the augmentation policy along with the training process is shown in Figure We observe that the magnitude (an indication difficulty) gradually increases with the training process.
an operation with a probability requires a certain
TThe details about the parameter setting please refer AutoAugment Cubuu al.
2019
4

---

Published as a conference paper at ICLR 2020
3.3 ADVERSARIAL LEARNING
In this section, the adversarial framework of jointly optimizing network training and augmentation policy search is presented in detail. We the augmentation policy network A(; 0) as adver- sary, which attempts to increase the training loss of the target network F(,; w) through adversarial learning. The target network is trained by large batch formed by multiple augmented instances of each batch to promote invariant learning (Salazar et al., 2018), and the losses of different augmen- tation policies applied on the same data are used to train the augmentation policy network by RL. algorithm.
Considering the target network Fl,, w) with loss function L[F(x, w), yl. where each example is transformed by some random data augmentation o(.), the learning process of the target network can be defined as the following minimization problem
arg min E [[F(o(x)) w) awi
where Ω is the training set, a and are the input image and the corresponding label, respectively. The problem usually solved by vanilla SGD with a learning rate 7) and batch size N, and the training procedure for each batch can be expressed as
Wt+1 Wt TJ
V (( w, w.yn].
To improve the convergence performance of DNNs, more random and efficient data augmentation performed under the help the augmentation policy network. Hence, the minimization problem should be slightly modified as
w" = arg min E
E (-)((-0)
()) yl.
(3)
where 7(-) represents the augmentation policy generated by the network A(, 0). Accordingly, the training rule can be rewritten as
M
N
w = w.
Σ m==1
V
V
C[F (Fm), w). ynl.
(4)
M N
where we introduce M different instances of each input example augmented by adversarial policies {Ti, "2, ; Tar.. For convenience, we denote the training loss of a mini-batch corresponding to the augmentation policy Tm. as
N Cm
(T w), yn].
(5)
N
==1
Hence, we have an equivalent form of Equation
M Σ ''M 172
Wr+1 w. 1)
Cm
(6)
Note that the training procedure can be regarded as larger MM batch training or an average over M instances of gradient computation without changing the learning rate, which will lead to reduction of gradient variance and a faster convergence of the target network [Hffer et al. (2019) However, overfitting will also come. To overcome the problem, the augmentation policy network designed increase the training loss of the target network with harder augmentation policies. Therefore, we can mathematically express the object the following maximization problem
0" = arg max J(O):
where ((0)
E
E A(.0))
C[F(T(x), (F)TT)),.))..)
a
Similar to Automugment (Cubuk et al. 2019). the augmentation policy network is also implemented a RNN shown in Figure At each time step of the RNN controller, the softmax layer will
5

---

Published as a conference paper at ICLR 2020
Sofhuax Lager
Select type of Opll
Select the magnittde Op
Select the magnitude of
type of Op1
Hidden
Eanbokding
Layer
Embeddiig
Embeddiing
Embedding
Embodding
Figure 3: The basic architecture of the controller for generating a sub- cabi-pollyy. which consists of two operations with corresponding parameters, the type and magnitude of each operation. When a policy contains Q sub sub-policies, the basic architecture will be repeated Q times. Following the setting of AutoAugment (Cubuk et al. 2019), the number of sub- coob-ooiiies Q is set to 5 in this paper.
predict action corresponding to discrete parameter of sub-policy, and then an embedding of the predicted action will be fed into the next time step. In our experiments, the RNN controller will predict 20 discrete parameters to form a whole policy.
However, there has severe problem in jointly optimizing target network training and augmentation policy search. This is because that non-differentiable augmentation operations break gradient flow from the target network FF to the augmentation policy network AA (Wang et al. [017]] Peng et al.]
2018). As alternative approach, REINFORCE algorithm (Williams) 1992) applied to optimize the augmentation policy network as
VoJ(O) V
E a Al A(- 0)
([F(T(x), w), y)
Σ Lm Vopm
Pmp V log
E Lm Vo Vologgo Pm A~A(-,0)
(8)
Lm Vo log
M
where Pm represents the probability of the policy To reduce the variance of gradient VoJ(O), replace the training loss of mini-batch L. with Lm moving average over certain mini- batche and then normalize among M instances as Lm- Hence, the training procedure of the augmentation policy network can be expressed as
M Em V
VoJ
~
Σ
log
M
m==
(9)
M
0 = 0- +
Σm V logPms
M
m==1
The adversarial learning of target network training and augmentation policy search is summarized as Algorithm 1
EXPERIMENTS AND ANALYSIS
In this section, we first reveal the details of experiment settings. Then, we evaluate our proposed method on CIFAR-IOCCIFAR-I00 ImageNet, and compare with previous methods. Results in Figure 4 show our method achieves the state-of-the-art performance with higher computing and time efficienc
"The length of the moving average fixed to an epoch our experiments. "To clearly present the advantage of our proposed method, normalize the performance of our method in the Figure and the performance of AutoAugment is plotted accordingly.

---

Published as a conference paper at ICLR 2020
Algorithm 1 Joint Training of Target Network and Augmentation Policy Network
Intiaaiiaaiin:: target network F(., w), augmentation policy network A(:, 0)
Input: input examples æ, corresponding labels y
1: for Se epochs do
2: Initialize L.m 0, Vm {1,22.... MM);
3: Generate MM policies with the probabilities {pi, . ):
4: for t
5:
Augment each batch data with M generated policies, respectively;
6:
Update Wr,t+1 according to Equation +
7:
Update L. through moving average. Vm E {1,2, :M];
8:
Collect L2, LM):
9:
Normalize Em among M instances as Em. Vm {1,2, ... ,M}:
10:
Update 1c+1 via Equation
Output w0, 0"
4.1
EXPERIMENT SETTINGS
The RNN controller is implemented as a one-layer LSTM (Hochreiter Schmidhuber 1997). We set the hidden size to 100, and the embedding size to 32. We use Adam optimizer (Kingma & Ba 2015) with a initial learning rate 0.00035 to train the controller. To avoid unexpected rapid convergence, entropy penalty of weight of 0.00001 is applied. All the reported results the mean of five runs with different initializations.
4.2 EXPERIMENTS ON CIFAR-10 AND CIFAR-100
CIFAR-10 dataset (Krizhessky & Hinton 2009) has totally 60000 images. The training and test sets have 50000 and 10000 images, respectively. Each image size of 32 32 belongs one
of 10 classes. We evaluate our proposed method with the following models: Wide-ResNett288-
10 ZZagruykko& & Komodakis 2016), Shake-Shar -Sake (26 2x32d) Gastaadi 2017). J. Shake-Shake (26
2x96d) [Gastaldi][0111 Shake-Shake (26 2x112d) (Gastaldi (017). PyramidNet+Shakell
(Han
al. Yamada
Yamada et al. 2018). All the models are trained on the full training set.
Training details: The Baseline is trained with the standard data augmentation, namely, randomly cropping a part of 32 x 32 from the padded image and horizontally flipping it with probability of 0.5. The Cutout (Devries & Taylor (017) randomly select 16 x 16 patch of each image, and then set the pixels of the selected patch to zeros. For our method, the searched policy is applied in addition to standard data augmentation and Cutout. For each image in the training process, standard data augmentation, the searched policy and Cutout are applied in sequence. For 10, the step learning rate (LR) schedule is adopted. The cosine LR schedule is adopted for the other models. More details about model hyperparameters are supplied in A.
28-
Choice of M: To choose the optimal M, select Wide-ResNNtt-8-11 as target network, and evaluate the performance of our proposed method verse different M, where M E (2, 4, 8, 16, 32). From Figure 5] we can observe that the test accuracy of the model improves rapidly with the increase of M up to 8. The further increase of M does not bring a significant improvement. Therefore, to balance the performance and the computing cost, M is
8 in all the following experiments.
CIFAR-10 results: In Table I] we report the test error of these models on CIFAR-10. For all of these models, our proposed method can achieve better performance compared to previous methods. We achieve 0.78% and 0.68% improvement on Cete-ReNNet-28-11111 compared to AutoAugment and PBA, respectively. We achieve a top-1 test error of 1.36% with PyramidNett-SSakeeDnng which 0.1% better than the current state-of-the reported in Ho et al. (2019). As shown in Figure 6(a) and further visualize the probability distribution the parameters the augmentation poli- cies learned with SyramidNet+Shakel that the percentages of some operations, such as Translate Rotate, Posterize, and SampleParing, gradually increase along with the training process. Meanwhile, more geometric transformations, such as TranslateX, Translate Y, and Rotate, are picked in the sampled augmentation policies, which different from color- focused Augmnnt (Cubuk et al. 2019) CIFAR-10. Figure 6(b) shows
CIFAR-10 over time. From Figure 6(a)) we can find

---

Published as a conference paper at ICLR 2020
Actmey on CIFAR-100
AstoAugment
M4
Top- Acauaay
M6.0
Accuncy CIFAR-10
ImageNey
07.8
97
Computinn
Time Dificiency
97.4
Efficiency
Figure 4: The Comparison of normalized perfor- mance between Augment and our method. Please refer to the following tables for more de- tails.
Figure 5: The Top-1 test accuracy of Wide-
ResNet-28-10 on CIFAR-10 verse different M, where M {2, 4, 16, 32}.
100
80
80-
Soarta
60
40
20-
200
opocts
(a) Operations
(b) Magnitudes
Figure 6: Probability distribution of the parameters in the learned augmentation policies on CIFAR- 10 over time. The number in (b) represents the magnitude of one operation. Larger number stands for more dramatic image transformations. The probability distribution of each parameter is the mean of each five epochs.
that large magnitudes gain higher percentages during training. However, the tail of training, low magnitudes remain considerable percentages. This indicates that our method does not simply learn the transformations with the extremes of the allowed magnitudes to spoil the target network.
CIFAR- R-100 results: We also evaluate our proposed method on CIFAR-100, 100, as shown Table 2 As we can observe from the table, we also achieve the state-of-the-art performance this dataset.
Table 1: Top-1 test error (%) on CIFAR-1O. We replicate the results of Baseline, Cutout and Au- toAugment methods from Cubuk et al. 2019), and the results PBA from Ho al. 2019 all of our experiments.
Model
Baseline
Cutout
AutoAugment
PBA
Our Method
Wide-ResNet-28-111
3.87
3.08
2.68
2.58
1.90:10.15
Shake-Shake (26 2x32d)
3.55
3.02
2.47
2.54
2.36
Shake-Shake (26 2x96d)
2.86
2.56
1.99
2.03
1.85:10.12
Shake-Shake (26 2x 12d)
2.82
2.57
1.89
2.03
1.78-10.05
PyramidNet++hhakoDDop
2.67
2.31
1.48
1.46
1.36-1000
4.3 EXPERIMENTS ON IMAGENET
As a great challenge in image recognition, ImageNet dataset (Deng et al. 2009) has about 1.2 million training images and 50000 validation images with 1000 classes. In this section, directly search the augmentation policy on the full training set and train ResNet-50 (He et al. 2016), ResNet-50-D (He al. 2018) and ResNet-200 (He et al. (016)) from scratch.
8

---

Published as a conference paper at ICLR 2020
Table 2: Top-1 test error (%) on CIFAR-100.
Model
Baseline
Cutout
AutoAugment
PBA
Our Method
Wide-ResNNet-2-100
18.80
18.41
17.09
16.73
15.49:0.118
Shake-Shake (26 2x96d)
17.05
16.00
14.28
15.31
14.10=0..15
PyramidNet-Shakeerry 13.99
12.19
10.67
10.94
10.42:10.20
Training details: For the baseline augmentation, we randomly resize and crop each input image to size of 224 x 224, and then horizontally flip it with a probability of 0.5. For AutoAugment (Cubuk et al.] 2019) and our method, the baseline augmentation and the augmentation policy are both used for each image. The cosine LR schedule is adopted in the training process. The model hyperparameters on ImageNet also detailed in A.1
ImageNet results: The performance of our proposed method ImageNet is presented in Table can be observed that we achieve a top-1 accuracy 79.40% on ResNet-50 without cxtra data. To the best of our knowledge, this is the highest top-1 accuracy for ResNet-50 learned on ImageNet. Besides, we only replace the ResNet-50 architecture with ResNet-50-D, and achieve a consistent improvement with top-1 accuracy of 80.00%.
Table 3: Top-1 / Top-5 test error (%) on ImageNet. Note that the result of ResNet-50-D is achieved only through substituting the architecture.
Model
Baseline
AutoAugment
PBA
Our Method
ResNet-50
23.69 / 6.92
22.37 6.18
20.60 0.15 / 5.53 1.05
ResNet-50-D
22.84 6.48
20.00 : 0.12 / 5.25 0.03
ResNet-220
21.52 5,85
20.00 4.90
18.68 4.70=0.05
4.4 ABLATION STUDY
To check the effect of each component in proposed method, report the test error of ResNet-50 on ImageNet the following augmentation methods in Table 4
Baseline: Training regularly with the standard data augmentation and step LR schedule.
Fixed: Augmenting all the instances of each batch with the standard data augmentation
fixed throughout the entire training process.
Random: Augmenting all the instances of each batch with randomly and dynamically generated policies.
Augmenting all the instances of each batch with adversarial policies sampled by the policy network along with the training process.
Ours:
From the table, we can find that Fixed can achieve 0.99% error reduction compared to Baseline. This shows that a large-batch training with multiple augmented instances of each mini-batch can indeed improve the generalization of the model, which is consistent with the conclusion presented in Hoffer et al. 2019). addition, the test error of Random is 1.02% better than Fixed. This indicates that augmenting batch with randomly generated policies can reduce overfitting in certain extent. Furthermore, our method achieves the best test eиror of 20.60% through augmenting samples with adversarial policies. From the result, we can conclude that these policies generated by the policy network are more adaptive to the training process, and make the target network have to learn more robust features.
4.5 COMPUTING COST AND TIME OVERHEAD
The computation in target network training is reused for policy evaluation. This makes the computing cost in policy search become negligible. Although there exists an increase of computing cost in target network training, the total computing cost in training target network with augmentation policies is quite small compared to prior work.
Computing Cost:
Since we just train target network with a large batch distributedly and simul- tancously, the time overhead of the large-batch training is equal to the regular training. Meanwhile, the joint optimization of target network training and augmentation policy search dispenses with the
Time Overhead:

---

Published as a conference paper at ICLR 2020
Table 4: Top-I test error (%) of ResNet-50 with different augmentation methods on ImageNet.
Method
Aug. Policy
Enlarge Batch
LR Schedule
Test Error
Baseline
standard
step
23.69
Fixed
standard
M 8
cosine
22.70
Random
random
cosine 21.68
Ours
adversarial
M
cosine
20.60
process of offline policy search and the retraining of target network, which leads to extreme time overhead reduction.
In Table take the training of ResNet-50 ImageNet example to compare the computing cost and time overhead of our method and AutoAugment. From the table, we can find that our method is 12x less computing cost and 11x shorter time overhead than AutoAugment.
Table 5: The comparison of computing cost (GPU hours) and time overhead (days) in training ResNet-50 on ImageNet between AutoAugment and our method. The computing cost and time overhead are estimated 64 NVIDIA Tesla V100s.
Computing Cost
Time Overhead
Method
Searching
Training
Total
Searching
Training
Total
AutoAugment Our Method
15000
160
15160
10
1
~
1280
1280
~
1
1
4.6
TRANSFERABILITY ACROSS DATASETS AND ARCHITECTURES
To further show the higher efficiency of our method, the transferability of the learned augmentation policies is evaluated in this section. We first take snapshot of the adversarial training process of ResNet-50 on ImageNet, and then directly use the learned dynamic augmentation policies regu- larly train the following models: Wide-ResNet-228 10 on CIFAR-10/10 and ResNet200 on ImageNet. Tablee[presentt the experimental results of the transferability. From the table, we can find that a competitive performance can be still achieved through direct policy transfer. This indicates that the learned augmentation policies transfer well across datasets and architectures. However, compared to the proposed method, the policy transfer results in an obvious performance degradation, especially the transfer across datasets.
ResNet-50-D on ImageNet
Table Top-1 test error (%) of the transfer of the augmentation policies learned with ResNet-50 on ImageNet.
Method
Dataset
AutoAugment
Our Method
Policy Transfer
Wide--RssNet-2-100 Wide-ResNNet228-100
CIFAR-10
2.68
1.90
2.45+0.13
CIFAR-100 100
17.09
15.49
16.48=0..15
ResNet-50-D
ImageNet
20.00
20.20:10.05
ResNer-200
ImageNet
20.00
18.68
19.05=+0.10
CONCLUSION
In this paper, we introduce the idea of adversarial learning into automatic data augmentation. The policy network tries to combat the overfitting of the target network through generating adversarial policies with the training process. To oppose this, robust features are learned in the target network, which leads to significant performance improvement. Meanwhile, the augmentation policy search performed along with the training of a target network, and the computation network training reused for policy evaluation, which can extremely reduce the search cost and make method more computing-efficiens
REFERENCES
Antreas Antoniou, Amos J. Storkey, and Harrison Edwards. Data augmentation generative adver- sarial networks. ICLR, 2017.
10

---

Published as a conference paper at ICLR 2020
Ekin D. Cubuk, Barret Zoph, Dandelion Mané, Vijay Vasudevan, and Quoe V. Le. Autoaugment:
Learning augmentation policies from data. CVPR, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. CVPR, 2009.
Terrance Devries and Graham W. Taylor. Improved regularization of convolutional neural networks with cutout. CoRR, Abs/1708.045522 2017.
Maayan Frid-Adar, Eyal Klang, Michal Amitai, Jacob Goldberger, and Hayit Greenspan. Synthetic data augmentation using GAN for improved liver lesion classification. IEEE International Sym- posium Biomedical Imaging (ISBI), 2018.
Xavier Gastaldi. Shake-shake regularization. CoRR, abs/ 2017.
Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. NIPS, 2014.
Minghao Guo, Zhao Zhong, Wei Wu, Dahua Lin, and Junjie Yan. IRLAS: inverse reinforcement learning for architecture search. CoRR, abs/1812.05285, 2018.
Swaminathan Gurumurthy, Ravi Kiran Sarvadevabhatla, and Venkatesh Babu Radhakrishnan. Deli- gan Generative adversarial networks for diverse and limited data. CVPR, 2017.
Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. CVPR, 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. CVPR, 2016.
Tong He. Zhi Zhang, Hang Zhang, Zhongyue Zhang, Junyuan Xie, and Mu Li. Bag of tricks for image classification with convolutional neural networks. CoRR, abs/1812.00187, 2018.
Daniel Ho, Eric Liang, Ion Stoica, Pieter Abbeel, and Xi Chen. Population based augmentation: Efficient learning of augmentation policy schedules. ICML, 2019.
Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural Computation, 1997.
Elad Hoffer, Tal Ben-Nun, Itay Hubara, Niv Giladi, Torsten Hoefler, and Daniel Soudry. Augment your batch: better training with larger batches. CoRR,
2019.
Hiroshi Inoue. Data augmentation by pairing samples for images classification. CoRR, 0bb//800.00992) 2018
Max Jaderberg, Valentin Dalibard, Simon Osindero, Wojciech M. Czamecki, Jeff Donahue, Ali Razavi, Oriol Vinyals, Tim Green, lain Dunning, Karen Simonyan, Chrisantha Fernando, and Koray Kavukcuoglu. Population based training of neural networks. CoRR, 2017.
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ICLR, 2015.
Alex Krizhevsky and Geoffrey E. Hinton. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convo- lutional neural networks. NIPS, 2012.
Joseph Lemley, Shabab Bazrafkan, and Peter Corcoran. Smart augmentation learning an optimal data augmentation strategy. CoRR, Abs//103.00m 700.08883, 2017.
Chen Lin, Minghao Guo, Chuming Li, Wei Wu, Dahua Lin, Wanli Ouyang, and Junjie Yan. Online hyper-parameter learning for auto-augmentation strategy. CoRR, 0ss/190550733,, 2019.
Xi Peng, Zhiqiang Tang, Fei Yang, Rogério Schmidt Feris, and Dimitris N. Metaxas. Jointly op- timize data augmentation and network training: Adversarial data augmentation in human pose estimation. CVPR, 2018.
11

---

Published as a conference paper at ICLR 2020
Luis Perez and Jason Wang. The effectiveness of data augmentation in image classification using deep learning. CoRR, abs/1712.04621, 2017.
Julian Salazar, Davis Liang, Zhiheng Huang, and Zachary C. Lipton. Invariant representation learn- ing for robust deep networks. NeurIPS Workshop, 2018.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott E. Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. CVPR, 2015.
Toan Tran, Trung Pham, Gustavo Carneir,, Lyle J. Palmer, and Ian D. Reid. A bayesian data augmentation approach for learning deep models. NIPS, 2017.
Li Wan, Matthew Zeiler, Sixin Zhang, Yann LeCun, and Rob Fergus. Regularization of neural networks using dropconnect. ICML, 2013.
Xiaolong Wang, Abhinav Shrivastava, and Abhinav Gupta. A-fast-renn: Hard positive generation via adversary for object detection. CVPR, 2017.
Ronald Williams. Simple statistical gradient-follwingg algorithms for connectionisttrciifooccmmm learning. Machine Learning. 1992.
Yoshihiro Yamada, Masakazu Iwamura, and Koichi Kise. abs/1802.02375, 2018.
Shakedrop regularization.
CoRR,
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. British Machine Vision Confer- ence, 2016.
Zhao Zhong, Junjie Yan, and Cheng-Lin Liu. Practical network blocks design with Q-learning. CVPR, 2018a.
Zhao Zhong, Zichen Yang, Boyang Deng, Junjie Yan, Wei Wu, Jing Shao, and Cheng-Lin Liu. BlockQNN: Efficient block-wise neural network architecture generation. CoRR, abs/1 fass/1800.05844, 2018b.
Barret Zoph and Quoc Le. Neural architecture search with reinforcement learning. ICLR, 2016.
Barret Zoph, Vijay Vasudevan, Jonathon Shlens, and Quoc V. Le, Learning transferable architectures for scalable image recognition. CVPR, 2017.
A APPENDIX
A.1 HYPERPARAMETERS
We detail the model hyperparameters on CIFAR-IO/CIFAR-100 and ImageNet in Table
12

---

Published as a conference paper at ICLR 2020
Table 7: Model hyperparameters CIFAR-IO/CIFAR- 100 and ImageNet. LR represents learning rate, and WD represents weight decay. We do not specifically tune these hyperparameters, and all of these are consistent with previous works, expect for the number of epochs.
Batch Size
Dataset
Model
LR
WD
Epoch
(N M)
CIFAR-10
Wide-ResNet-28-100
128 8
0.1
5e-4
200
CIFAR-10
Shake-Shake (26 2x32d)
128 8
0.2
le-4
600
CIFAR-10
Shake-Shake (26 2x96d)
128 8
0.2
le-4
600
CIFAR-10
Shake-Shake (26 2x 12d)
128 8
0.2
le-4
600
CIFAR-10
PyramidNet+ShakkDDrop
128 8
0.1
le-4
600
CIFAR-100 -00
Wide-ResNee-228-
128 8
0.1
5e
200
CIFAR-100
Shake-Shake (26 2x96d)
128 8
0.1
5e-4
1200
CIFAR-100
PyramidNet+ShukeDDropp
128 8
0.5
le44
1200
ImageNet
ResNet-50
2048 8
0.8
le4
120
ImageNet
ResNet-50-D
2048 8
0.8
lc44
120
ImageNet
ResNet-200
2048 8
0.8
1e-4
120
13


Reviews:
[{"review_id": "rkg8m0BKtr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a technique called Adversarial AutoAugment which dynamically learns good data augmentation policies during training. An adversarial approach is used: a target network tries to achieve good classification performance on a training set, while a policy network attempts to foil the target network by developing data augmentation policies that will produce images that are difficult to classify. To train the policy network, each mini-batch is augmented multiple times with different policies sampled from the policy network. Each augmented mini-batch is passed through the target network to produce a corresponding training loss, which is used as the training signal for the policy network. Experimental results are shown for CIFAR-10, CIFAR-100, and ImageNet datasets, where Adversarial AutoAugment outperforms competing methods (AutoAugment and Population Based Augmentation) on a variety of model architectures.\n\nIn its current state, I would tend towards rejecting this paper. The overall structure, the figures, and the experimental results are very nice, but there are two major issues that are holding it back. First, I am skeptical that the policy network is actually learning useful policies. Secondly, there are many grammatical errors in the paper which hamper readability. Upon reading the first paragraph of the paper, my initial impression was already quite negative, simply due to the number of grammatical errors. Fixing these would strengthen the paper considerably, and I would increase my score accordingly if properly addressed.\n\nPrimary Concerns:\n1) One of my main concerns with this paper is this line here: \"To guarantee the convergence during adversarial learning, the magnitude of all the operations are set in a moderate range\". Since the policy network has no incentive to select transformations that the target network can still learn from, I assume that the ranges are required so that the policy network cannot choose to apply extreme transformations which always fool the target network, such as setting brightness to 0 to make the entire image black. How are acceptable ranges determined? If cross validation is required, then this becomes very much like the original hand-tuning of data augmentations that we wanted to avoid in the first place. \n\nAdditionally, I think it would be useful to to see a plot of the magnitude of each transformation versus training epoch, similar to Figure 4a in [1]. If the policy network simply learns to use the most extreme augmentations available in order to fool the target network, then this may indicate that the gain in performance is from tuning the magnitude ranges, and not from the policy network selecting good policies.\n\n2) The paper could benefit greatly from some revision of the grammar. I would recommend either having a friend or colleague read it over, or even using an automated grammar checking program, such as Grammarly. For example, in the first paragraph alone there are several sentences that could be improved:\n\"Massive amount of data promotes the great success\" -> \"Massive amounts of data have promoted the great success\"\n\"when more supervised data available\" -> \"when more supervised data is available\"\n\"or better data augmentation method adapted\" -> \"or a better data augmentation method is adopted\"\n\"which can automated learn\" -> \"which can automatically learn\"\n\"there still requires tens of thousands of GPU-hours consumption.\" -> \"tens of thousands of GPU-hours of computation are still required\"\n\n\nThings to improve the paper that did not impact the score:\n3) In the first paragraph it is claimed that data augmentation policies have weak transferability across different tasks and datasets. I do not fully agree with this claim, since papers such as AutoAugment [2] have shown that learned policies are highly transferable to new datasets, and augmentation strategies such as CutMix have been shown to be highly effective for a variety of tasks. \n\n4) No citation for the original GAN paper, despite multiple mentions of adversarial learning, and GANs themselves.\n\n5) There is no computation time comparison with PBA, which is about 1000x faster than Autoaugment, and therefore roughly 100x faster than Adversarial AutoAugment.\n\n6) CIFAR-10 results are not necessarily state-of-the-art. The 1.36% error rate claimed by the paper is surpassed by work in [3], which achieved 1.33% using a combination of AutoAugment and mixup. \n\n7) Citation for the CIFAR-10 dataset incorrectly refers to the Adam optimizer paper [4].\n\n\nReferences: \n[1] Daniel Ho, Eric Liang, Ion Stoica, Pieter Abbeel, and Xi Chen. Population based augmentation: Efficient learning of augmentation policy schedules. ICML, 2019.\n\n[2] Cubuk, Ekin D., Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V. Le. \"Autoaugment: Learning augmentation policies from data.\" CVPR (2019).\n\n[3] Wistuba, Martin, Ambrish Rawat, and Tejaswini Pedapati. \"A Survey on Neural Architecture Search.\" arXiv preprint arXiv:1905.01392 (2019).\n\n[4] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ICLR, 2015\n\nEDIT: The authors have addressed the majority of my concerns, and as such I have increased my score from a 3 to a 6.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}, {"review_id": "SkeDSmkQ5r", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors propose a method for adversarial data augmentation which jointly trains the target network and the augmentation policy network. The authors claim that such learning set-up prevents overfitting and reduces computational cost with respect to competitors. Finally they provide extensive results and show that outperform the state-of-the-art in multiple datasets. \n\n* The rationale behind the idea is properly introduced and justified \n* The formulation is clear and sound\n* The results show improvements over competitors in terms of accuracy and computational cost\n\n* The contributions seem very incremental. Applying GANs for data augmentation is not new and regarding the policy search the authors strongly base their approach in Cubuk19. The main differentiator wrt the work of Cubuk is to jointly train both target and policy learner in a GAN setting, rather than learning the policies a priory with a fixed target network.\n\n* I miss further discussion regarding the benefits of the GAN approach against pre-training policies. The overfitting argument seems pretty weak given the relatively marginal gains of accuracy. \n\n* It would make the experiments more complete if the Top-1 and Top-5 results were provided, as well as running experiments on the same networks as the Cubuk19 paper.\n\n* How coupled are the policies learned to the specific dataset after training?. The work by Cubuk19 shows transferability properties that could somehow diminish the gain achieved by this work regarding computational cost.\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "SJxZB33S5S", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper describes a method to learn data augmentation policies using an adversarial loss. It builds on the AutoAugment method. In AutoAugment, an augmentation policy generator is trained by reinforcement learning. At each iteration, a classifier network is trained from scratch based on the current augmentation policy, and its validation accuracy is used as the reward signal. This is extremely costly because it requires to train a complete network for every training step of the policy generator. Instead, the current paper proposes to train the policy generator and the classifier simultaneously. The policy generator is trained adversarially to find augmentation policies that increase the loss of the classifier. This leads to a significant speedup compared to classic AutoAugment.\n\nThe presentation of the algorithm and the results is very clear. The proposed method yields improved performance compared to AutoAugment at ~1/10 of the computational cost, which is impressive. Although the paper only evaluates on two datasets (CIFAR and ImageNet), the idea is likely applicable very generally. I recommend this paper for publication, but have some comments that should be addressed:\n\nMajor comments:\n- It would be good to evaluate how well the learned policies transfer between datasets and architectures. Adversarial AutoAugment still comes with a significant computational cost compared to hand-crafted augmentation, so transfer of policies would be useful. AutoAugment is transferable by design, so any competing algorithm should evaluate transferability.\n- The authors state that all results are mean of 5 initializations, which is great. Please use these replicates to compute a measure of uncertainty (SEM or confidence interval) and state this with all values in the tables.\n\nMinor comments:\n- Overall, there are many grammatical errors and typos that sometimes require interpretation and reduce clarity. Please proof-read carefully.\n- Abstract sentence “... can simultaneously optimizes…” has grammatical issues.\n- Second sentence of introduction has grammatical issues.\n- Third sentence of intro: “et al.” is used for persons, use “etc.” for things.\n- Contribution section: “...our proposed method outperforms all previous augmentation method.” Please be careful with the breadth of your claims. You do not compare against *all* previous augmentation methods.\n- Figure 4: Please add units and/or refer to Table 5 in the legend.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a method to learn data augmentation policies using an adversarial loss. In contrast to AutoAugment where an augmentation policy generator is trained by RL (computationally expensive), the authors propose to train a policy generator and the target classifier simultaneously. This is done in an adversarial fashion by computing augmentation policies which increase the loss of the classifier. The authors show that this approach leads to roughly an order of magnitude improvement in computational cost over AutoAugment, while improving the test performance.
The reviewers agree that the presentation is clear and that the proposed method is sound, and that there is a significant practical benefit of using such a technique. As most of the concerns were addressed in the discussion phase, I will recommend acceptance of this paper. We ask the authors to update the manuscript to address the remaining (minor) concerns.

Decision: Accept (Poster)