Increasing the Coverage and Balance of Robustness Benchmarks by Using Non-Overlapping Corruptions
Authors: Alfred LAUGROS
Alice Caplier
Matthieu Ospici
Venue:  (2021)
Keywords: Computer Vision
Robustness
Common Corruptions
Benchmark

Abstract: Neural Networks are sensitive to various corruptions that usually occur in real-world applications such as low-lighting conditions, blurs, noises, etc. To estimate the robustness of neural networks to these common corruptions, we generally use a group of modeled corruptions gathered into a benchmark. We argue that corruption benchmarks often have a poor coverage: being robust to them only implies being robust to a narrow range of corruptions. They are also often unbalanced: they give too much importance to some corruptions compared to others. In this paper, we propose to build corruption benchmarks with only non-overlapping corruptions, to improve their coverage and their balance. Two corruptions overlap when the robustnesses of neural networks to these corruptions are correlated. We propose the first metric to measure the overlapping between two corruptions. We provide an algorithm that uses this metric to build benchmarks of Non-Overlapping Corruptions. Using this algorithm, we build from ImageNet a new corruption benchmark called ImageNet-NOC. We show that ImageNet-NOC is balanced and covers several kinds of corruptions that are not covered by ImageNet-C.

Under review as a conference paper at ICLR 2021
INCREASING THE COVERAGE AND BALANCE OF ROBUSTNESS BENCHMARKS BY USING NON- OVERLAPPING CORRUPTIONS
Anonymous authors Paper under double-bling brindd review
ABSTRACT
Neural Networks are sensitive to various corruptions that usually oceur real- world applications such as blurs, noises, low-lighting conditions, etc. To estimate the robustness of neural networks to these common corruptions, we generally use group of modeled corruptions gathered into benchmark. We argue that corrup- tion benchmarks often have a poor coverage: being robust to them only imply be- ing robust to narrow range of corruptions. They also often unbalanced: they give too much importance to some corruptions compared to others. In this paper, we propose build corruption benchmarks with only non-overlapping corrup- tions, to improve their coverage and their balance. Two corruptions overlap when the robustnesses of neural networks these corruptions are correlated. We pro- pose the first metric to measure the overlapping between two corruptions. We pro- vide an algorithm that uses this metric build benchmarks of Non-One Over-appiinn Corruptions. Using this algorithm, we build from ImageNet a new corruption benchmark called ImageNet-NOC. We show that ImageNet-NOCl is balanced and covers several kinds of corruptions that are not covered by ImageNet-C.
INTRODUCTION
Neural Networks perform poorly when they deal with images that are drawn from a different dis- tribution than their training samples. Indeed, neural networks are sensitive to adversarial examples (Szegedy et al. 20144), background changes (Xiao al. 2020), and common corruptions (Hendrycks) & Dietterich] 2019).
Common corruptions perturbations that change the appearance of images without changing their semantic content. For instance, neural networks are sensitive to noises (Koziarski & Cyganek]200 2017). blurs (Vasiljevic et al.] (016) or lighting condition variations (Temel et al.) 2017). Contrary to adversarial examples (Szegedy et al. 2014), common corruptions are not artificial perturbations especially crafted fool neural networks. They naturally appear in industrial applications without
any human interfering, and can significantly reduce the performances of neural networks.
neural network robust corruption c, when its performances on samples corrupted with e are close to its performances on clean samples. Some methods have been recently proposed to make neural networks more robust to common corruptions (Geirhos et 2019 Hendrycks* al. 2020
Rusak et al., 2020).
To determine whether these approaches are effective, is required to have method to measure the neural network robustness to common corruptions. The most commonly used method consists in evaluating the performances of neural networks on images distorted by various kinds of common corruptions: (Hendrycks & Dietterich] 2019; Karahan et al.) 2016)] Geirhos et al. 2019: Temel al.) 2017). In this study, we call the group of perturbations used to make the robustness estimation a corruption benchmark. We also use this term to refer to set of test images that have been corrupted with these various corruptions. We identify two important factors that should be taken into account when building corruption benchmark: the balance and the coverage.
In this paper, we consider that a corruption c covered by benchmark, when increasing the ro- bustness of network to all the corruptions of this benchmark, also increases the robustness of

---

Under review as a conference paper at ICLR 2021
the network to For instance, benchmark that contains camera shake blur corruption covers the defocus blur corruption, because the robustnesses towards these two corruptions are correlated Vasiljevie et al.) 2016). The coverage of benchmark is defined as the number of corruptions ered by this benchmark. 'hee more a benchmark covers a wide range of common corruptions, the more it gives complete view of the robustness of neural network.
At the same time, we consider a benchmark as balanced when it gives the same importance to the robustness to every corruption it contains. For instance, according balanced benchmark, being robust to noises is as important as being robust to brightness variations. We argue that most of the existing corruption benchmarks are unbalanced: they give too much importance to the robustness to some corruptions compared to others.
The coverage and balance of corruption benchmarks are related the notion of corruption over- lappings. We say that two corruptions overlap when the robustnesses of neural networks towards these corruptions are correlated. The contribution of this paper is fourfold:
1. We propose the first method estimate to what extent two corruptions overlap.
2. We show that building corruption benchmarks with non-overlapping corruptions make them more balanced and able to cover wider range of corruptions.
3. We propose method to build benchmarks that contain only non-overlapping corruptions.
4. We use this method to build from ImageNet, a benchmark of Non-Overlapping Corruptions called ImagNet-NOC, to estimate the robustness of image classifiers common corrup- tions. We show that ImagNet-NOC is balanced and covers corruptions that are not covered by ImageNet-C: reference corruption benchmark (Hendrycks & Dietterich 2019).
BACKGROUND AND RELATED WORKS
2.1 ESTIMATING THE ROBUSTNESS OF NETWORKS WITH OUT-OF-DISTRIBUTIN SAMPLES
Studying the performances of neural networks on samples that lie outside training distributions, is widely studied domain. Being able to understand oul-of-distribution (o.o.d) samples is essential to guarantee that neural networks are reliable in real-world applications. Several benchmarks and methods have been proposed study this field. For instance, ImageNet-A (Dan Hendryeks & Song, 2019) is a simple benchmark for ImageNet classifiers that contains samples drawn from differ- ent source than the one used build ImageNet. Adversarial examples, are samples that have been slightly modified to fool neural networks (Szegedy et al.] 2014). Making sure that models are robust to these kinds of o.o.d samples essential in terms of security. Artistic renditions (Hendryeks al,] 2020) or sketches (Haohan al. 2019), can also be usefull to determine if neural networks under- stand the abstract concepts we want them to learn. Methods to study how classifiers are affected by background changes have also been recently proposed (Beery et al. 2018 Xiao et al. 2020).
Another important aspect of the robustness of neural networks to o.o.d samples, is the robustness to common corruptions. This aspect of the robustness is generally estimated by gathering several commonly encountered corruptions, and by testing the performances of neural networks on images corrupted with these corruptions. Diverse selections of common corruptions have been proposed to make robustness estimation (Karahan et al.) 2016 Laugros et al., 2019 Geirhos et al.) 2019). In particular, ImageNet-C is a popular benchmark used to measure the robustness of ImageNet a
classifiers (Hendrycks & Dietterich 2019). Different common corruption benchmarks have also been proposed in the context of object detection (Michaelis et al. 2019). scene classification (Tadros) et al. 2019) or, eye-tracking (Che et al., 2020). It worth noting that some transformations that are in between adversarial attacks and common corruptions have been recently proposed to measure the robustness of image classifiers (Kang et al. 2019: Dunn et al. 2019 Liu et al. 2019).
2.2 CORRUPTION OVERLAPPINGS IN BENCHMARKS
has been noticed that fine-tuning a model with camera shake blur helps it to deal with defocus blur and conversely (Vasiljevic al. 2016)). The robustnesses diverse kinds of noises have also been shown to be closely related (Laugros et al. 2019). Even for two corruptions that do not look similar to the human eye, increasing the robustness of model to one of these corruptions, can
2

---

Under review as a conference paper at ICLR 2021
imply increasing the robustness to the other corruption (Kang et al. 2019). In general, it has been shown that the robustnesses to the corruptions that distort the high-frequency content of images are correlated (Yin et al., 2019). In the context of adversarial examples. it is known that the robustness towards one adversarial attack can be correlated with the robustness to another attack (Tramer & Boneh, 2019). So, is generally recommended to evaluate the adversarial robustness with attacks that are clearly different from each other (Carlini et al. 2019). The experiments carried out in this paper suggest that this recommendation should also be followed in the context of common corruption robustness estimation.
3
CORRUPTION OVERLAPPING
3.1 THE CORRUPTION OVERLAPPING SCORE
We consider that two corruptions overlap when the robustness to one of these corruptions is cor- related with the robustness to the other corruption. In this section, we propose methodology to estimate to what extent two corruptions overlap.
The Robustness Score. To determine whether corruptions overlap, first need to introduce metric called the robustness score. This score gives an estimation of the robustness of a model m to a corruption c. It is computed with the following formula: R
Aatcun
Aclenn is the accuracy of m on an uncorrupted test set and Ag is the accuracy of m on the same test set corrupted with The higher R is, the more robust is. Please note that using this metric requires to monitor Actean and make sure it is relatively high. Otherwise, an untrained model for which Ag equals Actann would be considered robust for example. In this study, this metrie is used only in the methodology we propose to estimate the overlapping between two corruptions.
The Corruption Overlapping Score. We consider two neural networks m1 and m2 and two ruptions cl and c2. ml and m2 are identical, and trained with exactly the same settings except that their training sets are respectively augmented with the corruptions cl and c2. A standard model is trained the same way but only with non-corrupted samples. We propose a method to measure to what extent cl and c2 overlap. The idea of the method to if data augmentation with el makes a model more robust to c2 and conversely. To determine this, ml, m2, and a test set are used to compute the following expression:
RM
Ret Rstandard) + (Rm)
R22
Rstandardy
The first term of measures whether model that fits exactly c2 is more robust cl than the standard model. Symmetrically, the second term measures whether model that fits exactly el is more robust than the standard model to c2. The more making model cl implies being more robust to c2 and reciprocally, and the more we can suppose that the robustnesses to cl and c2 are correlated in practice.
other words, the expression ( gives an estimation of the overlapping between cl and c2. To be more convenient, we would like to build corruption overlapping score equal to when cl = c2, and equal to 0 when the robustnesses to and c2 are not correlated at all. We propose new expression that respects both conditions:
1
pm1 Re2
Retandori
Rm Retandord
Oct,²2 max(0,
+
(2)
Dm2
R
Rstandord
Rml R
Rstandord
The expression 2 is normalized version of (T.. It measures the overlapping between two corrup- tions while respecting the conditions mentioned above. Indeed, if a data augmentation with el does not increase the robustness to c2 at all and conversely, then the ratios in (2) are null or negative, so the whole overlapping score is maximized to zero. In other words, when cl and c2 do not overlap at all, the overlapping score is equal to O. Besides, when el c2, Rm Rm² and Rm² R so both ratios of (2) are equal to 1. Then, Oct.c2 = when cl and c2 completely overlap.
How to compute overlapping score. To get the overlapping score between cl and c2, follow the method illustrated in Figure [ This method has six steps, and requires to have a training set, a test set and three untrained models that share the same architecture (m1, m2 and standard). The
3

---

Under review as a conference paper at ICLR 2021
step (1), consists in using the corruptions cl and c2 to get two training sets, each corrupted with one corruption. Then, the obtained corrupted sets are used to train the models ml and m2 in step (2). The standard model is also trained during this step but only with non-cormupted samples. In step (3), similarly to step (1), we use cl and c2 to get two corrupted versions of the test set. The accuracies of the three models on the three test sets are computed in step (4). The scores obtained used in step (5), to get the robustness scores of each model for the corruptions cl and c2. The results obtained are used to compute the overlapping score between cl and c2 in step (6).
Steps 1-2: Train in1, m2
Stepe 3-8:
gel overlappinge score and
saanddnd sicos
Relandard
Clean
rckerl
Glean
Standard
A Adanskird
ttai Bee
Retendart
A stande
dlean
Rm
Ot Tost
m1
A
Oa/2
8et
Ava
R2
Altan
4m
Gà Test
Ama
(1)
(3)
(5)
(8)
Figure 1: Methodology used to compute the overlapping score hetween two coruuption and C2.
3.2 CORRUPTION OVERLAPPING AND COVERAGE OF BENCIIARKS
With our definition, a corruption e is covered by a benchmark, when increasing the robustness of a network to all the corruptions of this benchmark, also increases the robustness of the network to c. The more a benchmark covers a wide range of corruptions, the more being robust to this benchmark provides strong guarantee about the robustness of neural network. Then, benchmark should cover as much common corruptions as possible.
To illustrate the notion of coverage, let us consider benchl, a benchmark that contains three cor- ruptions of ImageNet-CC C: Gaussian noise, shot noise and impulse noise (Hendrycks & Dietterich] 2019). We also consider bench2, that contains the Gaussian noise, brightness and elastic corruptions of ImageNet-C. Intuitively, being robust to bench/ implies being robust only to noises while being robust to bench2 implics being robust to a wider range of corruptions. Then, we can suppose that benchl has lower coverage than bench2.
When we compute the overlapping scores of these benchmarks, we observe that the overlapping between the corrptiion of benchl are close to 1, while they are close to 0 in bench2 (see Figure 3. The corruptions of benchl clearly overlap while the ones of bench2 do not. We argue that the overlappings in benchmarks tend to reduce their coverage. Indeed, the more two corruptions eı and 22 overlap, the more it is likely that a corruption covered by c is also covered by 02 and conversely. So, when two corruptions overlap, their range of covered corruptions overlap too. By reducing the overlappings in a benchmark, we separate the ranges of corruptions covered by the corruptions of this benchmark, which results in increasing its coverage. Section 5.2 we show that we can cover the fifteen corruptions of ImageNet-C with only eight non-overlapping corruptions.
3.3 CORRUPTION OVERLAPPING AND BALANCE OF BENCHMARKS
We consider that a benchmark is balanced, when it gives the same importance to the robustness to every corruption it contains. For instance in Section 5.3 we show that the ImageNet-C benchmark gives more importance to the blur corruptions than to the corruptions that affect the brightness of images. Yet. in weal-world upplications, we think that being robust to different kinds of blurs is not more valuable than being robust to lighting condition variations. Being unbalanced is in general not desirable property, it makes benchmarks give biased estimations of neural network robustness.
4

---

Under review as a conference paper at ICLR 2021
Overlappings between the corruptions of a benchmark can make it unbalanced. Let us consider three corruptions C1, C2 and C3 with C1 and C2 that completely overlap, and e1 and cg that do not overlap at all with Cy- A model robust to ca. is robust to one third of the corruptions of the benchmark. But a model robust to ei is also robust to c2, because 0i and 02 overlap. So being robust to ei or 22 implies being robust to third of the corruptions of the benchmark. Then, this benchmark rewards more the robustness to G1 or C2 than the robustness to c3: it is unbalanced. In general, if one corruption contributes more the total overlapping of benchmark than another corruption of this benchmark, then the benchmark is unbalanced. In Section 5.3 we show that benchmark built with non-overlapping corruptions is more balanced than ImageNet-C.
4 CONSTRUCTION OF A NON-OVERLAPPING CORRUPTION BENCHMARKS: IMAGENET-NOC
Experimental Set-up. For every training of this study, we use the following parameters. The used optimizer is SGD with a momentum of 0.9. The used cost function is a cross-entropy function, with a weight decay set to 10-1 Models are trained for 40 epochs with a batch size of 256. The initial learning rate is set to 0.1 and is divided by 10 at epoch 20 and 30. In all the experiments we use ImageNet- 100: subset of ImageNet that contains every tenth ImageNet class by WordNeuD order (Deng et al. 2009). All images are resized to the 224x224 format, and randomly horizontally flipped with a probability of 0.5 during trainings. When we use a data augmentation with a corruption in a training. half of the images of each training batch are transformed with the corruption, while the other half is not corrupted.
We present Algorithm D a general method to build benchmarks that do not contain any overlapping corruption. We argue that this method helps to build balanced benchmarks that have a large coverage.
Algorithm Methodology Proposed to Build a Benchmark of Non-Overlapping Corruptions
Require: S a set of common corruptions
Require: A train set, a test set and a neural network architecture
Require: An overlapping threshold: the maximum overlapping score allowed the benchmark
(0) n <- 2. is the current number of corruptions in the benchmark. It is initialized to 2.
(1) Use the train set., the test set and the chosen network architecture to apply the methodology
presented in Section 3.1 to get all the overlapping scores between the corruptions of S.
(2) Pick the largest subsets of S with overlapping scores under the overlopping threshold.
(3) Among the retained subsets, select the one with the lowest mean overlapping score to form
the benchmark.
We want to use this algorithm to build a new benchmark that measures the robustness of image classifiers to common corruptions. Algorithm requures to gather a group of candidate corruptions called S. The larger S, the more combinations of non-overlapping corruptions can be found in S, the larger the benchmarks built by the algorithm. Then, we recommend to use a large intial set of comuuptions to increase the coverage of the built benchmarks. For this study, we implemented two dozens of image corruptions (illustrated in Figure (2) to constitute S. All these corruptions are associated with severity range. A value is randomly chosen from the severity range of the considered corruption each time an image is corrupted. The higher this value is, the more the aspect of the corrupted image changes. More information about the modeled common corruptions can be found in Appendix A
We apply Algorithm using this set of corruptions, the ImageNet train set and test set, and the R8 architecture; with different values of the overlapping threshold. The corruption benchmarks obtained for different values of the threshold are shown in Appendix B The higher the overlapping threshold is, the more the number of corruptions included in the constructed benchmarks increases, and so does the coverage of the constructed benchmarks. However, the coverage gain due to the increase of the threshold is reduced by overlappings, because overlapping corruptions tend to cover the same kind of corruptions. Besides, as explained in Section 3.3 the more there overlappings in benchmark, the more it is likely to be unbalanced. All in all, selecting the overlapping threshold, determines when the coverage gain does not worth the balance loss. Choosing this value depends the application case and the kind of robustness estimation we want to make.
5

---

Under review as a conference paper at ICLR 2021
Figure 2: Illustrations of the common corruptions gathered to run the Algorithm
!
1.0
gaussiann
c_shot_noe noise
c_impuise_ng noise 03ram
031-335
defocus blur
c_ C_glass blur
0.8
motion blur userrat
87h
439
z0om blur
c_snow
c. fog
667819071
8
031
frost
0.6
C.brightness
contrast
a2z
C Cllastic
transform
pixelate
0.4
jpeg compression
03r
quantization shear
23:024
brightness
hue
vertical artifacts
334039 022
border
-0.0
noise
c_shot _
iippuise, noise
c_ c_glass blur E_motion blur
2 bolur
c.noww
c. fog
frost
b.brightness
C, contrast
cleastic transform
pixeelate
compression
rain essesssnon
quantization shear brightness hue
vertical artifacts
blu
border
[_defocus
<_ipeg compres
C_gaussian
Figure 3: The overlapping scores between all the ImageNet-NOC and ImageNet-CC corruptions.
Each benchmark obtained with Algorithm D that contains n corruptions, are the n-corruption bench- marks with the lowest mean overlapping possible. As explained in Sections and that benchmarks that are optimal in terms of overlapping will have good balance and coverage. We propose to study the set of eight corruptions obtained with overlapping threshold is: rain, quantization, shear, brightness, hue, vertical artifacts, blur and border. The overlapping scores between these corruptions are displayed in the right lower square in Figure Eight cor- rupted ImageNet validation sets, each corrupted with one of the eight corruptions, are gathered to form ImageNet-NOCC.
and 3.3 expect
0.1, which
We run the algorithm a second time using DenseNet-122 121 architecture instead of the ResNet- 18 one. The overlapping scores obtained by running the step (1) of Aggorithmaare displayed in Appendix A The benchmark obtained with overlapping threshold = 0.1 is rain, Gaussian, shear, brightness, hue, vertical artifacts, elastic. This benchmark shares six corruptions with ImageNet- and the overlapping score computed with Gaussian noise and quantization equals 0.6 and the one computed with elastic and blur equals 0.26. So, the only two corruptions that are not shared by the two benchmarks appear to be correlated in terms of robustness. So, using DenseNet-122 121 architecture makes the algorithm build a benchmark that is fairly similar to the one obtained using ResNet-18.
Running the Algorithm 1 requires to complete one training for each corruption in S. It took one week with a single GPU Nvidia Tesla V100 to get all the overlapping scores of Figure 3 While this computational cost is high, think that the process could be accelerated by fine-tuning models for a few epochs instead of training them from scratch. Further investigations should be conducted to determine what extent this alternative would modify the obtained results.

---

Under review as a conference paper at ICLR 2021
How to Use ImageNet-NOC. We recommend to use the CE metric (Hendrycks & Dietterich, 2019 to measure the robustness of an image classifier to an ImageNet-NOC corruption. The mean CE score computed with a benchmark is called mCE. Using the mCE metric avoids several pitfalls while measuring the robustness of neural networks. To compute a CE score, it is required to get the error rate of pretrained AlexNet model, the ImageNet validation set corrupted with the considered corruption. The eтrоr rates of the torchvision pretrained AlexNet computed with the corruptions introduced in this paper are displayed in Appendix [ We provide the ImageNet-NOC More details about how
CE scores of some traditionally used ImageNet classifiers in Appendix ( to use ImageNet-NOC can be found by visiting [Link available upon acceptance).
5 COMPARISON BETWEEN IMAGENET-NOC AND IMAGENET-C
5.1 CORRUPTION OVERLAPPINGS IN IMAGENET-C AND IMAGENET-NOC
ImageNet-C a benchmark commonly used to measure the robustness of ImageNet classifiers to common corruptions (Hendrycks & Dietterich 2019). It is built on fifteen common corruptions called Gaussian noise, shot noise, impulse noise, defocus blur, glass blur, motion blur, zoom blur, snow, frost, fog, brightness, contrast, elastic, pixelate, and jpeg compression. Each corruption is associated with five severity levels that determine to what extend the corrupted images are distorted. Please note that in general, the benchmark corruptions should not be used during training of model. Indeed, corruption benchmarks are built to estimate the robustness to unforeseen corruptions. In this study, we use the ImageNet-C and ImageNet-NOC corruptions during some training phases only because we analyze the benchmarks themselves.
Using the ResNet-18 18 model, the ImageNet training and validation sets, we apply the method illus- trated in Figure [ to get the overlapping score of every couple of ImageNet-C corruptions. The corruption severity randomly selected for each image corrupted in the process. The obtained scores are displayed in the upper left square of Figure 3 We observe that all the corruptions that damage the textures images (blurs, noises, pixelate and jpeg compression) significantly overlap. This result is consistent with the experiments carried out by Yin et al. (2019): they argue that the robustnesses of neural networks to corruptions that alter high-frequency information of images are correlated. Concerning the corruptions that alter wwwfireuency information of images, the over- lappings are less pronounced. But we do observe some significant overlappings. There a clear overlapping between fog and contrast between snow and frost. As explained in Section 3.2 and 3.3 all these overlappings suggest that ImageNet-C is unbalanced and has a poor coverage. Figure 3 reveals that ImageNet-NOC contains far less overalpping corruptions than ImageNet-C.
We compute again the overlapping scores of ImageNet-C and ImageNet-NOC with the DenseNet- 121 (Huang al. 2017) and WideRes-eet50-22 (Zagoruyko & Komodakis] (016) architectures. The aspect of the overlapping arrays obtained with these two architectures is the same as the one obtained with ResNet-18 (see Appendix D). For traditionally used image classifiers, it appears that overlapping scores do not vary much with the architecture of the model used to compute them.
5.2 COVERAGE OF NOG AND IMAGENET-C
In the lower left square of Figure 3 are displayed all the overlapping scores computed with one ImageNet-C corruption and one ImageNet-NOC corruption. We observe that for every ImageNet-C corruption cl, there is always at least one ImageNet-NOC corruption c2, for which the overlap- ping score computed with cl and c2 is higher than 0.3. On the other hand, two ImageNet-NOC corruptions (hue and border) do not overlap at all with any of the ImageNet-C corruptions. Then, increasing the robustness to all the ImageNet-NOCC corruption should imply being more robust to all the ImageNet-C corruptions, but being robust to ImageNet-C may not imply being robust to some IMa corruptions.
To confirm this, we train two 18 called miNoc and m.c. A data augmentation procedure with all the ImageNet-C corruptions is used to train m.c. Each corrupted image of this training is modified by one randomly selected corruption of ImageNet-C, with a randomly chosen severity. Similarly, mINOC is trained with data augmentation procedure with all the ImageNet-NOC cor- ruptions. After the trainings, we measure the robustness of NON to every corruption of ImageNet- C by computing its CE scores. We also measure the CE scores of m. towards the ImageNet-NOC
7

---

Under review as a conference paper at ICLR 2021
Table I: Upper Table: the CE scores of my woc ImageNet-CC (the lower is the better). Lower Table: the scores mic on the ImageNet-NOC corruptions.
Clean
Ingul
Motion
Frost
Fog
Bright
Contr
Flostic
Ipeg
mCR
119
107
PINOC
0.199
92
94
102
112
78
81
67
90
71
53
Clean
Queat
Blor
Bright
Huc
standamd
0.247 0.230
(2.a) The ImageNet-C mCE scores of models, each trained with corruption of ImageNet-C.
Gauss
Shoc
Impul
Defo
Glaas
Motion
Zoom
Snow
Prost
Pog
Bright
Contr
Elastic
Pixel
Jpeg
mCE
71
71
71
54
56
63
83
86
78
85
(2.b) The ImageNet-NOC: mCE scores of models, each trained with one corruption ImageNet-NOC.
Quant
Blur
Vert-Arti
Rain
Border
Shear
Bright
Huc
mCE
corruptions. We compare the obtained scores of both models with the ones of the standard model in Table T
The first column of this table contains the error rates on non-corrupted ImageNet samples.
We observe in Table that miNoC is cormuptions. However, myc is not robust to the hue and border corruptions of ImageNet-NOCC These results appear to confirm the hypothesis made by studying the overlapping scores in Fig- ure 3 ImageNet-C does not cover some of the ImageNet-NOC: corruptions while ImageNer-NOC covers the ImageNet-C corruptions. As argued in Section 3.2 it seems that using non-overlapping corruptions helps to build benchmarks that have larger coverage.
robust than the standard model to all the ImageNet-
5.3 BALANCE OF IMAGENET-NOC AND IMAGENET-C
We carry out an experiment to compare the balance of ImageNet-NOC and ImageNet-C. We train one ResNet-18 18 for each corruption of ImageNet-NOC and ImageNet-C. So, fifteen models trained using data augmentation procedure with one corruption of ImageNet-C, and eight oth- are trained with corruption of ImageNet-NOC. Then, estimate the robustness of the first fifteen ResNet-18 on ImageNet-C by computing their mCE scores. We also get the mCE scores of the eight remaining ResNet-18 on ImageNet-NOC. The obtained scores are displayed Tables 2.a 2.b The CE scores computed to get the mCE scores can be found in Appendix
The mCE scores obtained in Table 2.a are very different from each other. For instance, the mCE score of the model trained with defocus blur, is much lower than the one trained with brightness. Then, according to robustness estimation made with ImageNer-C, one of the models is much more robust than the other one. In other words, the ImageNet-C benchmark gives more importance to the robustness to defocus_bie blur than to the robustness to brightness: ImageNet-C unbalanced.
We observe far less variations in the mCE scores in Table 2.b than in Table 2.a More precisely, the difference between the lowest mCE and the highest mCE in Table 2.a and 2.b are respectively 40 and 11. And the standard deviation of the mCE scores in these tables are respectively 12.1 and 3.7. Then, the importance given by ImageNet-C to the robustness its corruptions, varies a lot with the considered corruption. This variation is way less important for benchmark. Then, ImageNet-NOC: is significantly more balanced than ImageNet-C.
5.4 ROBUSTNESS ESTIMATIONS USING IMAGENET-NOC AND IMAGENET-C
The experiments carried out in Section 5.2 and 5.3
suggest that Nma has a better balance and coverage than ImageNet-C. To determine whether using ImageNet-NOC instead of ImageNet- makes a difference in practice, we propose to compare the performances of various models on the two benchmarks. First, measure the mCE scores of several pretrained torchvision classifiers
8

---

Under review as a conference paper at ICLR 2021
on both ImageNet-C and ImageNet-NOC. The results displayed in Table and the details of the computed CE scores can be found in Appendix C We observe that some models are consid- ered relatively robust to ImageNet-NOC but not robust to ImageNet-C. For instance, the VGG-19, ResNet-50, and WideResNet-50- are much more robust to ImageNet-NOC than the Net model, but they less robust than AeexNet to ImageNet-C.
Table 3: ImageNet-C (IC) and ImageNet-NOC: (INOC) mCF obtained with several pretrained classifiers.
Alex
Squeeze
VGG-11
VGG-19-BN
Res-18
Res 50
Dense 121
Dense 201
Wide Res
ICEIIC @CF_NNOC
100
118
123
III
104
105
94
89
101
100
66
The second experiment is carried out using four ResNet-50 that have been shown to be robust to ImageNet-C. These models are called SIN+/N (Geirhos al. 2011 ANT (Rusak et al. 2020). Augmix (Hendrycks* et al. 2020) and DeepAugment (Hendrycks et al. 2020). We measure the robustness of these models to ImageNet-NOC by computing their CE scores. Then, we compare these scores with the ones obtained with the torchvision pretrained ResNet-50 in Tablef4] We observe that the SIN+IN, AN7 and DeepAugment models are not robust to border. Interestingly, we show in Section 5.2 that this corruption is not covered by ImageNet-C. This result confirms that ImageNet- NOC can reveal low robustness of models to corruptions that are not covered by ImageNet-C.
The ImageNet-NOC and ImageNet-C mCE scores of the five considered models are compared in the two last columns of Table We observe that the robustness ranking established with ImageNet-C is different from the one established with ImageNet-NOC. For instance, AN7 is very robust to ImageNet-C but not robust to ImageNet-NOGS We think this is a direct consequence the lack of balance of ImageNet-C. Indeed, we provide evidence in Section 5.3 that ImageNet-C gives lot of importance to the noise robustness, and ANT has been shown to be particularly robust to noises Rusak et al. 2020). So ANT is considered very robust to ImageNet-C. but not ImageNet- NOC which is more balanced. We note that Augmix obtains a relatively low ImageNet-NOCC mCE compared the ImageNet-C one. This result should be considered cautiously because shears and quantizations are used by the Augmix data augmentation procedure, and these corruptions overlap with some of the ImageNet-NOC corruptions. This is reason why the Augmix model obtains low shear and quantization CE scores.
The experiments carried out in this section show that the robustness estimations made with ImageNet-NOCC are different from the ones made with ImageNet-C. We think that ImageNet-NOC should be preferred ImageNet-C because of its coverage and balance.
CONCLUSION
We proposed metric called the corruption overlapping score, that measures to what extend the robustnesses towards two corruptions are correlated. We showed that the overlappings between the corruptions of a benchmark can reduce its coverage and make it unbalanced. We provided benchmark of Non-Overlapping Corruptions called ImageNet-NOC: to measure the robustness of image classifiers. We showed that ImageNet-NOC balanced and covers several kinds of common corruptions that are not covered by ImageNet-C. ImageNet-NOCI is built thanks to the method we proposed to construct non-overlapping corruption benchmarks. This method can easily adapted to other computer vision tasks. We hope it will be used build other non-overlapping corruption benchmarks, that will help to make better estimations the robustness of neural networks.
Table 4: ImageNet-NOC. CE scores obtained for several data augmentation strategies. The two last columns contain the NOC and ImageNet-C mCE scores, and the associated ranks written in brackets.
Blar
Vert-Ari
Border
Shiar
Bright
Ha:
INOC..CCE
IC.,CE (man)
Standard
130
60
95
93
53
87
71
58
(5)
77 (5)
55
56
61
49
Augmix
13
72
49
71
62
56
(1)
(3)
ANI
56
58
76
67
55
DespAugment

---

Under review as a conference paper at ICLR 2021
REFERENCES
Sara Beery, Grant Van Horn, and Pietro Perona. Recognition in terra incognita. In Proceedings of the European Conference on Computer Vision (ECCV), September 2018.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, lan Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv: 2019.
Zhaohui Che, Ali Borji, Guangtao Zhai, Xiongkuo Min, Guodong Guo, and Patrick Le Callet. How is gaze influenced by image transformations? dataset and model. Trans. Img. Proc., 2020.
Steven Basart JacobSteinhardt Dan Hendrycks, Kevin Zhao and Dawn Song. Natural adversarial examples. ArXiv, abs/1907.07174, 2019.
J. Deng, W. Dong, R. Socher, L. Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In IEEE Conference on Computer Vision and Pattern Recognition, 2009.
Isaac Dunn, Laura Hanu, Hadrien Pouget, Daniel Kroening, and Tom Melham. Investigating dis- tributional robustness: Semantic perturbations using generative models. ECCV Workshop Adversarial Robustness in the Real World, 2019.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained CNNs are biased towards texture; increasing shape bias im- proves accuracy and robustness. In International Conference on Learning Representations, 2019.
Wang Haohan, Songwei G, Lipton Zachary, and Xing Eric P. Learning robust global representations by penalizing local predictive power. In Advances Neural Information Processing Systems 32. 2019.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common ruptions and perturbations. Proceedings of the International Conference on Learning Represen- fations, 2019.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustess: A critical analysis preprint arXiv:2006. 16241, 2020.
generalization. arXiv
Dan Hendrycks* Norman Mu Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Laksh- minarayanan. Augmix: A simple method to improve robustness and uncertainty under data shift. In International Conference on Learning Representations, 2020.
G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger. Densely connected convolutional networks. In IEEE Conference on Computer Vision and Puttern Recognition (CVPR), 2017.
Daniel Kang, Yi Sun, Dan Hendrycks, Tom Brown, and Jacob Steinhardt. Testing robustness against unforeseen adversaries. arXiv preprint arXiv: 190..000066.666.. 2019.
Karahan, M. Kiline Yildirum, K. Kirtac, F. S. Rende, G. Butun, and K. Ekenel. How image degradations affect deep cun-based face recognition? In 2016 International Conference of the Biometrics Special Interest Group (BIOSIG), pp. Sep. 2016.
Micha Koziarski and Boguslaw Cyganek. Image recognition with deep neural networks in presence of noise dealing with and taking advantage of distortions. Integrated Computer-Aided Engineer- ing. 24:1-13, 08 2017.
Alfred Laugros, Alice Caplier, and Matthieu Ospici. Are adversarial robustness and common per- turbation robustness independant attributes ? In The IEEE International Conference on Computer Vision (ICCV) Workshops, Oct 2019.
Hsueh-Ti Ti Derek Liu, Michael Tao, Chun-Liang Li, Derek Nowrouzezahrai, and Alec Jacobson. Beyond pixel norm-balls Parametric adversaries using an analytically differentiable renderer. In International Conference Learning Representations, 2019.
10

---

Under review as a conference paper at ICLR 2021
Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexan- der Ecker, Matthias Bethge, and Wieland Brendel. Benchmarking robustness in object detection: Autonomous driving when winter is coming. 2019.
Evgenia Rusak, Lukas Schott, Roland S. Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. A simple way to make neural networks robust against diverse image corruptions. ECCV, 2020.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference Learning Representations, 2014.
Timothy Tadros, Nicholas C. Cullen, Michelle R. Greene, and Emily A. Cooper. Assessing neural network scene classification from degraded images. ACM Trans. Appl. Percept., 2019.
Dogancan Temel, Gukyeong Kwon, Mohit Prabhushankar, and Ghassan AlRegib, Cure-tsr: Chal- lenging unreal and real environments for traffic sign recognition. NIPS Workshop, 2017.
Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. In Advances in Neural Information Processing Systems 32. Curran Associates, Inc., 2019.
Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur on recognition by convolutional networks. arXiv preprintarXxn:11611007700 2016.
Kai Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition. ArXiv preprint 0rX1v:2000.09994, 2020.
Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin D. Cubuk, and Justin Gilmer. A fourier perspective on model robustness computer vision. ICML Workshop on Uncertainty and Ro- bustness in Deep Learning, 2019.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. British Machine Vision Associ- ation, 2016.
11

---

Under review as a conference paper at ICLR 2021
A PRESENTATION OF THE MODELED COMMON CORRUPTIONS
The common corruptions gathered in Section are implemented with computationally cheap image transformations that can be easily added in an image pipeline. We provide in Figures 5 and 6 information about how the common corruptions used in this study are modeled. These corruptions are implemented for images that have pixel values in [0-1].
The Severity Range column of these arrays precises how the severity of each corruption is set. The lower bound of each severity range is selected get robustness score of 0.95 with the standard ResNet-18 18 model, tested on the ImageNet validation set that has been altered with the considered corruption. The upper bound selected to get a robustness score of 0.5 in the same conditions. The upper bounds of the hue and sray_scale corruptions are different because these corruptions are not harmful enough to reach robustness score of 0.5. They respectively reach robustness score of 0.63 and 0.70 for the standard ResNet-18. The last column of the Figures (a and corresponds to the error rate of the torchvision pretrained AlexNet on the ImageNet validation set corrupted with the corruption indicated in the first column.
In Section 4 by completing the step (1) of Algorithm 1
we compute the overlapping scores between
the corruptions gathered in Figure 2 These overlapping scores are displayed in Figure 4
NesNet- 18
Don
quentization
10
quantication
10
paspper
sall papper
0.5
reaze
08
artifuct
vertical
thorbbs
0.6
thombu
06
bonder
bonder
0.4
04
rototio
trightness
0.2
-22
deortion
(Pay. scale
gray. scaee
-00
-00
poddod yer
catt
Figure 4: Overlapping scores between common corruptions displayed in Figure been computed with the ResNet-18 and DenseNet-12 121 architectures
The scores have
12

---

Under review as a conference paper at ICLR 2021
Corruption Name
AlexNet Error Rate
Illustration
Description
Severity Range
Quantize the pixel values into few quantization levels
Quantization
Number of levels: 4 to 9
0.592
Gaussian
Add zero mean Gaussian noise the image
Standard deviation: 0.05 to 0.18
0.620
Noise
Propability each pixel to be changed: 0.003 0.032
Salt Pepper Noise
Add sall-pepper noise in the image
0.649
Interpolate the image with its equivalent blured with five convolution with 3x3 filter. The filter is filled is the value 1.
Interpolation factor associated to the blured Image: 0.4 to 0.95
Blur
0.570
Apply bilinear interpolation twice. Firstly reduce the size the image. Secondly get back original size.
Thumbnail Resize
Reduction factor: 1.1 to 3.25
0.574
Convolve the image with mean pooling filter
Size of the filter and padding used:
Pixelate
0.760
Add artifacts into Image. The artifacts are made with small dotted lines
Number of artifacts:
Artifacts
0.746
170
Vertical Artifacts
The same corruption than Artifacts except that the artifacts are rotated 90 degrees
Number of artifacts: 15 to
0.758
180
Several randomly selected 7x7 rhombus like areas each filled with unique pixel value
Number of rhombus:
Rhombus
0.728
76
Randomly select circle areas (7 radius circles). For these areas, add to the pixel values and divide the result by 2
Number of circles: 12 to 120
Rain
0.748
Several randomly selected circle areas (7 radius circles) each filled with unique Number of circles: 7 to 50 pixel value
Circles
0.720
One randomly chosen square area is filled Size of the square 47 to with unique pixel value
Obstruction
0.597
125
Figure 5: Presentation of half of the group of common corruptions displayed in Figure
The other half is
presented Figure
13

---

Under review as a conference paper at ICLR 2021
Corruption Name
AlexNet Error Rate
Illustration
Description
Severity Range
Thickness of the corrupted area: 9 46 pixels
Fill the border of images with unique pixel value
Border
0.670
Number pixels translated both translations: 62
Translation
One horizontal and one vertical translation
0.603
Maximum pixel translation due to the shear. 0.39
Shear
Horizontal Shear
0.657
Crop the height the width of the Image. The image is then resized to its original
Number of cropped pixel: 44 to 110
Elastic
0.541
size
Degree of the rotation:
Rotation
Clockwise or anticlockwise rotation
0.711
Split image into two areas select value. Add this value pixel one the area and substract the value for the other.
Value added or subtracted: 0.11 to 0.44
Backlight
0.591
Select unique value. Add this value or substract to all the pixel value of the image
Value added or subtracted: 0.16 to 0.51
Brightness
0.577
Contrast reduction factor: 0.33 to 0.74
Contrast
Reduce the contrast of images
0.576
Color Distortion
Add a unique value to all pixels of one of the RGB channel
Value added: 0.09 to 0.40
0.606
Interpolation factor associated with the gray scale image: 0.49 to 1
Interpolate the image with its gray scale version
Gray Scale
0.580
Shift cyclically the value of the pixels of the Value of the shifting: 0.05 channel H in the HSV format
Hue
0.684
to 0.5
Figure 6: Presentation of half of the group of common corruptions displayed in Figure The other half is
presented in Figure
14

---

Under review as a conference paper at ICLR 2021
B BENCHMARKS OBTAINED FOR DIFFERENT VALUES OF THE OVERLAPPING THRESHOLD
Overlapping Threshold
Size of the Benchmark
Benchmark Obtained
Overiapping Arra
Bhsllghh
0.025
Shoor
Hume
palppepper
Brightraa
Bunder
..05
0.1
Sheer
Pain
Hule
Quarttaatioo
Bku
0.2
Nobis
Verticll
0.35
Shear
Rai
Him
Quarttattor
Slighnsss
Bonder
Back
Artlocks
Actieed
Gauesan
Bastic
Mal Hiaa
Antincce
TThambe
Orty
Figure 7: Benchmarks obtained when running Algorithm| for different values the overlapping threshold. The third column contains the overlapping scores between the corruptions of the benchmarks.
15

---

Under review as a conference paper at ICLR 2021
C PERFORMANCES OF VARIOUS MODELS ON IMAGENET-NOC AND IMAGENET-C
Table 5: The ImageNet-C CE scores obtained with several pretrained torchvision classifiers.
Gauss
Shul
Impal
Defo
Glass
Motion
Zoomn
Snow
Fros
Bright
Contr
Elastic
Pixel
Ipes
mCB
NlesNel
100
100
100
100
100
100
100
100
100
100
100
100
100
100
100
100
Ner
VGG-11-8N
104
105
114
108
132
114
119
102
100
68
89
125
144
111
ResNes-18
104
106
111
100
116
108
112
163
101
67
57
133
97
126
104
DenoeNet-
97
DenseNet-2011
82
87
87
91
116
100
107
85
82
45
62
136
90
113
WideResNet-50-2
91
97
93
123
103
109
95
65
89
99
126
101
Table 6: The ImageNet-NOC CE scores obtained with several pretrained torchvision classifiers.
Cleun
Quant
Blur
Vert Arti
Roin
Border
Sheur
Bright
Hose
mCE
AlexNet
43.5
100
100
100
100
100
100
100
100
100
SquerzeNet
106
VGGG-19:BN
25.8
175
70
113
77
91
71
88
RecNet-18
50.2
128
103
84
92
80
64
86
ResNet-50
23.9
DemseNas-121
72
DenseNes-201
2288
89
86
84
49
60
52
66
WideResNet-504
21.5
112
97
92
96
72
78
16

---

Under review as a conference paper at ICLR 2021
D OVERLAPPINGS OBTAINED FOR THREE DIFFERENT ARCHITECTURES
ResNet 50
DenseNet 121
C Coussian
14 Coustiin nola
c.shotnoae
Cdobou Sur
C.mzsbee rorr
Coass
64
Cagina Joc
Cooo
Frot
05
Chrigtress
Contierd
Celasic DransSum
CJeeg compeessoooooo
brigh
-02
brighnses
aerical ettileds
vertical artffrts
bonder
-00
Emprre Poree
Chighiies
Colantic ColaticTrret inveetm
Lav Co on
tar
ONU
Cdibicas Bir
Die
Cawn Lur
brighoss
Contrall
qua quattudi
toplacs
WideResNet 50
Corunsn noss
J.aomm Sk
00
C Chighteess
Ceatii Standtmm
Caussan rode-
Umgaatee fute
Sile She
Coloni aowtt.ttestee mnadtor
Figure The overlapping scores between all the ImageNet-NOC and ImageNet-C corruptions, computed with the ResNet-50, DenseNet-121 and Wide-ResNet-50-2 architectures.
17

---

Under review as a conference paper at ICLR 2021
E PERFORMANCES OF MODELS TRAINED WITH A DATA AUGMENTATION WITH ONE CORRUPTION ON IMAGENET-C AND IMAGENET-NOC
We provide in Table and the CE scores computed and averaged to get the mCE scores of Tables 2.a and 2.b The first column of these arrays contains the error rate on the non-corrupted ImageNet validation set.
Table CE scores computed with models trained with data augmentation with one corruption ImageNet-C. Each line refers to one model trained with one corruption of ImageNet-C and each column refers to one corruption of ImageNet-C.
Clean
Gouss
Shot
Impui
Defo
Glass
Metion
Snow
Bright
Contr
Blastic
Pixel
mCC
Standard
0.247
121
119
122
147
121
118
107
97
100
98
94
116
68
79
56
104
0.264
100
X7
107
58
0.269
102
84
103
Inqul
0.272
10
123
S3
99
96.
91
127
102
129
54
17
71
Deto
0.300
62
62
63
25
36
34
76
82
91
46
50
54
Zoom
0.254
98
98
99
60
30
31
BS
97
77
101
98
45
24
51
68
Snow
0.263
114
113
118
115
91
87
74
97
84
117
54
40
52
83
79
Fog
0.254
117
136
100
76
73
Bright
0.235
108
111
110
142
113
112
104
86
7
100
72
60
89
Contr
0.282
96
100
131
103
9T
K2
50
72
66
50
78
96
93
Jpgy
0.256
86
86
88
143
110
L18
113
98
102
120
101
129
66
32
11
94
Table 8: CE scores computed with models trained with a data augmentation with one corruption IMC. Each line refers one model trained with one corruption of ImageNet-NOCC and each column refers corruption of ImageNet-NOC.
Clean
Quant
Blur
Vert-Arti
Rain
Border
Shear
Bright
Huc
mCE
standard
0.247
87
122
77
71
67
79
117
88
89
Quant
0.237
9
125
77
90
70
90
124
80
83
Blur
0,251
79
82
90
106
79
Vert-Arti
0.242
79
80
84
83
Rain
0.231
86
131
78
2
73
82
115
97
83
Border
0.241
89
123
71
73
8
74
118
89
81
Shear
0.234
129
127
65
85
75
6
133
102
90
Bright
0.236
75
73
92
79
Hue
0.261
83
139
91
96
74
101
116
88
18


Reviews:
[{"review_id": "jrai3Is1mht", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "## Paper summary\nThe paper considers the problem of measuring the robustness of image classification models to common image perturbations. Datasets of corrupted images, such as ImageNet-C, have been created for this purpose. However, these datasets have been created from an ad-hoc, heuristic selection of perturbations. The present paper proposes a systematic approach to select types of perturbations in a way that spans a large variety of perturbations and assigns similar importance to each perturbation. Similarity of perturbations is measured based on how much training on one perturbations confers robustness against another perturbation. The paper provides an algorithm for selecting perturbations to include, and uses the algorithm to create a variant of ImageNet-C with improved coverage and balance.\n\n\n## Arguments for acceptance\n1. Robustness of computer vision models to image perturbations is a topic of great interest, but methods to measure robustness are either highly artificial (adversarial robustness) or ad hoc heuristics. The present paper takes an important step in the direction of making evaluation of robustness to non-adversarial corruptions more principled.\n2. The paper is written clearly.\n3. The overlapping score is based on a practically relevant quantity, namely the performance of a network on the corrupted data.\n4. A simple algorithm is provided for selecting perturbations for new datasets.\n5. A new alternative to ImageNet-C is created with the proposed algorithm. The new dataset has improved coverage and balance properties. Some evidence is provided that these improvements can affect the results of robustness evaluations.\n\n## Arguments against acceptance\n6. The computational cost of the method is high, and not stated or discussed. As far as I can tell, at least one neural network needs to be trained for each candidate dataset. Although the authors state that results transfer across architectures, such that a small architecture can be used, it is known that robustness properties depend significantly on model size and training procedure (e.g. see https://arxiv.org/abs/2007.08558). This should be addressed further.\n7. This method only really works for synthetic corruptions for which many new examples can be generated. Otherwise, it may be difficult to obtain enough examples to train the network used for computing the overlapping score.\n8. It is not discussed whether Algorithm 1 is guaranteed to provide the optimal combination of datasets (in terms of overlap and balance).\n9. It is not entirely clear if the improvements provided by ImageNet-NOC make a significant difference in practice. Table 3 starts to address this question, but it would be useful to compare ImageNet-C and ImageNet-NOC mCE across a wider range of models (e.g. pretrained models available online). What is the rank correlation between ImageNet-C and ImageNet-NOC mCE? \n\n## Conclusion and suggestions\nThis is a borderline submission. Because of the principled approach to an important and topical problem, I tend towards accepting it.\n\nSuggestions for improvement:\n10. Discuss the computational cost of the method.\n11. Discuss the optimality of Algorithm 1.\n12. Compare ImageNet-C and ImageNet-NOC on a wider range of models.", "extra_scores": {}, "extra_text": {}}, {"review_id": "aj0YOvWg-pD", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThis paper points out that ImageNet-C, the de facto standard for measuring robustness to natural corruptions for ImageNet classification models, contains correlated corruptions, so a mean robustness score over the ImageNet-C corruptions is biased in favor of certain classes of corruptions. It proposes two metrics: robustness score and overlapping score, and uses them to specify desirable characteristics of a robustness benchmark: coverage and balance. It specifies an algorithm for selecting a set of corruptions that optimize for these characteristics, and introduces a new benchmark (ImageNet-NOC) built using this algorithm and evaluates some models that performed well on ImageNet-C on ImageNet-NOC to see if they still perform well.\n\nPositives:\n* I think the authors are correct that some corruptions in ImageNet-C are correlated and therefore, using a simple mean over corruptions is going to bias towards models that improve on the correlated corruptions.\n* Results like Section 5.4 seem valuable, since they show that existing ImageNet-C results may not generalize to robustness to a broader set of corruptions.\n\nConcerns:\n* The ImageNet-C paper specifically says \"networks should not be trained on these images,\" for good reason, since training on them makes it too easy to optimize for the metric, but miss the overall goal. This paper specifically trains on it. Maybe it's ok for this particular case of analyzing the benchmark itself, but that should be called out very clearly. The entire benchmark becomes useless if people start training on it.\n* There is an assumption made throughout the paper that using a corruption as data augmentation during training imparts robustness to that corruption on the trained model. This needs to be established. I have seen empirically that it isn't always the case.\n* I worry that Algorithm 1 is itself not robust to changes in architecture or training methodology. You do present results showing that the corruptions selected using ResNet18 also have low overlap when measured on DenseNet, but I would have also liked to see whether running Algorithm 1 with the same set of candidate corruptions, but using DenseNet, would result in the same set of corruptions being selected.\n* The claims in section 5.2 seem entirely misleading. The results you show are purely a result of the initial set of candidate corruptions you chose, and you provided no methodology for how to perform that step. If your initial set had been exactly ImageNet-C or even a subset of ImageNet-C then the results would have looked entirely different. Similarly, I could introduce a new corruption that isn't in your candidate set and suddenly ImageNet-NOC would look like it has low coverage. Given that the space of possible corruptions is unbounded, this notion of coverage doesn't seem at all valuable to me.\n* On the whole, I think this paper would be a lot stronger if the proposal was just a set of weights for each ImageNet-C corruption, such that the top-line robustness metric used would be a weighted average that is less biased towards correlated corruptions.\n\nMinor details:\n* It's kind of weird to have section 2.3 placed where it is. It would make more sense at the beginning of section 4.\n* In section 3.1, the statement that R_c^m \\in [0, 1] isn't strictly true. It's possible that A_c > A_clean.\n* It's worth mentioning explicitly that the robustness score, as you've defined it, is only valuable when presented along with A_clean. If A_c == A_clean because both are at chance, this has optimal robustness but isn't interesting.\n* R^standard is used in Eq 1 but it isn't defined until a few paragraphs later.\n* Algorithm 1 is very verbose and complicated-sounding. Steps 2-6 could just have been written as: \"Pick the largest subset with overlap score under the threshold and break ties by selecting the lowest overlap score.\"\n* There are a number of misspellings and grammatical issues throughout.\n\nReasons for score:\nThe critique of ImageNet-C is valid, but I don't think the proposed solution really addresses it. A good solution needs to be totally agnostic to architecture and training algorithm, which this method is not. There also needs to be a lot less dependence on the manually selected list of initial corruption candidates. I think ImageNet-C made a conscious choice not to involve model training when building their benchmark dataset and they had good reasons for doing so. Those reasons (laid out in the \"Concerns\" above) are why I don't think this paper is worthy of acceptance.", "extra_scores": {}, "extra_text": {}}, {"review_id": "7wdTNl6c3e4", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a new dataset for estimating robustness to distribution shift, in particular corruption robustness. They accomplish this by proposing an alternative to ImageNet-C, ImageNet-NOC, which uses different corruptions. They consider corruptions not in ImageNet-C, and they argue that their dataset is superior because they have more \"balance and coverage.\" They select corruptions that are \"decorrelated\" in a specific sense.\n\nI appreciate the analysis in this paper and provides useful comparisons to ImageNet-C. Unfortunately experimentation is not thorough. They don't show results with AugMix nor DeepAugment, so the analysis only uses SIN and ANT.\n\nThe paper is missing key qualifiers.\n\"In other words, the expression (1) estimates if increasing the robustness to c2 implies an increase of robustness to c1 and vice versa.\"\n... provided that the model fits the exact corruption c2.\n\"Then, the higher (1) is, the more the robustnesses to c1 and c2 are correlated, i.e. the more c1 and c2 overlap.\"\n... provided the models are robustified through exactly training on c1 or c2.\nWithout these qualifications, the claims are far too general.\nContrast and fog can be negatively correlated with the rest of the corruptions under some robustness interventions. For example, adversarial training really harms contrast and fog corruption robustness, though it might help other corruptions like noise (and a less expansive testbed might not catch this). This demonstrates that their robustness correlations require qualification and are less predictive that this paper suggests.\n\nThis paper is fairly similar to Is Robustness Robust? On the interaction between augmentations and corruptions (submission #704). If these papers have very different ratings, then there's a problem with this review process.\n\nNitpicks:\n\nThe bibtex for the citations are messed up. For example, we see \"(Evgenia Rusak, 2020)\" instead of \"(Rusak et al., 2020)\". Author ordering for papers in the bibtex is often scrambled, some are separated by commas, and some are not. In general this paper's formatting is a little unrefined.\n\n\"weight decay set to 10e-4.\" -> \"weight decay set to $10^{-4}$.\"\n\n\"For instance, a benchmark that contains a motion blur corruption covers the defocus blur corruption, because the robustnesses [sic] towards these two corruptions are correlated (Vasiljevic et al., 2016).\"\nVasiljevic et al. (https://arxiv.org/pdf/1611.05760v1.pdf) show the opposite. Fine-tuning on defocus blur did made models slightly worse on horizontal motion blur (Figure 2).", "extra_scores": {}, "extra_text": {}}, {"review_id": "3sKlpl_rLiP", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "##################################################################\n\nSummary:\n\nThis paper proposes an algorithm to build a benchmark of Non-Overlapping Corruptions. The proposed ImageNet-NOC dataset is balanced and also covers a wider range of corruptions. \n\n##################################################################\n\nPros:\n\n(1) This paper first provides detailed analysis of dataset coverage and balance. \n(2) This paper develops an algorithm to construct a robust benchmark that is balanced and non-overlapping, which means a lot for future work.\n(3) This paper is well-organized relatively.\n(4) The experimental results are relatively consistent with the mentioned features.\n\n##################################################################\n\nCons:\n\n(1) The coverage (Sec 5.3) is a little bit confusing. It reads “We observe that the mINOC model is 【significantly】 more robust than the standard model to all the ImageNet-C corruptions … … ImageNet-NOC covers all the corruptions of ImageNet-C”The reviewer noticed that gaps of some corruptions are not sufficiently significant, for example, Elastic (67 vs 63), Pixel (78 vs 71) and Jpeg (56 vs 53). Although marginal gaps are observed, can we conclude that ImageNet-NOC already covers that of ImageNet-C? The reviewer suggests adding the following experiments: Reporting both the results of m_IC evaluated on ImageNet-C & ImageNet-NOC, and that of m_INOC evaluated on ImageNet-C & ImageNet-NOC. Comparing “m_IC on ImageNet-C” and “m_INOC on ImageNet-C”. If these two results are similar, then we can conclude that ImageNet-NOC covers ImageNet-C. \n\n(2) The experiments in Sec 5.4 show that SIN+IN is more robust than ANT on ImageNet-NOC. But on ImageNet-C, ANT is more robust. Is this phenomenon caused by imbalanced corruptions of ImageNet-C? Could the authors explain this? (Maybe based on the proposed overlapping scores between corruptions.)\n\n\n##################################################################\n[Edit]\nAfter reading the authors' response and other reviewers' comments, I have lowered the scored to 5. The reasons are bellow.\n\nThis paper provides good analysis of the coverage and balance of robustness benchmarks. Based on the analysis, the paper presents a method to construct a benchmark of Non-Overlapping Corruptions. I think such analysis is valuable and interesting, despite some concerns about the coverage comparisons (which are only partially addressed by the authors' response). \n\nI agree with Reviewer#1 that the comparisons between ImageNet-C and ImageNet-NOC are not solid. And that \"the paper should have done an equivalent evaluation, comparing ImageNet-C as a whole vs. ImageNet-NOC as a whole.\" Since the core idea of this paper is to propose a better robustness benchmark, solid comparisons between ImageNet-C and ImageNet-NOC are critical.\n\nI also agree with Reviewer #3 and Reviewer #4 that, the improvements provided by ImageNet-NOC does not make a significant difference. \n\nThe reviewer appreciates the analysis of the coverage and balance of the robustness benchmarks, which in my opinion, is valuable. However, since this paper focuses on proposing a better benchmark, solid evaluations between these two benchmarks are critical. \n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors propose a new dataset, namely ImageNet-NOC, for evaluating robustness of image classifiers to corruptions. The dataset may be viewed as an alternative to ImageNet-C which uses a different set of corruptions. To derive this set of corruptions, the authors first develop a notion of similarity between two corruptions, and then propose an iterative algorithm to build a set of corruptions which, intuitively, is sufficient to cover the larger set of corruptions (i.e., enjoys *high coverage*), and assigns a similar importance to each such corruption (i.e., is *balanced*). Then, the authors argue that ImageNet-NOC is superior to ImageNet-C as it achieves a higher degree of balance and coverage.

The reviewers found this to be a borderline paper. The reviewers appreciated the introduced metric and agree that there is no point in evaluating on corruptions which are perfectly correlated. In addition, the systematic approach for generating a set of relevant corruptions is seen as a step in the right direction. The reviewers appreciated the author response and were engaged in the discussion. As it currently stands the reviewers are not convinced that the paper is ready for acceptance. To improve the manuscript the authors could extend Tables 3 and 4 with a wider range of models and investigate qualitative differences between models robust on one dataset, but not on the other. Furthermore, there should be a more detailed discussion of stability and computational properties of algorithm 1. In addition, the authors should provide strong arguments as to why is it not sufficient to add additional corruptions to ImageNet-C and compute a weighted score instead. The latter suggestion could lead to an iterative improvement of the current set of benchmarks and place more emphasis on the methodology. I suggest the authors to incorporate the reviewer's feedback and place more emphasis on the methodology around algorithm 1, rather then on introducing another dataset which is likely to be superseded as soon as we add a couple more corruptions in the mix. 
Decision: Reject