Nuisances via Negativa: Adjusting for Spurious Correlations via Data Augmentation
Authors: Aahlad Manas Puli
Nitish Joshi
He He
Rajesh Ranganath
Venue: Submitted to ICLR 2023 (2023)
Keywords: spurious correlations
out of distribution generalization
shortcuts
bias mitigation
data augmentation

Abstract: There exist features that are related to the label in the same way across different settings for that task; these are semantic features or semantics. Features with varying relationships to the label are nuisances. For example, in detecting cows from natural images, the shape of the head is a semantic and because images of cows often have grass backgrounds but not always, the background is a nuisance. Relationships between a nuisance and the label are unstable across settings and, consequently, models that exploit nuisance-label relationships face performance degradation when these relationships change. Direct knowledge of a nuisance helps build models that are robust to such changes, but knowledge of a nuisance requires extra annotations beyond the label and the covariates. In this paper, we develop an alternative way to produces robust models by data augmentation. These data augmentations corrupt semantic information to produce models that identify and adjust for where nuisances drive predictions. We study semantic corruptions in powering different robust-modeling methods for multiple out-of distribution (OOD) tasks like classifying waterbirds, natural language inference, and detecting Cardiomegaly in chest X-rays.

Under review as a conference paper at ICLR 2023
NUISANCES VIA NEGATIVA: ADJUSTING FOR
SPURIOUS CORRELATIONS VIA DATA AUGMENTATION
Anonymous authors Paper under double-blind review
ABSTRACT
There exist features that are related to the label in the same way across different settings for that task; these are semantic features or semantics. Features with varying relationships to the label are nuisances. For example, in detecting cows from natural images, the shape of the head is a semantic and because images of cows often have grass backgrounds but not always, the background is nuisance. Relationships between a nuisance and the label are unstable across settings and, consequently, models that exploit nuisance-label relationships face performance degradation when these relationships change. Direct knowledge of a nuisance helps build models that are robust to such changes, but knowledge of a nuisance requires extra annotations beyond the label and the covariates. In this paper, we develop an alternative way to produce robust models by data augmentation. These data augmentations corrupt semantic information to produce models that identify and adjust for where nuisances drive predictions. We study semantic corruptions in powering different robust-modeling methods for multiple out-of distribution (OOD) tasks like classifying waterbirds, natural language inference, and detecting Cardiomegaly in chest X-rays.
INTRODUCTION
between the label and the covariates can change across data collected at different places and times. For example, in classifying animals, data collected in natural habitats have cows appear on grasslands, while penguins appear on backgrounds of snow; these animal-background relationships do not hold outside natural habitats (Beery et al., 2018; Arjovsky et al., 2019). Some features, like an animal's shape, are predictive of the label across all settings for a task; these are semantic features, semantics in short. Other features with varying relationships with the label, like the background, are nuisances. Even with semantics present, models trained via empirical risk minimization (ERM) can predict using nuisances and thus fail generalize (Geirhos et al., 2020).
Relationships
Models that rely only the semantic features perform well even when the nuisance-label relation- ship changes, unlike models that rely on nuisances. Many methods exist to build models robust to changing nuisance-label relationships (Mahabadi et al., 2019; Makar et al., 2022; Liu et al., 2021; Puli et al., 2022; He et al., 2019); we call these spurious-correlant These methods broadly fall into two classes: 1) methods that assume access to nuisances, like Distillation (NURD) (Puli et al., 2022), debiased focus loss (DFL), product of experts (POB) (Mahabadi al., 2019), and 2) methods that rely on assumptions about ERM- trained models relying on nuisances, like Just Train Twice (JTT) (Liu et al.. 2021). We point out commonality between the two classes of methods: model that predicts the label from the nuisance called biased model, that are built using extra annotations or assumptions. Intuitively, biased mod- els play a role in building robust predictive models by providing a way to detect when the nuisance can influence predictions.
avoiding methods (SCAMS).
How do we build biased models without extra annotations in the form of nuisances being known in the training data or assumptions about ERM-trained models relying on nuisances? this work, we build robust models from a different and complementary source of assumptions: knowledge about semantics. Imagine using data augmentation to corrupt semantics in the covariates - semantic-corrupted input can still predict the label, the prediction must rely on nuisances, thereby providing a window into nuisances that can be used to build a biased model.
if the resulting
Designing a data augmentation that corrupts semantics is easy. For example, replacing the covari- ates with random noise would fully corrupt the semanties. However, after such a corruption there

---

Under review as a conference paper at ICLR 2023
is nothing that predicts the label meaning no nuisance information would be identified. A better semantic corruption would corrupt the semantics, while preserving some nuisances. This preserva- tion is possible when semantics and nuisances appear differently in the covariates; call such difference a separation. We identify different separations to develop semantic corruptions for object recognition and natural language inference (NI.I).
The first separation is when semantics are global and nuisances are local. Formally, global seman- ties are desition-dependent functions of the subsets of the covariates (patches in images, or words in sentences), while local nuisances are vosition-independent For example, in recognizing cows, the shape of the animal structures the distant patches where the cow's 's eyes, ears, tail, hooves appear; nuisances like grass can appear anywhere without structure. Due to positional-dependenee izing positions of subsets of covariates corrupts global semanties; however, position-indepenn local nuisances are retained. Under the global/local separation, we corrupt semanties via patch ran- domization (PATCH-RAND) for images and n-gram randomization (NGRAM-RAND) for NI.I
random-
The second separation is when certain parts of the input are required for semantics. For example in chest X-rays, lungs appear in the center, while nuisances like the scanner affect the border. In NLI, the premise sets up the context for detecting entailment. Without the premise, entailment cannot be determined by semantics, but the hypothesis retains some nuisances. For this separation, masking parts of the covariates corrupts semantics for object recognition via region-of-intee interrsst masking (ROI- MASK) and for the semantic context in NLI via premise masking PPREM-MASK,
The last two separations are when semantics and nuisances are signals of different frequencies or dif- ferent pixel-intensities. For example, in detecting Cardiomegaly in chest X-rays, semantic features like the heart are low-frequency features with high pixel-intensity; see fig. 2. However, nuisances like noise due to the X-ray scanner can be high-frequency or low-intensity signals. For such separa- tions, frequency filtering (FREQ-FILTER) and intensity filtering (INT-FILTER) corrupt semantics.
We demonstrate the value of semantic corruption by using it to power variety of methods: NURD (Puli et al., 2022), DFL, POE (Mahabadi et al., 2019). and JTT (Liu al., 2021). We run these meth- ods by building biased models using nuisances produced by semantic corruption. These methods with semantic corruptions outperform ERM on out-of distribution (OOD) generalization tasks like waterbirds (Sagawa et al., 2019), cardiomegaly detection from chest X-rays, and NLI. The perfor- mance of NURD, DFL, POE run with semantic corruption is similar to what the methods achieve with extra observed nuisance variables. Finally, JTT with semantic corruptions outperforms vanilla JTT.
2 WHAT DO METHODS NEED TO REDUCE SPURIOUS CORRELATIONS?
A spurious correlation is relationship between the covariates and the label that changes across settings like time and location (Geirhos et al., 2020). Models that exploit a spurious correlation can perform poorly outside the training distribution. We focus on the class of methods that correct models using knowledge of nuisances or where they might appear (Mahabadi et al., 2019; Liu et al., 2021; Puli et al., 2022); call these spurious-correlation avoiding methods (SCAMs). With label y. a vector of nuisances z, and covariates x. the goal is to predict well on data regardless of the nuisance-label relationship. Next, we establish that the central part of several SCAMS is model that predicts the label using nuisances, which we call the biased model. Let Ptr and Pte be the training and test distributions respectively, and let a denote that the random variables a, b are independent.
NURD. In tackling spurious correlations, Puli al. (2022) identify a conditional that has per- formance guarantees on test distribution Pts with an unknown nuisance-label relationship. They develop NURD to learn the conditional using data from Ptr * Pte- NURD uses 1) the nuisance- randomized distribution, P. (y, 2, x) = p(y)p_ (z)p(x y, z), where ولاا y, and 2) an uncorrelat- ing representation r(x) for which z z.lp,, y r(x). In P_, the nuisance alone cannot predict the label; this helps avoid features that depend only on the nuisance. Next, features that are mixed functions of the label and the nuisance (c.g. X1 = y + z) can also be spurious. Uncorrelating r(x) avoid such features. With these insights, NURD builds models of the form p, (y r(x)) that are most informa- tive of the label. We work with reweighting-NURE NURD, which estimates p. by weighting samples as ply)/po.ty x) (y. 2, x). See appendix A for more details.
End-to-end bias mitigation. Mahabadi et al. (2019) consider two methods to train a biased model and base predictive model jointly make the base model predict without relying on the biases. The
2

---

Under review as a conference paper at ICLR 2023
Table 1: Summary of NURD, JTT, POE, and DFL. Each method approximates what we call a biased model: Ptr(y 2). This table describes the different biased models, their names, how they are built. We build biased models as (t T(x)) where T(x) is a semantic corruption.
Method
Name
What the biased model is
Assumptions
JTT
Identification model
Per (y
x) learned via ERM
ERM builds biased models. x) learned via ERM
POE/DFL.
Biased model
Per (y
z from domain-know ledge.
NURD
Weight model
Per (y
x) learned via ERM
z from domain-knone mainainnknwwllgger lodge..
methods use and fine-tune BERT model (Devlin et al., 2019) and do not propagate the gradients of the biased model to update the common parameters (token embeddings in this case). They propose 1) POE, where the log of the product of the predicted probabilities of the two models is used to compute the classification loss and 2) DFL, where the biased model is used to weight the cross- entropy loss for the base model. For both methods, Mahabadi et al. (2019) build a biased model as Pt z). The intuition is that the samples correctly classified by the biased model will have low loss and the base model focuses on classifying samples that the biased model misclassifies.
Just Train Twice JTT. With ITT, Liu al. (2021) aim to build models robust to group shift, where the relative mass of fixed set of disjoint groups of the data changes between training and test times. The groups here are subsets of the data defined by a pair of values of discrete label and nuisance values. While they work without relying on training group annotations, i.e. without nuisances, they assume ERM builds models with high worst-grous error. JTT first builds an "identification" model via ERM to isolate samples that are misclassified due to reliance the nuisances. Then, JTT trains model via ERM on data with the loss for the misclassified samples upweighted (by constant A). The number of epochs to train the identification model and the upweighting constant are hyperparameters that require tuning using group annotations (Liu et al., 2021).
The commonality of a biased model. The central part between NURD, DFL. POE, and JTT is a model that predicts the label using nuisances (like Ptr (y z)), which call the biased model as in He et al. (2019); Williams et al. (2018). While these methods reduce dependence on nuisances, they build biased models using additional annotations require assumptions that ERM-trained models predict using the nuisance. In the next section, we describe an alternative: corrupt semantic infor- mation with data augmentations to construct nuisances that can be used in a biased model.
3 ROBUSTNESS VIA SEMANTIC CORRUPTIONS
We define a data augmentation transformation of the covariates with random noise o: T(x, 8). Formally, an ideal semantic corruption is a data augmentation or transformation such that the label does not depend the transformation given the nuisance y .l. [L] 5) and that the transformation is not independent of the nuisance T 7(x, 8)... The first condition ensures that the biased model built from the semantic corruption only predicts the label because of the nuisance. The second condition ensures the semantic corruption depends on the nuisance. In designing semantic corruption these two conditions are tension. The former wants destroy everything about the label unrelated to the nuisance, while the latter wants to retain everything about the nuisance, which may be hard to achieve without retaining extra information about the label. The design of semantic corruption is made easier, when semantics and nuisances appear differently in the covariates; we call such a difference a separation. Focusing on two popular OOD tasks, object recognition and NLI, we identify separations and build semantic corruptions based on permutations and masking.
3.1 SEMANTIC CORRUPTIONS VIA PERMUTATIONS FOR A GLOBAL/LOCAL SEPARATION
The first separation we consider is between semantics that appear as global structure and nuisances that appear as local structure. We give an intuitive example for such global semantics and local nuisances before formalizing them. Consider the waterbirds dataset from (Sagawa et al., 2019) with waterbirds and landbirds appearing predominantly on backgrounds with water and land respectively. Semantic features like the wing shape and the presence of webbed feet are corrupted by randomly permuting small patches. However, the background nuisances remain after permutations because they can be detected from small patches due to colors and textures. See fig. la.
Formally, given subsets of the covariates XI, .x extracted in an order, semantics s(x1.... , .x)) change with the order of extraction while nuisances nxx1, xx) do not: for permutations II
3o E 11 s(XI, xx) # sXx((1)) :. -xa(k))
Vi E II n(x,, .xx)) xx) n((x(1), (xx()))
3

---

Under review as a conference paper at ICLR 2023
(a) PATCH-RAND to corrupt global semantics in Wa- terbirds. The original is the left most, followed by PATCH-RANDS with sizes 112, 28, 14. At sizes less than 28, shape is hard to make out.
(b) Masking to corrupt semantics in chest X-rays. The original the left most, followed by ROI-MASK of size 112, 154, 196. At sizes more than 154, the heart is blocked out.
Figure 1: Semantic corruptions of Waterbirds via PATCH-RAND and chest X-rays via ROI-MASK.
We give a demonstrative example of a semantic corruption with global semantics and local nui- sances. Consider family of distributions F = {pp) ( DER with changing nuisance-label relation- ships. With U as the uniform distribution over {1, 2, 3). and / as the normal distribution, samples from py(y, z, x) come as y ~ U, z ~ Dyy, 1), and y selects a configuration of x
y = + x = z, 2),
y= = x 2. -2. 2].
y=3 = x= 2,, -2]
The configuration is semantic that determines y and computing it requires comparing coordinates:
= X2X3 > 0, y = 2 if x1 > 0, and y = 3 otherwise. In words, the semantic feature global. However, z X1 + X2 + X3, which means that is determined regardless of where the negative sign is, i.e. it is local. Here, random permutation T(x, 8) of the coordinates in x is semantic corrpption: as T(x, 6) permutes the location of the negation, T(x) y. z is distributed identically to T(x) z. Next, we give semantic corruptions for vision and language tasks with global/local separations.
Patch randomization. In image recognition, object recognition tasks where the object is shape in the foreground and the color and texture in the background are nuisances, often satisfy the global- semantics and local-nuisances separation. For illustration, consider differentiating cows and pen- guins in natural images; here, shape is a global semantic feature, while grass in the background is local and can appear without structure. Permuting patches via patch randomization (PATCH- RAND), like in fig. la, corrupts global semantics while retaining local nuisances.
N-gram randomization. Tasks like natural language inference (NLI) where the goal is deter- mining if premise sentence entails a hypothesis satisfy the global-semanticc/llallliiiii -uisaacees separation. Consider this example: the sentence "Bob speaks but Jon does not" contradicts "Jon speaks but Bob does not" but entails "Bob speaks". The meaning is inferred from a global structure on the words and the order they appear in. Nuisances like the number of shared words between the hypothesis and the premise predict entailment, but do not impose order (McCoy et al., 2019). Here, randomizing the order of the words corrupts the semanties: For example, one order randomization of the sentence "Jon speaks but Bob does not" is "Bob speaks but Jon does not"; the former entails "Jon speaks" but the latter contradicts it. Local nuisances, like the number of overlapping words or the presence of certain negation word, are preserved after order randomization. We randomize the order by permuting different ri-grams each sentence; we call this n-gram randomization (NGRAM-RAND).
3.2 SEMANTIC CORRUPTIONS VIA MASKING FOR A LOCATION-BASED SEPARATION
The second separation we to build semantic corruptions is based when certain subset of the covariates contain a necessary part of the semantic information, masking, by removing that subset or setting it to a constant, corrupts semantics. Such masking retains nuisances outside the subset. Formally, we corrupt the semantics by replacing subsets xs with a value that is out of support: for example, in images where pixels lie in (0, 1), we corrupt = xs. x- as Xcorupted = [0*xg, x-s).
As an illustrative example, consider family F {pD } DER with varying nuisance-labe relation- ships. With a, b being random uniform binary random variables, c(p) as the exponential distribution with parameter p. and $ (u) log(1 + exp(u)) as soft-plus, let sampling from pn (y, z, x) be:
y= a + b, z e(+ * (2y 1))) x (2a- 1)z, (2b 1)z).
For such a family, we show that masking out coordinate x is semantic corruption: T(x) = [0, x2] satisfies T(x) holds that b bly.. Then, due to z only relying on y and exogenous noise, b bil z) which implies
z and T(x)1L2 2. First, due to y being computed as an XOR function of a, b,
Second, the magnitude of the second coordinate of T (xx) is [x()2] 1 = Ty
billy z. Given z, determines X2, meaning that b y
= T(x)
4

---

Under review as a conference paper at ICLR 2023
(a) Corruption via FREQ-FILTER. Original image to the left followed zeroing out 14, 56, 112 of the lowest frequencies. The heart features corrupted 56 but the token in the top left corner is preserved.
(b) Corruption via INT-FILTER, Original image to the left followed zeroing out pixels with intensities above the 80%, 60%, 40%. The heart features comuuted at 40% but non-heart parts are not.
Figure 2: Semantic corruptions of chest X-rays via FREQ-FILTER and INT-FILTER respectively.
Region-of-interest--ese wer----tteeeeskinnnee for object recognition. Semantics in images can often be localized to regions-of-interes, For example, in detecting cardiomegaly, the region-offinteres. of the chest where the heart resides. Masking out the region of interest removes centrally located semantic information from the chest X-ray (fig. 1b). However, nuisances like hospital siattal--peeffic infor- mation (like aligmment tokens (Zech et al., 2018)) are present in the border; see top right corner of the x-rays in fig. lb. We call this ROI-MASK. When the region-of-interes (ROI) centrally located, the size of the mask can be varied and the resulting border-only images are semantic corruptions.
the middle
Premise-masking for NLI. Semantic features in NLI rely on the meanings of the premise and the hypothesis sentences: for example, the premise states the occurrence of an event ("Alice sat while bob stood.") which can entail ("Alice sat.") or contradict ("Bob sat." ") the hypothesis. The information about the setup in the premise therefore crucial to differentiate between entailment and contradiction. If the context given by the premise is blocked out, the hypothesis sentence can predict the label only due to nuisances like the presence of negation words that correlate with contradictions (Gururangan et al., 2018). Thus, masking the premise is semantic corruption for NI.I that retains nuisance information present in the hypothesis; we call this PREM-MASK.
3.3 SEMANTIC CORRUPTIONS FOR IMAGES VIA FREQUENCY AND INTENSITY SEPARATIONS
PATCH-RAND relies on differences in relative size and ROI-MASK relies on differences in spatial position. We consider two aspects of the image that are not spatial, frequency and pixcl-intensity, and give corruptions for features that depend on these aspects. Under a frequency- bassed separa- tion, semanties and nuisances appear as signals of different frequencies. Under an intensity- based separation, semantics appear brighter dimmer than nuisances. For example, consider detect- ing Cardiomegaly from chest X-rays, where the heart appears as an object formed of bright pixels with little variation in intensity across the pixels; the latter suggests that the heart features are low- frequency signals. However, in chest X-rays nuisances like scanner noise have low pixel-intensity and nuisances like alignment-tokkes are high-frequency signals.
This observation motivates corruptions along the axes of frequency and pixel-intensity: frequency filtering (FREQ-FILTER) and intensity filtering FINT-FILTER). FREQ-FILTER zeroes-out frequen- cies in the discrete fourier domain, while INT-FILTER zero-out pixels based their intensities. See fig. 2 for how FREQ-FILTER and INT-FILTER corrupt the heart region. FREQ-FILTER and INT-FILTER based on positional separations in frequency and intensity spaces; this is in contrast ROI-MASK that is based on positional separations in pixel space.
3.4
USING SEMANTIC CORRUPTIONS IN PRACTICE
For each of the methods in table 1, we semantic corruption T(x) in building biased model Ptr(y T(x)). For reweighting-NURD with semantic corruptions, we replace Ptr(y z) with Ptr(y (y] T(x)) for semantic corrpption T(x), for DFL and POE, we replace the model Per z) with (y T(x)), and for JTT, we use Ptr (y [xx)) as the identification model.
Choosing the "size" in PATCH-RAND, SGRAM-RAND ROI-MASK. For PATCH-RAND, NGRAM- RAND, and ROI-MASK, misspecifying the size parameter, such setting it be too large or too small, runs the risk of either retaining semantics or corrupting nuisances. For example, with large patches, BACHHRRAND may not corrupt semanties while with small patches (like pixels) PATCH- -ANCH-RAND may corrupt all features. The resulting biased model can rely on semantics or ignore some nuisances; such biased models may not help mitigate spurious correlations.
5

---

Under review as a conference paper at ICLR 2023
We select the corruption parameters using small evaluation set from the test distribution for NURD, POE, and DFL; this is common practice in OOD generalization (Mahabadi et al., 2019; Gulrajani and Lopez-Paz, 2020). For JTT, we follow Liu et al. (2021) and use nuisance annotations in the validation data. We report the results for all corruption parameters in appendix B.2.
4 EXPERIMENTS
In this section, we study semantic corruptions in powering NURD (Puli et al., 2022), JTT (Liu et al., 2021), and POE and DEL (Mahabadi et al., 2019). To faithful to the original evaluations of each method, we run them on tasks from their respective papers: NURD on waterbirds, JTT waterbirds and NLI where the nuisance the presence of negation word, and POE and DFL on NLI evaluated on challenging test dataset, HANS (McCoy et al., 2019). Further, we run NURD chest X-rays but focus on the task of Cardiomegaly detection as is an object recognition task, instead of the original Pneumonia detection (Puli al., 2022) which is texture recognition task. See appendix B for implementation details. We have released the code here:
Methods, metrics and model selection. For images, we corrupt semantics with PATCH-RAND ROI-MASK, FREQ-FILTER, and INT-FILTER. For text, we corrupt semantics with NGRAM RAND and PREM-MASK. To point to the value of semantic corruptions relative to existing data augmentations, we also build biased models with two baseline transformations that corrupt features: random crop- ping (RAND-CROP) and adding gaussian noise (GAUSS-NOISE) both common data augmentations (Shorten and Khoshgoftaar, 2019). We report the average test accuracy for every method. To be able to compare what JTT is trained for in Liu al. (2021), report test worst-group accuracy for JTT. For each method, we compare the performance of the original method to that of the methods run with semantic corruption (including the baselines). For every method being run with semantic corruptions, group annotations and nuisances are unavailable in the training data. Known-nuisance versions of POE, DFI., and NURD use direct knowledge of one more nuisances during training. Vanilla JTT and JTT with corruptions use validation group annotations to early stop and tune hyper- parameters. For other methods, we select the size parameter alone on a small evaluation set from the test distribution. This follows the common practice of using limited queries on small test dataset to tune hyperparameters (Gulrajani and Lopez- Pazz, 2020).
4.1 OBJECT RECOGNITION TASKS
Table 2:
Mean and standard error test accuracy across 10 seeds of NURD with semantic corruptions on classi- fying waterbirds. Known-nuisance NURD uses a label for the type of background the nuisance. Consider the gap between ERM and known- nuisance NURD. NURD with seman- tic corruptions PATCH-RANN, ROI- MASK, FREQ- FILTER, and INT-FILTER close 99%, 93%, 89%, 82% of the gap respectively. Except with INT-FILTER, they outperform ERM and NURD with RAND-CROP and GAUSS-NOISE.
To be faithful to the original evaluations of each method, we evaluate JTT on waterbirds, and NURD on both water- birds and detecting cardiomegaly; both tasks have images of size 224 x 224 x 3. For both tasks, we use PATCH- RAND (of patch sizes 7, 14, 28, 56), ROI-MASK (of mask sizes 112, 140, 168, 196), FREQ-FILTER (of high-pat -psss fil- ter sizes 196, 168, 140, 112), and INT-FITEER (of intensity thresholds 0.1, 0.2, 0.3, 0.4) as semantic corruptions. For the baseline RAND-CROP, we use sizes 7, 14, 28, 56 and for GAUSS-NOISE, we use variances 0.01, 0.25, 1, 4. Both Puli et al. (2022) and Liu et al. (2021) use the raw waterbirds data from Sagawa et al. (2019), where the task is detect- ing the type of bird (water or land) from images where the background is nuisance. Unlike Liu al. (2021), Puli et al. (2022) process the waterbirds to get a different setup from Sagawa et al. (2019). To stay true the original eval- uations of the methods, we recreate the setups as described in their respective papers.
Method
test acc.
Known-2 NURD
87.2 + 1.0%
ROI-MASK
87.0 + 1.0%
PATCH-RAN RANN
86.0 + 1.5%
NURD on waterbirds. For NURD, we recreate the wa- terbirds experiment from Puli et al. (2022) where the full waterbirds data from Sagawa et al. (2019) was subsampled into training, validation, and test datasets each with label balance. However, unlike Sagawa et al. (2019), the valida- tion data comes from the same distribution the training data. The training and validation datasets have 90% water-
FREQ-FILTER
85.2 + 1.2%
INT-FILTER
84.0 + 1.9%
RAND-CROP
81.9 + 1.5%
GAUSS-NOISE
83.9 2.2%
ERM
69.2 + 2.1%
birds backgrounds with water and 90% landbirds backgrounds with land. The test data has

---

Under review as a conference paper at ICLR 2023
flipped relationship. Known-nuisance NURD uses additional label denoting the background-yye as the nuisance.
Table gives results. Selecting the size hyperparameter based on the average accuracy over 10 seeds on an evaluation dataset (200 samples) gives size 14 for PATCH-RAND (86.0%), size 196 for ROI-MASK (87 (87.2%), size 196 for FREQ-FII.TER (65,,)) and threshold 0.2 for INT-FILTER (84.0)). Consider the gap between ERM and known-nuisance NURD. NURD with PATCH-RAND, ROI-MASK, FREQ-FILTER, and INT-FILTER close 99%, 93%, 89%, 82% of the gap respectively. NURD with these semantic corruptions outperforms ERM (%) and NURD with RAND-CROP (81.9%) and GAUSS- NOISE (83.9%). In table 7 in appendix B, we give the results for all corruption parameters. These full results show that NURD with all semantic corruptions outperforms ERM (69.2%).
JTT waterbirds. For JTT, we repeat the waterbirds ex- periment from Liu et al. (2021) which uses the original data from (Sagawa et al., 2019). The training data has 95% wa- terbirds on backgrounds with water and 95% landbirds on backgrounds with land. Both the validation and test datasets have bird label independent of the background. The groups here are subsets of the data that correspond a pair of values of bird-type and background-tye group annotations group error and early stop training when using PATCH-RAND and ROI-MASK. The results for vanilla JTT are from our run using the optimal hyperparameters from Liu et al. (2021).
Table 3:
Test worst-group aceu- racies of JTT on waterbirds. JTT with semantic corruptions outper- forms ERM, vanilla JTT, and JTT with baseline corruptions (RAND- CROP and GAUSS-NOISE).
Like vanilla JTT, we use the validation data to compute worst-
Method
test acc.
Vanilla JTT
86.5%
ROI-MASK
88.2%
PATCH- RAND
89.0%
FREQ-FILTER
87.2%
Table 3 gives results. Selecting the corruption hyperparame- ters on the validation worst-group accuracy gives size 14 for PATCH- RANC (89%), size 196 for ROI-MASK (88.2%), size 112 for FREQ-FILTH FILTER (87.2%). and threshold 0.4 for INT- FILTER (87.0%). JTT with these semantic corruptions out- performs ERM (72.0%), vanilla JTT (86.5%) and JTT with the baseline corruptions RAND-CROP (59.2%) and GAUSS-NOISE (71.0%). Additionally, table shows that JTT with PATCH-RAND and ROI-MASK outperforms JTT with the baseline corruptions and ERM at every patch/border-size.
INT-FILTER 87.0%
RAND-CROP
59.1%
GAUSS-NOISE
71.0%
ERM
72.0%
NURD on detecting cardiomegaly In chest X-ray clas- sification, differences between hospitals, like the scan- ners used to produce the X-rays, known to corre- late thorasic conditions with non-physiological aspects in the image; for example, only some scanners render the air in the lungs in white (Zech et al., 2018). We consider the shape-based object recognition task of car- diomegaly (an irregularly sized heart) detection and, fol- lowing Puli et al. (2022), construct dataset by mixing two chest X-ray datasets: chexpert (Irvin et al., 2019) and MIMIC (Johnson et al., 2019). The training and validation datasets have 90% cardiomegaly images from MIMIC and 90% healthy images from chexpert, while the test data has flipped relationship. Known-nuisance NURD uses the hospital identity as the nuisance.
Table 4: Mean and standard error of test accuracy across 10 seeds of NURD on chest X-rays. Known-nuisance NURD uses the hospital as the nuisance. Con- sider the gap between ERM and known- nuisance NURD. NURD with PATCH- RAND, ROI-MASK, FREQ-FILTER, and INT-FILTER close 77%, 79%. 70%, 60% of the gap respectively. Except INT- FILTER, NURD with semantic comup-- tions outperform ERM and NURD with baseline corruptions.
Method
test acc.
Known-z NURD
81.7 + 0.3%
See table 4 for results. Selecting the corruption param- eters based on the mean accuracy over 10 seeds evaluation dataset (200 samples) gives size 7 for PATCH- RAND (77.5%), size 196 for ROI-MASK (77.2%), size 196 for FREQ-FILTER (75.6%), and threshold 0.1 for the INT-FILTER (73.9%). Consider the gap between ERM and known-nuisance NURD. NURD with PATCH- RAND, ROI-MASK, FREQ-FILTER, and INT-FILTER close 77%, 79%, 70%, 60% of the gap respectively. NURD with all these corruptions but INT-FILTER, outperforms ERM (62.0%) and NURD with RAND-CROP
ROI-MASK PATCH-RAND
77.2 + 0.8%
77.5 1 0.6%
FREQ- FILTER
75.6 + 1.3%
INT- INT-FILTER
73.9 + 0.9%
RAND-CROP GAUSS-NOISE
75.1 + 0.9%
58.8 + 3.7%
ERM
62.0 + 2.0%

---

Under review as a conference paper at ICLR 2023
(75.1%) and GAUSS-NOISE (51.9%). We give the results for all comuption parameters in table in appendix B; this table shows that NURD with PATCH-RAN RAND and ROI-MASK, for all size parame- ters, outperform ERM (62.0%)
4.2 NATURAL LANGUAGE INFERENCE (NLI)
For methods POE, DFL, and JTT, we use the MNLI dataset (Williams et al., 2018) during training- The evaluations of these methods in their respective papers have different nuisances and, conse- quently, different test sets, In accordance, we describe the setup and the results separately. We use NGRAM-RAND (sizes 1, 2, 4) to produce nuisances for both setups. We do not run POE/DEL with PREM-MASK because PREM-MASK corrupts nuisances shared across the sentences that HANS tests.
POE and DFL For POE and DFI., we report test accu- racies on the HANS dataset McCoy et al. (2019) as in Mahabadi et al. (2019). HANS was created test the reliance of models on three known nuisances: 1) lexical overlap. 2) subsequence match, and 3) constituent match- ing subtrees in the parse trees. Known-nuisance POE and DFL use exact knowledge of these nuisances.
Table 5: Average and standard devia- tion of accuracies (over seeds) on the HANS dataset. The results for POE and DFL that use known nuisances are given under known. POE with NGRAM-RAND performs better than known-nuisance POE. DFL with NGRAM-RAND (NR) closes 84% of the gap between ERM and known-nuisame DFL. Both beat ERM.
Table gives the mean test accuracies over 10 seeds. For both DFL. and POE, selecting the size hyperparame- ter based on the average accuracy on a small evaluation dataset (1000 samples) from the test distribution gives n = 3. With this size, POE with this size achieves 66.7% 66,7 improving over POE with known nuisances (66.3%). DFL with NGRAM-RAND of size 3, achieves 68.4%. closing 84% of the gap between ERM and known-nuisance DFL (69.3%). We give results for all n-gram sizes in table 10 in appendix B; this table shows that both POE and DEL beat ERM for all n--ramm sizes.
POE
DFL
Known
66.3 + 0.6%
69.3 + 0.2%
NR
66.7 1 1.5%
68.4 +. 1.5%
ERM
63.6%.
JTT For JTT, we repeat the NLI experiment from Liu et al. (2021), where the presence of negation word in the hypothesis sentence is the nuisance. The groups here are subsets of the data that correspond to a value of the label and whether or there is negation word in the hypothesis. Vanilla JTT uses group annotations in the val- idation data to tune the hyperparameters and early stop training. For each n--ram size, we run JTT with NGRAM- RAND for two values of the number of epochs of training for the identification model: 2,3. Following the hyper- parameter selection procedure from Liu al. (2021), for each n-gram size, we give the results for the run with the higher validation worst-group accuracy. We run vanilla JTT using the reported optimization hyperparameters from (Liu et al., 2021).
Table 6: Worst-group and average test accuracies of JTT on NLI. JTT with PREM-MASK (PM) and NGRAM-RAND (NR) outperforms vanilla JTT and ERM.
Worst-group
Avg.
Vanilla JTT 71.3%
79.1%
ITT + PM
72.1%
79.9%
JTT + NR
74.3%
79.7%
ERM
67.9%
Table gives the results. Selecting the size hyperparameter for NGRAM-BR AM-RANDR using validation worst-group accuracy, like Liu et al. (2021) do for JTT, gives = 1 with test worst-group accuracy of 74.3%, better than vanilla JTT's 71.3%. Additionally, table 11 shows that JTT using NGRAM- RAND every size or PREM-MASK perform better than both vanilla JTT (71.3%) and ERM (67.9%).
RELATED WORK
Epurious-corrclatio avoiding methods (SCAMS) like (Veitch et al., 2021; Clark et al., 2019; Puli al., 2022; He et al., 2019; Makar et al., 2022) assume the nuisance available as additional knowledge during training. Semantic corruptions offer complementary approach to hand-crafting nuisances or obtaining auxiliary labels, by capturing every nuisance that are separated from seman- tics (e.g. local nuisances and global semantics). Liu et al. (2021) build the identification model in JTT with ERM. When the identification model relies on semantics, upweighting misclassified samples produces data with different lebel-semanti relationship from the one in the training data. Models trained on such data are suboptimal on test data with the same semantic relationship as the training data. Using semantic corruptions reduces the identification model's reliance the semanties.
8

---

Under review as a conference paper at ICLR 2023
Sinha et al. (2021) use techniques like PATCH-RAND restrict supports in self-supervised learning and generative modeling. Carlucci et al. (2019) use PATCH-RAND images to encourage a model to recover semantic structure. In contrast, we PATCH-RAND to corrupt semantics and build biased models that rely on the nuisances, which help build predictive models that avoid reliance on nuisances. Work like (He al., 2019; Puli al., 2022) also use semantic comruptions without pointing out the reliance on knowledge about semantic features in producing nuisances, He et al. (2019) use the hypothesis as a nuisance to build biased model for NLI; this is the masking based semantic corruption PREM-MASK. Puli et al. (2022) focus on chest X-ray classification, and use the out-of-body border of the X-ray as a nuisance; this corrupting semantics via ROI-MASK.
Work like Bahng et al. (2020) uses CNNS with small receptive fields (RFs), to help capture local nuisances. However, their method is typically limited to very small filters because at size 3x3, deep neural networks like VGG detect non-local semantics like shapes. In contrast, the size choice in PATCH-RAND has no bearing on the choice of the model; we used default vision models. Bras et al. (2020) automatically identify and remove examples with nuisances using adversarial filtering. but risk removing genuinely easy examples. Qin et al. (2021) work solely with vision transformers and consider why labels can be predicted from transformations akin to patch-randomized images. Concluding that this can only be due to nuisances, they propose to encourage the transformer have predictions and representations of the original images be dissimilar from those of patch-randomized images. In contrast, our work applies to general flexible models and shows that semantic corruptions can be used to break the label's relationship with nuisances in the original images.
6 DISCUSSION
We study the use of semantic knowledge in building robust models. Given a procedure to corrupt semantics, anything that predicts the label in the corrupted input is a nuisance. Using semantic corruptions, practitioners can run different kinds of spurious-correlation avoiding methods (SCAMS) (NURD, JTT, DFL, POE). With these semantic corruptions, methods like NURD and DFL perform close to how they would with known nuisances, and methods like JTT perform better than how they would when relying on ERM on the raw covariates to build a nuisance.
The quality of any semantic corruption, and thus the quality of the results, depends on the extent to which semantics are destroyed and nuisances are retained. PATCH-RAND and NGRAM-RAND are built corrupt global semantics and retain local nuisances, ROI-MASK tain nuisances outside the ROI and PREM-MASK to retain nuisances in hypothesis.
Limitations.
When applied to cases other than what they were built for, these methods may not destroy all the semantics retain all the nuisances and thus yield models that generalize. For example, when PATCII-RAND is used blindly on covariates with local semantics, the biased model may rely on said semanties; this in turn guides the predictive model to ignore these semantics and, thus, lose predictive performance. Alternativeyy, when nuisances are global, PATCH-RA may corrupt them. For example detecting cows and penguins, other nuisance animals (like dogs) may co-occur with cows more often; PATCH-RAN RAND would corrupt this nuisance animal. Using PATCH-R R AND in a SCAM for such tasks could lead to non-robust predictive models that rely on corrupted nuisances.
Our experiments show blind usage does not always lead to poor performance despite violations of the separation that underlies the semantic corruption. In both classifying waterbirds and NI.I, there exist local semantics, like small beaks and individual words, that are not corrupted by PATCH-RAND and NGRAM-RANC respectively. However, in our Waterbirds and NLI experiments, we show models built using semantic corruptions close more than 80% of the gap in test performance between ERM and the methods that use known nuisances. Similarly. ROI-MASK соrтuрts nuisances in the ROI and retains semantics outside it. However, in both waterbirds and cardiomegaly detection, where nuisances like hospital-specific tokens and background features lie in the ROI, ROI-MASK still helps NURD close > 75% of the gap in test performance between ERM and NURD with known nuisance.
Summary. Semantic corruptions power SCAMS to build models robust to spurious correlations without requiring extra annotations in the form of known nuisances during training relying on hard to verify assumptions like ERM-trained models relying on nuisances. As discussed above, experiments point out that using semantic coruptiions leads to improved robustness even under violations of the separation assumptions they are built off of. These two properties indicate the value of semantic corruptions as way to build robust models.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Sara Beery, Grant Van Hom, and Pietro Perona. Recognition in terra incognita. In Proceedings of the European conference computer vision (ECCV), pages 456 473,473, 2018.
Martin Arjovsky, Léon Bottou, Ishaan Guirajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint arXiv: 2019.
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut learning deep neural networks, 2020.
Rabeeh Karimi Mahabadi, Yonatan Belinkov, and James Henderson. End-to-end bias mitigation by modelling biases in corpora. arXiv preprint arXiv: 1909.0632,, 2019..
Maggie Makar, Ben Packer, Dan Moldovan, Davis Blalock, Yoni Halpern, and Alexander D' Amour. Causally-motivatedd shortcut removal using auxiliary labels. In AISTATS, 2022.
Evan Z Liu, Behzad Haghgoo, Annie S Chen, Aditi Raghunathan, Pang Wei Koh, Shiori Sagawa, Percy Liang, and Chelsea Finn. Just train twice: Improving group robustness without training group information. In International Conference on Machine Learning, pages 6781-6792. PMLR, 2021.
Aahlad Manas Puli, Lily Zhang, Eric Karl Oermann, and Rajesh Ranganath. Out-of-distribution generalization in the presence of nuisance-induced spurious correlations. In International Confer- ence on Learning Representations, 2022. URL https: http://wpppeeeeeeeeeeeeeeeeeeeep net forum?id= 12RoR2o32T.
He He, Sheng Zha, and Haohan Wang. Unlear dataset bias in natural language inference by fitting the residual. arXiv preprint arXiv: 10763 2019.
Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generaliza- tion. arXiv preprint arviv: /9/ 1.08731, 2019.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In NAACI,, 2019.
Adina Williams, Nikita Nangia, and Samuel Bowman. A broad-coverage challenge corpus for sen- tence understanding through inference. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Tech- nologies, Volume (Long Papers), pages 1 1112-1122. Association for Computational Linguistics, 2018. URL http: / web. / werg/annthee aaa/noooolllloo /N1y//115 8-1101
Thomas McCoy, Ellie Pavlick, and Tal Linzen. Right for the wrong reasons: Diagnosing syntactic heuristics in natural language inference. arXiv preprint 190.v:1902.01007, 2019.
John R Zech, Mareus A Badgeley, Manway Liu, Anthony B Costa, Joseph J Titano, and Eric Karl Oermann. Variable generalization performance of a deep learning model to detect pneumonia in chest radiographs: cross- srossnsectional study. PLoS medicine, 15111)xe00,66,, 2018.
Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel R Bowman, and Noah A Smith. Annotation artifacts in natural language inference data. arXiv preprint 15f3:1880002222 2018.
Ishaan Gulrajani and David Lopez-Paz. In search of lost domain generalization. arXiv preprint arXiv:2007.01334, 2020.
Connor Shorten and Taghi M Khoshgoftaar. A survey on image data augmentation for deep learning. Journal of big data, 6(1):1-48, 2019.
Jeremy Irvin, Pranay Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ilcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al. Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison. Proceedings of the AAAI Conference Artificial Intelligence, volume 33, pages 590-597, 2019.
10

---

Under review as a conference paper at ICLR 2023
Alistair EW Johnson, Tom Pollard, Nathaniel R Greenbaum, Matthew P Lungren, Chih-ying Deng, Yifan Peng, Zhiyong Lu, Roger G Mark, Seth Berkowitz, and Steven Horng. Mimic-cxr-jpg large publicly available database of labeled chest radiographs. arXiv preprint arXiv:1901.07042, 2019.
Victor Veitch, Alexander D' Amour, Steve Yadlowsky, and Jacob Eisenstein. Counterfactual invari- ance spurious correlations: Why and how pass stress tests. arXiv preprint arXiv:2106.0054:: 2021.
Christopher Clark, Mark Yatskar, and Luke Zettlemoyer. Don't take the easy way out: Ensemble based methods for avoiding known dataset biases. arXiv preprint arXiv: hww::/909.000 1909.0683,, 2019.
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation. arXiv preprint arXiv:2102.051133 2021.
Fabio M Carlucci, Antonio D'Innocente, Silvia Bucci, Barbara Caputo, and Tatiana Tommasi. Do- main generalization by solving jigsaw puzzles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1229-2233 2019.
Hyojin Bahng, Sanghyuk Chun, Sangdoo Yun, Jaegul Choo, and Seong Joon Oh. Learning de-biased representations with biased representations. In International Conference on Machine Learning, pages 528-539. PMLR, 2020.
Ronan Le Bras, Swabha Swayamdipta, Chandra Bhagavatula, Rowan Zellers, Matthew E. Peters, Ashish Sabharwal, and Yejin Choi. Adversarial filters of dataset biases. In ICMI., 2020.
Yao Qin, Chiyuan Zhang, Ting Chen, Balaji Lakshminarayanaan, Alex Beutel, and Xuezhi Wang. Understanding and improving robustness of vision transformers through patch-based negative augmentation. arXiv preprint arXiv:2 2021.

---

Under review as a conference paper at ICLR 2023
A FURTHER DETAILS ABOUT SPURIOUS-CORRELATII AVOIDING METHODS
NURD. Focusing on mitigating spurious correlations, Puli al. (2022) identify conditional that has performance guarantees on every test distribution within a family of distributions with vary- ing nuisance-label relationships: pte E F. They develop NURD to learn the conditional using data only from Ptr * Pte- NURD uses 1) the nuisance-randomized distribution, P. (Y, z, x) = p(y)p. (2)))(Z)p(x
y,z), where p.Ipp. y, and 2) an uncorrelating representation r(x) for which p p. y r(x). NURD builds models of the form p. (y | r(x)) using r(x) that are most informa- tive of the label.
We run reweighting-Nuse
which uses biased model Per z) as an importance weight to com- pe-(y)
pute loss under the nuisance-randomized distribution: p. (y, 2, x) ptrly 2) (y, 2, x).
To run neweighting-NURE with semantic corruptions, we replace Ptr (y | 2) with Pt- T(x)) for semantic corruption T(x). Semantic corruptions are noisy functions of with noise such that (y, 11 (xx) = U (xx c). This implies
y y PL 6 - y x x - y T(x) x
Thus, r(x) = x is uncorrelating and p. (y x) achieves the optimality guarantees in Puli et al. (2022). These optimality guarantees imply that regardless of the test nuisance-label relationship, ( x) will achieve optimal performance within the class of models like (y r(x)).
End-to-end bias mitigation. Mahabadi et al. (2019) consider two methods to train a biased model (y z) and a base predictive model jointly make the base model predict without relying on the biases. The methods use and fine-tune a BERT model (Devlin et al., 2019) and do not propagate the gradients of the biased model update the common parameters (token embeddings in this case). They propose 1) POE, where the log of the product of the predictions (the output probabilities) of the two models is used compute the classification loss and 2) DFL, where the biased model is used to weight the cross- cross-entropy loss for the base model.
The intuition for POE is that the samples for which the biased model classifies correctly will not contribute to the gradients of the base model; thus the base model focuses more on classifying samples that the biased model misclassifies. The DFL algorithm weights each sample as the biased model's ' predicted probability of all but the label, exponentiated with y > O. This downweights samples that the biased model classifies correctly which in turn mitigates the base model's reliance on a nuisance which only helps predict the downweighted samples correctly.
Mahabadi et al. (2019) build the biased model as pt. (y z) with known nuisances z. We replace this model with Pt-(y (y [x))) for semantic corruption T(x).
Just Train Twice (JTT). JTT works in two stages: 1) build an "identification" model via ERM on the training data to isolate samples that are misclassified due to reliance on the nuisances and 2) train a model via ERM on data with the loss for the misclassified samples upweighted (by constant X).
The identification model in JTT is built to be biased model. When the identification model equals (y z). it exactly misclassifies the samples in the groups in the minority group'. Upweighting these samples produces a dataset with lesser dependence between the nuisance and the label. Then, models learned on the upweighted data depend more on the semantic features.
In this work, we build the identification model on semantic corruptions i.e. we learn (y Tx()).
The training samples to be upweighted are the ones misclassified when predicting with the identifi- cation model on semantic-com cemantic-corupted versions of the sample, i.c. T(x). The second stage is run as in (Liu et al., 2021) with training data.
B FURTHER EXPERIMENTAL DETAILS
See fig. 3 for an example of PATCH-RANT for chest X-rays.
'The minority group is the set of samples that the nuisance misclassifies. For example, when (y = Pe # z). then the minority group is the set of samples with y o z because using only the nuisance feature results in predicting y = b on samples with b.
12

---

Under review as a conference paper at ICLR 2023
Figure 3: Example of PATCH-RAND of a chest X-ray image. The original image is the left most followed by PATCH-RANDS with sizes 112, 56, 28, 14, 7, 2 respectively.
B.1 IMPLEMENTATION DETAILS
Each experiment in the paper was run on up to 2 RTX8000 GPUs. The hyperparameters for methods which use known nuisances in the training data like NURD, POE, DFL are tuned on validation data from the training distribution. We do the same when using semantic corruptions.
Experimental details for Waterbirds For the NURD setup, the training. validation, and test datasets have 3020, 756, 800 samples respectively. We use a single architecture to parameterize the predictive model and the weight model in this experiment: two fully connected layers on top of a ResNet18 initialized at weights pretrained on Imagenet. We use the same training procedure for NURD with known nuisances or with semantic corruptions. Both models are trained with cross- entropy. The weight model is optimized with the default Adam optimizer for 20 epochs with a batch size 64. The predictive model optimized with the Adam optimizer for 20 epochs with learning rate of 0.0002, weight decay of 0.01, and batch size of 250.
For the JTT setup, the training, validation, and test datasets have 4795, 1199, 5794 samples respec- tively. For JTT, we use the same model and model parameters as Liu et al. (2021) using their released code. We repeat the details here for completeness. The model for both stages of JTT is ResNet-50. Both models are optimized by stochastic gradient descent (SGD) with momentum 0.9, weight decay 1.0, and learning rate 1 x 10-5, Both models are trained for 300 epochs with batch size 64, using batch normalization and no data augmentation. The identification model used to select samples to upweight corresponds to epoch 60 and the upweighting constant is À 100.
Experimental details for cardiomegaly detection. The training, validation, and test datasets are fixed across seeds and have 18000, 2000, 1000 samples respectively. To run Seweighting-URRE we single architecture to parameterize the predictive model and the weight model in this exper- iment: two fully connected layers on top of a ResNet18 initialized at weights pretrained on Ima- genet. In known-nuisance NURD with the hospital the nuisance, the biased model is an estimate of Per (y hospital). which is obtained by binning the samples based on the hospital and averaging the labels. We the same training procedure for NURD with known nuisances or with semantic corruptions. Both weight and predictive models are trained with cross-entropy. The weight model and the predictive model are optimized with the Adam optimizer over 25 epochs with batch size of 256, and learning rate 0.001.
Implementation details for NL1 For POE and DFL, we build classifiers by fine-tuning a pretrained BERT model (Devlin et al., 2019) on the data. We follow the same training procedure and hyper- parameter details as used in Mahabadi et al. (2019) models were trained on the MNLI training dataset which consists of 392k examples, with learning rate of 2 x 10-5 with batch size of 8 using the Adam Optimizer. All models are trained for 3 epochs. The development set contains 9815 examples and the HANS test contains 30000 examples. Since the HANS dataset has only two labels we combine the neutral and contradiction classes during
"entailment' and 'non-entailment
inference on HANS.
For the JTT setup, Liu et al. (2021) mix the training and development sets from MNLI and create their own training, validation, and test sets of sizes 206175, 82462, 123712 respectively. For JTT, we use the same model and model parameters as Liu et (2021) using their released code. We use the optimal hyperparameters reported in Liu et al. (2021) for the learning rate, weight decay, and the upweighting constant. We repeat the details here for completeness. The model for both stages of JTT is a pretrained BERT model that is finetuned during training. Both models are optimized by the AdamW optimizer with clipping for the predictive model, no weight decay, and an initial learning rate of 10-5 Both models are trained for 5 epochs with batch size 32 and dropout. The identification model used to select samples to upweight corresponds to epoch for vanilla JTT (reported optimal in Liu et al. (2021)); for JTT with semantic computiion, select one from
13

---

Under review as a conference paper at ICLR 2023
Table 7: Mean and standard error of test accuracy across 10 seeds of NURD on classifying water- birds. Known-nuisanee NURD uses label for the type of background as the nuisance. Selecting the size hyperparameter based on the average accuracy over 10 seeds on evaluation dataset (200 sam- ples) gives for PATCH-RAND, 196 for ROI-MASK, 196 for FREQ-FILTER, and 0.2 for INT-FILTER. Consider the gap between ERM and known-nuisanee NURD. NURD with FATCH-RAND, ROI-MASK, FREQ-FILTER, and INT-FILTER close 99%, 93%, 89%, 82% of the gap respectively. NURD with these semantic corruptions outperforms ERM and NURD with RAND-CROP and GAUSS-NOISE. NURD with all semantic corruptions outperforms ERM (69.2%).
known
RM
RM
RM
RM
PR 7
PR
PR
PR
2
196
168
140
112
14
28
56
ERM
Mean
87. 87.2% 87.0% 1.0%
87.6% 1.8%
85. 85.1%
85.5%
82.6%
86.0%
83.9%
80.4%
69.2%
Std. err.
1.0%
1.0%
1.6%
2.2%
1.5%
1.2%
2.0%
2.1%
FF 196
FF
FF
FF 112
IF
IF
IF
IF
168
140
0.1
0.2
0.3
0.4
Mcan Std.
85.2%
82.6% 1.6%
83.7%
80.1% 1.5%
83.1% 1.8%
84.0%
80.7% 3.3%
7%%
1.2%
1.0%
1.9%
3.4%
CROP 56
CROP 28
CROP 14
CROP 7
GAUSS 0.01
GAUSS 0.25
GAUSS 1
GAUSS 4
Mean
81.9%
80.3%
74.9%
67.9%
75.8%
74.1%
78.0%
83.9%
Std. err.
1.5%
1.3%
1.5%
2.9%
3.2%
3.1%
3.4%
1.4%
2,3 using validation group annotations. For both, the upweighting constant is À 6. Our runs with these parameters did not yield the test worst-group aceuracy reported in (Liu et al., 2021) (72.6%); our experiments yielded test worst-group accuracy 71.3%. We expect this may be due to the differences in the random seed; JTT is sensitive to hyperparameters and differences in order of batches may result in drops in performance.
In NGRAM -GRAM-RAND, when the number of words in the sentence is not multiple of there will be one k-gram (k < 71). In implementing NGRAM-RAN RAND, we ensure that the position this k-gram is randomized i.e. make that it does not always at the end of the sentence, for example. NGRAM-RAND is implemented before word-piece tokenization (which BERT uses), to ensure that randomize words instead of subwords.
We also create small HANS-like development set, which can be optionally used tune the size parameter. This set is constructed by randomly sampling 1000 examples from the HANS training set, which does not have any overlap with the main HANS test set.
B.2 FULL RESULTS TABLES
We give the results for all size parameters; see table 7, table 8, table 9, table 11, and table 10. To report the same metrics as in Mahabadi al. (2019) for POE and DFL and Puli al. (2022) for NURD, we report standard error for NURD and standard deviation for POE and DFL.
Table 10: Average accuracies and standard deviation over seeds of POE and with semantic corruptions on the HANS dataset. The results for known POE and DFL from Mahabadi et al. (2019), where both methods use known nuisances. For both methods, selecting the size hyperparameter based on the average accuracy on a small evaluation dataset (1000 samples) from the test distribution gives n With this size, POE with BEERAMRRANT performs better than known-nuisance POE while DFL with NGRAM-RAND closes 84% of the gap between ERM and known-nuisance DFL.
z
POB
DFL
Known
66.3 + 0.6%
69.3 + 0.2%
1-gram
65.7 + 2.0%
66.5 1 1.5%
2-gram
66.0 0.9%
68.5 0.7%
3-gram
66.7 + 1.5%
68.4 1.5%
4-gram
66.2 + 2.9%
65.0 2.0%
ERM
63.6%.
14

---

Under review as a conference paper at ICLR 2023
Table 8: Mean and standard error of test accuracy across 10 seeds of NURD detecting car- diomegaly from chest X-rays. Known-nuisance NURD uses the hospital as the nuisance. Selecting the corruption parameters based the mean accuracy over 10 seeds on an evaluation dataset (200 samples) gives 7 for PATCH-RAND, 196 for ROI-MASK, 196 for FREQ-FILTER, and 0.1 for the INT- FILTER. Consider the gap between ERM and known- NURD. NURD with PATCH-RAND, ROI- MASK, FREQ-FILTER, and INT-FILTER close 77%, 79%, 70%, 60% of the gap respectively. NURD with NATCH-RAND ROI-MASK, FREQ-FILTER outperforms ERM and NURD with RAND-CROP and GAUSS-NOISE. NURD with PATCH-RAND and ROI-MASK outperforms ERM for all size parameters.
known
RM
RM
RM
RM
PR
PR
PR
2
196
168
140
112
14
28
56
ERM
Mean
81.7% 0.3%
77.2% 0.8%
75.0%
74.4%
68.9%
77.5%
75.2%
72.2%
69.2%
62%
Std. err.
0.9%
1.3%
1.6%
0.6%
0.8%
1.3%
2.3%
2.0%
FF
FF
FF
FF
IF
IF
IF
IF 0.4
196
168
140
112
0.1
0.2
0.3
Mcan Std.
75.6%
74.2% 1.5%
70.4% 2.0%
71.4% 1.1%
73.9% 0.9%
69.8% 1.5%
61.8% 3.2%
54.0%
1.3%
2.3%
CROP 56
CROP 28
CROP 14
CROP 7
GAUSS 0.01
GAUSS 0.25
GAUSS 1
GAUSS 4
Mean
75.1% 71.2%
66.1%
67.9%
58.8%
49.0%
51.9%
51.1%
Std. err.
0.9%
1.2%
1.7%
1.9%
3.7%
2.8%
2.1%
2.3%
Table 9: Test worst-group accuracies of JTT with semantic corruptions waterbirds. Selecting the corruption hyperparameters on the validation worst-group accuracy gives size 14 for AATCH-RAND, size 196 for ROI-MASK, size 112 for TREQ-FILTER and threshold 0.4 for INT-FLTER. JTT with these semantic corruptions outperforms ERM, vanilla JTT, and JTT with the baseline corruptions RAND-CROP and GAUSS-NOISE. JTT with PATCH-RAND and ROI-MASK outperforms JTT with the baseline corruptions and ERM at every patch/border-size.
Vanilla
RM
RM
RM
RM
PR
PR
PR
PR
JTT
196
168
140
112
7
14
28
56
ERM
86.5%
88.2%
88.0%
86.9%
86.2%
89.3%
89.0%
88.9%
89.1%
72%
FF
1F
IF
IF
1F
196
168
140
112
0.1
0.2
0.3
0.4
82.5%
84.5%
85.2%
87.2%
69.1%
80.0%
81.7%
87.0%
CROP
CROP 28
CROP
CROP
GAUSS
GAUSS 0.25
GAUSS 1
GAUSS 4
56
14
0.01
59.1%
0.0%
0.0%
0.0%
0.0%
0.0%
71.0%
0.0%
Table 11: Worst-group and average test accuracies of JTT with semantic corruptions on NLL JTT with PREM-MASK and NGRAM-RAND of every size outperforms vanilla JTT. Selecting the size hyperparameter for NGRAM-RAN RAND using validation worst-group accuracy, like Liu et al. (2021) do for vanilla JTT, gives n 1. At this size, JTT with AGRAM-RANS outperforms vanilla JTT by 3%.
Worst-group
Average
Vanilla JTT
71.3%
79.1%
PREM-MASK
72.1%
79.9%
1-gram
71.3%
79.7%
2-gram
71.9%
80.0%
3-gram
72.0%
80.1%
4- 4-gram
73.4%
80.4%
FRM
67.9%
15


Reviews:
[{"review_id": "sCMW7dGth6j", "reviewer": "Reviewer_fx5t", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces a data augmentation framework that attempts to avoid spurious correlations (nuisance) in order to enjoy increased generalization. \nTo that end, the authors propose to corrupt the semantic signal in the input. If a model maintains a good level of prediction under these circumstances, it means the model relies on nuisance signals and is thus not robust. Achieving this through data augmentation is possible if nuisance and semantic signals in the inputs are well separable. The authors argue that one way to exploit signal separation is when: \n- local modifications of inputs does not change nuisance but harms semantics.  \n- semantic signal is position dependent (like organ positions in medical image inputs).\nThe authors leverage two random patch permutations (as data augmentation mechanisms) to exploit one of the above separation in practice.\n", "summary_of_the_review": "Major remarks: \n\nThe paper explains how to train a biased model using a method from the literature plus one of the introduced mechanisms. But the paper is too quick on how to exploit this biased model to avoid spurious correlations. Please add more information in this regard. Appendix A does not say more than the main text.\n\nThe proposed mechanisms belong to the family of random transformation type of data augmentation. Yet in the experimental section, no comparison with such alternative data augmentation mechanisms can be found. The authors should demonstrate that the positional information on which their augmentations rely is really a key aspect or if random cropping, random erasing or others might compete. \n\nIn Table 2, RM + NURD outperforms known nuisance + NURD for RM size 168. Is this normal ?\n\n\nMinor :\n\nStd deviations wrt the reported accuracies can only be found in the appendices. If paper length permits, I think it would be preferable to display them immediately. \n\nPage 2 : the authors start using mathematical notations that were not introduced before. ", "strength_and_weaknesses": "Pros : \n- The method is clear and addresses an important issue in deep learning\n- The approach is tested on various tasks\n- The method can be readily plugged into recent approaches from the literature\n\nCons : \n- The method applies only to data where positional information has an impact on semantics but not on nuisance\n- The methodological contribution needs to be validated by comparing to other data augmentation mechanisms that randomize inputs", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "gIxsZaiKGe", "reviewer": "Reviewer_yHka", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work proposes a new method to produce robust models by data augmentations that corrupt semantic information. Semantic corruptions power nuisance-avoiding methods to build robust models against spurious correlations without requiring extra annotations or strong assumptions. This paper analyzes semantic corruptions in powering different robust-modeling methods for multiple out-of-distribution tasks.", "summary_of_the_review": "This work is focusing on an important problem in reliable machine learning. The motivation of this paper is reasonable and the experimental results look good but there are a few detailed issues that need to be clarified.", "strength_and_weaknesses": "Strengths:\n\nS1: This paper focuses on adjusting for spurious correlations, which is an important problem in reliable machine learning.\n\nS2: The main idea of adopting data augmentations corrupt semantic information to produce models that identify and adjust for spurious correlations is reasonable.\n\nS3: The experimental results and analysis look good.\n\nWeaknesses:\n\nW1: A few details are not very clear. How to control the data augmentation directions? How to identify and disentangle the corrupt semantic features.\n\nW2: I wonder what the semantic augmented data look like and it may be better to visualize them.\n\nW3: It might be interesting if the authors can provide experimental results on large-scale datasets like ImageNet with spurious cues.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "cjwQY57bMd", "reviewer": "Reviewer_NEkh", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This article mitigates OOD issues in ERM with semantic corruption.", "summary_of_the_review": "Due to the poor writing of this article, it is difficult for me to follow what the author wants to convey.", "strength_and_weaknesses": "Strengths:\n1. The proposed method is well analyzed with rich ablation studies.\n2. This paper validates the effectiveness of the method on multiple tasks.\n\n\nWeakness:\n1.  The writing of this paper needs polishing. I have a hard time understanding the expression of this paper.\n2.  to produces -> to produce. In addition, there are many such errors.\n3.  It is recommended to validate the effectiveness of the method on larger datasets.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "SApTn_79s3", "reviewer": "Reviewer_QvJV", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper shows a simple way to improve the performances of existing methods to avoid spurious correlations, which can be applied to all methods that rely on a bias model that predicts the labels using the nuisances in the data. \n\n \n\nThe authors propose to build the biased model by using transformations to the input data that are such that nuisances are preserved, but the semantic information (which is the one that should drive the classifier) is destroyed. Two types of transformation are considered: 1) permutation-based, which can be applied when only nuisances (and not semantic information) are still present when the input data is randomized; 2) mask-based, which can be applied if only nuisances are present in a subsed of the input data. \n\n \n\nExperiment show that the method successfully avoids spurious correlations when the biased model is constructed as explained above. ", "summary_of_the_review": "This is overall an interesting work. However I have some concerns on the novelty of the presented ideas, as well as the applicability of the method in many real world applications.", "strength_and_weaknesses": "**STRENGTHS** \n\n1. The paper discusses a simple yet effective to generalize and improve existing methods. \n\n2. The performances reached in the experiments are close to then ones achieved when having labelled data for the nuisances. \n\n3. The method seems to be robust to the choice for the \"size\" hyperparameter, which makes it easier to be used in practice. \n\n \n\n \n\n**WEAKNESSES** \n\n1. I am not very convinced on the level of novelty of the paper. While I do acknowledge that the authors present a more unified view of existing methods by formally introducing semantics/separations, in practice many of the presented ideas have been already applied to the same or similar task (for example ROI-MASK in Puli et al, 2022). \n\n2. The two separations introduced in the paper work well with the benchmark datasets for this task. However I do not think they are generic enough in many real tasks, where there is no clear separation between semantics and nuisances, or no obvious data transformation to apply. \nROI masking is for example hard to apply in practice when relevant objects might be in very different parts of an image. \n\n ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject