Defending Against Image Corruptions Through Adversarial Augmentations
Authors: Dan Andrei Calian
Florian Stimberg
Olivia Wiles
Sylvestre-Alvise Rebuffi
András György
Timothy A Mann
Sven Gowal
Venue: ICLR 2022 Poster (2022)
Keywords: robustness
adversarial training
image corruptions

Abstract: Modern neural networks excel at image classification, yet they remain vulnerable to common image corruptions such as blur, speckle noise or fog. Recent methods that focus on this problem, such as AugMix and DeepAugment, introduce defenses that operate in expectation over a distribution of image corruptions. In contrast, the literature on Lp-norm bounded perturbations focuses on defenses against worst-case corruptions. In this work, we reconcile both approaches by proposing AdversarialAugment, a technique which optimizes the parameters of image-to-image models to generate adversarially corrupted augmented images. We theoretically motivate our method and give sufficient conditions for the consistency of its idealized version as well as that of DeepAugment. Our classifiers improve upon the state-of-the-art on common image corruption benchmarks conducted in expectation on CIFAR-10-C and improve worst-case performance against Lp-norm bounded perturbations on both CIFAR-10 and ImageNet.

Published as a conference paper at ICLR 2022
DEFENDING AGAINST
IMAGE
CORRUPTIONS
THROUGH ADVERSARIAL AUGMENTATIONS
Dan A. Calian'
Florian Stimberg 1
Olivia Wiles! oaxiles@deepmind com
dancallianedeepmind..com
deimmbrr@deeemindd..o com
Sylvestre-Alvise Rebuffi!
András György+
Timothy Mann
syLvestrrefdeepnnnd com
egyorgyddeepmind.cmm
mann. wwa.ttimtthy@ac..c org
Sven Gowal srowal@deepmind.com com
DDepMindd Meta
ABSTRACT
Modern neural networks excel at image classification, yet they remain vulnerable to common image corruptions such as blur, speckle noise or fog. Recent meth- ods that focus on this problem, such as AugMix and DeepAugment, introduce defenses that operate in expectation over a distribution of image corruptions. In contrast, the literature on Ep fy-norm bounded perturbations focuses on defenses against worst-case corruptions. In this work, we reconcile both approaches by proposing AdversarialAugment a technique which optimizes the parameters image-to-image models to generate adversarially corrupted augmented images. We theoretically motivate our method and give sufficient conditions for the consistency of its idealized version well that of DeepAugment. Classifiers trained using our method in conjunction with prior methods (AugMix & DeepAugment) improve upon the state-of-the-arr on common image corruption benchmarks conducted in expectation on CIFAR- 10-C and also improve worst-case performance against f--norm bounded perturbations on both CIFAR-10 and IMAGENET.
INTRODUCTION
By following process known as Empirical Risk Minimization (ERM) (Vapnik, 1998), neural net- works are trained to minimize the average error on a training set. ERM has enabled breakthroughs in a wide variety of fields and applications (Goodfellow et al., 2016; Krizhevsky et al., 2012; Hinton et al., 2012), ranging from ranking content on the web (Covington et al., 2016) to autonomous driving (Bojarski et al., 2016) via medical diagnostics (De Fauw et al., 2018). ERM is based on the principle that the data used during training is independently drawn from the same distribution as the one encountered during deployment. In practice, however, training and deployment data may differ and models can fail catastrophically. Such occurrence is commonplace as training data is often collected through biased process that highlights confounding factors and spurious correla- tions (Torralba et al., 2011; Kuchlkamp et al., 2017), which can lead to undesirable consequences (c.g., ht..tt///// /tte://geeee hee.//geeeedddeeeeeeeeees org).
As such, it has become increasingly important to ensure that deployed models are robust and generalize various input corruptions. Unfortunately, even small corruptions can significantly affect the performance of existing classifiers. For example, Recht et al. (2019); Hendrycks et al. (2019) show that the accuracy of IMAGENET models is severely impacted by changes in the data collection process, while imperceptible deviations to the input, called adversarial perturbations, can cause neural networks to make incorrect predictions with high confidence (Carlini & Wagner, 20;7;; Goodfellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014). Methods counteract such effects, which mainly consist of using random or adversarially
data augmentations, struggle. Training against corrupted data only forces the memorization of such corruptions and, as result, these models fail to generalize to new corruptions ( (Vasiljevic et al., 2016; Geirhos et al., 2018).
Recent work from Hendrycks et al. (2020b) (also known as AugMix) argues that basic pre-defined corruptions can be composed to improve the robustness of models to common corruptions. Another line of work, DeepAugment (Hendrycks et al., 2020a), commutt images by passing them through

---

Published as a conference paper at ICLR 2022
(a) Original
Ab) (EDSR) V = .0375
AdA (CAE) = .015
Figure 1: Adversarial examples generated using our proposed method (AdA). Examples shown from two different backhone architectures used with our method: EDSR in (b) and CAE in (c). Original images are shown in (a); the image pairs (b) and (c) show the adversarial example produced by our method on the left and exaggerated differences on the right. In this case, adversarial examples found through either backbone show local and global color shifts, while examples found through EDSR preserve high-frequeng details and ones found through CAE do not. Examples found through CAE also exhibit grid-like artifacts due to the transposed convolutions in the CAE decoder.
two specific image-to-image models while distorting the models' parameters and activations using an extensive range of manually defined heuristic operations. While both methods perform well on average on the common corruptions present in CIFAR- and IMAGENET-CC C, they generalize poorly the adversarial setting. Most recently, Laidlaw et al. (2021) proposed an adversarial training method based on bounding a neural perceptual distance (i.c., an approximation of the true perceptual distance), under the acronym of PAT for Perceptual Adversarial Training. Their method performs well against five diverse adversarial attacks, but, as it specifically addresses robustness to pixel-level attacks that directly manipulate image pixels, it performs worse than AugMix on common corruptions. In this work, we address this gap. We focus on training models that are robust to adversarially-chosse corruptions that preserve semantic content. We go beyond conventional random data augmentation schemes (exemplified by Hendrycks et al., 2020b;a) and adversarial training (exemplified by Madry et al., 2018; Gowal et al., 2019a; Laidlaw et al., 2021) by leveraging image-to-imas models that can produce wide range of semantics- preetiiiip corruptions; in contrast related works, our method does not require the manual creation of heuristic transformations. Our contributions are as follows:
We formulate an adversarial training procedure, named AdversarialAuggmen (or AdA for short) which finds adversarial examples by optimizing over the weights of any pre-trate mr--triieed image-to-image model (i.e. over the weights of arbitrary autoencoders).
We give sufficient conditions for the consistency of idealized versions of our method and Deep- Augment, and provide PAC-Bayesian performance guarantees, following Neyshabur et al. (2017). Our theoretical considerations highlight the potential advantages of AdA over previous work (DeepAugment), as well as the combination of the two. We also establish links to Invariant Risk Minimization (IRM) (Arjovsky et al., 2020), Adversarial Mixing (AdvMix) (Gowal et al., 2019a) and Perceptual Adversarial Training (Laidlaw al., 2021).
We improve upon the known state-of-theear (at the time of initial submission) on CIFAR- by achieving a mean corruption error (mCE) of 7.83% when using our method in conjunction with others (vs. 23.51 % for Perceptual Adversarial Training (PAT), 10.90% for AugMix and 8. 1119 % for DeepAugment). On IMAGENET we show that our method can leverage 4 pre-trained image- to-image models simultancously (VQ-VAE of van den Oord et al., 2017, U-Net of Ronneberger et al., 2015, EDSR of Lim et al., 2017 & CAE of Theis ct al., 2017) to yield the largest increase in robustness to common image corruptions, among all evaluated models.
On & and fox: norm-bounded perturbations we significantly improve upon previous work (Deep- Augment & AugMix) using AdA (EDSR), while slightly improving generalization performance on both IMAGENET-V2 and on CIFAR-10.1.
2 RELATED WORK
Data augmentation. Data augmentation has been shown to reduce the generalization error of standard (non-robust) training. For image classification tasks, random flips, rotations and crops
After our initial submission Diffenderfer al. (2021) obtained slightly better mCF. See G.1 for more details.
2

---

Published as a conference paper at ICLR 2022
commonly used (He et al., 2016a). More sophisticated techniques such as Cutout of DeVries & Taylor (2017) (which produces random occlusions), CutMix of Yun et al. (2019) (which replaces parts of an image with another) and mixup of Zhang et al. (2018a); Tokozume et al. (2018) (which linearly interpolates between two images) all demonstrate extremely compelling results. Guo et al. (2019) improved upon mixup by proposing an adaptive mixing policy. Works, such as AutoAuggent (Cubuk et al., 2019) and the related RandAugment (Cubuk et al., 2020), learn augmentation policies from data directly. These methods are tuned improve standard classification accuracy and have been shown to work well on CIFAR- 10, CIFAR- 100, SVHN and IMAGENET. However, these approaches do not necessarily generalize well to larger data shifts and perform poorly on benign corruptions such as blur or speckle noise (Taori et al., 2020).
Robustness to synthetic and natural data shift. Several works argue that training against cor- rupted data only forces the memorization of such corruptions and, as a result, models fail to generalize to new corruptions (Vasiljevic et al., 2016; Geirhos et al., 2018). This has not prevented Geirhos et al. (2019); Yin et al. (2019); Hendrycks et al. (2020b); Lopes et al. (2019); Hendryeks et al. (2020a) from demonstrating that some forms of data augmentation can improve the robustness of models on IMAGENET- C, despite not being directly trained on these common corruptions. Most works on the topic focus on training models that perform well in expectation. Unfortunately, these models remain vulnerable to more drastic adversarial shifts (Taori et al., 2020).
Robustness to adversarial data shift. Adversarial data shift has been extensively studied (Good- fellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014; Moosavi-Dezfore et al., 2019; Papernot al., 2016; Madry et al., 2018). Most works focus on the robustness of classifiers to f--norm bounded perturbations, In particular, it is expected that robust classifier should be invariant to small perturbations in the pixel space (as defined by the (--norm). Goodfellow et al. (2015), Huang et al. (2015) and Madry et al. (2018) laid down foundational principles to train robust networks, and recent works (Zhang et al., 2019; Qin et al., 2019; Rice et al., 2020; Wu et al., 2020; Gowal et al., 2020) continue to find novel approaches to enhance adversarial robustness. However, approaches focused on fn-norm bounded perturbations often sacrifice accuracy on non-adversarial images (Raghunathan et al., 2019). Several works (Baluja & Fischer, 2017; Song et al., 2018; Xiao et al., 2018; Qiu et al., 2019; Wong & Kolter, 2021b; Laidlaw et al., 2021) go beyond these analytically defined perturbations and demonstrate that it is not only possible maintain accuracy non-ad aon-adversarial images but also to reduce the effect of spurious correlations and reduce bias (Gowal et al., 2019a). Unfortunately. most aforementioned approaches perform poorly on CIFAR- and IMAGENET-C.
3 DEFENSE AGAINST ADVERSARIAL CORRUPTIONS
In this section, we introduce AdA, our approach for training models robust to image corruptions through the use of adversarial augmentations while leveraging pre-trained autoencoders. In Appendix A we detail how work relates Aug (Hendrycks et al., 2020b), DeepAugment (Hendrycks et al., 2020a), Invariant Risk Minimization (Arjovsky et al., 2020), Adversarial Mixing (Gowal et al., 2019a) and Perceptual Adversarial Training (Laidlaw et al., 2021).
Corrupted adversarial risk. We consider a model fe : X + y parametrized by 0. Given a dataset D C X x y over pairs of examples z and corresponding labels y, we would like to find the parameters A which minimize the corrupted adversarial risk:
E Em
-D max [(fe(x').v)) x'EC(x)
where L is suitable loss function, such as the 0-1 loss for classification, and C: X + corruption set for a given example x. For example, in the case of an image x, a plausible corruption set C(x) could contain blurred, pixelized and noisy variants of x.
2 outputs
In other words, we seek the optimal parameters 6* which minimize the corrupted adversarial risk so that for is invariant to corruptions; that is, fo- (z') = fe- (x) for all x' C(x). For example if z is an image classified to be a horse by for then this prediction should not be affected by the image being slightly corrupted by camera blur, Poisson noise JPEG compression artifacts.
3

---

Published as a conference paper at ICLR 2022
AdversarialAugmert (AdA). Our method, AdA, uses taage-to-image models to generate adversar- ially corrupted images. At a high level, this is similar to how DeepAugment works: DeepAugment models using heuristic operators, which perturbs the parameters of two specific image-to-imas are manually defined for each model. Our method, instead, is more general and optimizes di- rectly over perturbations to the parameters of any pre-trained image-to-image model. We call these image-to-image models corruption networks. We experiment with four corruption networks: vector-quantised variational autoencoder (VQ-VAE) (van den Oord et al., 2017); a convolutional U-Net (Ronneberger et al., 2015) trained for image completion (U-Ner), super-resolution model (EDSR) (Lim al., 2017) and compressive autoencoder (CAE) (Theis al., 2017). The latter two models are used in Dugmentment as well. Additional details about the corruption networks are provided in Appendix E.6.
Formally, let Go X' + X' be corruption network with parameters @ = { } which acts, with perturbed parameters, upon clean examples by corrupting them. Here each o, corresponds to the vector of parameters in the i-th layer, and K is the number of layers. Let 5 { kK be a weight perturbation set, so that a corrupted variant of æ can be generated by C(o. ) (2). With a slight abuse of notation, we shorten (( JKK to Cd+5- Clearly, using unconstrained perturbations can result in exceedingly corrupted images which have lost all discriminative information and are not useful for training. For example, if C is multi-layer perceptron, trivially setting 6, -Ø, would yield fully zero, uninformative outputs. Hence, we restrict the corruption sets by defining a maximum relative perturbation radius > 0, and define the corruption set of AdA as C(x) {<)+s(()) 2 S J). where the norm || ||2, is defined as || = (1....K |6:112/||<x11 ///122
Finding adversarial corruptions. For a clean image with label y, corrupted adversarial ex- ample within a bounded corruption distance v is a corrupted image x' = cg+s(x)) generated by the corrpption network with bounded parameter offsets [|ā]|2,0 S which causes fe to misclassify fo(x') # y. Similarly to Madry et al. (2018), we find an adversarial corruption by maximizing a surrogate loss L to L, for example, the cross-entropy loss between the predicted logits of the corrupted image and its clean label. We optimize over the perturbation ò c's parameters é by solving
max [(fe(co+o(z)) v). 6112,05v
(2)
In practice, we solve this optimization problem (approximately) using projected gradient ascent to enforce that perturbations 8 lie within the feasible set ||0]|2, S Examples of corrupted images obtained by AdA are shown in Figure 1.
Adversarial training. Given the model ʃ parameterized by 0, we aim to minimize the corrupted adversarial risk from (1) by solving the following surrogate optimization problem (using the loss function L instead of L):
0 arg min ((z
[(fo(coto())) 11
max
(3)
The full description of our algorithm given in Appendix
Mcaningful corruptions. A crucial element of AdA is setting the perturbation radius v to ensure that corruptions are varied enough constitute strong defense against common corruptions, while still being meaningful (i.e., without destroying semantics). We measure the extent of corruption induced by a given through the structural similarity index measure (SSIM) (Wang et al., 2004) between clean and corrupted images (details on how SSIM is computed are given in Appendix F.I). We plot the distributions of SSIM over various perturbation radii in Figure for corrupted images produced by AdA using two backbones (EDSR and CAE) on CIFAR- 10. We find that a relative perturbation radius of v = .015 yields enough variety in the corruptions for both EDSR and CAE This is demonstrated for EDSR by having large SSIM variance compared to, e.g. without destroying semantic meaning (retaining a high mean SSIM). We guard against unlikely but too severe corruptions (i.e. with too low SSIM) using efficient approximate line-search procedure (details can be found in Appendix F). A similar approach for restricting the SSIM values of samples during adversarial training was used by Hameed (2020); Hameed & György (2021).
0.009375,
4

---

Published as a conference paper at ICLR 2022
50-
EDSR 0.0078
CAE v 0.0075
EDSR 0.009378
CAE 0.015
60
EDSR
0.011255
CAE 0A225
Density
EDSR
0.013125
Density
02
CAE 0.03
00-
EDSR
0.015
10
CAE 0.0375
21-
0.90
0.52
0,91
0.50
0.35 1.00
0.0
0.2
0.1 0.6
1.0
SSIM
SSIM
Figure Distribution SSIM scores between clean and adversarial images found through AdA. Densities are shown for two backhones (EDSR & CAE) backhones at five perturbation radii (V). The AdA (EDSR) SSIM distribution with low perturbation radius (v 0.0075) is highly concentrated around 0.99 yielding images very close the clean inputs; increasing y slightly, dissipates density rapidly. For AdA (CAE) increasing the perturbation radius shifts the density lower. yielding increasingly more corrupted images. Also note that SSIM range with non-zero support of AdA (CAE) is much wider than of AdA (EDSR).
4 THEORETICAL CONSIDERATIONS
In this section, we present conditions under which simplified versions of our approach (AdA) and previous work (DeepAugment), are consistent (i.e., the data size grows, the expected error of the learned classifier over random corruptions converges to zero). The role of this section is two-fold: (I) to show that our algorithm is well-behaved (i.e.. it converges); and (2) introduce and to reason about sufficient assumptions for convergence.
In this section assume that the classification problem consider is binary (rather than multi-class) and that the loss function is the 0-1 loss. Thus, denoting the parameter space for 0 and ø by θ and 4 we assume that there exists ground-truth binary classifier fo- for some parameter 0" O. We further assume that the clean input samples come from a distribution μe over X, and the algorithm is given a of labeled (clean) data points {Z,, 9t) where ys fe- (z:).
To start with, we consider the case when the goal is to have good average performance on some future corruptions; as such, we assume that these corruptions can be described by an unknown distribution of corruption parameters ø over Φ. Then, for any 0 E θ the expected corrupted risk is defined as
R(fe. a) = Ez-pp,aaa [Lfe c,)( (x))
(4)
which is the expected risk of fo composed with a random corruption function Cp. Φ a.
Since a unknown, we cannot directly compute the expected corrupted risk. DeepAugment overcomes this problem by proposing suitable replacement distribution 3 and instead scores
classification functions by approximating R(fe, (rather than R(fe. a:)). contrast, AdA searches over a set, which we denote by 4 C 4 of corruptions to find the worst case, similarly to the adversarial training of Madry et (2018).
Augment. The idealized version of DeepAugment (which neglects optimization issues and the use of a surrogate loss function) is defined as 0|m) = arg mingge 1 n Σi= L(ffo a cas (x:;). ys). The following assumption provides a formal description of a
where &² ~ 3 for = 1,, n. ........ suitable replacement distribution.
Assumption 1. (Corruption coverage) There exists a known probability measure 3 over T such that a is absolutely continuous with respect to 33 (i.e, o > Ofror some W C & then 3(W) > 0) and for all x, fo- (x) fo- (cs (x)) )) for all o E sf), where s3p)(3) is the support of the distribution 3 (that is, Pro- [fe- (I) = fe- (e-(cc(( (z)]
1).
Assumption says that while we do not know a, we do know another distribution 3 over corruption functions with support at least broad as that of Furthermore, any corruption function that belongs to the support of 3 leaves the ground-truth label unchanged, which implies that the corrupted adversarial risk (1) of the optimal predictor fo- is zero when the corruptions are restricted to supp(33.
Given Assumption 1, the problem reduces to learning under covariate shift and, since 0" E θ, empirical risk minimization yields consistent solution to the original problem (Sugiyama al., 2007, footmote 3), that is, the risk of ((7) converges to the minimum of (4). Thus, the idealized version of DeepAugment is consistent.
5

---

Published as a conference paper at ICLR 2022
1.0
0.5
SSM
0.6
0.2
CAE EDSR
00
Comnian
Stot
Notie
Insotte
Role
Dalooa
Blar
Cluss
Blur
Mestia
Zoom
Snow
Frest
Fog
Brightsees
Centraal
Elatte
Pieslate
JPEG
Garntaa
Blur
Satwese
Sparter
Speckd
Neles
Figure3 3: Reconstructing CIFAR-1O-4 corruptions through two image-to-image models. These bar plots show the extent to which two AdA backbones (EDSR CAE) can be used to approximate the effects of the 15 corruptions present in CIFAR- 10-C C. Bars show mean (and 95% CI of the mean) SSIM (Wang ct al., 2004) (higher is better) between pairs of corrupted images and their reconstructions (starting from the original images).
AdversarialAugment. An idealized version of AdA defined as
arg min ess sup L(Jo o co)(s.),
(5)
AdA
O
The essential supremum operation represents our ability to solve the difficult computational problem of finding the worst case corruption (neglecting corruptions of ß-measure zero). Assuming that
compute (5), the consistency of the idealized version of AdA (i.e., that the error of AdA converges to the minimum of (1), which is O under Assumption as discussed above) is guaranteed for predictor classes (So} with bounded capacity measures, such particular for neural networks with bounded weights, since 6* E Ô (see, c.g., Anthony & Bartlett, 2009; Golowich et al., 2017). Furthermore, as the expected loss of the learned predictor converges to zero for the supremum loss (over the corruptions), so does R( (8), and also R(forn a) since supp(a) C s3) (based on Assumption 1).
Rademacher complexity, in
Discussion. In Appendix C we relax this assumption to consider the case of inexact corruption coverage (Assumption 2). In Appendix D we also analyze these algorithms using the PAC-Bayesian view. In Figure 3 we explore how well Assumption 1 holds in practice: it is shown how well the 15 corruptions present in the CIFAR- 10-C benchmark can be approximated by two corruption functions, EDSR and CAE. For each image pair (of a corrupted and clean image) in random 640-image subset of CIFAR- 10-C and 100,
optimize the perturbation the corruption network parameters that best transform the clean image into its corrupted counterpart by solving the perturbation to the corruption network's
max; SSIM(ca+511) x²) 10 5 11 where parameters, x is the clean example and x' is its corrupted counterpart; we also apply & regularization with a constant weight (as shown above) to penalize aggressive perturbations. We use the Adam optimizer (Kingma & Ba, 2014) to take 50 ascent steps, with a learning rate of 0.001. Finally, we average the residual SSIM errors across all five severities for each corruption type. Note that both models can approximate most corruptions well, except for Brighiness and Snow. Some corruption types (e.g. Fog, Frost, Snow) are better approximated by CAE (0.84 0.16 overall SSIM) while most are better approximated by EDSR (0.91 + 0.26 overall SSIM).
EMPIRICAL RESULTS
In this section we compare the performance of classifiers trained using our method (AdA) and competing statc-of-the et al,, 2020a) on (1) robustness to common image corruptions (on CIFAR-1O-C & IMAGENET-C), (2) robustness to no-morm bounded adversarial perturbations; and (3) generalization to distribution shifts on other variants of IMAGENET and CIFAR- 10. For completeness, on CIFAR- also compare with robust classifiers trained using four well-known adversarial training methods from the literature, including: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang al., 2019), Adversarial Weight Perturbations (AWP) (Wu et al., 2020) as well Sharpness Aware Minimization (SAM) (Foret et al., 2021). Additional results are provided in Appendix G.
methods (AugMix of Hendrycks et al., 2020b, DecpAugment of Hendrycks
Overview. On CIFAR- 10-C we set a new state-of-th-att (at time of initial submission) mCE of 7.83% by combining" AdA (EDSR) with DeepAugment and AugMix. On IMAGENET (downsampled
AAppendix E.5 details how methods are combined.

---

Published as a conference paper at ICLR 2022
to 128 x 128) we demonstrate that our method can leverage 4 image-to to--nag models simultaneously to obtain the largest increases in mCE. Specifically, by combining AdA (All) with DeepAugment and AugMix we can obtain 62.90% mCE which improves considerably upon the best model from the literature that we train (70.05% mCE, using nominal training with DeepAugment with AugMix). On both datasets, models trained with AdA gain non-trivial robustness z z--norm perturbations compared to all other models, while showing slightly better generalization to non-synthetic distribution shifts.
Experimental setup and evaluation. For CIFAR- 10 we train pre-activation ResNet50 (He et al., 2016b) models (as in Wong et al. (2020)) the clean training set of CIFAR- 10 (and evaluate on CIFAR-10-C and CIFAR- 10.1), D) our models employ 3 x 3 kernels for the first convolutional layer, as in previous work (Hendrycks et al., 2020b). For IMAGENET we train standard ResNer50 classifiers on the training set of IMAGENET with standard data augmentation but 128 x 128 re-scaled image crops (due to the increased computational requirements of adversarial training) and evaluate on IMAGENET- vC.R.v2). We summarize performance on corrupted image datasets using the mean corruption error (mCE) introduced in Hendrycks & Dietterich (2019). mCE measures top-1 classifier error across 15 corruption types and 5 severities from IMAGENET-C and CIFAR- For IMAGENET only, the top-1 error for each corruption weighted by the corresponding performance of specific AlexNet classifier; see (Hendrycks & Dietterich, 2019). The mCE is then the mean of the 15 corruption errors. For measuring robustness to f,-norm bounded perturbations, on CIFAR- 10 we attack our models with one of the strongest available combinations of attacks: AutoAttack & MultiTargeted as done in Gowal et al. (2020); for IMAGENET we use a standard 100-step PGD attack with 10 restarts. Omitted details on the experimental setup and evaluation are provided in Appendix E.
Common corruptions. On CIFAR- 10, models trained with AdA (coupled with AugMix) obtain very good performance against common image corruptions, as shown in Table (left) and Table 8, excelling at Digital and Weather corruptions. Combining AdA with increasingly more complex methods results in monotonic improvements to mCE; i.e., coupling AdA with Aug improves mCE from 15.47% to 9.40%: adding DeepAugment further pushes mCE to 7.83%. 33%..ompa to all adversarially trained baselines, we observe that AdA (EDSR) results in the most robustness to common image corruptions. Vanilla adversarial training (trained to defend against & attacks) also produces classifiers which are highly resistant to common image corruptions (mCE of 17. 17.42%).
On IMAGENET, in Table 2 (left) and Table 9 we see the same trend, where combining AdA with increasingly more methods results in similar monotonic improvements to mCE. The best method combination leverages all 4 image-to-image models jointly (AdA (All)), obtaining 62.90% mCE. This constitutes an improvement of more than 19% mCE over nominal training and 7.15% mCE over the best non-AdA method (DeepAugment AugMix). These observations together indicate that the corruptions captured by AdA, by leveraging arbitrary image-to-imal models, complement the corruptions generated by both DeepAugment and Aug
We observe that neither VQ-VAE nor CAE help improve robustness on CIFAR- 10-C while they are both very useful for IMAGENET-C. For example, training with AdA (VQ-VAE and AdA (CAE) results in 26. 77% and 29.15% mCE on CIFAR- 11FAR-10-C 10-C respectively, while AdA (All) on IMAGENET obtains the best performance. We suspect this is the case as both VQ-VAE VAE and CAE remove high-frequency information, blurring images (see Figure 1 (c)) which results in severe distortions for the small 32> x 32 images even at very small perturbation radii (see Figure 2).
Adversarial perturbations. For CIFAR-10, in the adversarial setting (Table 1, right) models trained with AdA using any backbone architecture perform best across all metrics. Models trained with AdA gain limited form of robustness to f--norm perturbations despite not training directly to defend against this type of attack. Interestingly, combining AdA with Aug actually results in drop robustness across all four no-morm settings for all backbones except U-Ner (which increases in robustness). However, further combining with DeepAugment recovers the drop in most cases and increases robustness even more across the majority of lo settings. Unsurprisingly the adversarially trained baselines (AT, TRADES& & AWP) perform best on lg- and l -orm bounded perturbations, as they are designed to defend against precisely these types of attacks. AdA (EDSR) obtains stronger robustness to L, attacks compared to SAM, while SAM obtains the best generalization to CIFAR- 1..
On IMAGENET, as shown in Table 2 (right), the AdA variants that use EDSR obtain the highest robustness to f,-norm adversarial perturbations; note that top-1 robust accuracy more than doubles
7

---

Published as a conference paper at ICLR 2022
from AdA (CAE) to AdA (EDSR) across all evaluated fg-norm settings. As for CIFAR-10, combining the best AdA variant with DeepAugment results in the best Ep robustness performance.
By themselves, neither AugMix nor DeepAugment result in classifiers resistant to lp attacks for either dataset (top-1 robust accuracies are less than 4% across the board), but the classifiers have non-trivial resistance to & attacks (albeit, much lower than AdA trained models). We believe this is because constraining the perturbations (in the (n-mm to weights and biases of the early layers of the corruption networks can have similar effect training adversarially with input perturbations (i.e., standard f--norm adversarial training). But note that AdA does not use any inpul perturbations.
Generalization. On CIFAR- 10 (Table 1, center), the models trained with AdA (U-Net) and AdA (EDSR) alone or coupled with Aug generalize better than the other two backbones to CIFAR- 10.1, with the best variant obtaining 90.60 90.60% top-1 accuracy. Surprisingly, coupling AdA with can reduce robustness to the natural distribution shift captured by CIFAR- 10.1. This trend applies to IMAGENET results as well (Table 2. center) when using AdA (All), as combining it with AugMix, DeepAugment both, results in lower accuracy on IMAGENET-VE v2 than when just using AdA (All). These observations uncover an interesting trade-off where the combination of methods that should be used depends on the preference for robustness to image corruptions vs. to natural distribution shifts.
LIMITATIONS
In this section we describe the main limitations of our method: (1) the performance of AdA when used without additional data augmentation methods and (2) its computational complexity.
As can be seen from the empirical results (Tables & 2). AdA performs best when used in conjunction with other data augmentations methods, i.c. with AugMix and DeepAugment. However, when AdA is used alone, without additional data augmentation methods, it does not result in increased corruption robustness (mCE) compared to either data augmentation method (except for one case, ef. rows 6 and 7 in Table 2). AdA also does not achieve better robustness to -nrrr bounded perturbations when compared to adversarial training methods. However, this expected, as the adversarially trained baselines (AT, TRADES and AWP) are designed to defend against precisely these types of attacks.
Our method is more computationally demanding than counterparts which utilize handcrafted heuris- tics. For example, AugMix specifies K image operations, which are applied stochastically the input (i.e. over images). Aummentment requires applying heuristic stochastic operations to the weights and activations of an image-to to to-image model, this requires forward pass through the image-to- tangge model (which can be computed offline). But AdA must optimize over perturbations to the parameters of the image-to-image model; this requires several backpropagation steps and is similar ep-norm adversarial training (Madry et al., 2018) and related works. We describe in detail the computational and memory requirements of our method and contrast with seven related works in Appendix I.
We leave further investigations into increasing the mCE performance of AdA when used alone, and into reducing its computational requirements, for future work.
CONCLUSION
We have shown that our method, AdA, can be used to defend against common image corruptions by training robust models, obtaining new ofate-of-the-art (at the time of initial submission) mean corruption error on L1FAR-10-CC Our method leverages arbitrary pre-trained image-to-imag, models, optimizing over their weights to find adversarially corrupted images. Besides improved robustness to image corruptions, models trained with AdA substantially improve upon previous works' (Deep- Augment& & AugMix) performance on lg- and -norm bounded perturbations, while also having slightly improved generalization to natural distribution shifts.
Our theoretical analysis provides sufficient conditions on the corrutiion-ccnerating process to guar- antee consistency of idcalized versions of both our method, AdA, and previous work, DeepAugment. Our analysis also highlights potential advantages of our method compared to DeepAugment, as well as that of the combination of the methods. We hope method will inspire future work into theoretically-supprree methods for defending against common and adversarial image corruptions.
8

---

Published as a conference paper at ICLR 2022
Table CIFAR-10: Robustness to common corruptions, fp norm bounded perturbations and generaliza- tion performance. Mean corruption ertor (mCE) summarizes robustness to common image corruptions from 1EAAR-0--C: the corruption eтror for each group of corruptions (averaged across severities and individual cor-
ruption types) is also shown. Generalization performance is measured by accuracy CIFAR-IO. 10.1. Robustness
E, adversarial perturbations summarized by the accuracy against &oo and & norm bounded perturbations.
CORRUPTION GROUP ERR. (1)
CLEAN ACC. (1) CHAR-10
f2 AcC. (1)
& ACC. (1)
MCB
CHAR-19.
WITHOUT ADDITIONAL DATA AUGMENTATION:
Nominnl
82.60
2
AdA (U-Net)
23.11
36.47
24.59
15:53
19.18
92.56
84.75
0.13
0.00
43.78
10,66
(VQ VAE)
64.65
4
AdA (EDSR)
15.47
26.83
14.94
10.50
12.14
93.17
86.55
9.28
0.09
72.41
41.13
(CAE)
30.74
61.90
3,93
57.11
40.92
6
AdA (All)
18.49
20.86
19.37
16.98
17.35
88.49
78.60
9.76
0.29
62.30
33.41
7
((
23.64
20.56
20.29
25.90
27.04
86.08
74.20
51.66
16.64
82.32
78.20
8
(T
17.42
13,93
15.20
19.34
20.33
91.02
$0.40
67.06
30.75
85,98
79.77
9
TRADES (E,))
24.72
21.31
21.49
27.26
27.99
84.79
71.00
54.55
19.51
81.33
77.59
10
TRADES (fa)
18.08
14.07
15.64
20.46
21.15
89.96
78.60
68.16
37.01
85.07
79.12
(E.)
25.01
21.73
21.58
27.69
28.23
84.36
70.50
57.01
24.07
81.38
77.98
AWP (Fa)
18.79
14,92
15.87
21.54
21.86
89.20
77.40
71.79
44,83
85.18
80.21
SAM
24.59
49.44
24.74
12.80
17.59
96.17
90.35
0.01
0.00
48.10
6.86
AUGMIX:
14
Nominal
12.26
21.11
10.56
7.60
11.98
96.09
89.90
0.13
0.00
42.26
7.17
AdA (U-Ner)
12.02
20.56
10.34
8.05
11.25
95.74
90.60
1,04
0.00
54.90
16.08
16
AdA (VQ-VAE)
20.85
23.07
20.44
20.76
19.68
83.64
72.40
0.90
0.00
28. 28.38
5.74
AdA (EDSR)
9.40
15.81
8,33
6.99
8.07
96.15
90.35
6.90
0.02
72.15
35.13
18
AdA (CAE)
20.20
20.15
19.40
21.30
19.94
84.25
72.85
2.30
0.00
42.28
15.22
AdA (AII)
14.12
17.67
14.43
11.88
13.40
92. 18
84,70
6.09
0.03
61
29.50
WITH DEEPAUGMENT:
20
Nominal
11.94
12.88
12.22
10.32
12.56
92.60
84.15
3.46
0.00
60.16
23.55
AdA (U-Ner)
13.09
13.24
13.14
11.88
12.63
91.32
83.50
11.26
0.40
68.87
40.71
AdA (VQ-VAE)
26.35
30.35
24.30
27.08
24.65
77.79
63.25
0.03
0.01
1,60
0.33
AdA (EDSR)
12.37
14.24
12.16
11.63
11.91
91.17
82.20
26.31
2.87
76.63
56.33
AdA (CAE)
27.98
27.31
27.00
29.81
27.64
74.62
61.60
8.62
0.72
40.34
21,68
25
AdA (All)
21.70
22.01
22.20
21.92
20.75
82.17
68.95
11.05
0.95
58.21
33.07
AUGMIX & DEGPAUGMENT:
26
Nominal
7.99
8.84
7.64
6.79
8.91
95.42
89.95
2,87
0.00
62.78
23.21
AdA (U..Not)
8.63
9.84
8.19
7.41
9.37
95.13
89.20
8.07
0.08
69.22
35.60
AdA (VQ-VAE)
25.17
26.94
24.05
26.41
23.71
77.36
65.40
4.62
0.32
38.81
15.47
AdA (EDSR)
7,83
9.26
7,61
7.27
7.55
94.92
87.35
18.63
0.99
77.72
49.95
30
AdA (CAE)
20.09
19.65
19.70
21.48
19.43
83.60
71.20
2.97
0.00
43.28
17.18
AdA (AII)
11.72
12.49
11.77
11.38
11.43
91.53
82.95
11.60
0.78
62.38
34,82
Table 2: IMAGENET:
Robustness common corruptions, fp norm bounded perturbations and general- ization performance. Mean corruption error (mCE) summarizes robustness to common image corruptions from IMAGENET-CE C; the corruption error for each major group of corruptions is also shown. We measure generaliza- tion to IMAGENET-VE v2 ("IN-v2") and IMAGENET-R ("IN-R"). Robustness to l, adversarial perturbations summarized by the accuracy against &oo and & norm bounded perturbations.
CORRUPTION GROUP ERR. (L)
CLEAN AcC. (1)
fg ACC. (?)
Ex Acc. (f) si
SETUP
())
Nrees
BLDe
DHOmAL
IN:92
IN-2
6.5
==
d
WITHOUT ADDITIONAL DATA AUGMENTATION:
Nominal
53.05
2
AdA (U-Ner)
83.51
85.25
78.13
49.44
56.07
70.59
59.15
21.72
15.58
3.06
0.97
0.10
(VQ-VAF)
78.26
58.75
60.33
7.92
4
AdA (EDSR)
79.59
76.10
69.83
50.22
58.43
73.05
60.83
23.19
32.93
9.99
6.15
0.41
AdA (CAE)
86.44
56.67
46.32
13.76
6
AdA (Ail)
75.03
78.57
68.49
47.08
48.61
73.20
61.30
24.43
23.97
6.42
2.97
0.20
AUGMIX:
7
Nominal
77.12
72.52
66.30
48.63
57.91
74.25
62.19
19.22
13.18
1.74
0.23
0.01
8
AdA (U-Ner)
77.87
76.58
71.52
46.58
54.28
71.20
59.58
23.37
15.77
3.00
0.78
0.06
9
AdA (VQ-VAE)
73.41
72.73
64.74
49.49
48.31
65. 12
53.52
22.22
10.51
1.75
0.28
0.01
10
AdA (EDSR)
73.59
69.06
65.84
47.89
52.06
74.31
61. 558
23.65
34.29
12.21
7.32
0.50
(CAE)
80.85
60.68
21.17
16.95
12
AdA (All)
72.27
68.28
65.05
46.55
50.21
71.68
59.43
24.25
20.83
4,74
1.68
0.11
DEEPAUGMENT:
13
Nominal
73.04
$2.49
64.67
47.68
61.26
72.25
60.50
21.67
18.16
3.61
0.71
0.02
AdA (U-Ner)
75.03
70.91
46.54
57.79
68.
56.60
25.28
20.28
4.52
1.94
0.10
AdA (VQ-VAF)
69.15
57.39
62.89
48.74
48.43
66.01
54.55
25.11
12.52
2.12
0.38
0.03
AdA (EDSR)
65.62
48.88
62.63
45.94
47.37
73.60
61.65
25.83
42.67
16.87
12.83
1.16
AdA (CAE)
77.55
66.90
67.90
48.26
59.59
16
54.90
22.80
11.08
1.82
0.24
0.02
18
AdA (Ail)
65.54
47.78
62.81
45.11
47.80
70.61
59.06
27.18
31.08
9.57
5.79
0.32
WITH AUGMIX DEEPAUGMENT:
19
Nominal
70.05
50.65
61.15
44.67
59.13
71.57
60.11
22.32
16.07
2.44
0.35
0.01
0.06
21
AdA (VQ-VAE)
69.02
54.25
61.25
51.01
48. 96
60.28
49.26
24.76
14.88
2.90
0.88
0.03
AdA (EDSR)
64.31
48.05
58.36
44.74
48. 19
72.03
60.20
25.83
34.82
10.85
6.67
0.36
23
AdA (CAE)
67.89
55.70
59.53
49.41
48.09
62.
51.18
23.12
12.91
2.15
0.43
0.03
AdA (AiI)
62.90
48.45
58.51
44.88
44.34
69.26
57.57
27.83
27.10
7.41
3.89
0.15

---

Published as a conference paper at ICLR 2022
REFERENCES
Martin Anthony and Peter Bartlett. Neural network learning: Theoretical foundations. Cambridge University Press, 2009. 6
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arXiv preprint (9XXvv:907.000000 2020. URL
02893.
3, 15
Shumeet Baluja and Ian Fischer. Adversarial transformation networks: Learning to generate adver- sarial examples, arXiv preprint arXiv:1703.09338, 2017. URL httppt//aaaaae org /pdf/ 1703. 09387. 3
Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner. Beat Flepp. Prasoon Goyal, Lawrence D. Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, Xin Zhang, Jake Zhao, and Karol Zieba. End to end learning for self-driving cars. NIPS Deep Learning Symposium, 2016.
Nicholas Carlini and David Wagner. Adversarial examples
easily detected: Bypassing detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3-14. ACM, 2017a.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy, 2017b.
Paul Covington, Jay Adams, and Emre Sargin. Deep neural networks for YouTube recommendations.
In Proceedings of the 10th ACM Conference on Recommender Systems, 2016. I
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter- attacks. arXiv preprint arXiv:2003.0168 01690,, 2020. 21
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark, 2020. 23
Ekin D Cubuk, Barret Zoph. Dandelion Mane, Vijay Vasudevan, and Quoe V Le. Autoaugment: Learning augmentation policies from data. IEEE Conf. Comput. Vis. Pattern Recog., 2019. 3
Ekin D. Cubuk, Barret Zoph, Jonathon Shlens, and Quoe V. Le. Randaugment: Practical automated data augmentation with a reduced search space. IEEE Conf. Compul. Vis. Pattern Recog. 2020. 3
Jeffrey De Fauw, Joseph R Ledsam, Bernardino Romera-Paredes. Stanislav Nikolov, Nenad Tomasev, Sam Blackwell, Harry Askham, Xavier Glorot, Brendan O' O'Donoghue, Daniel Visentin, George van den Driessche, Balaji Lakshminarayanan, Clemens Meyer, Faith Mackinder, Simon Bouton, Kareem Ayoub, Reena Chopra, Dominic King, Alan Karthikesalingam. Cían Hughes, Rosalind Raine, Julian Hughes, Dawn A Sim, Catherine Egan, Adnan Tufail, Hugh Montgomery, Demis Hassabis, Geraint Rees, Trevor Back, Peng T Khaw, Mustafa Suleyman, Julien Cornebise, Pearse Keane, and Olaf Ronneberger. Clinically applicable deep learning for diagnosis and referral in retinal discase. In Nature Medicine, 2018.
Terrance Vries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv: / 011.1008...4 04552, 2017.
James Diffenderferr Brian R Bartoldson, Shreya Chaganti, Jize Zhang, and Bhavya Kailkhura. A winning hand: Compressing deep networks can improve out-t--distribution robustness. In A. Beygelzimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. 2,
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In International Conference on Learning Representations, 2021. URL https: openreview net forum? d wee.mmmmmmmmmsmmmmmmmmmemmmmmmmm rM. 16, 17
Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix A
Wichmann. Generalisation in humans and deep neural networks. In Advances in Neural Information Processing Systems, pp. 7538-7550, 2018. 1,3
10

---

Published as a conference paper at ICLR 2022
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-traines cnns are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, 2019. URL
https:: /tppss///peeeeiiiieee ew. http://dffdddddooee 90xXX. 3
Noah Golowich, Alexander Rakhlin, and Ohad Shamir. Size-independent sample complexity of neural networks. Information and Inference: Journal the IMA, 9, 12 2017. doi: 10. 10.1093/imaia//aa000. 6
Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, 2016. URL /wwp: wwtp::/wwwwepeeennnnooooooo org.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. Int. Conf. Learn. Represent, 2015. 1, 3, 16, 21
Sven Gowal, Chongli Qin, Po-Sen Huang, Taylan Cemgil, Krishnamurthy Dvijotham, Timothy Mann, and Pushmeet Kohli. Achieving Robustness in the Wild via Adversarial Mixing with Disentangled Representations. arXiv preprint arXiv: 1912.3391. 2019a. URL https: /wtpxv/wivvvv//aa///a//e../..wva org/
1912. 00103319222 92. 3, 15
Sven Gowal, Jonathan Uesato, Chongli Qin, Po-Sen Huang, Timothy Mann, and Pushmeet Kohli. An Alternative Surrogate Loss for PGD-based Adversarial Testing, arXiv preprint arXiv: (EIi::990000338 2019b. 21
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 2020.
wwtp:///pppppppae/////eeeet/et http:///p//21.....///// 03593. 3, 7, 21,
Priya Goyal, Piotr Dollár, Ross Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tulloch, Yangqing Jia, and Kaiming He. Accurate, large minibatch sgd: Training imagenet
in hour. arXiv preprint orXiv:170..02677 2017. 21,22
Hongyu Guo, Yongyi Mao, and Richong Zhang. Mixup as locally linear out-of-mmnifold reg- ularization. In Proceedings of the AAAI Conference on Artificial Intelligence, 2019, URL https://ojj aaaa..aaa...m org/ wwwg/inneen http//iddxxxxppee
Muhammad Zaid Hameed. New Quality Measures for Adversarial Attacks with Applications to Secure Communication. PhD thesis, Imperial College London, 2020.
Muhammad Zaid Hameed and András György. Perceptually constrained adversarial attacks, 2021. 4
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. IEEE Conf. Comput. Vis. Pattern Recog., 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pp. 630.645. Springer. 2016b. 20
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corrup- tions and perturbations. Proceedings of the International Conference on Learning Representations, 2019. 7
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. arXiv preprint arXiv:1907.0r 2019.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The Many Faces of Robustness: A Critical Analysis of Out-of-Disttibuttion Generalization. arXiv preprint 2X2:22006.16241, 2020a. URL https: arxiv wwtp://wwwwwpp........oo 6, 14, 16, 17,
1,
Dan Hendrycks, Norman Mu, Ekin D. Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. Int. Conf. Learn. Represent., 2020b. 1, 2, 6, 7, 14, 16, 17, 20
11

---

Published as a conference paper at ICLR 2022
Geoffrey Hinton, Li Deng, Dong Yu, George E Dahl, Abdel-rahman Mohamed, Navdeep Jaitly, Andrew Senior, Vincent Vanhoucke, Patrick Nguyen, Tara N Sainath, and others. Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups. IEEE Signal processing magazine, 29(6):82-97, 2012.
Ruitong Huang, Bing Xu, Dale Schuurmans, and Csaba Szepesvári. Learning with strong adversary. arXiv preprint arviv: 151 103034, 2015. URL httpthttp///aattt /tte///axxit /ttw//ixvvvvv./////v//////a//atv org/ ha//bb///1 /1ss/15111 13311133143.1.
03034.
Max Jaderberg, Karen Simonyan, Andrew Zisserman, and koray kavukcuoglu. Spatial transformer networks. In C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Gar- nett (eds.), Advances in Neural Information Processing Systems, volume 28. Curran Asso- ciates, Inc., 2015, URL https: http:////ooe//eeee/eee/eee/ese/t neurips. wwtprrppp.cpppppp//eeeee cc/ppaper//2////Eiee. 2ewp
Paper, pdf. 15
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6988 6980, 2014. 6, 16, 22
Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion. On the effectiveness of adversarial training against common corruptions, 2021. 23
Alex Krizhevsky, Σya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolu- tional neural networks. In Adv. Neural Inform. Process. Syst., 2012. 23
Andrey Kuchlkamp, Benedict Becker, and Kevin Bowyer. Gender-from-iris or gender-from-maseee In 2017 IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 1151-1159. IEEE, 2017.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. ICLR workshop, 2016. 1, 21
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations, 2021. URL https: /ttp:////peeeeeeeeeeeeee net peee://ddddddddeeeeeee widddddBosssccee 2, 3, 16, 17, 22, 23
Jungkyu Lee, Taeryun Won, Tae Kwan Lee, Hyemin Lee, Geonmo Gu, and Kiho Hong, Compounding the performance improvements of assembled techniques in a convolutional neural network, 2020. 21
Bee Lim, Sanghyun Son, Heewon Kim, Seungjun Nah, and Kyoung Mu Lee. Enhanced deep residual networks for single image super-resolution, 2017. 2,
Raphael Gontijo Lopes, Dong Yin, Ben Poole, Justin Gilmer, and Ekin D. Cubuk. Improv- ing robustness without sacrificing accuracy with patch gaussian augmentation. arXiv preprint arXiv:1906.0261/ 2019. URL
wwwp:/tgggppp//ee//o 02611.
Ilya Loshchilov and Frank Hutter. SGDR: stochastic gradient descent with warm restarts. In Int. Conf. Leurn. Represent., 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. Int. Conf. Learn. Represent. 2018 2, 4, 5, 6, 8, 16, 17
Seyed-Mohsen Moosavi- Dezzool,,, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robust- ness via curvature regularization, and vice versa. IEEE Conf. Comput. Vis. Pattern Recog., 2019.
Yurii Nesterov. A method of solving convex programming problem with convergence rate o(1/k9). In Sov. Math. Dokl, 1983. 21
Behnam Neyshabur, Srinadh Bhojanapalli, David Mcallester, and Nati Srebro. Exploring generaliza- tion in deep learning. In Advances in Neural Information Processing Systems, volume 30, 2017. 2, 19
12

---

Published as a conference paper at ICLR 2022
Nicolas Papemot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. IEEE Symposium on Security and Privacy, 2016. 3
Boris T Polyak. Some methods of speeding up the convergence of iteration methods. Computational Mathmaatics and Mathematical Physics, 1964. 21
USSR
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial Robustness through Local Linearization. Adv. Neural Inform. Process. Syst., 2019. 3
Haonan Qiu, Chaowei Xiao, Lei Yang. Xinchen Yan, Honglak Lee, and Bo Li. SemanticAdv: Generating Adversarial Examples via Attribute-conditionaal Image Editing. arXiv preprint
1rXiv:1906.00927, 2019. https:::// /ttp://aaaivvvv..iv httpr///pp///9eeeeee /ttp://s/...aavoooooo///////././ 079.//1990000997... 07927.
Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Adversarial training can hurt generalization. In ICML 2019 Workshop on Identifying and Understanding Deep
Learning Phenomena, 2019. URL https:/ http:///pppeeeeeeeeeeeeeee /
net poodfiid-San httpp/dddddd---225555555 6yxM33256..
Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do ImageNet Classifiers Generalize to ImageNet? arXiv preprint arXiv: /902. 1081 2019.
Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning, Int. Conf. Much. Learn., 2020.
Eitan Richardson and Yair Weiss. The surprising effectiveness of linear unsupervised image-to-imane translation. In 2020 25th International Conference on Pattern Recognition (ICPR), pp. 7855-7861, 2021. doi: 10. 1199/1CP488006.200 2022202222999 9493199. 15
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Nassir Navab, Joachim Hornegger, William M. Wells, and Alejandro F. Frangi (eds.), Medical Image Computing and Computer-Assisted Intervention MICCA/ 2015, pp- 234 241, Cham, 2015. Springer International Publishing. ISBN 378-3-319-245744-4 2,
Evgenia Rusak, Lukas Schott, Roland S. Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. A simple way to make neural networks robust against diverse image corruptions. arXiv preprint Siti:22001000057 2020. URL https : //tp/aaxvvv//////////////////avl 2001. 06057. 21
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with generative models. In Advances in Neural Information Processing Systems, pp. 8312-8323, 2018. 3
Masashi Sugiyama. Matthias Krauledat, and Claus-Robers Müller. Covariate shift adaptation by importance weighted cross validation. Journal of Machine Learning Research, 8(5), 2007. 5, 18
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. Int. Conf. Learn. Represent., 2014. 1,
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Measuring robustness natural distribution shifts in image classification. Advances in Neural Information Processing Systems, 33, 2020.
Lucas Theis, Wenzhe Shi, Andrew Cunningham, and Ferenc Huszár. Lossy image compression with compressive autoencoders, 2017. 2,
Yuji Tokozume, Yoshitaka Ushiku, and Tatsuya Harada. Between-class learning for image classifica- tion. IEEE Conf. Comput. Vis. Pattern Recog., 2018. 3
Antonio Torralba, Alexci A Efros, and others. Unbiased look dataset bias. In IEEE Conf. Compus. Vis. Pattern Recog.. 2011. 1
Aäron van den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. In Ady. Neural Inform. Process. Syst., 2017. 2, 4, 22
13

---

Published as a conference paper at ICLR 2022
Vladimir Vapnik. Statistical learning theory. Wiley New York, 1998. 1
Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur 2016. 1,3
recognition by convolutional networks. arXiv preprint
Zhou Wang, Alan Bovik, Hamid R Sheikh, and Ecro P Simoncelli. Image quality assessment: from eπror visibility to structural similarity. IEEE transactions image processing, 13(4):600-612, 2004. 4, 6, 22
Eric Wong and J. Zico Kolter. Learning perturbation sets for robust machine learning. lnt. Conf. Learn. Represent. 2021a. 23
Eric Wong and Zico Kolter. Learning perturbation sets for robust machine learning. In International Conference on Learning Representations, 2021b. URL ht https: http///ppp//eiieeee/eeeeeee net/ pdE?
id-MIDckA56aD.2
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. Int. Conf. Learn. Represent. 2020. 7, 20
Dongxian Wu, Shu-tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. Adv. Neural Inform. Process. Syst. 2020. 3, 6, 16, 17
Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. arXiv preprint orXiv:1801.0260 2018. URL
https:// /awpiv/ org/pdf/////oooooooooo.peo...trr 11001. 02610.
Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. arXiv preprint 1.005333 2016. 21
Dong Yin, Raphael Gontijo Lopes, Jonathon Shlens, Ekin D. Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. arXiv preprint 19X6::19060089880 2019. URL
https: / arxiv, org/ wtttpdt/////ooooooo/////p//t.//p / 1906. 08988.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. Int. Conf. Comput. Vis., 2019.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. arXiv preprint arXiv: /6/ 103553, 2016. 19
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing. Laurent El Ghaoui, and Michael I. Jordan. Theoretically Principled Trade-off between Robustness and Accuracy. Int. Conf. Mach. Learn., 2019. 3, 6, 16, 17
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. Int. Conf. Learn. Represent., 201 8a.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness deep features as a perceptual metric. In CVPR, 2018b. 16, 17
A RELATIONSHIPS TO RELATED WORK
A.1 RELATIONSHIP TO DEEPAUGMENT & AUGMIX
AugMix is a data augmentation method which stochastically composes standard image opera- tions which affect color (c.g., posterize, equalize, etc.) and geometry (c.g., shear, rotate, trans- late) (Hendrycks et al., 2020b). Classifiers trained with AugMix excel at robustness to image corruptions, and AugMix (when used with Pensen-Shannon divergence consistency loss) sets the known -fte----tfhhtrr---e on CIFAR- 10-C of 10.90%, prior to our result herein.
DeepAugment is data augmentation technique introduced by Hendrycks al. (2020a). This method creates novel image corruptions by passing each clean image through two specific pre-defined image- to-image models (EDSR and CAAE) while distorting the network's internal parameters well as
14

---

Published as a conference paper at ICLR 2022
intermediate activations. An extensive range of manually defined heuristic operations (9 for CAE and 17 for EDSR) are stochastically applied to the internal parameters, including: transposing, negating, zero-ing, scaling and even convolving (with random convolutional filters) parameters randomly. Activations are similarly distorted using pre-defined operations; for example, random dimensions are permuted or scaled by random Rademacher or binary matrices. Despite this complexity, classifiers trained with DugpAngment in combination with AugMix, set the known state-of-the-ar mCE on IMAGENET-C of 53.6%.
Any method which relies on image-to-image models (e.g., AdA or DeepAugment) will inherit the limitations of the specific image-to-ima -imeg models themselves. In this paper we focus on local image corruptions, but one might want to train classifiers robust to global image transformations -ndd it is known that most image-to-image models are not well suited for capturing global image transformations (Richardson & Weiss, 2021). For modeling global image transformations, one could, for example, consider using an image-to-image model consisting of a single spatial transformer layer (Jaderberg et al., 2015). Applied at the input layer, the spatial transformer differentiably parameterizes global image transformation. Leveraging such an image-to-image model would allow AdA to find adversarial examples by optimizing over the global image transformation. But, using such a model with DeepAugment would first require manually defining heuristic weight transformations for this specific image-to-image model.
Similarly to both AugMix and DeepAugment, AdA is also "specification-agnosii i.e., all three methods can be used train classifiers to be robust to corruptions which not known in advance (e.g., CIFAR- 10-C, IMAGENET-C), Both DeepAugment and AdA operate by perturbing the pa- rameters of image-to-image models. DeepAugment constrains parameter perturbations to follow pre-specified user-defined directions (i.e., defined heuristically); AdA bounds perturbation magnitudes automatically and prevents severe distortions (by approximately constraining the minimum SSIM deviation of the corrupted examples). To be able to define heuristic operations, DeepAugment relies on in-depth knowledge of the internals of the image-to-image models it employs; our method, AdA, does not. Instead, our method requires global scalar threshold to specify the amount of allowed relative parameter perturbation. AugMix requires having access to a palette of pre-defined useful input transformations; our method only requires access to pre-trained autoencoder.
We believe the generic framework proposed in our paper, which (at minimum) requires an auto- encoder and a scalar perturbation radius, is applicable to other domains beyond images. We leave further investigations to future work.
A.2 RELATIONSHIP TO INVARIANT RISK MINIMIZATION
Invariant Risk Minimization (IRM) proposed by Arjovsky et al. (2020) considers the case where there are multiple datasets D. = {a;, ys > drawn from different training environments e E E. The motivation behind IRM is to minimize the worst-case risk
max Bi [z(f((z). v)].
(6)
cEE'
In our work, the environments are defined by the different corruptions x' resulting from adversarially choosing the parameter offsets 5 of ø. Given a dataset (I,, Vi !== we can rewrite the corrupted adversarial risk shown in (1) as (6) by setting the environment set & to
E [f(o++5(2z) 31 3 Sv..
This effectively creates an ensemble of datasets for all possible values of 5 for all examples. The crucial difference between IRM and AdA is in the formulation of the risk. In general, we expect AdA to be more risk-averse than IRM, as it considers individual examples to be independent from each other.
A.3 RELATIONSHIP TO ADVERSARIAL MIXING
Gowal et al. (2019a) formulate a similar adversarial setup where image perturbations are generated by optimizing a subset of latents corresponding to pre-trained generative models. In our work, we can consider the parameters of our image-to-image models to be latents and could formulate Adversarial Mixing (AdvMix) in the AdA framework. Unlike AdvMix, we do not need to rely known partitioning of the latents (i.c., disentangled latents), but do need to restrict the feasible set of parameter offsets 8.
15

---

Published as a conference paper at ICLR 2022
A.4 RELATIONSHIP TO PERCEPTUAL ADVERSARIAL TRAINING
Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) finds adversarial examples by optimizing pixel-space perturbations, similar to works on E norm robustness, c.g. (Madry et al., 2018). The perturbed images are constrained not exceed maximum distance from the corresponding original (clean) images measured the LPIPS metric (Zhang et al., 2018b). Their setup requires a complex machinery to project perturbed images back the feasible set of images (within a fixed perceptual distance). AdA, by construction, uses a well-defined perturbation set and projecting corrupted net- work's s parameters trivial operation. This is only possible with method because perturbations are defined on weights and biases rather than on input pixels.
B ALGORITHM DETAILS & COMPUTATIONAL AND SPACE COMPLEXITY
Algorithm 1 contains the algorithm listing for our proposed method. We illustrate our algorithm using SGD for clarity. practice, we batch training examples together and use the Adam optimizer (Kingma & Ba, 2014) to update the classifier's parameters 0. We still compute adversarial examples for each training sample individually using projected FGSM (Goodfellow et al., 2015) steps.
Algorithm 1 AdA, our proposed method.
I: Inputs: training dataset D; classifier's (fo) initial parameters (()) corruption network ca: corruption network's pretrained parameters ø; relative perturbation radius over the corruption network's ' parameters number of layers of the corruption network K; learning rate 7) and number of gradient descent steps N for the outer optimization; learning rate V) and number of projected gradient ascent steps M for the inner optimization.
2: for 1...N. do
>> Outer optimization over
3:
(I,
4: for i 1... do
> Initialize á perturbation.
5:
U(0, (1x
6:0) uniformly random vector of the same shape as Φ with length equal to Inner optimization over 5 using PGD. >> FGSM step. b Project ò; to lie in v-length balb around Φ;.
6:
7:
for j 1 ....M do
8:
86) (60-1 + ne sign| V V
1=56-11
9:
for i = 1...Ko. do
if 110601112 > v 11 then
10:
8(0) 16 la
g(0)
v 2110
r' Catsim) (x)
The adversarial example x'. Approx. SSIM line-search; App. F.I. Update classifier parameters.
x' SSIMLineScarch(z,
14:
g(t) g(--1) n, Vo V.
0=0(e-1)
15: Return optimized classifier parameters ((N)
B.
COMPUTATIONAL COMPLEXITY AND MEMORY REQUIREMENTS
Table lists the computational and memory requirements of our method and of related works. We primarily compare to similar methods which perform iterative optimization to find adversarial examples: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang al., 2019), Adversarial Weight Perturbations (AWP) (Wu et al., 2020) and Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021). For completeness, we also compare to related methods which do not perform adversarial optimization: Sharpness Aware Minimization (SAM) Foret et al. (2021), DempAugment (Hendrycks et al., 2020a) and AugMix (Hendrycks et al., 2020b). We characterize the number of passes (forward and backward, jointly) through the main classifier network (fe) and, where applicable, through an auxiliary neural network (c²) separately. For methods using adversarial optimization also describe the cost of the projection steps used for keeping perturbations within
16

---

Published as a conference paper at ICLR 2022
the feasible set. Taken together, these costs represent the computational complexity of performing one training step with each method.
Note that for method. the auxiliary network corresponds to the corruption network (i.e. the image- to-image model); for PAT it corresponds to the network used to compute the LPIPS (Zhang et al., 2018b) metric. We characterize the PAT variant which uses the Lagrangian Perceptual Attack in the bxternalyy-buunded case and the default bisection method for projecting images into the LPIPS-ball.
Table 3: Computational complexity and memory requirements for one training step of our method and related works. M represents the number of inner/ad optimizer steps (i.e. PGD steps in AdA or AT); |a| is the dimensionality of the input; (0] and (6) are the number of parameters of the main classifier and of the auxiliary network respectively. The number of adversarial weight perturbations in AWP or SAM is denoted by W; this is typically set to I (Wu et al., 2020; Foret et al., 2021). For PAT, we also refer the number of bisection iterations N and to the number of steps used for updating the Lagrange multiplier as S; N is set to 10 and S to by default (Laidlaw et al., 2021, Appendix A.3).
FWD. AND BWD. PASSES THROUGH
SETUP
CLASSIFIER (fs)
AUx. NET (c²)
ADV. PROJECTION
METHODS WHICH PERFORM ADVERSARIAL OPTIMIZATION:
AdA (this work)
O(M)
O(M)
O(M |o] + (x])
PAT (Laidlaw al., 2021)
O(M S)
O(M
O(N) O(M [x])
AT (Madry et al., 2018)
O(M)
TRADES (Zhang et al., 2019)
((M)
O(M (z]
AWP (Wu al., 2020)
O(M + W)
O(M |a| + W (0))
METHODS WHICH DO NOT PERFORM ADVERSARIAL OPTIMIZATION:
SAM (Foret et al., 2021)
O(W)
DeepAugment (Hendrycks et al., 2020a)
0(1)
O(1)
AugMix (Hendrycks et al., 2020b)
0(1)
Computational complexity. For each input example, AdA randomly initializes weight perturba- tions in (1ø)) time. It then adversarially optimizes the perturbation using M PGD steps. These steps amount to M forward and M backward steps through the main classifier (fe) and the corruption network (c²). At the end of each iteration, the weight perturbation is projected back onto the feasible set by waier-wise re-scaling in (lo)) time. After the PGD iterations, an additional forward pass is done through the corruption network, using the optimized perturbation, to augment the input example. Finally, the SSIM safe-guarding step (see Appendix F) takes time proportional to ((æ)).
Similar to AdA, PAT performs multiple forward and backward passes through both the main classifier and an auxiliary network. PAT searches for suitable Lagrange multiplier using S steps, and for each candidate multiplier performs an M-step inner optimization. This results in (at most) S times more forward and backward passes through the two networks when compared to AdA. The projection step of PAT is considerably more expensive, requiring N+1 forward passes through the auxiliary network; however, it is applied only once at the end of the optimization, rather than at every iteration as in AdA.
AT. TRADES and AWP perform M PGD steps, with forward and backward passes done only through the main classifier network they do not use auxiliary network. Hence, these methods have reduced computational complexity compared to PAT and AdA.
Deepnng augments each data sample by passing it through an auxiliary network while stochas- tically perturbing the network's 's weights and intermediate activations (using a pre-defined set of operations); this amounts to one (albeit modified) forward pass through the auxiliary network for each input example. AugMix stochastically samples and composes standard (lightweight) image operations; it does pass images through any auxiliary network. AugMix applies most 3 K image operations for each input image; K is set to 3 by default (Hendrycks et al., 2020b, Section 3). Methods which use adversarial training, AT, TRADES, PAT as well as AdA, have higher computa-
17

---

Published as a conference paper at ICLR 2022
tional complexity than both DeepAugment AugMix, as they specifically require multiple iterations (M) of gradient ascent to construct adversarial examples.
Memory requirements. Compared to AT, TRADES & PAT which operate on input perturbations, AdA has higher memory requirements as it operates on weight perturbations (6) instead. Similar to AT, TRADES and PAT, AdA also operates on each input example independently. For mini-batch of inputs, naively, this would require storing the corresponding weight perturbations for each input at the same time in memory. This could amount to considerable memory consumption, as the storage requirements grow linearly with the batch size and the number of parameters in the corruption network. Instead, we partition each mini-batch of inputs into multiple smaller "nano-batches", and find adversarial examples one "hano-batch" at time. In practice, on each accelerator (GPU or TPU), we use 8 examples per "nano-batch" for CIFAR- 10 and for IMAGENET. This allows us to trade-off performance (i.e. parallelization) with memory consumption.
In contrast to AWP, which computes perturbations to the weights of the main classifier (0) at the mini-bated level, AdA computes perturbations to the weights of the corruption network (Ø) for each input example individually.
DeepAugment samples weight perturbations whose storage grows linearly with the number of parameters in the auxiliary network (O(1)))) matching AdA's a output storage requirements. But note that all methods which use adversarial optimization (AdA included), must also store intermediate activations during each backward pass.
For each input sample AugMix updates an input-sized arryy using storage proportional to O(xx)), having the same storage requirements as AT or PAT.
Our method must keep the weights of the image-to-image models in memory. This does not incur a large cost as all models that we use are relatively small: the U-Ner model has 58627 parameters (0.23MB); the VQ-VAE model has 762053 parameters (3.05MB); the EDSR model has 1369859 parameters (5.4 (5.48MB) and the CAE model has 2241859 parameters (8.97MB).
C ADDITIONAL THEORETICAL CONSIDERATIONS ON THE CORRUPTION COVERAGE
As in Section 4, consider binary classification problems with I. being the 0-1 loss.
Inexact corruption coverage. Assumption 1 on corruption coverage, introduced in Section 4, can be unreasonable in practical settings: for example, if the perturbations induced by elements of d can be unbounded (c.g., for simple Gaussian perturbations), the assumption that the labels do not change with any of the perturbations are usually violated (e.g., for sure for Gaussian perturbations). On the other hand, it may be reasonable to assume that there exists a subset of the perturbations, Φ1 C + such that all perturbations in $ keep the label unchanged for any input x E X. Even this assumption becomes unrealistic if input points can be arbitrarily close to the decision boundary, in which case even for arbitrarily small perturbations we can find inputs for which the label changes. However, is reasonable to assume that this does not happen if we only consider input points sufficiently far from the boundary (which is only meaningful if the probubility of getting too close to the boundary is small, say at most some 7 0). We formalize these considerations in the next assumption, where we assume that there exists a subset of input points X, C X' with (x(,)) 2 1 - 7 and a subset of perturbations , such that Assumption holds on X. and Φ
Assumption 2. (Inexact corruption coverage) Let 7 E (0, Let क C + and X, C X with (((x)) 2 1 Y such that (i) no perturbation in Φ changes the label of any x E X,, that is, (x) fo- (co(x)) for any & E 41 (ii) there exists a distribution 3 supported on d such that is absolutely continuous with respect to 3 on Q
Assuming we have access to distribution 3 satisfying the above assumption and X.,. we can consider the performance of the idealized AdA rule (5) for I II,..., In E Xz. Again by the result of Sugiyama al. (2007), under Assumption 2, the resulting robust error restricted to Xy and & converges, as n + oo, to the minimum restricted robust error
Eezeyllas doall [T(so fo-
18

---

Published as a conference paper at ICLR 2022
where plx,, and alo, denote the restrictions of μ and to X, and Φ1, respectively. Since 0 E θ and by the assumption, no corruption in 1 changes the label, this minimum is in fact 0. Then, since assumed that L is the 0-1 loss, the error of the classifier when the imput is not in X, the perturbation is not in 11, can be bounded by 1. Hence, the robust error of the learned classifier fass (obtained for n = oc, i.e., in the limit of infinite data) can be bounded as
B [[Jsaax cc( fo (x))
E Bo A L cc((z), fo (x)) + +
E Bx
Lifo col fo- (x)) + + a(
= - (
Note that in the assumption there is an interplay between X, and @1 (the conditions on Φ1 only apply to imputs from X,, and as X, decreases, @ can increase). As one should always choose X, so that @ be the largest given y get the best bound, one optimize to minimize + - ax If the probability of the inputs close to the decision boundary (?) and the probability of perturbations changing the label for some input (1 a (((P)) are small enough, the resulting bound also becomes small.
D PAC-BAYESIAN ANALYSIS
We can also reason about the idealized AdA and DeepAugment algorithms (from Section 4 in the main manuscript) using the PAC-Bayesian view. If random perturbations are introduced to the parameter of the classifier fo, the following bound holds (see, egg., Neyshabur et al., 2017);² Given prior distribution P over O which is independent of the training data, for any r E (0, 1), with probability at least 1 1-11
KL + c) + log
E. R o)] & Be [((f)] + +41
where = L[Jo cal (2:), vi) and KL(O < e) is the KL divergence between the parameter distribution 0 + (given 0) and p.a Defining and to have spherically invariant normal distributions with variance 2 in every direction, the KI. term becomes ||012 2 and so the second term goes to zero as the number of samples increases (and does not grow fast). An idcalistic choice (recommended, e.g., by Neyshabur et al., 2017) is to choose the perturbation of each parameter to be proportional to the parameter value itself, by setting the standard deviation of cj (the jth coordinate
of e) and the corresponding coordinate of P as oj 000, + b, making the KL term equal to E, 20
Note, however, that since fe depends on the training data, this choice makes the bound in (8) invalid, hence, in our experiment we choose e; to be proportional to the average norm of the weights in each layer when trained on a different (but similar) dataset. Note that minimizing the first term on the right hand side of (8) is not straightforward during training, since we have no access corruptions sampled from a. DegpAugment tries to remedy this situation by using samples from 3 however, the effectiveness of this depends on how well 33 approximates a, more directly on the importance sampling ratios
for W C & with a(W) > 0 (see Assumption 1). On the other hand, AdA minimizes the worst-case loss over supp(3), which dominates the worst-case loss over supp(a) under Assumption 1, which minimizes the expected loss over which is the first term. Thus, AdA minimizes an upper bound on the first term, while DeepAugment only minimizes a proxy.²
We have assumed that 0* E θ implying that the classifier is parameterimeeddd This is common assumption in the literature which often holds practice (Zhang et al., 2016).
3 Experimental results presented Table 4 show that if the variance e small enough, the performance of the classifier only changes very slightly.
'To obtain this hound, one think of the randomized classifier as the compound classifier fo cs having parameters both and á, and the prior on & is a, which then cancels from the KL. term.
"Note that this calibrated proxy in the sense that the minimum of both the proxy and the original target assumed at the same value 8*
19

---

Published as a conference paper at ICLR 2022
D.1 PERFORMANCE UNDER STOCHASTIC PARAMETER PERTURBATIONS
In Table 4, we show that the performance of AdA-trained classifier gradually degrades under increasingly larger perturbations to its parameters, providing experimental support for the PAC-Bayes analysis.
Let w denote block of parameters (c.g., the set of convolutional filters of layer) and wy be the j-th coordinate of the parameter block; then, Cj is the stochastic perturbation we add to the individual scalar parameter wy. We draw the perturbation ej from a O-mean Gaussian with standard deviation proportional to the 2o norm (i.e.. the maximum absolute value) of the enclosing parameter block: <j (N., 7 ||w]]>>> where 7/ denotes the standard deviation scaling factor. We vary v from 0.00 (0% noise; i.e., nominally evaluated model) to 0.10 (10% noise) increments of 0.02 (2% noise at a time), as shown in the first column of Table 4. We sample stochastic parameter perturbations (for all of fe's 's parameters) 50 times per dataset example and average the model's predicted probabilities (i.e., we average the softmax predictions and then compare the averaged prediction with the ground-truth label).
Table 4: Robustness to common image corruptions under stochastic parameter perturbations. The table shows top-1 clean error, mCE and individual corruption error (averaged over all severities) for increasingly larger stochastic parameter perturbations to the AdA + AUGMIX classifier trained on CIFAR-10. 10.
NOISE
BLUR
WEATHER
DIGITAL
1007
MONS
18083
NOISE (%)
CLEAN E
MCE
0% (detault)
3.74%
8.80%
16.
12:
14:
5:
10-
7.
6:
7.
6:
6.
3a
4:
8.
11.
8+
2%
3.76%
8.81%
16:
12:
14:
5-
10-
7:
61
7:
6:
6:
3:
4:
11.
49%
3.75%
9.21%
174
13a
15:
6:
11-
8:
6:
7.
6-
6:
4:
5,
8:
11:
8:
6%
4.28%
10.49%
19:
15:
17:
7:
12x
9,
8-
7:
7.
4:
8-
9.
12.-
8-
8%
6.01%
14.56%
24:
19.
22:
11:
17a
14.
12
114
10:
11:
6.
15.s
12:
16.:
11-
10%
17.75%
31.34%
40:
35:
44
26
40
34:
30:
29h
22.:
24
19.:
34.:
28::
32x-
26:
We observe a gradual degradation in mCE and clean error when increasing the expected magnitude of parameter perturbations. Performance on mCE is maintained up and including a noise level of 2%, and on clean error up to noise level of 4% respectively.
E EXPERIMENTAL SETUP DETAILS
E. TRAINING AND EVALUATION DETAILS
For CIFAR- 10 train pre-activation ResNer50 (He et al., 2016b) models (as in Wong al. (2020)); as in previous work (Hendrycks et al., 2020b) our models use 3 x 3 kernels for the first convolutional layer. We use standard data augmentation consisting of padding by 4 pixels, randomly cropping back to 32 x 32 and randomly flipping left-to-right.
We train all robust classifiers ourselves using the same training strategy and architecture as for our own method (as described above); we use perturbation radius of 0.5 for &g robust training and of 8/255 for for robust training. For both lg and &co robust training, we sweep over AWP step sizes of 0.005, 0.001, 0.0005 and 0.0001; we further evaluate the two models which obtained the best robust train accuracy (for Eg this is the model which uses an AWP step size of 0.001, and for &oo model which uses one of 0.0005). Similarly, for SAM we train five models sweeping over the step size (0.2, 0.15, 0.1, 0.05, 0.01) and further evaluate the one obtaining the best robust train accuracy (which uses step size of 0.05).
the
For IMAGENET we use a standard ResNer50 architecture for parity with previous works. We use a standard data augmentation, consisting of random left-to-right flips and random crops. Due to the increased computational requirements of training models with AdA (due to the adversarial training formulation) we resize each random crop (of size 224 x 224) to 128 x 128 using bilinear interpolation. We perform standard evaluation by using the central image crop resized to 224 x 224 on IMAGENET, even though we train models on 128 x 128 crops.
20

---

Published as a conference paper at ICLR 2022
All methods are implemented in the same codebase and use the same training strategy (in terms of standard data augmentation, learning rate schedule, optimizers, etc.).
We constrain capacity and use the ResNer50 architecture for all our models for parity with previous works that tackle robustness to image corruptions (like Hendrycks et al., 2020a; Lee ct al., 2020; Rusak et al., 2020), but note that larger models can achieve better mCE: e.g., Hendrycks et al. (2020a) train a very large model (RESNEXT-10 101 32 x 8d; Xie et al., 2016) with AugMix and DeepAugment obtain 44.5% mCE on IMAGENET-C.
F.2 EVALUATING ROBUSTNESS AGAINST lp- f--NORM BOUNDED PERTURBATIONS
For CIFAR-10 10, we follow the evaluation protocol of Gowal et al. (2020) and evaluate their robustness to l--norm bounded perturbations using combination of two of the strongest adversarial attacks: AutoAttack (Croce & Hein, 2020) and MultiTargeted (Gowal et al., 2019b). Specifically, we run AutoPGD on the cross-entropy loss with restarts and 100 steps; we also run AutoPGD on the difference of logits ratio loss with 5 restarts and 100 steps; finally, we run the Multi attack on the margin loss with 10 restarts and 200 steps. For IMAGENET attack with 10 restarts.
standard 100-step PGD
E.3 OUTER MINIMIZATION
We minimize the corrupted adversarial risk by optimizing the classifier's parameters using stochastic gradient descent with Nesterov momentum (Polyak, 1964; Nesterov, 1983). For CIFAR-10 10 we train for 300 epochs with batch size of 1024 and use a global weight decay of 10-1 For IMAGENET train for 90 epochs with batch size of 4096 and use a global weight decay of 5- We use a cosine learning rate schedule (Loshchilov & Hutter, 2017), without restarts, with 5 warm-up epochs, with an initial learning rate of 0.1 which is decayed to 0 at the end of training. We scale all learning rates using the linear scaling rule of Goyal al. (2017), i.e., effective LR max(LR x batch size/256, LR). In Algorithm the effective learning rate of the outer optimization is denoted by M7.-
E.4 INNER MAXIMIZATION
Corrupted adversarial examples are obtained by maximizing the cross-entropy between the classifier's predictions on the corrupted inputs (by passing them through the corruption network) and their labels. We initialize the perturbations the corruption network parameters randomly within the feasible region. We optimize the perturbations using iterated fast-gradient sign method (FGSM) steps (Goodfellow et al., 2015; Kurakin al., 2016) We project the optimization iterates to stay within the feasible region. We use step size equal to 1 /4 of the median perturbation radius over all parameter blocks (for each backbone network individually). use only steps (due to the increased
Algorithm this step size is denoted
by Nee For CIFAR- 10 use 10 steps; for IMAGENET computational requirements) but we increase the step size by a factor of 10/3 to compensate for the reduction in steps. When AdA is specified to use multiple backbones simultaneously (e.g.. "AdA (All)" which uses four image-to-ines to--mage models) each backbone is used for finding adversarial examples for an equal proportion of examples in each batch.
E.5 COMBINING DATA ACGMENTATION METHODS
We view the process of combining data augmentation methods as a data pipeline, where the output from each stage is fed input to the next stage. We first draw random samples either from the clean training dataset or from the ceepAuument-proeesse
training set if DeepAugment is used, as in Hendrycks et al. (2020a). Then we apply standard data augmentation (random pad and crop for CIFAR-10. 10, random left-right flip and resized crop for IMAGENET). When AdA is used, we apply it now in the pipeline, followed by the SSIM line-search procedure. When AugMix is used, we apply it. as the final step in the data pipeline.
We also experimented with Adam, SGD and normalized gradient ascent but obtained the best results using FGSM.
21

---

Published as a conference paper at ICLR 2022
E.6 CORRUPTION NETWORKS
We train separate VQ- VAE and U-Net model on the training set of each of CIFAR- 10 and IMAGENET (for a total of four models). We train VQ-VAE models using the standard VQ-VAE loss (van den Oord et al., 2017, Eq. 3) with 128 (base) convolutional filters, a 2-layer residual stack (with 32 convolutional filters); we use a vector quantisation embedding dimension of 512, a commitment cost of 0.25 and use exponential moving averages to update the embedding vectors.
We train U-Ner models on an image completion task; i.e. we zero-out 2-35% random pixels of each input image and train the U-Net to fill-in the deleted pixels. We use an image reconstruction loss which is the sum of the mean absolute pixel differences and the mean squared pixel differences (with has two-layer encoder (with 16
the latter being scaled by 0.5 0.1). The U-Net architecture and 32 filters respectively) and a three-layer decoder (with 64, 32 and 16 filters respectively).
We train all four image-to-ing -mmag models for 90 epochs, with batch size of 1024 for IMAGENET and of 16384 for CIFAR- 10. We use the Adam optimizer (Kingma & Ba, 2014) with an initial learning rate of 0.0003 for IMAGENET and 0.003 for CIFAR-10, which we decay throughout training using the linear scaling rule Goyal et al. (2017).
For both EDSR and CAE used by DeepAugment (which are available online).
the same model architectures and pre-trained weights the
F APPROXIMATE SSIM LINE-SEARCE PROCEDURE
The adversarial examples produced by AdA can sometimes become too severely corrupted (i.e., left-tail of densities in Figure 2 of the main manuscript). We guard against these unlikely events by using efficient, approximate line-search procedure. We set maximum threshold, denoted by on the SSIM distance between the clean example and the AdA adversarial example.
Denote by Jyy the linear combination of the clean example, x, and the corrupted example output by AdA, a:
= (1 7) x + +.
When the deviation in SSIM between the clean and the corrupted example is greater than the threshold (SSIM(x .t)= > t), we find scalar y" [0, such that the deviation between the corrected example, values in [0. 1]
2,, and the clean example, J. is 4: SSIM xT,) = I. We take 9 equally-spaced and evaluate the SSIM distance between the clean example and x.y for each considered 7. We fit quadratic polynomial in 7 to all the pairs of y and the threshold-shifted SSIM deviation from the clean example SSIM(x, x.,) - t. We then find the roots of this polynominal, clip them to [o, 1], and take the y closest to the desired y². This corresponds returning the most corrupted variant of x along the ray between x and á which obeys the SSIM threshold. The procedure is very efficient on accelerators (GPUs, TPUs) it requires no iteration. It is approximate, however, because the quadratic polynomial can underfit.
In practice,
maximum SSIM threshold (t) of 0.3 for CIFAR- 10 experiments and one of 0.7 for IMAGENET experiments.
F.1 COMPUTING THE SSIM DISTANCE
For computing the SSIM distance we follow the original paper (Wang et al., 2004) and use an isotropic Gaussian weighting function of 11 with 1.5 standard deviation (normalized), and regularization parameters K1 0.01, K₂ 0.03.
G ADDITIONAL EXPERIMENTS AND COMPARISONS
G.1 COMPARISON TO PREVIOUS WORK ON CIFAR-10
Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) proposes adversarial training method based on bounding neural perceptual distance (LPIPS). Appendix G (Table 10) of the PAT article shows the performance of various models on common image corruptions. However, performance
22

---

Published as a conference paper at ICLR 2022
is summarized using relative mCE, whereas provided us? with the raw corruption errors of their models at each severity and we reproduce their results in (the top half of) Table 5. We observe that PAT has overall lower robustness to common image corruptions (best variant obtains 23.54% mCE) than AugMix (10.90% mCF) and than our best AdA-trained model (7.83% mCE).
absolute mCE throughout. The authors kindly
PAT however, performs very well against other adversarial attacks", including & fn-nrm bounded perturbations. The best PAT model obtains 28.7% robust accuracy against foe attacks (e 8/255) and 33.3% on E2 attacks (e = 1) while our best AdA-variant obtains less robust accuracy in each case (0.99% against l attacks and 13.88% against &o attacks with 4 4/255). This difference in performance against l -y-norm attacks is not surprising, as PAT addresses robustness to pixel-level attacks (i.e., manipulates image pixels directly); whereas AdA applies adversarial perturbations to the corruption function parameters (and not to the image pixels directly).
In similar spirit to PAT, Kireev et al. (2021) introduce an efficient relaxation of adversarial training with LPIPS as the distance metric. Their best model, with a smaller architecture, RESNET18 18, obtains 11.4% mCE on CIFAR- The authors of Kireev et al. (2021) also show that models trained adversarially against f--norm bounded perturbations can act strong baseline for robustness to common image corrpttions.
The strongest known e adversarially trained model against é, -orm bounded perturbations on common image corruptions is that of Gowal et al. (2020) which obtains 12.32% mCE (training against 2--norm bounded perturbations with = 0.5 while using extra-data).
In Wong & Kolter (2021a), the authors first train generative models to represent image corruptions by feeding them a subset of the common image corruptions (from CIFAR- 10-C). In a second stage, they train classifiers using samples (adversarial or random) coming from these pre-trained generative models. Despite having this additional knowledge of the test corruptions, the robust classifiers they train only achieve between 9.5% and 9.7 mCE%.
At the time of our initial submission, to the best of our knowledge, our best performing model (AdA (EDSR) coupled with AugMix and DeepAugment) was more robust to common image corruptions on CIFAR- 10 than all previous methods, obtaining a new state-of-the-art mCE of 7.83%.
After our initial submission, Diffenderfer et al. (2021) obtained lower mCE of 7.22% through an adaptive test-time ensemble of six compressed models (where each model had been pruned 95% sparsity). Diffenderfer et al. (2021) also show that carefully compressing (i.e., pruning and optionally quantizing) neural networks can yield sparser models with similar clean (test) accuracy and similar or better robustness to corruptions.
Table 5: Performance of Perceptual Adversarial Training on common image corruptions. The table lists the performance of ResNer50 models trained using Perceptual Adversarial Training by the original authors of Laidlaw et al. (2021) common image corruptions and two of our AdA- trained models. The table shows clean error, mean corruption error on CIFAR- and individual corruption errors for each corruption type (averaged across all severities). "PAT-self" denotes the case where the same model is used for classification as well as for computing the LPIPS distance, while "PAT-AlexNet" denotes the case where the LPIPS distance is computed using preitrained CIFAR-10 AlexNet (Krizhevsky et al., 2012) classifier.
DIGITAL
CLEAN
PAT MODELS (1 ALA ATALL, 2021)
Traning
25.00%
21
Trining
13.20%
20.71%
Advenarial Training Eg
21.83%
PAT4seff
17.60%
33.54%
PAT-AlexNet
28.40%
34.25%
31s
36.
34:
33,
32-
35,
43:
30:
32.
29.
29.
SOLECTTON qp MODULS (QURS)
AnA TEDSN)
6.63%
13,47%
275 215
31.
11
20
13
14:
12
11
11
75
14
12:
34
115
AdA (RDSR) + DaepAngment + AngMis
5.07%
7.8%%
8.
75
11
5.
10
7:
61
81
61
81
51
51
81
7-
7.
Personal communication.
"See Table 2 of Laidlaw et al. (2021) for full details. See the RORUSTBENCH (Croce al., 2020) leaderhoard: https::/robustt .iiihhhitttti thub.
23

---

Published as a conference paper at ICLR 2022
G.2 NUMBER OF INNER OPTIMIZATION STEPS
We show the effect of changing the number of inner optimization steps (i.e. the number of PGD steps for finding adversarial examples) for AdA (EDSR) on CIFAR-10 Table 6. We sweep a number of PGD steps from 0 to 10 where 10 is the default for CIFAR-10. 10. As described in Appendix E.4, we compensate for the decrease in number PGD steps (from 10) by proportionally scaling up 1o-10 Zero (0) PGD steps correspond to only performing the step size (i.e. effective ?e num_steps"
the random initialization of perturbations to the corruption network's parameters (i.c. lines 5-6 in Algorithm 1). We observe that performance
common image corruptions in aggregate (mCE) and for individual groups, in general, increases with the number of inner optimization PGD steps. We note that adversarial training appears to be necessary for training the most robust models, and randomly sampling the parameter perturbations is not sufficient.
Table 6: Effect of number of inner optimization steps robustness common image corrup- tions (CIFAR& R- CCFAA--0-CC) 10-C). The table shows the performance of the AdA (EDSR) model while varying the number inner optimization steps (M). The table shows the clean top-1 error, the mean corruption еπоо on CIFAR- CIFAR-10-C and on individual corruptions (averaged across all severities).
NOISE
BLUR
WEATHER
DIGITAL
1000
4003
ma
0 (L.c. only random init.)
8.99
28.33
43
34.
35
22.
49
30
29
22.
24.
16
10.
2X
23.
31
23
14.91
26:
21.
12a
18.-
14-
12.
11:
11.
13:
9.
12:
6
6.83
15.94
30:
23
29.
12.
19
13:
15
13a
12:
12:
7.
15.
13:
9.
11
15.66
28.
224
15:
11
12:
15.
13o
12:
15.47
21
20.
11
14.
G.3 PERTURBATION RADIUS
We show the effect of changing the corruption network parameters perturbation radius in AdA on CIFAR-10 in Table We perform a sweep on the perturbation radius by scaling the radius (v 0.015) of the best performing model, AdA (EDSR) + DeepAugment AugMix (from Table in the main manuscript), by {0.5, 0.75, 1.0, 1.25, 1.5). We observe that the robustness performance varies minimally across small range of perturbation radii.
Table 7: Effect of perturbation radius on robustness to common image corruptions (CIFAR- 10-C). The table shows the performance of the best AdA-combination from Table from the main manuscript (AdA (EDSR) + DeepAugment + AugMix) while varying the perturbation radius (v). The table shows mean corruption corruption type (averaged across all severities).
CIFAR-10- and individual corruption errors for each
NOISE
BLUR
WEATHER
DIGITAL
PERTURBATION RADIUS
MCE
30V
www
I400Z
MONS
0,0225
8.10%
113
62
11.4
7.
6n
8.
8x
0.01875
8.06%
11.
9-
8:
6:
0.015 (default)
7.83%
8:
7%
11.
5o
10:
8.
8:
6:
8:
7.
0.01 125
8.41%
9
8:
12
65
11:
8.
6
9:
7:
9:
5
6
8
8:
0.0075
7.99%
8. 11:
8o
6
10:
75
6
9.
6
86
5.
6.
8:
7
8
G.4 PERFORMANCE ON IMAGE CORRUPTIONS THROUGH TRAINING
We visualize the performance of AdA trained models (best AdA-combination from Tables and from the main manuscript) during training in Figure 4. Due to adversarial training, we expect the performance on each of the +-C corruptions to improve as training progresses, and this is indeed what observe. On both datasets, the AdA-trained classifiers perform consistently best Brightness, especially at the beginning of training. On IMAGENET performance increases more slowly on the Blur-type corruptions than all others.
24

---

Published as a conference paper at ICLR 2022
Iepedo Wolee
Zoet Bar
Redio
(Pol Comprnstic
Spater
Spacis
1044
Training
Training (S)
(a) CIFAR-10
arrursy
Gauodan
Zoor Dur
Show
Pree
Dusic Trrab
Redac
PPG Congresice
Sotalan Bur
Spater
189
106
Training
Traiking
(b) IMAGENET
Figure 4: Performance on image corruptions through training, These plots visualize the perfor- mance of the best AdA combination each of the common and +-C corruptions as training progresses. Each individual rectangle plots top-1 accuracy. Brighter is better. The accuracies are visualized raw (plots to the left), normalized over the columns (middle plots) or over the rows (plots to the right). Normalizing over the columns visualizes which corruption's 's performance is best at that point in training. Normalizing over the rows visualizes which stage the classifier performs best on given corruption.
G.5 EXTENDED RESULTS ON INDIVIDUAL IMAGE CORRUPTIONS
We provide supplemental details to Tables and (from the main manuscript) on individual corruption types in Tables 8 and 9, respectively.
25

---

Published as a conference paper at ICLR 2022
Table 8: CIFAR-10: Extended results on robustness common image corruptions. The table shows mean corruption eπror CIFAR-100 10-C and individual corruption errors for each corruption type (averaged across all 5 severities).
NOISE
BL.R
WEATHER
DIGITAL
SETUP
MCE
WING
MOTIO
200N
MOWS
MAIGHT
CONTRAN
WITHOUT ADDITIONAL
DATA
AUGMENTATION:
Nominal
29.37
49
39.
39
20
53
26
24
27
17a
10:
28
21
31
23
(U-Net)
41.
21:
19:
13:
23c
AdA (VQ-VAE)
26.77
25.
24.
28
23
26x
25:
25
27
24
37:
22
37
26:
22
22
AdA (EDSR)
15.47
27:
21
31
11:
20
13
14
12:
11
11
7.
14:
12:
9-
11:
AdA (CAE)
29.15
26:
26.
28:
28
27.
26:
31.
28:
40
25
43
29:
25.
25.
AdA (AD)
18.49
20
18:
23
18
18
18
17:
19
12:
15
(T(
23.64
18c
17.
25
18
20
22.
19.
20
24
40
17:
56
20g
15:
16:
AT (G2)
17.42
12:
11.
17:
13:
16.
17.:
14:
15:
16.
33s
11.
44:
14,
10:
10x
TRADES (E..)
24.72
19s
18:
25
20.
21.
23:5
20:
22:
26.
40
19-
56
21
17.1
17.-
TRADES (f2)
18.08
17.
12:
11
AWP (Pxc)
25.01
20.
19.
20:
21.
23.
21
22
27
404
20:
56
21
17.
AWP (P2)
18.79
14
13
17
14
16
17.
15:
17x
19
35
13:
46
15
12
12
SAM
24.59
58
43
46
14
46
19.
18
15:
19
11:
5:
20
13a
20:
16.
WITH AUGMIX:
Nominal
12.26
27
20:
15
14.
10.-
4.
9.
20:
AdA (U-Net)
12.02
246
18.
18:
7=
16:
9.
8-
10:
9-
7
4.
5:
10.
19:
10:
AdA (VQ-VAR) VAR
20.85
22
21
25
19
24
19
19
22
20
24
16:
20
20:
19:
18
AdA (EDSR)
9.40
17:
13:
16-
11
7.
8.
7:
7
4.
10:
AdA (CAE)
20.20
18:
22.
22
18
22
20.
26
16
21
20:
AdA (All)
14.12
18s
16.3
17.
12
17a
13.a
14:
13.
12
12.
8.4
10.
13a
16.
12x
WITH DEEPALGMENT:
Nominal
11.94
12:
11:
15.
8,
18:
11.
9.
12.
10.
10.
7.
10:
13a
14.
12.1
(U-Net)
13.09
13a
19:
19.
11:
14.
11:2
13:
13:
AdA (VQ-VAE)
26.35
29
28.4
32
22.
26
24
23:
27.
25:
32.
22.-
26
26:
23
23a
AdA (EDSR)
12.37
13o
12
17
10.
16
11:
10:
13
10
13
9.
11
13
10:
11-
AdA (CAE)
27.98
26
26.6
28
25
28
27.
26
30:
27
36
25:
29:
29:
25:
26.
AdA (AII)
21.70
21s
20.
23
24
22.4
23.4
20.
25:
18.
23.1
19.
AUGMIX
DEEPAUGMENT:
Nominal
7.99
8x
7-
10
5
11:
7:
6
8
7:
4+
8
12
8
AdA (U-Net)
8.63
94
8:
11
5.
12.
7-
6.
9-
6:
8n
5
5
9.
14
8
AdA (VQ-VAR,
25.17
25.
29:
27
23.
22
27
30:
22
23
25.
23
23
AdA (EDSR)
7.83
10:
8:
8:
7:
AdA (CAE)
20.09
19:
18a
21:
17.
23.
20.
18
22
20:
26.
16s
19
20.
19:
18a
AdA (AB)
11.72
12n
11:
14:
10:
14:
11.
10.
13a
10x
13
8.
9.
12:
12:
11:
26

---

Published as a conference paper at ICLR 2022
Table 9: IMAGENET (128x128) Extended results on robustness to common image corruptions. The table shows mean corruption error on IMAGENET-C and individual corruption errors for each corruption type (averaged across all 5 severities).
NOISE
BL.U
WEATHER
DIGITAL
SETUP
MCE
L2RR
Manon
20022
2008
003
PREEC
WITHOUT ADDITIONAL
DATA
AUGMENTATION:
Nominal
82.40
73.-
74.
71.
78ss
70.-
65.
66.7
63:
57.
72.4
55.
AdA (U-Net)
83.51
81.
92s
79:
86
73a
74.
613
60
41
34.3
48
65p
51
58
AdA (VQ-VAE)
78.26
73.-
71:
72-
71:
66
62
66-
67.
63
60:
44.
64
54.
44p
43
AdA (EDSR)
79.59
74-
75.
78
70
75.
67
66
62
60:
44
33
56
57
64.
54
(CAE)
89:
75
70
66
75
68.
564
45
62.
47s
AdA (All)
75.03
76
76
83
67
72
65
67
59
55
41
31
48
57
37
50s
WITH AUGMIX:
Nominal
77.12
70.
71.
75.
67.2
75.1
64m
59.
60>
61.
37
34.7
46
375
71.4
35o
AdA (U-Net)
77.87
71.2
72:
86
74.
814
64.
57.
58
37:
32w
41
51.
59.
AdA (VQ-VAE)
73.41
75.
73-
69:
68.
69
61
60:
61s
56.
41.
38
44
56
44
48
AdA (EDSR)
73.59
67.
68.
71:
65
73
62x
61.
61s
58.
39.
31
43
55.
60s
48
AdA (CAE)
80.85
87.
86
91:
66
65
63e
63a
71
66
50
42:
52:
53
59
44
AdA (AII)
72.27
66
67.-
71s
60%
58
55
40
46.1
55a
WITH
Nominal
73.04
52:
52
53
60
69
65p
63
57.
55.
43
33s
58
56
66x
63x
AdA (U-Ner)
75.03
54,
56:
60
67.s
77
66:
72.
55
54.
40:
34
42.
62,
47
79.
AdA (VQ-VAE)
69.15
58
56
57
63
68
57
54.
46:
37:
49
37.
49:
AdA (EDSR)
65.62
48.2
49.
58.
66.
62s
63.4
56x
5344
42.
31
50
53:
33
51.
AdA (CAE)
77.55
64.3
66:
69.
64.
73
66
66
56.
55:
44
36:
50:
61.
39.
87
AdA (All)
65.54
47.
48
47
59.
66
60.
65.
54.2
51.
42.
32
44:
55.
37.4
54
WITH AUGMIX
DEEPAUGMENT!:
Nominal
70.05
50
67x
54s
53
37
33
43
72n
AdA (U-Net)
71.64
53a
54
57
62
73:
63
65
53
53
38
34:
38
61
45
76
AdA (VQ-VAE)
69.02
54.:
54
54
56.
62
59:
66:
58:
56:
47:
42
47
59:
42.
46:
AdA (EDSR)
64.31
47%
48
64
56a
56
55a
52a
39.
32
41
35
62:
AdA (CAE)
67.89
55.
56:
55:
55.
60:
57
55
45.
39.
45
38.
48:
AdA (Ali)
62.90
48.
48.
48
55.4
63
54:
60:
53:
51:
41
34.1
39.
56:
36:
45
27


Reviews:
[{"review_id": "rmkql4WXkHo", "reviewer": "Reviewer_31sh", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength:\n* the proposed Adversarial Augment (AdA) is a novel contribution that comes with the benefit of being a general purpose approach. That is: in contrast to other augmentation operations, it could be applied on any type of data if there exist a suitable pretrained corruption network for the type of data\n * Strong empirical results, establishing a new state-of-the-art for CIFAR-10-C when combined with other augmentations. Moreover, strong results are also shown for ImageNet-C\n* paper is well written and experiments are well structured and presented (Table 1 and Table 2)\n\nWeaknesses:\n * Related work on sharpness-aware minimization (SAM; Foret et al. \"Sharpness-aware Minimization for Efficiently Improving Generalization\", ICLR 2021) and adversarial weight perturbation (AWP, Wu et al., \"Adversarial Weight Perturbation Helps Robust Generalization\", NeurIPS 2020) should be discussed. The main difference seems to be that the proposed method utilizes an auxiliary image-to-image model while SAM and AWP generate adversarial weight perturbations directly in parameter space of the classifier. Since the setting of SAM/AWP is more generic (no requirement of pretrained vorruption network), it would be important to clearly show an advantage of AdA over these works.\n * Assumption 1 (Corruption coverage), which is the basis for the theoretical considerations, is not plausible. The authors show in Figure 3 that the first part of the assumption (\"$\\beta$ has support as least as broad as $\\alpha$\") is approximately fulfilled. However, the second part (\"any corruption function sampled from $\\beta$ leaves the ground-truth label unchanged\") seems highly unlikely: because of the first part of the assumption, the same property would have to hold for $\\alpha$. Prior work has established that images corresponding to different classes can have small $\\ell_p$ distance. The support of corruptions such as Gaussian noise-severity 5 on an image thus very likely covers parts of the input space that belong to other classes (even though sampling such Gaussian noise is highly unlikely).\n* since the general method is not restricted to image classifiers or even image-based tasks, including results on other types of data would strengthen the paper.\n* discussing the computational and memory overhead more transparently would be desirable. As I see it, the additional inner maximization should increase runtime by a factor of M (M=10 on CIFAR10). Moreover, the additional corruption network needs to fit in memory, increasing the required memory. This should be part of a discussion of pros and cons of the methods. \n* AdA is by design a deterministic procedure that should generate the same augmented version of the input for a given model when applied repeatedly. A desirable property of data augmentation is diversity, that is: the same input is augmented differently in every application of the augmentation operator. Could the authors comment on why AdA is defined as a deterministic procedure? (I acknowledge that due to randomness in optimization and changing model parameters, the input augmentation during training is not static but still, diversity is more an accidental byproduct and not an intrinsic property of AdA).\n\nAdditional comments:\n * in the current form, all layers of the corruption network are perturbed. Would it make sense to perturb only a subset of the layers - for instance the first layers that presumable focus more on appearance than semantics?\n * shouldn't $\\eta_c$ in line 8 of Algorithm 1 depend on the layer index i - because it needs to depend on the {2, \\phi} norm ?  Also, shouldn't Algorithm 1 use the {2, \\phi} norm?\n* Having error bars in Figure 3 that go beyond 1 does not make sense since SSIM cannot be larger than 1. This indicates that a different way of plotting the empirical distribution of SSIM scores would be better suited for the data.\n", "summary_of_the_paper": "The main contribution of the paper is the proposed AdversarialAugment (AdA) method. AdA generates augmented versions of an input by passing the input through an corruption network (such as a pretrained image-to-image model) while adding a worst-case perturbation to the _weights_ of this pretrained network. The paper thus aims at using worst-case perturbations for increasing average case out-of-distribution generalization such as common corruption robustness. Tuning the weight perturbation radius of the corruption network is done based on controlling the SSIM of the augmented to the clean input.\n\nThe paper provides theoretical considerations that state assumptions under which AdA is well-behaved (converges) and how it is related to prior work such as DeepAugment.\n\nThe paper presents an extensive evaluation on common corruption benchmarks (CIFAR10-C and ImageNet-C), domain shift (ImageNet-R), resampled test sets (CIFAR-10.1 and ImageNet-v2), and worst-case robustness against $\\ell_p$ perturbations.\n", "summary_of_the_review": "The main strengths of the paper are its strong empirical results and that the proposed AdA is a generic approach that could be extended to other types of data. However, the strong empirical results come at the cost of highly increased computation at train time and it remains unclear if appropriately tuned SAM couldn't provide similar benefits. Moreover, the general purpose nature of the approach is not demonstrated because experiments are restricted to image classification. Finally, the theoretical considerations are based on an impractical assumption.\nIn summary, I consider the paper in its current form below the acceptance threshold (albeit marginally so). Showing the potential of AdA on other types of data _and_ comparing to SAM/AWP could bring it above the threshold.\n\n### Update after rebuttal ###\nThe authors have convincingly addressed my concerns regarding a comparison to SAM/AWP, discussing the computational and memory overhead more transparently, and several further minor points. I am raising my score to 6: marginally accept.\nHowever, I would still like to emphasize that the \"Theoretical Considerations\" in their current form are grounded on unrealistic assumptions and disconnected from the rest of the paper. The authors describe in the discussion how the theoretical considerations could be revised to be grounded on more realistic assumptions. It is difficult to judge the correctness of this line of thought based on a discussion in the review forum, without a proper revision of the paper. I highly encourage the authors to update the \"Theoretical Considerations\" of the main paper.\nIn summary, I lean towards acceptance because the paper is strong on the empirical side and provides a compelling approach - but this is in spite of (not because of) the theoretical considerations.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "nD8qsfq7zOE", "reviewer": "Reviewer_AUQw", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "strengths:\n===========\n- empirical evaluations are thorough and detailed.\n\n- formalisation and theoretical analysis are provided, connecting the proposed method with previous work\n\n- combining defense against perturbation with adversarial training, providing a data augmentation method that can provide resilience against both at the same time, without sacrificing generalisation.\n\nweaknesses:\n===========\n- Main results (Table1,2) suggest that none of the single Ada methods can consistently outperform DeepAugment or AugMix, in any of the corruptions, clean accuracy, or adversarial attacks. In fact, none of the 4 proposed variants (EDSR,CAE,UNET, VQVAE) can by their own outperform DeepAugment or AugMix, on any of the corruptions, generalisation, or adversarial robustness (compare any of the Ada methods, with nominal row in AugMix and DeepAugment). This is a very important drawback, which is  hard to justify, that only by combinations with other techniques, the proposed method becomes effective. \n\n- Although one of the aspects of this work is building adversarial robustness into models, no thorough comparisons against SOTA adversarial training methods (such as [1,2,3]) are provided. Table4 in appendix F only shows perturbation and clean performance, and not adversarial robust accuracy. This is the second drawback of the current paper, that does not provide the full comparison to the two edge of the related work. Ideally, we would like a method that can improve both, or at least perform on-par, or with a reasonable trade-off. \n\n- The proposed approach seems to be significantly more computationally demanding than its counterparts AugMix and DeepAugment. I would like to see a comparison in terms of computational requirements.\n\n\nAdditional questions\n====================\n\n- In Appx E, what is the value of max threshold t? and how is it calculated?\n\n- In the sample guarding mechanism, how many of the augmented samples are guarded? are there any statistics? and also on the linear interpolation, some statistics on what values of lambda have been used would be insightful, to demonstrate that actually the augmented samples have been largely influential, and not ignored by the guard or interpolation.\n\n- Do all methods (Ada, DeepAugment, AugMix) use the same training strategy (lr schedule, resizing on ImageNet, etc)?\n\n- In Appx C, it is mentioned that for ImageNet and CIFAR10 standard data augmentation has been used. Is this the basic setting? E.g, all methods used and evaluated in this paper, use the \"standard\" augmentations, in addition to the mentioned augmentations (e.g, DeemAugment, AugMix, Ada)?\n\n- In Alg1, it seems there is no randomness choosing between training on real samples and augmented samples. Were models always trained on augmented samples (e.g, no original training was used)?\n\n- In Appx A: One of the benefits of Ada was mentioned to be its generality to other tasks and data modalities such as Audio and text. Though there is no provided result that can support this claim. I recommend to rephrase or strengthen the claim by additional results.\n\n- In section 4, discussions, where did 10^-5 ||\\delta|| come from? \n\n\n- are there any evaluation metrics on the generative models used? How good do they perform in the task they have been trained on?\n\n\n- Adversarial Mixing [4] is an augmentation method that similar to Ada uses a generative model, as well as an adversarial loss, to create augmented samples. In this regard, it is the closes method to Ada. I expect to see how it compares to Ada, at least on some of the experiments.\n\nrefs:\n=====\n[1] Zhang, Hongyang, et al. \"Theoretically principled trade-off between robustness and accuracy.\" International Conference on Machine Learning. PMLR, 2019.\n\n[2] Gowal, Sven, et al. \"Uncovering the limits of adversarial training against norm-bounded adversarial examples.\" arXiv preprint arXiv:2010.03593 (2020).\n\n[3] Kireev, Klim, Maksym Andriushchenko, and Nicolas Flammarion. \"On the effectiveness of adversarial training against common corruptions.\" arXiv preprint arXiv:2103.02325 (2021).\n\n[4] Gowal, Sven, et al. \"Achieving robustness in the wild via adversarial mixing with disentangled representations.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n", "summary_of_the_paper": "This paper provides a data augmentation method that augments samples by perturbing parameters of a generative model. The perturbations are found by an adversarial loss, and are constrained based on a perceptual similarity distance to guard from the outliers.\nIn addition to thorough empirical evaluations, this paper provides formalization of their method and a closely related one (deep augment), adding theoretical insights , and provide interesting convergence properties and PAC-Bayesian analysis.\n", "summary_of_the_review": "The proposed method builds on recent related work, and its design is justified. Provides insightful empirical and theopretical results, and unifying some related work.\nHowever:\n- Empirical results does not support the claims (considering single methods applied)\n- Is not compared to adversarial training methods on adversarial robustness AND perturbation robustness.\n- Some relevant approaches have been missed in comparisons, as discussed above.\n\n\n## after rebuttal:\nDuring the rebuttal, the authors responded to all my concerns, and strengthened their empirical evaluations with additional results. Also the claims of the paper are now aligned with the reported results, and the limitations of the proposed approach is clarified and sufficiently discussed.\nI find this paper a good reference for research on adversarial and perturbation robustness method that benchmarks a wide range of methods from both areas, with a method that although has its limitation, a strong baseline for the future work in this direction. I therefore increase my score.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "XRlwXCszbT", "reviewer": "Reviewer_fuXu", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "*Strength*\n\nIn contrast to attacking the classifier, this approach makes a novel use of image-to-image translations network to generate corrupted samples for the classifier. This general proposed approach is amenable to learning a wide-set of image transformations, thus creating a potential for a big impact on the current state of the art in the field. \n\n*Weakness*\n\nI think that the proposed approach is significantly more computationally expensive than baselines (except DeepAugment) This is because the optimization process is solved over image-to-image translation networks. Unlike classification networks, these models largely operate on full-resolution images throughout the network, thus have much higher latency. Additionally the optimization process is solved individually for each sample. Can authors provide a comparison of the computation cost with baselines?\n\nWhat is the impact of architecture-specific priors? There is a common trend, where U-Net and VQ-VAE models consistently perform worse than their counterparts (table 1, 2). In particular, clean accuracy itself degrades significantly when using them as a source of adversarial dataset augmentation. Is it because of their inability to reconstruct the input image in absence of perturbation or hard to achieve high fidelity in presence of perturbations. Can authors shed some light on this phenomenon?\n\nMoving beyond image corruptions: Due to use of image-to-image translation network, current approach is mostly limited to image corruptions. For example, it is very hard for an image-to-image translation network to model affine transformations. Modelling such non-local transformations is an active area of research [1]. I encourage authors to discuss this limitation. \n\nAnother missing analysis in the paper is towards understanding how the proposed augmentations generalize to unseen corruptions at test time. I agree that the image-to-image translation network is expressive enough to model most image corruptions techniques, when specifically optimized for them (figure 3). However, we operate in an untargeted setting, i.e., not aware of the test-time corruption mechanism. In this untargeted setting, does the translation network using corruptions similar to the existing set of corruptions (such as blurring, weather changes)? This can be potentially measured with a classifier trained to recognize presence of specific corruptions in an image. \n\nOn a minor note, range of SSIM values in fig. 3 appears above 1 (which is not feasible since SSIM is bounded between [-1, 1]. Is it just a plotting issue with errorbars?\n\n\n1. ​​Richardson, Eitan, and Yair Weiss. \"The surprising effectiveness of linear unsupervised image-to-image translation.\" 2020 25th International Conference on Pattern Recognition (ICPR). IEEE, 2021.\n\n\n", "summary_of_the_paper": "This paper makes use of image-to-image translation networks to generate adversarial data augmentation for input images. When combined with existing approaches, it achieves state-of-the-art robustness against unseen corruptions and worst-case perturbations.", "summary_of_the_review": "This paper provides a general framework to defend against unseen image corruptions and adversarial perturbation. The general nature of the framework makes it feasible to use it with a wide range of corruptions. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "6iB9Jfl6Xx", "reviewer": "Reviewer_w3th", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "- Strength:\n    - Connecting common image corruption robustness and adversarial robustness is a good direction. \n    - While models trained with AdversarialAugment is not specifically designed to defend against lp-norm bounded adversarial perturbations, their classifiers show some resilience. This is an important improvement over DeepAugment+AugMix, because these previous approaches didn't show robustness against adversarial perturbations. Previously, adversarially-trained networks were shown to be robust to some corruption types, but they fail at corruption types like Fog. Future work might be able to fix this gap by leveraging AdversarialAugment.\n\n- Weaknesses:\n    - The current formulation seems to be much more computationally demanding than their counterparts such as AugMix, DeepAugment etc. It would be more fair to discuss the limitation on this aspect and/or compare the baselines controlled for similar computational resources.    ", "summary_of_the_paper": "The authors propose a new data augmentation technique, called AdversarialAugment, to increase robustness of image classification models.\nThe proposed method optimizes the parameters of image-to-image models to generate adversarially corrupted images, where they also show sufficient conditions for the consistency in the simple setting.\nThey empirically show that AdversarialAugment improves common corruption robustness on CIFAR-10-C as well as worst-case performance against lp-norm bounded perturbations on CIFAR-10 and ImageNet. ", "summary_of_the_review": "This paper contributes to the body of work that tries to tackle both types of robustness problems (common corruption and adversarial corruption) under a unifying view, which is an important step. While their method seems to be computationally demanding, it demonstrates good empirical performance along with theoretical justification.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes an adversarial data augmentation technique searching for adversarial weight perturbations of a corruption network (e.g. a pretrained image-to-image model). The goal is to achieve common corruption robustness as well as a non-trivial level of adversarial robustness. The authors claim state-of-the-art-performance on CIFAR10-C.

Most reviewers had initial concerns which the authors could clarify in most cases. Finally, all reviewers argue for acceptance.

Strengths:
- no pre-defined corruption model necessary
- extensive experiments on CIFAR10 and ImageNet with SOTA results
- all reviewers agree that this paper would be valuable as a future reference

Weaknesses:
- the theoretical part is in my point of view rather misleading and should be completely rewritten as the authors lack here rigor concerning the setting they are working in (as also Reviewer 31sh criticizes). In particular the corruptions are not just a covariate shift (p(y|x) is invariant, only p(x) changes) as the corruptions mix the conditional distributions of different points. Thus under the given assumptions (which should be summarized at one point rather than being scattered over the text) the Bayes optimal classifer is invariant but not the Bayes optimal predictive probability distribution (which is clearly important for assessing uncertainty of the prediction). 
However, when training with the cross-entropy loss we are estimating the predictive probability distribution and thus the given statement
about convergence of the risks makes no sense for me and the optimal parameters of the classifier need not be equal even if their classifications agree everywhere. Thus the required changes to fix this theoretical part go significantly beyond what the authors suggest in their rebuttal. 
- the improvements over AugMix+DeepAugment (7.83 mCE vs 7.99 mCE) are negligible and most likely not statistically significant
While AdA has significantly higher adversarial robustness than AugMix+DeepAugment, it remains unclear if using AugMix+DeepAugment together with adversarial training for l_2 as done in
 [3] Kireev, Klim, Maksym Andriushchenko, and Nicolas Flammarion. "On the effectiveness of adversarial training against common corruptions." arXiv preprint arXiv:2103.02325 (2021).
could have led to a similar result 

The paper provides an interesting approach to achieve robustness against common corruptions and all reviewers recommend acceptance. The theoretical part as written currently is misleading as discussed above - the authors have to make it completely rigorous (including proofs, formal statements/defininitions etc) or get rid of it.

Minor weak points:
- According to the leaderboard of RobustBench the SOTA for CIFAR10-C is  by now taken by the NeurIPS 2021 paper
Diffenderfer et al,  A Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution Robustness
which achieves 96.56% standard accuracy and 92.78% mCE. This is 1.64% and 0.61% better than in the present paper and needs
to be discussed as prior work.
- for the adversarial robustness evaluation regarding "AutoAttack & MultiTargeted" you refer to Gowal et al (2020) but the robustness
evaluation has to be properly discussed in this paper
Decision: Accept (Poster)