Understanding and Improving Robustness of Vision Transformers through Patch-based Negative Augmentation
Authors: Yao Qin
Chiyuan Zhang
Ting Chen
Balaji Lakshminarayanan
Alex Beutel
Xuezhi Wang
Venue: ICLR 2022 Submitted (2022)
Keywords: Vision Transformer
robustness under distributional shift
data augmentation

Abstract: We investigate the robustness of vision transformers (ViTs) through the lens of their special patch-based architectural structure, i.e., they process an image as a sequence of image patches. We find that ViTs are surprisingly insensitive to patch-based transformations, even when the transformation largely destroys the original semantics and makes the image unrecognizable by humans. This indicates that ViTs heavily use features that survived such transformations but are generally not indicative of the semantic class to humans. Further investigations show that these features are useful but non-robust, as ViTs trained on them can achieve high in-distribution accuracy, but break down under distribution shifts. From this understanding, we ask: can training the model to rely less on these features improve ViT robustness and out-of-distribution performance?  We use the images transformed with our patch-based operations as negatively augmented views and offer losses to regularize the training away from using non-robust features. This is a complementary view to existing research that mostly focuses on augmenting inputs with semantic-preserving transformations to enforce models' invariance. We show that patch-based negative augmentation consistently improves  robustness of ViTs across a wide set of ImageNet based robustness benchmarks. Furthermore, we find our patch-based negative augmentation are complementary to traditional (positive) data augmentation, and together boost the performance further.

Under review as a conference paper at ICLR 2022
UNDERSTANDING AND IMPROVING ROBUSTNESS OF VISION TRANSFORMERS THROUGH PATCH-BASED NEGATIVE AUGMENTATION
Anonymous authors Paper under double-blind review
ABSTRACT
We investigate the robustness of vision transformers (ViTs) through the lens of their special patch-based based architectural structure, i.e., they process an image as a sequence of image patches. We find that VITs surprisingly insensitive to patch- based transformations, even when the transforratiin largely destroys the original semanties and makes the image unrecognizable by humans. This indicates that ViTs heavily use features that survived such transformations but are generally not indicative of the semantic class humans. Further investigations show that these features are useful but non-robust, as ViTs trained on them can achieve high in in-distribution accuracy, but break down under distribution shifts. From this un- derstanding, we ask: can training the model to rely less on these features improve ViT robustness and out-of-distribution performance? formed with our patch-based operations negatively augmented views and offer losses to regularize the training away from using non-robust features. This is a complementary view to existing research that mostly focuses augmenting in- puts with show that patch-based negative augmentation consistently improves robustness of ViTs across a wide set of ImageNet based robustness benchmarks. Furthermore, we find our patch-base negative augmentation are complementary traditional (positive) data augmentation, and together boost the performance further. All the codes in this work will be open-sourced.
use the images trans-
transformations to enforce models' invariance. We
INTRODUCTION
Building vision models that are robust, i.e., that are highly accurate even on unexpected and out-of- distribution images, is increasingly requirement to trusting vision models and a strong benchmark for progress the field. Recently, Vision Transformers (ViT', Dosovitskiy et al. (2021)) sparked radically new model architecture offering significant accuracy
great interest in the literature, improvements and with hope of new robustness benefits. Over the past decade, there has been extensive work understanding the robustness of convolution-based neural architectures, the dominant design for visual tasks; researchers have explored adversarial robustness (Szegedy et al., 2013), domain generalization (Xiao et al., 2020; Khani & Liang, 2021), feature biases (Brendel & Bethge, 2019; Geirhos et al., 2018; Hermann et al., 2020). As result, with the new promise of vision transformers, critical understand their properties and in particular their robustness. Recent early studies (Naseer et al., 2021; Paul & Chen, 2021; Bhojanapalli et al., 2021) have found ViTs be more robust than ConvNets in some scenarios, with the hypothesis that the non-local attention based interactions enabled VIT's to capture more global and semantic features. In contrast, we add to this line of research showing a different side of the challenge: we find ViTs are still vulnerable to relying non-robust features impeding cuttof-diittrbbtion performance.
In this paper, we first demonstrate ViTs rely on specific non-robust features and then show how to re- duce the reliance on these non-robust features, enabling improved out-of-distribution performance. To understand the robustness properties of ViTs, we start with the architectural traits of ViTs ViTs operate non-veerlnpping image patches and allow long range interaction between patches in lower layers. It is hypothesized in recent studies (Naseer et al., 2021; Paul & Chen, 2021; Bho- janapalli al., 2021) that the non-local attention based interactions contribute better robustness

---

Under review as a conference paper at ICLR 2022
Conh 0.997
Conti 954
Cont 9999
Cont: 937
Cont:
Conh 997
Canti 997
Class: keeshond
Cont: 0.997
Cont. O 982
Cont. 0.976
Cont: 0.379
Cont: 0.983
Cont: 0.86
Cont. 0.663
Class: magple
P. P-Shufiic
P-Shuffic
Rotatt
R-Ratto
P-lefil
P-infil
Replace
Figure 1:
Patch-based transformations largely destroy images to be unrecognizable to humans whereas ViT recognizes them the original class (e.g.. keeshond or magpie) with high confidence. Visualization of patch-based transformations, On the top of each image, we display the predicted confidence score of ViT-B/16 pretrained on ImageNet-21k and finetuned on ImageNet-Ik.
of ViTs than ConvNets. To study the ability of ViTs to integrate global semantics structures across patches, design and apply patch-based image transformations, such random patch rotation, shuffling, and biikkrouud-infillin (Figure 1). Those transformations destroy the spatial relation- ship between patches and corrupted the global semantics, and the resultant images are often visually unrecognizable. However, we find that ViTs are surprisingly insensitive to these transformations and can make highly accurate predictions these transformed images. This suggests that ViT's features that survive such transformations but are generally not indicative of the semantic class to humans. Going one step further, find that those features are useful but not robust, ViTs trained on them achieved high in in-distribution accuracy, but suffered significantly on robustness benchmarks.
With this understanding of ViTs' reliance on non-robust features captured by patch-based transfor- mations, we still must answer: (a) how can we train ViTs to not rely such features? and (b) will reducing reliance on such features meaningfully improve aut-of-distribution performance and not sacrifice in-distribution accuracy? A majority of past robust training algorithms encourage the smoothness of model predictions on augmented images with semantic preserving transformations (Hendrycks et al., 2020b; Cubuk al., 2019). However, the patch-based transformations deliber- ately destroy semantic meaning and only leave non-robust features. Taking inspiration from recent research generative modeling (Sinha al., 2020), propose family of robust training patch-based based negative augmentations that regularize the training from relying non-robust features surviving patch-based transformations. Through extensive evaluation wide set of ImageNet-based benchmarks, we find that our methods consistently improve the robust- ness of the trained ViTs. Furthermore, our patch-based negative augmentation can be combined with the traditional (positive) data augmentation to boost the performance further. With this we more complete picture: training models both to be insensitive to spurious changes (as in positive augmentation) but also to not rely on non-robust features (as in negative augmentation) together can meaningfully improve robustness of ViTs.
algorithms based on patch
Our key contributions are as follows:
Understanding Non-Robust Features ViT: We show that ViTs heavily rely on non- robust features surviving patch-based transformations but are not indicative of the semantic classes to humans.
We propose a set of patch-based operations as negatively augmented views, complementary existing works that focus cemantic-peeserving ("positive") augmen- tations, to regularize the training away from using these specific non-robust features;
Modeling:
Improved Robustness of ViT: We show across a wide set robustness benchmarks that our proposed negative augmented views can consistently improve ViT's robustness and complementary to "positive" augmentation.
PRELIMINARIES
Vision Transformers Vision transformers (Dosovitskiy et al., 2021) are a family architec- tures adapted from Transformers in natural language processing (Vaswani al., 2017), which di-
2

---

Under review as a conference paper at ICLR 2022
Patch Shuffle
Patch Rotate
Potch Infill
Clean
60
80
80
Tha-1 Accurary (%)
60
80
60
60
40
VIT-8/16
40
VIT-B/16
40
VT-B/16
40
VIT 8/32
8/32
VT
20
VT--L/16
20
WIT-L/16
20
WT-L/16
20
V/3-
V/T
V/3
32
64
96 32
64
96
0.4
0.3
0.2
Patch Size
Patch Size
Replace Rate
Figure 2: ViTs can rely on features surviving patch-based transformations to maintain a high accu- racy, even after images have been heavily transformed to be largely unrecognizable. Top-I accuracy of VIT models when tested on patch-based transformed images using the semantic class of the cor- responding clean image as ground-trutie The test accuracy on ImageNet- Ik validation set is shown on the right. All ViT models are pre-trained on ImageNet-21K and fine-tuned on ImageNet-1k.
rectly process visual tokens constructed from image patch embeddings. To construct visual tokens, VIT (Dosovitskiy et al., 2021) first splits an image into a grid of patches. Each patch is linearly pro- jected into a hidden representation vector, and combined with a positional embedding. learnable class token is also added. Transformers (Vaswani et al., 2017) are then directly applied on this set of visual and class token embeddings as if they are word embeddings in the original Transformer formulation. Finally, a linear projection of class token is used to calculate the class probability.
Model Variants We consider VIT models pretrained on either ILSVRC-2012 ImageNet- 1k, with 113 million images or ImageNet-2lk, with ~4 million images (Russakovsky et al., 2015). All models are fine-tuned on ImageNet- Ik dataset. We adopt the notations used in (Dosovitskiy al., 2021) to denote model size and input patch size. For example, ViT-B/16 denotes the "Base" model variant with input patch size 16 x 16.
Robustness Benchmarks To evaluate models' robustness, we mainly focus on three ImageNet- based robustness benchmarks, ImageNet-A (Hendrycks et al., 2019), ImageNet-C (Hendrycks & Dietterich, 2019), ImageNet-R (Hendrycks et al., 2020a). Specifically, ImageNet-A contains chal- lenging natural images from a distribution unlike ImageNet training distribution, which can easily fool models to make misclassification. ImageNet-C consists of 19 types of corruptions that are frequently encountered in natural images and each corruption has 5 levels of severity. It is widely used to measure models' robustness under distributional shift. ImageNet-R is composed of images obtained by artistic rendition of ImageNet classes, e.g., cartoons, and is widely used to evaluate model's 's robustness
data.
3 UNDERSTANDING ROBUSTNESS OF VISION TRANSFORMERS
Recent works (Naseer et al., 2021; Paul & Chen, 2021; Bhojanapalli et al., 2021) have shown that vision transformers achieve better robustness compared standard convolutional networks. One explanation for vision transformers' stronger robustness is that the attention mechanism can capture better global structures. To investigate ViT has successfully taken advantage of the long range interactions between patches, we design series of patch-based transformations which significantly destroys the global structure of images. The patch-based transformations (see Fig. I) are:
Patch-based Shuffle (P-Shuffle): randomly shuffle the input image patches to change their positions!.
Patch-based Rotate (P-Rotate): we randomly select a rotation degree from the set Ω {0", 90%, 180" 270%) } and rotate each image patch independently.
Patch-based Infill (P-Infill): we replace the image patches in the center region of an image with the patches on the image boundary
1 Shufflle is equivalent shuffling the position embeddings. For example, given an image with size 384 x 384, input patch size is 16 x 16 and replace rate 0.25, we in total have 576 patches Da where i and j denotes the row and column index and 1 S i. 24. The patches in the center am.a: 7 S m, 18 are replaced by the remaining patches.
3

---

Under review as a conference paper at ICLR 2022
ImageNet 1k
ImageNat
ImageNet (Goussian No so
ImagoNit
5.0
1.9
2.5
P-Shutfic (ps=26)
Hotott (ps=26)
P-00 (mm00,34)
10p Accuracy (58)
P.Stuffic (p5-32)
80
Robote (25-32)
Pinfll (m=0042)
P-Shuftle (ps
P Robate (ps:48))
Pirill (ma00,00)
26.7
-12.2
4.5
-7.7
20.3
-2.7
37.9
-17.1
-7.5
-74
WT802 P.56/m
P-Rotate
AShule
WIT-426 P.Siffll
Panfil
WT/4/26 P-StuTTc
Pututake
Minfll
Figure 3: Features preserved in patch-based transformations are useful but non-robust as training VIT on them impedes robustness. Top-1 Accuracy (%) on ImageNet-1K l validation set and Ima- geNet robustness datasets: ImageNet-A, ImageNet-C. ImageNet-R, The baseline model is ViT-B/16 in (Dosovitskiy et al., 2021) trained on original images. Other models are trained on patch-based transformed images, e.g., "P-Shuffle" stands for a ViT-B/16 model trained on patch-based shuffled images. Numbers above the bars are either accuracy (e.g., ViT-B/16) or the max accuracy difference between each model family and the baseline BTTTB/16. The patch size in P-Shuffle and P-Rotate and replacement ratio in P-Infill is denoted by "ps" and "rr" respectively.
Each patch- patch-based transformation is performed to a single image. We make sure the patch size of our patch-based transformation is multiple of the input image patch of ViT so that the content within each patch is well-maintained. For P-infill, we use "replace rate" to denote the ratio of replaced patches in the center over the total number of patches in an image. Examples of transformed images are shown in Fig. I (see Appendix F for more examples). In most cases, it is challenging to recognize the semantic classes after those transformations.
Do ViTs rely on features not indicative of the semantic classes to humans? To validate if ViTs be- have similarly as humans on these patch-based transformed images, we evaluate ViT models (Doso- vitskiy et al., 2021) on these patch-based transformed image. Specifically, we apply each patch- based transformation to ImageNet- Ik validation set and report the test accuracy of each ViT on the transformed images. The test accuracy is computed by using the semantic class of the correspond- ing original image as the ground-truth. As shown in Figure 2, the accuracy achieved by ViTs are significantly higher than random guessing (0.1%). In addition, shown in Figure 1, ViT gives these patch-based transformed images a very high high-confident prediction even when the transforma- tion largely destroys the semantics and make the image unrecognizable by humans 3. This strongly indicates that ViT models heavily rely on the features that survive these transformations to make a prediction. However, these features are not indicative of the semantic class humans.
Do features preserved in patch-based transformations impede robustness? Taking one step further, want to know if the features preserved by simple patch-based transformations, which are not indicative of the semantic class to humans, result in robustness issues. To this end, we train a vision transformer, e.g., ViT-B/16, on patch-based transformed images with original semantic class assigned as their ground-trute Note that all the training images are patch-based transformed images. In this way, we force the model fully exploit the features preserved in patch based transformations. In addition, we reuse all the training details and hyperparameters in (Dosovitskiy et al., 2021) to make sure the "only" difference between our models and the baseline ViT-B/16 (Dosovitskiy al., 2021) is the training images. Then, we test the model on ImageNet-Ik validation set and three robustness benchmarks, ImageNet-A, ImageNet-C and ImageNet-R without any transformation.
First, we can observe that for the baseline ViT-B/16, compared to in-distribution accuracy, all the out-of-distribution accuracies have suffered from significant drop (the 4 blue bars in Figure 3). This trend has been observed both for ViTs and iivoouution-bseed networks (Paul & Chen, 2021; Zhai et al., 2021). Second, if we compare the accuracy between the baseline model and models trained on patch-based transformations (i.e., the difference between the blue har and one of the red/green/orange bars in Figure 3), we find that ViTs' in-distribution accuracy drops only slightly, but the robustness drop is significant when models are trained on these patch-based transformations. Take P-Shuffle as an example, the model trained on patch-based shuffled images can still achieve 79.1% accuracy on ImageNet- 1k, only percentage point (pp) drop in n--iitribution accuracy. In contrast, the accuracy drop on robustness datasets is much more significant, e.g., 17pp on ImageNet- R. The deterioration rate in robustness is close 50% of the baseline ViT-B/16. This strongly
Similar patterns observed when ViT models are pretrained ImageNet-
4

---

Under review as a conference paper at ICLR 2022
suggests that the features preserved in patch-based transformations sufficient for high-aceurate in-distribution prediction but are not robust under distributional shifts.
Taking the above results together, we conclude that even though VITs shown to be more robust than ConvNets in previous studies (Nascer et al., 2021; Paul & Chen, 2021), they still heavily rely on features that not indicative of the semantic classes to humans. These features, captured by patch-based transformations, are useful but non-robust, as ViTs trained on them achieve high in- distribution accuracy but suffer significantly on robustness benchmarks.
With this knowledge we now ask: based on these understandings, can we train ViTs to not rely on such non-robust features? And if we do, will it improve their robustness?
IMPROVING THE ROBUSTNESS OF VISION TRANSFORMERS
Based on the key observations that the patch-based transformations encode features that contribute to the non-robustness of ViTs, we propose negative augmentation procedure to regularize ViTs from relying on such features. To this end, we use the images transformed with our patch-based operations as negatively augmented views. Then we design negative loss regularizations to prevent the model from using those non-robust features preserved patch-based transformations.
Specifically, given clean image a, we generate its negative view, denoted as Tt by ap- plying a patch-based transformation to æ. We call it negative augmentation, in contrast with the standard (positive) augmentation that are semantic preserving. Let Loe (IB; 0) E(e,)ee y log softmax(f(a;; 0)) represent the cross-entropy loss function used to train a vi- sion transformer with parameters 0, where B is a minibatch of clean examples, and y denotes the ground-truth label. The loss on negative views Laeg (B, B; 0) can be easily added to the cross- entropy loss Lee [B; 0) via
L.e (B; + A eeg (B, B: 0),
where À is coefficient balancing the importance between clean training data well as patch-based negative augmentation. Below, we introduce three different losses on negative views to leverage patch-based negative augmentation through label, logit and representation space respectively.
Label space: uniform loss Many existing data augmentation techniques (Cubuk et al., 2019; 2020; Hendrycks al., 2020b) one-hot labels for remantic-prexerving augmented data to enforce the invariance of the model prediction. In contrast, the semantic classes of our generated patch-based negative augmented data are visually unrecognizable, as shown in Figure 1. Therefore, we propose to use uniform labels instead for those negative augmentations. Specifically, the loss function on negative views that we optimize at each training step can be formulated as:
Lueg [B, 13 0)
Σ
(a ÿ log softmax(f 0)),
(2)
[B]
where ÿ denotes the uniform distribution: ÿA: * where K is the total number of classes. f(;;; denotes the function mapping the input image into the logit space.
Logit space: & Loss An alternative to pre-assuming labels for negative augmentation is to add the constraints on the logit space (or the space of predicted probability). Inspired by existing work (Kan- nan et al., 2018 8; Zhang et al., 2019; Hendrycks al., 2020b) which provides an extra regularization term encouraging similar logits between clean and "positive" augmented counterparts, we instead encourage the logits of clean examples and their corresponding negative augmentations to be far away. In this way, we prevent the model from relying on the non-robust features preserved in neg- ative views. Specifically, we maximize the lg distance between the predicted probability of clean examples and their corresponding negative views. The loss on negative views, therefore, can be formulated as: Lneg (B,
Σ ZERR ||softmax[[(er 0)) softmax((( ())
Here the & distance computed over the predicted probability rather than the logits [(x 0) because empirically we observe that maximizing the difference of logits can cause numerical instability.
Representation space: contrastive loss Lastly, we propose to use a contrastive loss (Oord et al., 2018: Chen et al., 2020a; Khosla et al., 2020) to regularize the training away from using non-robust features. For an example x; e B, we create a positive set P, = (x, E B((x,) |3, = y: with all the examples in the minibatch B sharing the same class as w. The anchor a; is excluded from its
5

---

Under review as a conference paper at ICLR 2022
positive set Pj. Next, we can generate the negative set composed of two types of negative examples: 1) all the examples in the minibatch B with a different class as 2i, 2) the patch-based based negatively transformed images H E IB. For each anchor I; we can in total have || - |PP negative pairs, where [B] is the batch size and [P,] is the cardinality of the positive set P,, Let the candidate set Q
B (ar)) the loss function can be expressed as:
exp(sim(a,,
Gneg B,
log
(4)
IB
PP
Σ EQ. exp(sim(z,, Tx)
2,
22
EP:
0la((;;0) ||اا( computes the cosine similarity be- tween ( 0) and g(æ;; 0), and g(æ; 0) denotes the representation learned by the penultimate layer of the classifier. We do not use a learnable projection head" as in contrastive representation learn- ing (Chen et al., 2020a;b). Therefore, no extra network parameters are used for our proposed method and the improvement of robustness can be mainly attributed to patch-based negative augmentations.
where t is the temperature and sim(2;; z.)) o( T.
When the batch size is larger than the number of classes (which is the case for our ImageNet- 1K experiments), it is easy find positive examples from the same class in a mini-batch, so only extend candidate set Qi with our proposed patch-based negative data augmentations. When the batch size is far smaller than the number of classes (which is the case for our ImageNet-21K experiments), it can be difficult to find two examples from the same classes, Similar to (Chen et al., 2020a; Khosla et al., 2020). we generate another "positive" view for each image using common data augmentation (e.g., random cropping) so that we can make sure there is at least one positive pair from the same class. Denoting the set of positively augmented data as B the modified positive set P, = {ay E B y } the candidate set Q, is now B+ instead of B (x{x;).
EXPERIMENTS
Experimental setup We follow Dosovitskiy et al. (2021) to first pre-train all the models with image size 224 x 224 and then fine-tune the models with higher resolution 384 384. We reuse all their training param--arrmeters, including batch size, weight decay, and training epochs (see Appendix A for details). For the two extra hyperparameters in our algorithms, the loss coefficient À in Eqn. and the temperature r in Eqn. in contrastive loss, we sweep them from the set {0.5, 1, 1.5) and {0.1, 0.5) respectively and choose the model with the best hold-out validation performance. Please refer to Appendix B for the chosen hyperparameterss for each model. We make sure our proposed models and our implemented baselines are trained with exactly the same settings for fair comparison. The top-1 accuracy of the fine-tuned models are reported on ImageNet- 1k validation set as well as three robustness benchmarks, ImageNet-A (Hendrycks et al., 2019), ImageNet-C (Hendrycks & Dietterich, 2019) and ImageNet-R (Hendrycks et al., 2020a). For ImageNet-C, the reported accuracy is averaged over 19 corruptions types and different corruption severities.
5.1 EFFECTIVE AND COMPLEMENTARY TO "POSITIVE" DATA AUGMENTATION
Effective in improving robustness First, we apply our proposed patch-based transformations to VIT-B/16 model pre-trained and fine-tuned on ImageNet- The extra loss regularization on neg- ative views is used in both pre- pre-training and fine-tuning stages to prevent the model from learning non-robust features preserved in patch-based transformations. We use "Transformation/ / Regulariza- tion" to denote a pair of patch-base based negative augmentation and loss regularization. For examples, "P-Rotate / Uniform" means that loss to regularize the training. We display the results in Table 1, where we can clearly see that our proposed patch-based negative augmentation effectively improves the in-distribution test accuracy and the out-o--distribution robustness across all ImageNet-based benchmarks. We observe that all three loss regularizations effectively leverage the negative views to regularize the training away from using non-robust features, while the contrastive loss works the best.
P-Rotate to generate the negative views and use uniform
Complementary traditional ("positive") data augmentation To investigate if our proposed patch-base negative augmentation is complementary to traditional ("positive") data augmentation, we apply our patch-based negative transformation on top of traditional data augmentation: Rand- Augment (Cubuk et al., 2020), which is widely used in vision transformers (Touvron et al., 2021;
WWe did not experiment if extra projection head can push the result further as it is not our main focus hut we encourage interested readers validate if it is true or not.

---

Under review as a conference paper at ICLR 2022
Table 1: Top-1 accuracies for ViT-B/16 pre-trained and fine-tuned on ImageNet-Ik Ik with or without the proposed negative augmentation.
Model
ImageNet-1k 1k
ImageNet-A
ImageNet-C
ImageNet-R
BTT- (Dosovitskiy al., 2021)
77.6
6.7
50.8
20.3
P-Rotate / Uniform
78.2 (+0.6)
7.0 (+0.3)
52,4 (+1.6)
21.4 (+1.1)
P-Rotate / /12
77.8 (+0.2)
6.7 (+0.0)
51.6 (+0.8)
21.0 (+0.7)
+ P-Rotate / Contrastive
78.9 (+1.3)
8.6 (+1.9)
54.1 (+3.3)
23.6 (+3.3)
Table 2:
Top-1 accuracies for ViT-B/16 pre-trained and fine-tuned on ImageNet- IK using Rand- Augment (Cubuk et al.. 2020) or AugMix (Hendrycks et al., 2020b). The proposed negative aug- mentation is added on top of either positive augmentation. See Table 8 in Appendix for a full table with three losses for each patch-based transformation. Patch-based negative augmentation is com- plementary to "positive" data augmentation.
Model
ImageNet-Ik
ImageNet-A
ImageNet-C
ImageNet-R
Rand-Auge Aund-nt (Cubuk et al., 2020)
79.1
7.2
55.2
23.0
+ P-Rotate / L2
79.1 (+0.0)
7.9 (+0.7)
56.7 (+1.5)
23.8 (+0.8)
+ P. P-Infill / Uniform
79.2 (+0.1)
7.8 (+0.6)
56.4 (+1.2)
24.0 (+1.0)
+ P-Rotate / Contrastive
79.9 (+0.8)
9.4 (+2.2)
58.4 (43.2)
25.4 (+2.4)
+ P-Infill / Contrastive
79.9 (+0.8)
9.3 (+2.1)
57.9 (42.7)
25.0 (+2.0)
AugMix (Hendrycks et al., 2020b)
78.8
7.7
57.8
24.9
+ P-Rotate / L2
79.0 (40.2)
8.3 (+0.6)
58.8 (+1.0)
26.0 (+1.1)
+ P-Infill / Uniform
79.3 (+0.5)
8.3 (+0.6)
58.4 (40.6)
25.7 (+0.8)
P-Rotate / Contrastive
79.6 (+0.8)
9.8 (+2.1)
60.0 (+2.2)
27.5 (42.6)
+ P-Infill / Contrastive
79.6 (+0.8)
9.9 (+2.2)
60.3 (+2.5)
27.3 (+2.4)
Mao et al., 2021), and AugMix (Hendrycks et al., 2020b), which is specifically proposed to improve models' robustness under distributional shift. Crucially, we follow (Hendrycks et al., 2020b) to exclude transformations used "positive" data augmentation which overlap with corruption types in ImageNet-C (Hendrycks & Dietterich, 2019). Therefore, the set of transformations used in Rand- Augment and AugMix disjoint with the corruptions in ImageNet-C.
When we combine "negative" and "positive" augmentation, the cross-entropy loss Loe (B+: O) in Eqn. 1 is computed over "positive" examples B = [xt,... , .N using either Rand-Augmen or AugMix. Meanwhile, the loss regularization on negative views Eqn. 1 is computed over neg- atively transformed version of t That is: for Ve+ E B+, we apply our patch-based negative transformation obtain its negative version and then use the negative example to compute the loss regularization Lxeg- The positive data augmentation is only used in pre-training stage we ob- serve it is slightly better than using them for both stages (Please see more detailed discussion in Appendix D) and Steiner et al. (2021) have the similar observation. Instead, we apply negative augmentation in both stages, as is the best design choice as discussed in Section 5.3.
As shown in Table 2, we see that when patch-based negative augmentations are applied to either Rand-Augment or AugMix, we can consistently improve the robustness of vision transformers across all three robustness benchmarks (please refer Table 8 in Appendix for a full table with three losses for each patch-based transformation). This is particularly noteworthy as both Rand-Agument and AugMix are already designed to significantly improve the robustness of vision models. Yet, we see that patch-based negative augmentation provides further robustness benefits. This suggests that robustness of vision models was not adequately addressed by "positive" data augmentation and that patch-back batch-based negative augmentation is complementary to these traditional approaches.
5.2 ROBUSTNESS IMPROVEMENTS EVEN UNDER LARGER PRE- TRAINIG DATASETS
Considering that larger training data can significantly improve models' robustness and achieve state- of-the-art performance, we further investigate if our proposed method can scale up to larger datasets and continues to be necessary and valuable. To this end, we test if our proposed patch- patch-based negative augmentation still helps robustness than ImageNet- Ik). Since we follow (Dosovitskiy et al., 2021) and use a batch size of 4096 in the pretraining stage, which is much less than the 21K classes in ImageNet-21k,, it is unlikely to
when models are pre- trained
ImageNet-21s (10x larger

---

Under review as a conference paper at ICLR 2022
Table Top-1 accuracies of ViT-B/16 pretrained on ImageNet-2Ik and finetuned on ImageNet- Ik. Patch-based negative augmentation is helpful even with large-scale pretraining.
Model
ImageNet-Ik
ImageNet-A
ImageNet-C
ImageNet-R
1/T- (Dosovitskiy al., 2021)
84.1
26.7
65.2
37.9
Rand-Augment (Cubuk et al., 2020)
84.4
28.7
67.2
38.7
+ P-Shuffle/ / Uniform
84.5 (+0.1)
29.9 (+1.2)
67.7 (40.5)
38.9 (+0.2)
P-Shuffle /12
84.5 (+0.1)
29.7 (+1.0)
68.0 (+0.8)
39.6 (+0.9)
P-Shuffle / Contrastive
84.3 (-0.1)
30.8 (42.1)
68.1 (+0.9)
38.6 (-0.1)
Table 4: Effect of patch-based negative augmentation in pre-training and fine-tuning stages. Top-1 accuracies of ViT-B/16 pretrained and fine-tuned on ImageNet-Ik, Under 'Stagee we denote which training stage patch-based negative augmentation is used.
Model
Stage
ImageNet-Ik
ImageNet-A
ImageNet-C
ImageNet-R
AugMix (lenddyyck et al., 2020b)
78.8
7.7
57.8
24.9
P-Shuffle / Contrastive
Fine-tune
79.2 (+0.4)
8.3 (+0.6)
58.4 (+0.6)
25.9 (+1.0)
+ P-Shuffle/ / Contrastive
Pre-train
79.4 (+0.6)
8.7 (+1.0)
59.5 (+1.7)
26.7 (+1.8)
+ P-Shhuffle Contrastive
Both
79.6 (+0.8)
9.0 (+1.3)
60.1 (42.3)
27.3 (+2.4)
have multiple images of the same class in mini-batch during pretraining. As mentioned above, address this issue by augmenting each image one more time, generating another positive view of the same image, make sure there is at least two examples from the same class in the mini-batch.
We use P-Shuffle as an example to generate negative views and display the results in Table 3 with negative augmentation in both pre- pre-training and fine-tuning stages. We can clearly that even when we greatly increase the size of pre-training dataset (i.e., ImageNet-21k is 10x larger than ImageNet- still further improve the robustness of ViT.
1k), our proposed patch-based negative augmentation This demonstrates that our approach is valuable at scale and improves models' robustmess from an angle orthogonal to larger training data.
5.3 PRE-TRAINING VS. FINE-TUNING
We further disentangle the effect of patch-based negative data augmentation in pre-training and fine- tuning. Take P-Shuffle as an example, we design experiments to apply negative augmentation 1) only the fine-tuning stage, 2) only the pre-training stage. and 3) at both stages. As shown in Table 4, compared to the baselines, patch-based negative augmentation can effectively help improve robustness in both stages, and its effect in pre-training is slightly larger than fine-tuning. Finally, we found using negative augmentation in both stages during training yields the largest gain. Please refer to Table 9 in Appendix for more settings, where the same conclusion holds.
5.4 UNDERSTANDING THE EFFECTS OF PATCH-BASED NEGATIVE AUGMENTATION
Does ViT become more robust w.r.t. transformed images? We further evaluate ViTs trained with our robust training algorithms on the patch-based transformed images. We found all three losses on negative views can successfully reduce the prediction accuracy of ViTs to be close random guess (0.1%) with the original semantic classes as the ground-truth, In other words, our robust training algorithms make ViTs behave similarly as humans on those patch-based transformed images.
Are texture biases contributing to non-robust fcatures? Geirhos et al. (2018) observed that unlike humans, CNNs rely on more local information (e.g., texture) rather than more global infor- mation (c.g., shape) to make classification. Since our patch-based transformations largely destroy the global structure (e.g., shape), we want to investigate if the non-robust features surviving patch- based transformation overlap with local texture biases. To this end, we evaluate ViT-B/16 trained on patch-based transformations on Conflict Stimuli benchmark (Geirhos et al., 2018), and we see that ViTs trained only on patch-based transformation have 4.9pp to 3p. increase texture bias (Figure 4 in Appendix). This suggests that the useful but non-robust features preserved in patch- transformation are indeed overlapped with the local texture bias. In addition, using patch-negative augmentation can also to some extent reduce models' reliance on local texture bias, e.g., decrease the texture accuracy from 71.7% to 62.2% for ViT-B/16 (Table 13 in Appendix).
8

---

Under review as a conference paper at ICLR 2022
5.5 ABLATION STUDY
Sensitivity analysis We test the sensitivity of our patch-based negative augmentation to various patch sizes in P-Shuffle and P-Rotate, and different replace rates in P-Infill. We find that P-Shuffle and P-Rotate are insensitive to patch sizes from {16, 32, 48, 64, 96) for ViT-B/16, and P-Infill is robust to replace rates ranging from 1/3 to 1/2. The aceuracy difference is smaller than 0.5% on ImageNet- Ik as well as ImageNet-A and ImageNet-R. Therefore, we use the same parameter for all the settings investigated in this work (see Table 7 and Appendix for details).
Double batch-size of baselines As we use the negative augmented view per example, the effective batch size is doubled compared to the vanilla ViT-B/16 trained with only cross-entropy loss. There- fore, we further investigate if the robustness improvement is result from larger batch size. When we increase the batch size from 4096 to 8192 in pre-training while keeping the same 300 training epochs, it decreases the in-distribution accuracy to 76.0% on ImageNet- 1k as well the accuracy on robustness benchmarks, e.g., ImageNet-R from 20.3% to 19.3%. Hence we conclude the robustness improvement is from the negative data augmentation we applied.
6 RELATED WORK
Vision transformers (Dosovitskiy al., 2021; Touvron al., 2021) family of Transformer models (Vaswani et al., 2017) that directly process visual tokens constructed from image patch embedding. Unlike convolutional neural networks (LeCun et al., 1989; Krizhevsky et al., 2012: He et al., 2016) that assume locality and translation invariance in their architectures, vision transformers have no such assumptions and are able exchange information globally, thus having less inductive bias about the input image data. The significant difference in architectures raises questions about their robustmess properties. A few recent studies find pretrained vision transformers are at least as robust the ResNet counterparts (Bhojanapalli et al., 2021), and possibly more robust (Naseer et al., 2021; Paul & Chen, 2021). Our work studies a specific aspect of robustness pertaining patch-based visual tokens in ViT, and show it may lead to generalization gap. Different from (Naseer et al., 2021) which also shows ViTs are insensitive to patch operations such as shuffle and occlusion, we further propose a mitigation strategy increase robustness of patch-based architectures.
Data augmentation is widely used in computer vision models to improve model perfor- mance (Howard, 2013; Szegedy et al., 2015; Cubuk et al., 2020; 2019; Hendrycks et al., 2020b). It has been shown that data augmentation benefits vision transformers more than convolutional net- works for relatively small scaled datasets (Touvron al., 2021). However, most of the existing data augmentations are "positive" in the sense they assume the class semantic being preserved af- ter the transformation. In this work, we explore "negative" data augmentation operations based on patches, where we encourage the representations of transformed example to be different from the original ones. Most related to our work in this direction the work of Sinha et al. (2020). Although the concept of negative augmentation was proposed in their work, they only apply it for genera- tive and unsupervised modeling. contrast, our work focuses on discriminative and supervised modeling, and demonstrate how such negative examples can reveal specific robustness issues and such augmentation approaches can directly mitigate them, offering robustness improvements under large-scale pretraining settings.
CONCLUSION
Through this research have found concrete examples of ViTs relying on non-robust features for predictions and shown that this reliance is limiting robustness and out-of-distribution perfor- mance. We believe this opens multiple exciting new lines of research. First, believe that the methodological approach developed here is a valuable recipe for further progress. Through finding patch-wise, semantic-des -estniiidettroyinngg. transformations that ViTs are insensitive to we can identify when models rely on non-robust features, and through incorporating them as negative augmentations dur- ing training we can meaningfully reduce reliance on such features. Second, we believe this shows the potential for further improving the robustness of ViTss. Through training the model to use such non-robust features less, we have seen we can significantly improve the out-of-distributiin perfor- mance of ViTs, without harming in-distribution accuracy! While we have identified multiple such non-robust features in ViTs, we believe that discovering and addressing more provides an avenue for valuable, on- -o-giin improvement of out-of- distirbiit performance. Taken together, we believe this is a promising direction for continued progress toward robust vision transformers and vision models in general.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Srinadh Bhojanapalli, Ayan Chakrabarti, Daniel Glasner, Daliang Li, Thomas Unterthiner, and An- dreas Veit. Understanding robustness of transformers for image classification. arXiv preprint arXiv:2103. 14586, 2021.
Wieland Brendel and Matthias Bethge. Approximating cnns with feg-a-el models works surprisingly well on imagenet. In The International Conference Learning Represen- tations, 2019.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference machine learning, pp. 1597-1607. PMLR, 2020a.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey Hinton. Big self- supervised models are strong remi-supervised learners. arXiv preprint arXiv:2006. /0029, 2020b.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation strategies from data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 113-123, 2019.
Ekin Cubuk, Barret Zoph, Jonathon Shlens, and Quoc Le. Randaugment: Practical automated data augmentation with reduced search space. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition Workshops, pp. 702-703, 2020.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An im- age is worth 16x words: Transformers for image recognition at scale. International Conference on Learning Representations, 2021.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias im- proves accuracy and robustness. In The International Conference Learning Representations, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEFE Conference Computer Vision and Pattern Recognition, pp- 770-778, 2016.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9729-9738, 2020.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common ruptions and perturbations. In International Conference on Learning Representations, 2019. URL https: opwnreview..eeeeeeoe/eeee/ net forum? -i iCqYm.
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. arXiv preprint arXiv:1907.07174, 2019.
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, Dawn Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: A critical analysis cufrof-distribution generalization. arXiv preprint wwX.:iv000..624:11 2020a.
Dan Hendryeks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. AugMix: Simple Data Processing Method to Improve Robustness and Uncertainty. In International Conference on Learning Representations, 2020b.
Katherine L Hermann, Ting Chen, and Simon Kornblith. The origins and prevalence of texture bias in convolutional neural networks. In Advances In Neural Information Processing Systems, 2020.
R Devon Hjelm, Alex Fedorov, Samuel Lavoie-Marchiile
Karan Grewal, Phil Bachman, Adam Trischler, and Yoshua Bengio. Learning deep representations by mutual information estimation and maximization. International Conference Learning Representations, 2019.
10

---

Under review as a conference paper at ICLR 2022
Andrew G Howard. Some improvements deep convolutional neural network based image classi- fication. arXiv preprint arXiv: 2013.
Harini Kanman, Alexey Kurakin, and lan Goodfellow.
Adversarial logit pairing. arXiv preprint
urXiv:1803.0637. 2018.
Fereshte Khani and Percy Liang. Removing spurious features can hurt accuracy and affect groups disproportionately. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pp. 196-205, 2021.
Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised contrastive learning. Advances In Neural Information Processing Systems (NeurIPS), 2020.
Diederik P. Kingma and Jimmy Ba. abs/1412 0bss/141..6900, 2015.
Adam: A method for stochastic optimization. CoRR,
Alex Krizhevsky, Nya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Advances in Neural Information Processing Systems, 25:1097-1105, 2012.
Yann LeCun, Bernhard Boser, John S Denker, Donnie Henderson, Richard Howard, Wayne Hub- bard, and Lawrence D Jackel. Backpropagation applied to handwritten zip code recognition. Neurul computation, 1(4):541-551, 1989.
Xiaofeng Mao, Gege Qi, Yuefeng Chen, Xiaodan Li, Shaokai Ye, Yuan He, and Hui Xue. Rethinking the design principles of robust vision transformer. arXiv preprint 100.0:2000007920 2021.
Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Ming-Hsuan Yang. Intriguing properties of vision transformers. arXiv preprint 1xXiv:2105.0099 2021.
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding. arXiv preprint 887.v:1807.03748,, 2018.
Sayak Paul and Pun-Yu Chen. Vision transformers are robust learners. arXiv preprint arXiv:2105.07581, 2021.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV,, 115-2)211-225,, 2015. doi: 10. 1007/s1 1263-015-08166..
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation. In International Conference on Learning Representations, 2020.
Andreas Steiner, Alexander Kolesnikov, Xiaohua Zhai, Ross Wightman, Jakob Uszkoreit, and Lucas Beyer. How to train your vit? data, augmentation, and regularization in vision transformers. arXiv preprint arXiv:2106.10270 2021.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.61999 2013.
Christian Szegedy, Wei Liu, Yangging Jia, Pierre Sermanet, Scott Reed. Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1-9, 2015.
Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XI 16. pp. 776-794. Springer, 2020.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference Machine Learning, pp. 10347-10357. PMLR, 2021.

---

Under review as a conference paper at ICLR 2022
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998 09995-9988, 2017.
Zhirong Wu, Yuanjun Xiong, Stella X Yu, and Dahua Lin. Unsupervised feature learning via non- parametric instance discrimination. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 3733-3742, 2018.
Kai Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry. Noise or signal: The role of image backgrounds in object recognition. arXiv preprint arXiv:2006.09994, 2020.
Xiaohua Zhai, Alexander Kolesnikov, Neil Houlsby, and Lucas Beyer. Scaling vision transformers, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing. Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on International Conference on Machine Learning, 2019.
12

---

Under review as a conference paper at ICLR 2022
A TRAINING DETAILS
We follow (Dosovitskiy et al., 2021) to train each model using Adam (Kingma & Ba, 2015) opti- mizer with 81 = 0.9, 32 0.999 for pre-training and SGD with momentum for fine-tuning, The batch size is set to be 4096 for pre-training and 512 for fine-tuning. All models are trained with 300 epochs on ImageNet-Ik and 90 epochs on ImageNet-21k, in the pre-training stage. the fine-tuning stage, all models are trained with 20k steps except the models pretrained from ImageNet- 1k without Rand-Augment (Cubuk al., 2020) Augmix (Hendrycks et al., 2020b), which we train them with 8k steps. The learning rate warm-up is set to be 10k steps. Dropout is used for both pre-training and fine-tuning with dropout rate 0.1. the training dataset is ImageNet- 1k, we additionally apply gradient clipping at global norm 1.
Table 5: Training details following (Dosovitskiy et al., 2021).
Pre-train Dataset
Stage
Base LR
IR Decay
Weight Decay
Label Smoothing
ImageNet-Ie IK
Pre-train
3 10
'cosine"
None
10
ImageNet-2Ik
Pre-train
10-3
'linear'
0.03
10-4
ImageNet- 1K
Fine-tune
"cosine'
None
None
ImageNet-21K
Fine-tune
0.03
"cosine'
None
None
Table 6: Models using a different hyperparameter than the default value (1.5).
Model
Pre-train Dataset
Training stage
Hyperparameter
Rand-Augment P-Shuffle Uniform
ImageNet-Il
Pre-train
1.0
Rand-A uand-Augeent + P-Shuftte Contrastive
ImageNet-Il Ik
Pre-train
1.0
AugMix + P-Shuffle L.2
ImageNet-1K
Pre-train
1.0
AugMix P-Rotate I.2
ImageNet-1K
Pre-train
1.0
AugMix P-Infill I.2
ImageNet-1K
Pre-train
1.0
AugMix P-Shuffle Contrastive
ImageNet-
Pre-train
1.0
Rand-Augment + P P-Shuftte/ / Uniform
ImageNet-21K
Pre-train
0.5
Rand-Augment P- P-Suuftle L2
ImageNet-21K
Pre-train
0.5
Rand-Augment P-Shuffle / Contrastive
ImageNet-218
Pre-train
0.5
Rand-Augment P-Rotate Uniform
ImageNet-Ik
Fine-tune
0.5
Band-Augment P-Infill Uniform
ImageNet-Il
Fine-tune
1.0
AugMix P-Rotate Uniform
ImageNet-II -k
Fine-tune
1.0
Rand-Auge Rand-Augment P-Shuffle / Uniform
ImageNet-21K
Fine-tune
0.5
B HYPER- SYPER-PARAMETERR IN PATCH-BASER NEGATIVE AUGMENTATION
For the temperature used in contrastive loss, we consistently observe that r = 0.5 works better in pre-training stage and 0.1 works better in fine-tuning stage. Therefore, we keep this setting for all the models in our paper.
Since we sweep the coefficient À in Eqn. from the set (0.5, 1.0, 1.5), we observe that for most of the cases, X = 1.5 works the best. In total we have 48 models using loss regularization on negative views in Table Table 2, Table and Table 8. We use À 1.5 for all of them except those listed in Table 6, where either À 0.5 or À 1.0 works better. Actually, we find our proposed negative augmentation is relatively robust to Therefore, we suggest using = 1.5 if readers do not want to sweep for the best value for this hyperparameter.
In Table. 7, we display the hyperparameters in each patch-based transformation that we use for the reported results in this work. Our algorithms are generally insensitive these parameters, and use the same hyperparameter for all the settings investigated in this work.
13

---

Under review as a conference paper at ICLR 2022
Table 7: Hyperparameters in patch-based transformations.
Image Size
Stage
Transformation
Hyperparameter
224 x 224
Pre-train
P-Shuffle
patch size 32
224 x 224
Pre-train
P-Rotate
patch size 16
224 x 224
Pre-train
P-Infill
replace rate 15/49
384 x 384
Fine-tune
P-Shuffle
patch size 64
384 x 384
Fine-tune
P-Rotate
patch size
384 x 384
Fine-tune
P-Infill
replace rate 3/8
Table 8: Patch-based negative augmentation is complementary to "positive" data augmentation. Top-1 accuracy ImageNet-1k (IN), ImageNet-A (IN-A), ImageNet-C (IN-C) and ImageNet-R (IN-R) of ViT-B/16 pretrained and fine-tuned on ImageNet-Ik, lk. Our proposed patch-based negative augmentation are applied either Rand-Augment (Cubuk al., 2020) or AugMix (Hendrycks al., 2020b). We display the accuracy of five different corruption severities on ImageNet-C (IN-C).
IN-C
IN-R
Model
IN
IN-A
2
Rand Augd-mt (Cubuk al., 2020)
79.1
7.2
70.4
63.7
57.9
48.2
36.1
23.0
P-Shuffle / Uniform
79.3
7.7
71.0
64.4
59.0
49.5
37.3
23.4
P-Rotate Uniform
79.3
8.1
71.1
64.6
59.0
50.0
37.6
23.8
+ P-Infill Uniform
79.2
7.8
64.6
59.1
37.3
24.0
P-Shuffle L.2
78.9
7.5
70.5
63.9
58.3
48.6
36.6
22.6
+ P-Rotate / L2
79.1
7.9
71.1
64.8
59.5
50.1
37.8
23.8
+ P-Infill L.2
78.8
7.4
70.5
63.8
58.2
48.4
36.0
23.2
+ P-Shuffle/ Contrastive
79.7
8.9
72.2
65.9
60.6
51.2
38.9
24.7
+ P P-Rotate / Contrastive
79.9
9.4
72.4
66.3
61.2
52.1
40.1
25,4
P-Infill / Contrastive
79.9
9.3
72.3
66.1
61.0
51.8
39.5
25.0
AugMix (Hendrycks et al., 2020b)
78.8
7.7
71.4
65.2
60.5
51.9
40.2
24.9
P-Shuffle Uniform
79.2
8.0
71.6
65.7
61.2
$2.8
25.7
+ P-Rotate / Uniform
79.1
8.2
71.7
65.7
61.1
52.7
41.4
25.7
P-Infill / Uniform
79.3
8.3
71.9
65.8
61.1
52.4
40.8
25.7
P-Shuffle /L2
78.8
7.9
71.8
65.8
61.0
52.4
40.7
25.7
P-Rotate /I2
79.0
8.3
71.9
66.0
61.5
52.9
41.6
26.0
P-Infill 1.2
79.0
7.9
71.8
65.8
61.3
52.7
41.0
25.6
P-Shuffle Contrastive
79.6
9.0
72.9
67.2
62.8
54.6
43.2
27.3
P-Rotate Contrastive
79.6
9.8
72.6
66.9
62.6
54.5
43.5
27.5
+ P-Infill Contrastive
79.6
9.9
72.9
67.4
63.0
54.8
43.4
27.3
C EXTRA RELATED WORK
Our work is also related to contrastive learning (Wu al., 2018; Hjelm et al., 2019; Oord et al., 2018; He et al., 2020; Tian et al., 2020). The increasing number of negative pairs has shown to be important for representation learning in self-supervised contrastive learning (Chen et al., 2020a), where different images
negative examples for each other, and supervised contrastive leamn- ing (Khosla et al., 2020), where images with different classes are used as negative examples. Unlike the traditional setting of representation learning, proposed contrastive loss serves regular- ization term with patch-based negative augmentations as extra negative data points.
14

---

Under review as a conference paper at ICLR 2022
Table 9: Effect of patch-based negative augmentation in pre-training and fine-tuning stages. Top-1 accuracies of ViT-B/16 pretrained and fine-tuned on ImageNet- 1k. Under 'Stage' we denote which training stage patch-based negative augmentation is used. The best result under each setting is highlighted in bold.
Pre-train on ImageNet-Ik
Model
Stage
ImageNet- Ik
ImageNet-A
ImageNet-Ci
ImageNer-RR R
Augd-et (Cubuk al.. 2020)
79.1
7.2
55.2
23.0
P-Shuffle / Uniform
Fine-tune
79.1
7.1
55.3
23.0
P-Shuffle Uniform
Pre-train
79.3
7.6
56.2
23.5
+ P-Shuffle Uniform
Both
79.3
7.7
56.2
23.4
P-Shuffle Contrastive
Fine-tune
79.5
7.6
56.2
23.7
+ P-Shuffle Contrastive
Pre-train
79.4
8.5
56.8
24.0
P-Shuffle Contrastive
Both 79.7
8.9
57.8
24.7
Pre-train on ImageNet-21K
Model
Stage
ImageNet-Ik 1k
ImageNet-A
ImageNet-CC
ImageNet-R
Rand-Augment (Cubuk al., 2020)
84.4
28.7
67.2
38.7
P Shuffllc / L2
Finc-tune
84.5
29.4
67.9
39.0
P-Shuffle
Pre-train
84.4
29.9
67.5
38.8
+ P-Shuffle /
Both
84.5
29.7
68.0
39.6
P-Shuffle Contrastive
Fine-tune
84.4
29.2
67.5
38.7
P-Shuffle Contrastive
Pre-train
84.6
67.7
38.5
+ P-Shuffle Contrastive
Both
84.3
30.8
68.1
38.6
Table 10: Effect of positive augmentation in pre-training and fine-tuning stages. Top-1 of ViT-B/16 pretrained on ImageNet-21I, and fine-tuned on ImageNet- lk. Under 'Stage' we denote which training stage Rand-Augment (Cubuk et al., 2020) is used.
accuracies
Model
Stage
ImageNet-Ik
ImageNet-A
ImageNet-C
ImageNet-R
Ragmenu
Pre-train
84.4
28.7
67.2
38.7
Rand-Auge Aund-At
Both
84.4
29.1
67.0
38.4
D WHEN TO USE POSITIVE DATA AUGMENTATION
As Steiner et al. (2021) observed that traditional (positive) augmentation can slightly hurt the aceu- racy of ViT if applied to fine-tuning stage, we compare the accuracy of a ViT-B/16 when positive augmentation (e.g., Ragm-Augment (Cubuk et al., 2020)) only applied pre-training stage as well as both stages. As shown in Table 10, fine-tuning without Rand-Augment achieves slightly better performance. In addition, we also provide the results Table 11 where we apply positive data aug- mentation in both stages, our proposed negative augmentation are still complementary to positive ones.
E EFFECT OF NEGATIVE AUGMENTATION IN CONTRASTIVE LOSS
Since consistently observe that contrastive loss regularization works the best across all the set- tings that we have studied, we want to further investigate the effect of our proposed negative aug- mentation contrastive loss. To this end, we design a stronger baseline by "only" excluding the patch-based negative augmentation the negative set. Specifically, we replace Q B B in Eqn. 4 with Q = B ). We denote this stronger baseline as "Contrastive#" and display the com- parison in Table 12. We can see that even if we add the patch-based negative augmentation on top of this stronger contrastive baseline, marks. This further supports the effectiveness our proposed patch- based negative augmentation in improving models' robustness.
still achieve extra improvement across robustness bench-
15

---

Under review as a conference paper at ICLR 2022
Table 11: Top-1 accuracies for ViT-B/16 pre-trained and fine-tuned on ImageNet- Ik using Rand-
Augment (Cubuk et al., 2020) or AugMix (Hendrycks et al., 2020b) in both pre-training and fine- tuning. The proposed negative augmentation added on top of either positive augmentation. Patch- based negative augmentation is complementary to "positive" data augmentation.
Model
ImageNet-1k
ImageNet-A
ImageNet-C
ImageNet-R
Rand-Augen Aand-Atgment (Cubuk al., 2020)
79.2
55.1
23.2
P-Shufile / Uniform
79.4 (+0.2)
(+0.7)
56.0 (+0.9)
23.3 (+0.1)
P-Shuffle / 1.2
79.3 (+0.1)
8.2 (+0.3)
55.5 (+0.4)
22.6 (-0.6)
+ P-Shuffle / Contrastive
79.4 (+0.1)
9.4 (+1.5)
56.9 (+1.8)
24.9 (+1.7)
AugMix (Hendrycks al., 2020b)
78.7
57.9
24.7
P-Shuffle / Uniform
79.4 (+0.7)
9.0 (+0.2)
(91.1)
25.3 (+0.6)
P-Shuffle /L.
78.9 (+0.2)
8.6 (-0.2)
58.5 (+0.6)
25.5 (40.8)
P-Shuffle / Contrastive
79.2 (+0.5)
10.2 (+1.4)
59.4 (+1.5)
26.6 (41.9)
Table 12:
Effect of patch-based negative augmentation in contrastive loss regularization. Top-1 accuracies of ViT-B/16 trained with without patch-basee based negative augmentation.
Pre-train ImageNet-Ik
Model
ImageNet-Ik
ImageNet-A
ImageNet-C
ImageNet-R
ViT-B/16 + Contrastive
78.7
8.1
53.5
22.8
VIT-B/16 Shuffle Contrastive
78.9
8.2
54.1
23.2
VIT-B/16 P-Rotate / Contrastive
78.9
8.6
54.1
23.6
Rand-Augment Contrastive*
79.7
8.9
57.6
24.7
Rand-Augnn Augmentt P-Rotate Contrastive
79.9
9.4
58.4
25.4
Aand-Augment- P-Infill Contrastive
79.9
57.9
25.0
AugMix Contrastive
79.6
9.0
59.8
27.2
AugMix P-Rotate Contrastive
79.6
9.8
60.0
27.5
AugMix P-Infill Contrastive
79.6
9.9
60.3
27.3
Pre-train on ImageNet- 1k
Model
ImageNet-Ik lk
ImageNet-A
ImageNet-C
ImageNet-R R
Rand-Augment Contrastive
84.1
29.7
67.6 68.1
39.2
Rand-A Band-Augment- P-Shuffle Contrastive
84.3
30.8
38.6
F VISUALIZATION OF PATCH-BASED TRANSFORMATIONS
We display more examples with patch-based transformations without cherry-picking in Figure 5, Figure and Figure 7.
16

---

Under review as a conference paper at ICLR 2022
Conflict Stimuli
100
P-Shuffle (ps=16)
Texture Accuracy (%6
90
P-Shuffle (ps=16)
+31.1
P-Shuffle (ps=16)
P-Rotate (ps=16)
P-Rotate (ps=32)
+16.8
P-Rotate (ps=48)
70
P-Infill (rr=0.34)
P-Infill (rr=0.42)
+4.9
P-Infill (r==0.50)
54.4
50
VIT-B/16
P-Shuffle
P-Rotate
P-Infil
Figure 4: ViTs trained only on our patch-based transformations exhibit stronger texture bias. Each bar is the texture accuracy (%) on Conflict Stimuli (Geirhos et al., 201 8), and a higher texture accuracy indicates the model has a higher bias towards texture. The "texture accuracy" defined as the percentage of images that are classified as the "texture" label, provided the image is classified as either "texture" or "shape" label. The baseline model ViT-B/16 in (Dosovitskiy et al., 2021) trained on original images. Other models are trained patch-based transformed images, e.g., "P- Shuffle" stands for ViT-B/16 model trained on patch-based shuffled images. Numbers above the bars either accuracy (e.g.. ViT-B/16) the max accuracy difference between each model family and the baseline ViT-B/16. The patch size in P-Shuffle and P-Rotate and replacement ratio in P-Infill denoted by "ps" and "Ir" respectively.
Table 13: Patch-based negative augmentation effectively reduce models' texture bias on Conflict Stimuli (Geirhos et al., 2018). A higher texture accuracy indicates the model has a higher bias towards texture, The "texture accuracy" is defined as the percentage images that are classified as the "texture" label, provided the image is classified as either "texture" or "shape" label.
Pre-train on ImageNet- 1k
Pre-train on ImageNet-21k
Model
Texture Accuracy
Model
Texture Accuracy
ViT-B/16
71.7
Rand- Rugment
57.5
P- R-Rotate Uniform
66.5
Shuffle Uniform
56.4
P-Rotate L2
67.2
+ P-Sufffle L2
54.7
P-Rotate Contrastive
62.2
+ P-Shuffle Contrastive
56.4
17

---

Under review as a conference paper at ICLR 2022
OBACCO
Figure 5: Examples of original images (on the top) and their corresponding patch-based shuffle (at the bottom) with either patch size 32 or without cherry-pice sicrry.pccking.
18

---

Under review as a conference paper at ICLR 2022
Figure 6: Examples of original images (on the top) and their corresponding patch-based rotation (at
the bottom) with either patch size 32 or without therry-picking.
19

---

Under review as a conference paper at ICLR 2022
Figure 7: Examples of original images (on the top) and their corresponding patch- based infill (at the bottom) with either replace rate 0.25 or 0.375 without therry-picking
20


Reviews:
[{"review_id": "xyOx4T53AMj", "reviewer": "Reviewer_rziK", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "1. The exploration is novel: ViTs heavily use features that survived patch-based transformations but are generally not indicative of the semantic class to humans.\n2. The experiments can support this paper’s claim and the designed patch-based negative augmentation is effective.\n", "summary_of_the_paper": "This paper investigates the robustness of vision transformers. They first found that ViTs heavily use features that survived patch-based transformations but are generally not indicative of the semantic class to humans. However, these features are non-robust and the authors propose to use the images transformed with our patch-based operations as negatively augmented views and offer losses to regularize the training away from using non-robust features. Experiments on ImageNet show that patch-based negative augmentation consistently improves the robustness of ViTs.", "summary_of_the_review": "My concerns are mainly focused on the experiments.\n\n1. This paper only conducts experiments on the ViT while there are other SOTA vision transformer structures, e.g. swin-transformer [a]. The authors should conduct experiments with more transformer structures to demonstrate the generalization of the exploration and the proposed negative augmentation strategy.\n[a] Swin transformer: Hierarchical vision transformer using shifted windows, ICCV2021\n\n2. The authors only conduct experiments on one dataset, ImageNet. Although ImageNet is large enough, I wonder if the experiments’ results can be reproduced on the dataset of CIFAR-10-C and CIFAR-100-C which are utilized in AugMix.\n\n3. The authors have tried with the transformation of patch-wise shuffle, rotation, and infill. How about other commonly utilized transformations in data augmentation? E.g., horizontal and vertical flip.\n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "Qw7Oe1zZV_Y", "reviewer": "Reviewer_DY4w", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strength\n------------\n1. Thorough analysis of the hypothesis of patch-based robustness of ViTs and its detrimental effects on generalizability and robustness to image corruption (however, please see weaknesses). This provides further insight into properties of ViTs and complements existing work that investigates “positive” robustness of ViTs.\n2. The proposed approaches on alleviating the detrimental effects are simple, intuitive and interesting. \n3. Thorough investigation on approaches on how to alleviate this detrimental effect. These approaches are categorized as negative augmentations. The authors ablate the proposed method under a wide range of settings that provides insight and value to the research community.\n4. Expanding on the previous point, the authors test negative augmentation in combination with positive augmentation and with larger datasets, both which may already solve the problem on their own but are shown to still improve in the presence of negative augmentation.\n5. The paper is well-written and easy to read.\n\nWeaknesses\n-----------------\n1. Experiments of Fig 2: This experiment is performed to demonstrate the robustness of ViTs towards patch-based transformations. This is done by running a trained ViT on ImageNet testing data on P-corrupted images and reporting the test accuracy. But for P-Shuffle and P-Infill, the accuracy of the ViTs clearly degrades (e.g ViT-B/32, P-Infill: ~80% -> 42%). Yet, these experiments of Fig 2 are used to empirically claim robustness. Whereas I tend to agree, I argue that a more non-subjective measure would be needed. I believe that repeating these experiments with a standard non-transformer CNN whose performance should degrade much faster would strengthen the argument being made for Fig 2.\n2.  Experiments of Fig 3: This experiment is performed to emphasize features that are preserved by the patch-based transformations and to demonstrate that these aforementioned features are non-robust to out-of-distribution images. This is performed by training ViTs on P-corrupted images and evaluating them on non-corrupted OoD data. The resulting ViTs perform clearly worse and the authors use this as empirical evidence to support their hypothesis that the learned features are not generalizable. However, a degradation of performance is to be expected as the model has observed only P-corrupted images. Hence it is not clear whether the degradation comes from the non-robustness of the features or because of the shift in domain (from corrupted to non-corrupted). I believe that having an additional result, where the test data is corrupted in accordance with training data corruption would shed more light, as it would remove the parameter of domain shift (corrupted -> non-corrupted) from the equation. This would strengthen the author's argument.\n3. All experiments seem to have been performed once and are being used to draw conclusions. As some improvements reside in the smaller ranges, I wonder how stable these results are when re-run. Hence, I would have liked to see some statistical significance testing, as the entire paper relies heavily on empirical results.\n4. The authors propose three different corruption types and three different negative augmentation types. With all the tables and numbers, I’m missing a final conclusion on which combination is suggested by the authors to work the best and hence recommended.\n\nQuestions / Comments\n--------------\n1. For P-Rotate, is each patch rotated randomly by the same rotation degree or is a new rotation degree sampled for each?\n2. Experiments of Fig 2: Are these re-trained by the authors or taken directly from Dosovitskiy et al? If the latter, it may be better to re-train them, as the experiments of Fig 3 use re-trained models to make sure minor differences in training code does not affect results\n3. Do the experiments of Fig 2/3 use positive data augmentation and is the training set for both ImageNet (as opposed to ImageNet-1k)?\n4. Out of curiosity, how would the authors extend the negative data augmentation to regression tasks?\n5. Page 7: (...) and Steiner et al. (2021) have the similar observation -> have “made” similar observations\n6. Have combinations of the P-corruptions been tried? E.g P-shuffle with P-rotate?\n", "summary_of_the_paper": "This paper empirically investigates robustness properties of vision transformers (ViT) towards image augmentation strategies that destroy the semantic meaning of the image. The authors experimentally demonstrate that ViTs achieve high test set accuracies on ImageNet where the test data was transformed with patch-based transformations (I refer to these collectively as P-corrupted) which render the images unrecognizable to humans. They show that by emphasizing this property of ViT, it leads to detrimental effects to generalization to out-of-distribution (OoD) datasets. \nAs a remedy, the authors introduce several data augmentation techniques, termed negative augmentation, to alleviate ViTs tendencies to learn features that are robust to patch-based transformations\nExtensive experimental results on ImageNet-(1k, A, C, R) ablate the proposed approach to extract the most effect hyperparameters and demonstrate the effectiveness of the proposed method", "summary_of_the_review": "In summary, I enjoyed reading the paper. The authors perform thorough analysis of the hypothesis as well as their proposed approach. The weaknesses I mention are not minor and I would like to see them addressed. My biggest worry is the statistical analysis of the results, as  the entire paper relies heavily on experimentation.\nNevertheless, it did not dampen my positivity about the paper and therefore I feel comfortable recommending acceptance. \n", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "MDi8vooY0r", "reviewer": "Reviewer_FXi6", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\n+ The proposed idea is simple and easy to understand.\n\n+ The illustrations and presentations are clear and easy to follow.\n\n+ Most of the experiments are reasonable and the settings are clear.\n\n\nWeaknesses:\n\n- The paper concludes that the proposed method can significantly improve the out-of-distribution performance of ViTs. However, from the experimental results it is observed that the improvements led by the two losses, Uniform and L2, are limited. Only the contrastive loss leads to clear improvements to some extent, however,\n\n- Contrastive loss is known to be very useful in improving the model training from the metric learning way, which helps to learn compact representations in class distributions in the learned representation feature space. Regarding this, the contribution of the contrastive loss is not clearly ablated in the proposed method. A fair baseline with contrastive loss should also be compared, that is, with only the clean images or positively augmented images for training, how about also appending the contrastive loss along with the classification loss, where in the contrastive loss all the anchors, positive examples, and negative examples are from the labeled clean images or positively augmented images?\n\n- From Fig. 2 it is hard to conclude that ViTs are insensitive to patch transformations. The authors extends a lot on the range of the vertical axis to make the changes appeared to be narrow. However, from the figure it can still be observed that patch transformations significantly decrease the performance by up to more than 20%. This is hard to be understood as \"insensitive\".\n\n- In Eq. (3) the loss is negative. Will it cause problems in optimization?\n\n- Does the same finding also hold on CNNs?", "summary_of_the_paper": "This paper presents that Visual Transformers (ViTs) are not sensitive to patch transformations (e.g. shift, rotation). It thus presents an idea that patch transformations can be used as negative augmentations to train the Visual Transformers (ViTs) to improve robustness similar to human perception. Three losses are thus applied to regularize the model training from being too confident to patch transformed images. A number of experiments on ImageNet-series datasets are presented to prove the finding of the authors.", "summary_of_the_review": "I appreciate the authors' work from an interesting point of view. However, I think the statement of \"ViTs are insensitive to patch transformations\" does not hold, and the contribution of the contrastive loss is not clear. These two points make the current paper not reliable.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "1: The main claims of the paper are incorrect or not at all supported by theory or empirical results.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "C9ABl-lo1tT", "reviewer": "Reviewer_j5h2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Strengths**\n\n - The stemming observations of this work is very interesting, where ViTs give stable predictions over those human-unrecognizable transformed samples. The author also provide extensive comparisons to support this findings. \n\n - While negative data augmentations have been explored in self-/unsupervised representation learning, they are rarely visited in vision transformers and from the robust perspective. Based on the paper motivation and experiment results, the proposed method looks promising. \n\n\n**Weakness**\n\n - The incorporated loss function contains 3 individual components of a uniform loss, a L2 loss, as well as a contrastive loss. While comparisons in terms of accuracies are made, there exists no clear conclusion about the best choice or some detailed difference between them. In consequence, the message/contribution about the three losses is made uncertain. Further analysis or experiments that can support the statement in Sec 4 are expected.\n\n - Major experiments are conducted on the original ViT, or the ones with RandAug and AugMix. As has conveyed in the paper, the proposed negative augmentation is complementary to positive augmentations. Thus it's crucial to see the results where applying the proposed method to better models such as DeiT, since the training strategy adopted by DeiT is still ``positive''.\n\n - The transformer architecture used across most experiments is ViT-B/16, which uses a $16 \\times 16$ token input. Will the transformer architectures that use a more fine-grained token representations, such as $8 \\times 8$, produce dissimilar results? It's interesting to study the difference between them. Also, how do different scales of patch augmentation influence the results? \n\n - Recent progress in vision transformers cover modifications towards the tokenization process, where multi-scale or overlapping token embeddings are incorporated. Do you think the high confidence predictions towards unrecognizable images come from the non-overlapping token embedding in ViTs? If not, can such observations and augmentations apply to transformers architecture that uses overlapping token embeddings?", "summary_of_the_paper": "This paper draws motivations from the observations that ViTs are insensitive towards patch-based transformations. Through detailed analysis by evaluating the models on such transformed inputs, the authors find a relatively stable accuracy, and term such features as **useful** but **non-robust** feature.  In order to push ViTs from these undesired features, patch-based negative augmentation and losses are proposed, which consistently improve the robustness of ViTs. ", "summary_of_the_review": "This paper provide some interesting findings on ViTs and propose patch-level negative augmentation. The authors also conduct experiments to validate the contribution of the augmentation and losses in details. However, the approach is only validated on the naive ViT-B/16 architecture and not convincingly enough. Moreover, additional analysis on losses and different architectures are expected.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviews are split. The most significant concern seems to be the narrow focus of the paper: insensitivity of a very specific architecture, ViT to some patch-based transformations of the image. The paper aims to "understand and improve" the behavior of ViTs in this respect, but as the reviewers point out, the understanding (what exactly is the mechanism for this insensitivity) is lacking. Furthermore, there is a good reason to believe that other transformer architectures might not have a similar behavior. Ultimately both the lack of depth and the lack of breadth of the investigation suggest that the impact may be limited. I think this is not a good fit for ICLR.
Decision: Reject