The Effect of Intrinsic Dataset Properties on Generalization: Unraveling Learning Differences Between Natural and Medical Images
Authors: Nicholas Konz
Maciej A Mazurowski
Venue: ICLR 2024 poster (2024)
Keywords: generalization
medical images
scaling law
intrinsic dimension
medical image analysis
Primary area: representation learning for computer vision, audio, language, and other modalities
TL;DR: Investigating how and why neural network generalization ability and adversarial robustness differ between natural and medical image datasets.

Abstract: This paper investigates discrepancies in how neural networks learn from different imaging domains, which are commonly overlooked when adopting computer vision techniques from the domain of natural images to other specialized domains such as medical images. Recent works have found that the generalization error of a trained network typically increases with the intrinsic dimension ($d_{data}$) of its training set. Yet, the steepness of this relationship varies significantly between medical (radiological) and natural imaging domains, with no existing theoretical explanation. We address this gap in knowledge by establishing and empirically validating a generalization scaling law with respect to $d_{data}$, and propose that the substantial scaling discrepancy between the two considered domains may be at least partially attributed to the higher intrinsic ``label sharpness'' ($K_\mathcal{F}$) of medical imaging datasets, a metric which we propose. Next, we demonstrate an additional benefit of measuring the label sharpness of a training set: it is negatively correlated with the trained model's adversarial robustness, which notably leads to models for medical images having a substantially higher vulnerability to adversarial attack. Finally, we extend our $d_{data}$ formalism to the related metric of learned representation intrinsic dimension ($d_{repr}$), derive a generalization scaling law with respect to $d_{repr}$, and show that $d_{data}$ serves as an upper bound for $d_{repr}$. Our theoretical results are supported by thorough experiments with six models and eleven natural and medical imaging datasets over a range of training set sizes. Our findings offer insights into the influence of intrinsic dataset properties on generalization, representation learning, and robustness in deep neural networks. *Code link: https://github.com/mazurowski-lab/intrinsic-properties*

Published as a conference paper at ICLR 2024
THE EFFECT OF INTRINSIC DATASET PROPERTIES ON GENERALIZATION: UNRAVELING LEARNING DIFFER- ENCES BETWEEN NATURAL AND MEDICAL IMAGES
Nicholas Konz', Maciej A. Mazurowski-2233.
Department of Electrical and Computer Engineering, Department of Radiology,
3 Department of Computer Science, Department of Biostatistics & Bioinformatics Duke University, NC, USA {nicholas konz, maciej.. maw.rwwkkkkaooiaa.cmoooo.... @duke. edu
ABSTRACT
This paper investigates discrepancies in how neural networks learn from different imaging domains, which are commonly overlooked when adopting computer vi- sion techniques from the domain of natural images to other specialized domains such as medical images. Recent works have found that the generalization error of trained network typically increases with the intrinsic dimension (damta) of its training set. Yet, the steepness of this relationship varies significantly between medical (radiological) and natural imaging domains, with existing theoretical explanation. We address this gap in knowledge by establishing and empirically validating generalization scaling law with respect to daatas and propose that the substantial scaling discrepancy between the two considered domains may be at least partially attributed to the higher intrinsic "label sharpness" (Kr) of medical imaging datasets, metric which propose. Next, we demonstrate additional benefit of measuring the label sharpness of training set: it is negatively correlated with the trained model's adversarial robustmess, which notably leads to models for medical images having a substantially higher vulnerability to adversarial attack. Finally, extend our diata formalism to the related metric of learned represen- tation intrinsic dimension (drepr), derive a generalization scaling law with respect drepr. and show that daata serves results are supported by thorough experiments with six models and eleven natu- ral and medical imaging datasets over a range of training set sizes. Our findings offer insights into the influence of intrinsic dataset properties on generalization, representation learning, and robustness in deep neural networks.
upper bound for deepr- Our theoretical
INTRODUCTION
There has been recent attention towards how neural network's ability to generalize to test data relates to the intrinsic dimension daata of its training dataset, i.e., the dataset's inherent "complexity" or the minimum degrees of freedom needed to represent it without substantial information loss (Gong et al. 2019). Recent works have found that generalization error typically increases with daata, empirically (Pope al. 2020) theoretically (Bahri al. 2021). Such "scaling laws" with respect to intrinsic dataset properties are attractive because they may describe neural network behavior in generality, for different models and/or datasets, allowing for better understanding and predictability of the behavior, capabilities, and challenges of deep learning. However, recent study (Konz al., 2022) showed that generalization scaling behavior differs drastically depending on the input image type, e.g., natural or medical images, showing the non- con-universality of the scaling law and motivating us to consider its relationship to properties the dataset and imaging domain
In this work, we provide theoretical and empirical findings on how measurable intrinsic properties of an image dataset can affect the behavior of neural network trained on We show that certain
'oode link: https:: //g/ thub. com / ma zurowski i 1ab/ aaaabbinntrre intrinttiiiiiiii properties HHeee take "medical" images to refer radiology images (e.g., x-ray, MRJ), the most common type.

---

Published as a conference paper at ICLR 2024
dataset properties that differ between imaging domains can lead to discrepancies in behaviors such as generalization ability and adversarial robustness. Our contributions are summarized as follows.
First, we introduce the novel measure of the intrinsic label sharpness (K)) of dataset (defined in Section ).2). The label sharpness essentially measures how similar images in the dataset can be to each other while still having different labels, and we find that it usually differs noticeably between natural and medical image datasets. We then derive and test a neural network generalization scaling law with respect dataset intrinsic dimension ddata= which includes KF. Our experiments support the derived scaling behavior within each of these two domains, and show a distinct difference in the scaling rate between them. According to our scaling law and likelihood analysis of observed generalization data (Appendix C.I), this may be due to the measured Ky being typically higher for medical datasets.
Next, we show how model's adversarial robustness relates to its training set's Ky, and show that over a range of attacks, robustness decreases with higher Ky. Indeed, medical image datasets, which have higher K5, are typically more susceptible to adversarial attack than natural image datasets. Finally, we extend our daaza formalism to derive and test a generalization scaling law with respect to the intrinsic dimension of the model's learned representations, diepr- and reconcile the daata and drepr scaling laws to show that ddata serves as an approximate upper bound for dzepr- We also provide many additional results in the supplementary material, such as a likelihood analysis of our proposed scaling law given observed generalization data (Appendix C.1), the evaluation of a new dataset in third domain (Appendix C.2), example of practical application of our findings (Appendix C.3), and more.
All theoretical results are validated with thorough experiments on six CNN architectures and eleven datasets from natural and medical imaging domains over a range of training set sizes. We hope that our work initiates further study into how network behavior differs between imaging domains.
2 RELATED WORKS
We are interested in the scaling of the generalization ability of supervised convolutional neural networks with respect to intrinsic properties of the training set. Other works have also explored generalization scaling with respect to parameter count or training set size for vision or other modal-
ities (Caballero et al. 2023; Kaplan et al. 2020, Hoffmann et al. 2022. Touvron et al. 2023). Note
that we model the intrinsic dimension to be constant throughout the dataset's manifold as in Pope jet al. (2020): Bahri et al. 2 for simplicity, as opposed to the recent work of Brown et al. 2023 which we find to be suitable for interpretable scaling laws and dataset properties.
Similar to dataset intrinsic dimension scaling (Pope et al., 2020; Bahri et al. 2021 Konz et al, 2022), recent works have also found a monotonie relationship between network's generalization error and the intrinsic dimension of both the learned hidden layer representations (Ansuini et al. 2019) or some measure of intrinsic dimensionality of the trained model itself (Birdal et al.) 2021] Andreeva et al. 2023). In this work, we focus on the former, as the latter model dimensionality measures are typically completely diffferent mathematical objects than the intrinsic dimension of the manifolds of data or representations. Similarly, Kvinge et al. (2023) found a correlation between prompt perplexity and representation intrinsic dimension in Stable Diffusion models.
PRELIMINARIES
We consider a binary classification dataset D of points E IR" with target labels y = F(x) defined by some unknown function F R. {0, 1). split into a training set Durain of size and test set Drest. The manifold hypothesis (Fefferman et al. 2016) assumees that the input data x lies approx- imately on some -dast--dimessione
manifold Maaat C R., with datta < n. More technically, Mdam.. is metric space such that for all Ma there exists some neighborhood U₂ of x such that Uz is homeomorphic to da defined by the standard L2 distance metric || ||-
As in Bahri et al. (2021), we consider over- parameterizee (number of parameters >> N) models f(x) R + {0. ). that are "well-trained" and leam to interpolate all training data: f(x) F(x)
for all x E D Dirain We use a non-negative loss function L, such that L = when f(x) = F(x).
Note that write 7. as the expected loss over a of test set points. We assume that F. f and
2

---

Published as a conference paper at ICLR 2024
L are Lipschitz/smooth on Ma with respective constants Ky, 2 and Ky- Note that the term "Lipschitz constant" of a function to refer to the smallest value that satisfies the Lipschitz i We focus binary classification in Pope et al. (2020); Konz et al. (2022). but note that our results extend naturally to the multi-class case (see Appendix A. for more details).
3.1 ESTIMATING DATASET INTRINSIC DIMENSION
Here we introduce two common intrinsic dimension estimators for high-dimensional datasets that we use in our experiments. which have been used in prior works on image datasets (Pope et al.
2020 Konz al. 2022) and learned representations (Ansuimi al. 2019 Gong al. (019)).
MLE: The MLE (maximum likelihood estimation) intrinsic dimension estimator (Levina & Bickel, 2004 MacKay & Ghahramani 2005) works by assuming that the number of datapoints enclosed within some c-ball about some point on Mdd scales not as O(c"). ). but O ). and then solving for daata with MLE after modeling the data as sampled from a Poisson process. This results in
where (z) is the L2 distance from x to its j'h nearest neighbor and 4 is a hyperparameter: we set = 20 as in Pope et al. (2020); Konz et al. (202)). TwoNN: TwoNN (Facco et al. 2017) is similar approach that instead relies on the ratio of the first- and second nearest neighbor distances. We default to using the MLE method for daata estimation as Popee al. (2020) found it to be more reliable for image data than TwoNN, but we still evaluate with TwoNN for all experiments. Note that these estimators do not use datapoint labels.
dasta NI Ex= -i=10 f=1 log Ty(m;)
Te(m,)
3.2 ESTIMATING DATASET LABEL SHARPNESS
Another property of interest is empirical estimate for the "label sharpness" of dataset, K5. This measures the extent to which images in the dataset can resemble each other while still having different labels. Formally, K5 is the Lipschitz constant of the ground truth labeling function F, i... the smallest positive K5 that satisfies [ x2 > {F(z1) F(x2)) = lg y2l for all
T1, Md where yi F(;)) E {0, 13
the target label for r;. We estimate this as
ly; yk
K = max J.k
(1)
||x x&
computed over all 2 pairings ((z,, (IK, yk)) of some M evenly class-balanced random sam-
ples {(x; bs)) from the dataset D. We use M = 1000 in practice, which we found more than sufficient for converging estimate, and takes <1 sec. compute KF. We minimize the effect of trivial dataset-specifie factors on K by linearly normalizing all images to the same range (Sec. and we note that both Ky and dasta are invariant to image resolution and channel count (Appendix B. As the natural image datasets have multiple possible combinations of classes for the binary classification task, we report K averaged over 25 runs of randomly chosen class pairings.
4 DATASETS, MODELS AND TRAINING
Medical Image Datasets. We conducted our experiments on seven public medical image (radiol- ogy) datasets from diverse modalities and anatomies for different binary classification tasks. These are (1) brain MRI glioma detection (BraTSS, Menze et al. (2014); (2) breast MRI cancer detection
(DBC. Saha et al. (2018)): ); (3) prostate MRI cancer risk scoring (Prostate MRI. Sonn et al. (2013));
MRI.,Sonn&
(4) brain CT hemorrhage detection IRSNA-IH-CT, Flanders et al. (0200) ); (5) chest X-ray pleural effusion detection (CheXpert, Irvin et al. 2019)); (6) musculoskeleta X-ray abnormality detection (MURA, Rajpurkar et al. (2017)); and (7) knee X-ray osteoarthritis detection (OAI, TTulpin et al. 2018 All dataset preparation and task definition details are provided in Appendix G.
Natural Image Datasets. We also perform our experiments using four common "natural" image classification datasets: ImageNet (Deng et al. 2009), CIFARIO (Krizhevsky et al. 2009), SVHN
Netzer et al. 2011), and MNIST (Dngg] 2012).
A subtlety here is that our Lipschitz assumptions only involve pairs of datapoints sampled from the true data manifold M adversarially perturbbe images (Gondfellow al. 20155 not included.
3

---

Published as a conference paper at ICLR 2024
For each dataset, create training of size N {500, 750, 1000, 1250, 1500, 1750), along with a test set of 750 examples. These splits are randomly sampled with even class- balancing from their respective base datasets. For the natural image datasets choose two random classes (different for each experiment) to define the binary classification task, and all results are averaged over five runs using different class pairs Images resized 224 x 224 and normalized linearly [0. 1].
1c-4
imaging domaln
15
medical netural
deata
20
brots
dbc
charpeet
prostat
MNIST
CIPARTO
SVEN
IncegeNet
brats
dbe
ORl
chexpert
morr
rsma
prostate
MNIST
CITARIO
SVHN
ImageNet
dataset
dataset.
Figure 1: Measured intrinsic dimension (ddatas left) and label sharpnesses (Ky, right) of the natural (orange) and medical (blue) image datasets which analyze (Sec. 4 K is typically higher for the medical datasets. daata values averaged over all training set sizes, and K over all class pairings (Sec. 3.2 error bars indicate 95% confidence intervals.
Models and training. We evaluate six models total: ResNet- 18, -34 and -50 (He et al., 2016). and VGG-13, -16 and -19 (Simonyan Zisserman 2015). Each model f is trained on each dataset for its respective binary classification task with Adam (Kingma & Bal (015) until the model fully fits to the training set, for each training set size described previously. We provide all training and implementation details in Appendix F, and our code can be found at https: /tt:://gittte com/
mazurowaki lab/iaainne int rinsic- properties
THE RELATIONSHIP OF GENERALIZATION WITH DATASET INTRINSIC DIMENSION AND LABEL SHARPNESS
In Fig. I we show the average measured intrinsic dimension daata and label sharpness K5 of each dataset we study. While both natural and medical datasets can range in ddatas we note that medical datasets typically have much higher K than natural image datasets, which we will propose may explain differences in generalization ability scaling rates between the two imaging domains. We emphasize that daata and Ky are model-independent properties of a dataset itself. We will now describe how network generalization ability scales with daata and Kz.
5.1 BOUNDING GENERALIZATION ABILITY WITH DATASET INTRINSIC DIMENSION
A result which we will use throughout is that average, given some N datapoints sampled i..dd from a d-dimensional manifold, the distance between the nearest neighbor of some data- point a scales as E, ||x æ|| ONN -1/dasa))) (Levina Bickel 2004). As such, the nearest- neighbor distance of some test point to the training set decreases as the training set grows larger by O(N-1/dauu) It can then be shown that the loss on the test sel/generalization error scales as OKK max(K, N-)daa/ddata) on average; this summarized in the following theorem.
Theorem (Generalization Error and Dataset Intrinsic Dim. Scaling Law (Bahri al. (021)). Let Másas with respective consiants Kr, K₃ and Ky. Further let Derain be a training set of size N sampled ii.d. from Mdaaao with f(x F(x) for all x E Derain- Then, = OK1, max K,, K -11/dnat))))) 11/daas).
L, J and FF be Lipschitz
'N = 1750 is the upper limit of N that all datasets could satisfy, given the smaller size of medical image datasets and ImageNet's typical example count per class. In Appendix C.4 we evaluate much higher N for datasets that allow for it.
4

---

Published as a conference paper at ICLR 2024
We note that the Ky term is typically treated as an unknown constant in the literature (Bahri al. 2021 1 instead, we propose estimate it with the empirical label sharpness K (Sec. 3.2 We will next show that y = Ky for large N (common for deep models), which allows us to approximate Theorem
a scaling law independent of the trained model f- Intuitively, this means that the Lipschitz smoothness of f molds to the smoothness of the label distribution as the training set grows larger and test points typically become closer to training points.
1 as L ~ K
Theorem (Approximating K with Ky). Ky converges to Ky in probability as N + oc.
We show the full proof in Appendix A.2 due space constraints. This result is also desirable because computing an estimate for y, the Lipschitz constant of the model f, either using Eq. ① or with other techniques (Fazlyab et al. 2019), depends on the choice of model f. and may require many forward passes, Estimating K (Eq. is far more tractable, as it is an intrinsic property of the dataset itself which is relatively fast to compute.
Next, note that the Lipschitz constant Kg is a property of the loss function, which we take as fixed a priori, and so does not vary between datasets or models. As such, K2 can be factored out of the scaling law of interest, such that we can simply consider L
i.e.,
log L <
log N + log K +
(2)
ddata
for some constant a. In the following section, we will demonstrate how the prediction of Eq. may explain recent empirical results the literature where the rate of this generalization scaling law differed drastically between natural and medical datasets, via the measured differences in the typical label sharpness K of datasets in these two domains.
5.2 GENERALIZATION DISCREPANCIES BETWEEN IMAGING DOMAINS
Consider the result from Eq. 2 that the test loss/generalization error scales approximately as T. x K=N -1/dasts on average. From this, we hypothesize that a higher label sharpness K5 will result in the test loss curve that grows faster with respect to daata-
In Fig. [ we evaluate the generalization error (log test loss) scaling of all models trained on each natural and medical image dataset with respect to the training set intrinsic dimension daata. for all evaluated training set sizes N. We also show the scaling of test accuracy in Appendix F.
We see that within imaging domain (natural medical), model generalization error typically increases with ddata, as predicted, similar to prior results (Pope et al. 2020 Konz et al. 2022); in particular, approximately log L x -1/ddata + const., aligning with Eq. (2). However, we also see that the generalization error scaling is much sharper for models trained on medical data than natural data; models trained datasets with similar daata and of the same size N tend perform much worse if the data is medical images. A similarly large gap appears for the scaling of test accuracy (Appendix E.1). We posit that this difference is explained by medical datasets typically having much higher label sharpness (Ky- 2.3 x 10-4) than natural images (Ky ~ 1 10 10-4) (Fig. [ as K5 is the only term in Eq. (2) that differs between two models with the same training set intrinsic dimension daata and size N. Moreover, in Appendix C. we show that accounting for K₁ increases the likelihood of the posited scaling law given the observed generalization data. However, we note that there could certainly be other factors causing the discrepancy which are not accounted for.
Intuitively, the difference in dataset label sharpness K, between these imaging domains is reason- able, as Ks describes how similar a dataset's 's images can be while still having different labels (Sec. 3.2 For natural image classification, images from different classes tinct. However, in many medical imaging tasks, a change in class can be due to a small change or abnormality in the image, resulting in a higher dataset K5; for example, the presence of small breast tumor will change the label of a breast MRI from healthy to cancer.
typically quite visually dis-
6 ADVERSARIAL ROBUSTNESS AND TRAINING SET LABEL SHARPNESS
In this section we present another advantage of obtaining the sharpness of the dataset label distri- bution (Kx): it is negatively correlated with the adversarial robustness of neural network. Given
5

---

Published as a conference paper at ICLR 2024
monnt188
model: m4s19134
100
100
K
100
[best loss)
20-1
(best
10-1
(best
10
10-1
10.0
10.0
15.0 17.5
20.0
10.0
Gassa (dalaaset intrinsic dim.)
Coota (dalaaset intrinsio dim.)
Claaa (dislasee intrizsic dim.)
model: vgg13
training set size (N)
model: vgg
500
750 1000
1250 1500 1750
medical
100
1.P
natural
model: vpg16
10-1
(best
(tost loss)
1.0
(test
20-1
10-2
10-3
10.0 12.5 dasta (dataset intrinstc dim.)
10.0
15.0 12.5
20.0
10.0
diota (dataset intrinste dim.)
Cloau (detaset intrinste dim.)
Figure 2: Scaling of log test set loss/generalization ability with training dataset intrinsic dimension (ddata) for natural and medical datasets. Each point corresponds (model, dataset, training set size) triplet. Medical dataset results are shown in blue shades, and natural dataset results are shown in red; note the difference in generalization error scaling rate between the imaging domains. Standard deviation error bars are shown for natural image datasets for 5 different class pairs.
some test point To E MM with true label F(xo). the general goal of an adversarial attack to find some that appears similar to Fig i.e. || xo rollox is small - that results in differ- ent, seemingly erroneous network prediction for ã. Formally, the robustness radius of the trained network f at Zo is defined by
R(f, 20) = inf {1| zollxx f(z) 4
(3)
where 2o E Ma Zhang et al. 2021 This describes the largest region around where is robust adversarial attacks. ExgaMaaaaa R(f,
We define the expected robust radius of f R(f)
Theorem (Adversarial Robustness and Label Sharpness Scaling Law). Let be K--Lipschit, on R". For a sufficiently large training set, the lower bound for the expected robustness radius of f scales as R(f)) ~ (1/KF).
Proof. This follows from Prop. of Tuzzuu et al. 2018 see Appendix A.4 for all details.
While it is very difficult to estimate robustness radii of neural networks in practice Katz et al. 2017). we can instead measure the average loss penalty of f due to attack, Ezn-Dina (L(x) L(zo)). over
a test set Drest of points sampled from Milana and see if it correlates negatively with K, (Eq. Ih) for different models and datasets. As the expected robustness radius decreases, should the loss penalty become steeper. We use FGSM (Goodfellow et al. 2015) attacks with Loo budgets of (1/255, 2/255, 4/225, 8/255] obtain
In Fig. we plot the test loss penalty with respect to K5 for all models and training set sizes for = 2/255,, and show the Pearson correlation between these quantities for each model, for all c, in Table (per- correlations are provided Appendix E.3). (We provide the plots for the other values, well as for the test accuracy penalty, in Appendix E.3). Here we average results over the different training set sizes N due to the lack of dependence of Theorem on N.

---

Published as a conference paper at ICLR 2024
model: resneti
model: resnet34
madel: resnet50
12.5
Aloss
Aless
7.5
Aloss
35
0.70
5.0
0.37
==
0.48
10
X
0.0
Iw-4
Kr
1w-4
1e-4
model: vgg13
model: 16
model: vgg19
25
25
20
Aloss
15
Aloss
10
0.47
10
0.64
-
0.61
3
Ie-4
Kr
1e-4
Kr 1o-4
Figure 3: Test set loss penalty due to FGSM adversarial attack vs. measured dataset label sharpness (Kx) ) for models trained natural and medical image datasets (orange and blue points, respec- tively). Pearson correlation coefficient r also shown. Error bars are 95% confidence intervals over all training set sizes N for the same dataset.
As expected, the loss penalty is typ- ically worse for models trained on
RN-18
RN-34
RN-50
V-13
V-16
V-19
1/255
0.77
0.48
0.55
0.47
0.63
0.61
datasets with higher KF. implying
2/255
0.70
0.37
0.48
0.47
0.64
0.61
a smaller expected robustness radius.
4/255
0.63
0.26
0.41
0.45
0.62
0.6
8/255
0.54
0.18
0.34
0.39
0.58
0.57
We see that medical datasets, which typically have higher Ky than natu- ral datasets (Fig. [. are indeed typ- ically more susceptible to attack, as was found in Ma et al. (20T)) pendix D.I show example clean and attacked images for each medical image dataset for e = 2/255. A clinical practitioner may not notice any difference between the clean and attacked images upon first look yet the attack makes model predictions completely unreliable. This indicates that adversarially-robur models may be needed for medical image analysis scenarios where potential attacks may be a concern.
Table 1: Pearson correlation between test loss penalty due
to FGSM attack and dataset label sharpness Kx, over all datasets and all training sizes. "RN" ResNet, "V" = VGG.
Ap-
CONNECTING REPRESENTATION INTRINSIC DIMENSION TO DATASET INTRINSIC DIMENSION AND GENERALIZATION
The scaling of network generalization ability with dataset intrinsic dimension dasta (Sec. 5.1 moti- vates us to study the same behavior in the space of the network's 's learned hidden representations for the dataset. In particular, we follow (Ansuini et al. 2019 Gong et al. 2019) and assume that an coder a neural network maps input images to some drepr dimensional manifold of representations (for given layer), with drepe < n. As in the empirical work of Ansuini al. (2019), we consider the intrinsic dimensionality of the representations of the final hidden layer of /. Recall that the test
loss can be bounded above as L = O OKK max(K; (a N=)NN-//daa can be used derive loss scaling law for dreprs follows.
(Thm. I A similar analysis
Theorem 4 (Generalization Error and Learned Representation Intrinsic Dimension Scaling Law), where K the Lipschitz constant for L.
'hhat heing said, the precise physical interpretation of intensity values in certain medical imaging modali- ties, such as Hounsfield units for CT, may reveal the attack upon close inspection.

---

Published as a conference paper at ICLR 2024
We reserve the proof for Appendix A.3 due to length constraints, but the key is to split f into composition of an encoder and a final layer and analyze the test loss in terms of the encoder's outputted representations. Similarly to Eq. (2) K is fixed for all experiments, such that we can
simplify this result to L = ONN-1/door) i.e.
log L S
drepr log N +
(4)
for some constant b. This equation is of the same form the loss scaling law based on the dataset intrinsic dimension daata of Thm. [ This helps provide theoretical justification for prior empirical
results of L. increasing with drepr (Ansuini et al. (2019), well as for it being similar in form the scaling of I. with ddata (Fig. (
In Fig. 4 evaluate the scaling of log test loss with the drepr of the training set (Eq- ) for each model, dataset, and training set size as in Sec. 5.1 The estimates of drepr are made using TwoNN on the final hidden layer representations computed from the training set for the given model, in Ansuini et al. (2019). We also show the scaling of test accuracy in Appendix E. as well as results from using the MLE estimator compute diepe.
model. resnel18
model: resnel31
model: resnet50
10P
loss)
(best loss)
lozs)
10-1
20-11
10
15
20
25
16
15
20
10
15
20
Opcor (roprasentation intrinsic dim.)
tropresentation intrinsic dim.)
Orge (representation intrinsic dtm.)
model: v3g13
training
modeh vgg19
500
750
1000
1250
1500 1750
medical
netural
(oest
model: vgg16
10-1
(bost loss)
(tost
20
20-1
10
10-2
10-1
10-4
15 20
25
10
25
1.0
20
(representation intrinsic dim.
(representation intrinsic dim.)
Orger
intrinsic dim.))
Figure 4: Scaling of log test set loss/generalization ability with the intrinsic dimension of final hidden layer learned representations of the training set (drepr). for natural and medical datasets. Each point corresponds
(model, dataset, training set size) triplet. Medical dataset results are shown in blue shades, and natural dataset results are shown in red.
We that generalization error typically increases with dreper in similar shape as the daata scaling (Fig. 2). The similarity of these curves may be explained by dreps S daatav or other potential factors unaccounted for. The former arises if the loss bounds of Theorems[[]ane and taken as estimates:
Theorem (Bounding of Representation Intrinsic Dim. with Dataset Intrinsic Dim.). Les Theorems
7 aand be taken estimates, i.e., L x K2 max(K,, K=)N -11/dana and L RJ K1/der/ Then, drepr daata-
Proof. This centers equating the two scaling laws and using property of the Lipschitz constant of classification networks- see Appendix A.5 for the full proof.
In other words, the intrinsic dimension of the training dataset serves upper bound for the intrinsic dimension of the final hidden layer's 's learned representations. While a rough estimate, we found this to usually be the case in practice, shown in Fig. for all models, datasets and training
8

---

Published as a conference paper at ICLR 2024
sizes. Here, drepr ddata is shown dashed line, and the same estimator (MLE, Sec. 3.1 for ddata and dzepr for consistency (similar results using TwoNN are shown in Appendix E.2).
Intuitively, would expect drepr to be bounded by daata ddata encapsulates all raw dataset information, while learned representations prioritize task-related information and discard irrelevant details (Tishby & Zaslavsky 2015), resulting in deepr X ddata- Future work could investigate how this relationship varies for networks trained on different tasks, including supervised (e.g., segmenta- tion, detection) and self-super or unsupervised learning, where drepr might approach ddata-
DISCUSSION AND CONCLUSIONS
In this paper, explored how the generalization ability and adversarial robustness of neural network relate to the intrinsic properties of its training set, such as intrinsic dimension (ddata) and label sharpness (Kx). We chose radiological and natural image domains as prominent examples, but our approach was quite general: indeed, in Appendix C.2 we evaluate our hypotheses on skin lesion image dataset, a domain that shares similarities with both natural images and radiological images, and intriguingly find that properties of the dataset and models trained on it often lie in between these two domains. It would be interesting to study these relationships in still other imaging domains such as satellite imaging (Pritt & Chemn 2017). histopathology (Komura & Ishikawa 2018). and others. Additionally, this analysis could be extended to other tasks (e.g., multi-class classification or semantic segmentation), newer model architectures such as ConvNeXt (Liu et al. 2022), non-
convolutional models such as MLPs or vision transformers (Dooovisskiy et al. (2221). or even natural language models.
Our findings may provide practical uses beyond merely better theoretical understanding of these phenomena. For example, we provide a short example of using the network generalization dependence on label sharpness to rank the predicted learning difficulty of different tasks for the same dataset in Appendix C.3. Additionally, the minimum number of annotations needed for an unlabeled training set of images could be inferred given the mea- sured daata of the dataset and some desired test loss (Eq. 2), which depends on the imaging domain of the dataset (Fig. 2 This is especially relevant to medical images, where creating quality annotations can be expensive and time-consuming. Additionally, Sec. 6 demonstrates the importance of using adversarially robust models or train- ing techniques for more vulnerable domains. Finally, the relation of learned representation intrinsic dimension to generalization ability (Sec. 7 and dataset intrinsic di- mension (Theorem 55) could inform the minimum param- eter count of network bottleneck layers.
30
25
imaqing domain
medical
natural
model
reanetE0
6
ogp
1gg19
15
25
30
35
deeta
Figure 5: Training set intrinsic dimen- sion upper-bounds learned represen- tation intrinsic dimension. Each point corresponds to a (model, dataset, train- ing set size) triplet.
A limitation of our study is that despite our best efforts, it is difficult to definitively say if training set label sharpness (Kx) causes the observed generalization scaling discrepancy between natural and medical image models (Sec. [.1 Fig. 2) We attempted to rule out alternatives via our formal analy- sis and by constraining many factors in our experiments (e.g.. model, loss, training and test set sizes, data sampling strategy, etc.). Additionally, we found that accounting for K2 in the generalization scaling law increases the likelihood of the law given our observed data (Appendix C.I). Altogether, results tell us that K5= constitutes an important difference between natural and medical image datasets, but other potential factors unaccounted for should still be considered.
Our findings provide insights into how neural network behavior varies within and between the two crucial domains of natural and medical images, enhancing our understanding of the dependence of generalization ability, representation learning, and adversarial robustness on intrinsic measurable properties of the training set.
'Not that doing in practice by fitting the scaling law model to existing (I., N, daats) results would require first evaluating a wider range of N due the logarithmic dependence of Eq. 2 N.

---

Published as a conference paper at ICLR 2024
AUTHOR CONTRIBUTIONS
N.K. wrote the paper, derived the mathematical results, ran the experiments, and created the visual- izations. M.A.M. helped revise the paper, the presentation of the results, and the key takeaways.
ACKNOWLEDGMENTS
The authors would like to thank Hanxue Gu and Haoyu Dong for helpful discussion and inspiration.
REFERENCES
Rayna Andreeva, Katharina Limbeck, Bastian Rieck, and Rik Sarkar. Metric space magnitude and generalisation in neural networks. arXiv preprint arXiv:2305.05611, 2023.
Alessio Ansuini, Alessandro Laio, Jakob H Macke, and Davide Zoccolan. Intrinsic dimension of data representations in deep neural networks. Advances in Neural Information Processing Sys- tems, 32, 2019.
Yasaman Bahri, Ethan Dyer, Jared Kaplan, Jachoon Lee, and Utkarsh Sharma. Explaining neural scaling laws. arXiv preprint arXiv:2102.0670. 2021.
Tolga Birdal, Aaron Lou, Leonidas J Guibas, and Umut Simsekli. Intrinsic dimension, persistent homology and generalization in neural networks. Advances in Neural Information Processing Systems, 34:6776-6789, 2021.
Bradley CA Brown, Anthony L. Caterini, Brendan Leigh Ross, Jesse C Cresswell, and Gabriel Loaiza-Ganem. Verifying the union of manifolds hypothesis for image data. In The Eleventh International Conference on Learning Representations, 2023. URL httttttss///perreeee
Ethan Caballero, Kshitij Gupta, Irina Rish, and David Krueger. Broken neural scaling laws. In The Eleventh International Conference on Learning Reprexentations, 2023. URI. https://
openreview net. forum?
www.:/tu////rtteetm d=sckjvee C7.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei. Imagenet: A large-scale hi- crarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web). IEEE signal processing magazine, 146)::411142 2012.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recogni- tion at scale. In International Conference on Learning Representations, 2021. URL https: //openreview. fet/ FineiiTTbbFFFFyyyyc
Elena Facco, Maria d' Errico, Alex Rodriguez, and Alessandro Laio. Estimating the intrinsic dimen- sion of datasets by a minimal neighborhood information. Scientific reports, 7(1):12140, 2017.
Mahyar Fazlyab, Alexander Robey, Hamed Hassani, Manfred Morari, and George Pappas. Efficient and accurate estimation lipschitz constants for deep neural networks. Advances in Neural Information Processing Systems, 32, 2019.
Charles Fefferman, Sanjoy Mitter, and Hariharan Narayanan. Testing the manifold hypothesis. Journal of the American Mathematical Society, 29(4)9833-0499 2016.
Adam E Flanders, Luciano M Prevedello, George Shih, Safwan S Halabi, Jayashree Kalpathy- Cramer, Robyn Ball, John T Mongan, Anouk Stein, Felipe C Kitamura, Matthew P Lungren, et al. Construction of a machine learning dataset through collaboration: the rsna 2019 brain ct hemorrhage challenge. Radiology: Artificial Intelligence, 2(3)ee19211, 2020.
10

---

Published as a conference paper at ICLR 2024
Sixue Gong, Vishnu Naresh Boddeti, and Anil K Jain. On the intrinsic dimensionality of image representations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3987-3996, 2019.
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.). 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http::p/wwww...////.ep.. 1412. 6572
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Jordan Hoffmmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes Welbl, Aidan Clark, al. Train- ing computeeoptimal large language models. arXiv preprint arXivv2203. 2022.
Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-llcus, Chris Chute, Henrik Marklund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al. Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison. Proceedings of the AAAI conference on artificial intelligence, volume 33, pp. 590-597, 2019.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arXiv preprint arXi::2001.0836: 2020.
Guy Katz, Clark Barrett, David I. Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: efficient smt solver for verifying deep neural networks. In Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part I 130, pp. 97-117. Springer, 2017.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), ), 3rd International Conference on Learning Reprexentations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL httt: //arxiv. www.ivvorg//o.ee abs 1412. 6980
Daisuke Komura and Shumpei Ishikawa. Machine learning methods for histopathological image analysis. Computational and structural biotechnology journal, 16:34-22, 2018
Nicholas Konz, Hanxue Gu, Haoyu Dong, and Maciej A Mazurowski. The intrinsic manifolds of radiological images and their role in deep learning. In Medical Image Computing and Computer Assisted Intervention-MICCAA 2022: 25th International Conference, Singapore, September 18- 22, 2022, Proceedings, Part VIII, pp. 684-694. Springer, 2022.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Henry Kvinge, Davis Brown, and Charles Godfrey. Exploring the representation manifolds of stable diffusion through the lens of intrinsic dimension. ICLR 2023 Workshop Mathematical and Empirical Understanding of Foundation Models, 2023.
Elizaveta Levina and Peter Bickel. Maximum likelihood estimation of intrinsic dimension. Advances in neural information processing systems, 17, 2004.
Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer. Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and paltern recognition, pp. 11976-11988 2022.
Xingjun Ma, Yuhao Niu, Lin Gu. Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Under- standing adversarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 10:33333,, 2021.
11

---

Published as a conference paper at ICLR 2024
David JC MacKay and Zoubin Ghahramani. Comments on maximum likelihood estimation of in- trinsic dimension' by e. levina and p. bickel (2004). The Inference Group Website, Cavendish Laboratory, Cambridge University, 2005.
Bjoern H Menze, Andras Jakab, Stefan Bauer, Jayashree Kalpathy-Cramer, Keyvan Farahani, Justin Kirby, Yuliya Burren, Nicole Porz, Johannes Slotboom, Roland Wiest, et al. The multimodal brain tumor image segmentation benchmark (brats). IEEE transactions on medical imaging, 34 (10):1993-0024 2014.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 2011.
Phil Pope,
Chen Zhu, Ahmed Abdelkader, Micah Goldblum, and Tom Goldstein. The intrinsic dimension of images and its impact on learning. In International Conference on Learning Repre- sentations, 2020.
Mark Pritt and Gary Chern. Satellite image classification with deep learning. In 2017 IEEE applied imagery pattern recognition workshop (AIPR). pp. 1-7. IEEE, 2017.
Pranav Rajpurkar, Jeremy Irvin, Aarti Bagul, Daisy Ding, Tony Duan, Hershel Mehta, Brandon Yang. Kaylie Zhu, Dillon Laird, Robyn L Ball, et al. Mura: Large dataset for abnormality detec- tion in musculoskeletal radiographs. arXiv preprint arXiv: 1712.0712.0 2017.
Ashirbani Saha, Michael Harowicz, Lars J Grimm, Connie E Kim, Sujata V Ghate, Ruth Walsh, and Maciej A Mazurowski. A machine learning approach to radiogenomies of breast cancer: study of 922 subjects and 529 dee-mri features. British journal of cancer, 1 119(4)508--16, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http: /atp::///axvvv.a org/ abs 1409.
Geoffrey Sonn, Shyam Natarajan, Daniel JA Margolis, Malu MacAiran, Patricia Lieu, Jiaoti Huang, Frederick J Dorey, and Leonard S Marks. Targeted biopsy in the detection of prostate cancer using an office based magnetic resonance ultrasound fusion device. The Journal of urology, 189(1):86-92, 2013.
Naftali Tishby and Noga Zaslavsky. Deep learning and the information bottleneck principle. In 2015 ieee information theory workshop (itw), pp. 1-5. IEFF, 2015.
Aleksei Tiulpin, Jérôme Thevenot, Esa Rahtu, Petri Lehenkari, and Simo Saarakkala. Automatic Knee Osteoarthritis Diagnosis from Plain Radiographs: Deep Learning- Approach. Sci- doi: 10. 100010/41198-00--00113333 https:://oii.... wttp///.orgg....o/ 1038 0228//4159888 -11-20132-2222-
entific Reports, 8(1):1727, 2018. ISSN 2045-2322.
URL
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov. Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.09228 2023.
Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz-margin training: Scalable certi- fication of perturbation invariance for deep neural networks. Advances in neural information processing systems, 31, 2018
Bohang Zhang, Tianle Cai, Zhou Lu, Di He, and Liwei Wang. Towards certifying l-infinity bustness using neural networks with l-inf-dist neurons. In International Conference on Machine Learning, pp. 12368-12379. PMLR, 2021.
12


Reviews:
[{"review_id": "1RqgppPlj0", "reviewer": "Reviewer_xVDy", "summary": "The paper hypothesizes about and investigates the reason behind generalization challenges in medical imaging domain. The intrinsic dimension of data is known to affect the generalization error; however, the strength of this relationship seems to depend on the data being from medical or natural imaging domains. This may hint to a missing component in the known scaling laws; the authors propose and empirically validate a scaling law where the discrepancy between these domains can be partially explained by the difference in their “label sharpness”. Furthermore, the authors connect the label sharpness to adversarial robustness.", "questions": "- How does Figure 1 look like for datasets within the medical domain? It seems that there are at least three datasets (brats, chexpert, prostate) with similar label sharpness to natural imaging domain (MNIST). Do you see some sort of similar separation that you see between natural and medical imaging domains? \n- Are there any other domains that you can use to validate your hypothesis further?  \n- Can you provide the confidence intervals for at least one of the subplots in Figure 2? \n- The results in Figure 3, considering only the results in each group, is not that convincing. Can you report the correlation within each group? \n- There are numerous similar examples of adversarial attacks natural imaging domain to the ones presented in Figure 4. What is special about these examples compared to the ones presented in even the earliest papers in this field (e.g., Szegedy et al. 2013, Intriguing properties of neural networks)?\n- Can you provide some intuition on why in Figure 5 and for the VGG models, the representation intrinsic dimension doesn’t change that much for medical imaging domain?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "- The paper addresses an important knowledge gap in understanding generalization error of medical imaging domain. \n- The proposed scaling law is investigated both theoretically and empirically on a wide range of models. \n- The paper is clearly written and relatively easy to follow.", "weaknesses": "- The proposed scaling law and the effect of label sharpness is only (partially) verified in two domains. I suggest adding other domains or datasets that have different label sharpness values. \n- The empirical results for the adversarial examples are not convincing enough, specially if we only consider the datasets within a single domain. Also the relationship between test set loss penalty vs label sharpness varies wildly based on the model used. This makes it harder for the reader to understand the message of section 6.\n- The theoretical and empirical results may have limited practical uses. Adding some results on use cases such as determining the minimum number of annotations (as mentioned in Discussion) can further strengthen the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5dLwGxo42t", "reviewer": "Reviewer_kQAF", "summary": "The paper discusses the generalization discrepancies of deep neural networks between natural image datasets and medical image classification datasets. In particular, the authors derive a scaling law between the intrinsic dimension $d_\\text{data}$ and its label sharpness $K_\\mathcal{F}$ (describing how similar image pairs may be while still having different labels). They also derive a second scaling law between adversarial robustness of trained classifiers on a dataset and its label sharpness. The authors perform experiments using 4 natural image datasets and 7 medical imaging datasets and -to some extent- validate their laws empricially.", "questions": "1. Is $\\lVert x_j - x_k\\rVert$ the $L_2$ distance measured in image space? Did you consider an extension where both $d_\\text{data}$ and $K_\\mathcal{F}$ are estimated in some feature representation (similar to what is done in Sec. 7) for $d_\\text{repr}$?\n\n2. How long would it take to compute $K_\\mathcal{F}$ on larger images, e.g. $512\\times 512$ which would be a common choice for the image matrix of CT images? Is it true that this only takes few seconds to compute $K_\\mathcal{F}$ for large datasets such as ImageNet?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "The paper is very well written and interesting to read. It tackles an interesting and important problem. Although not carefully checked, the Theorems and proofs seem sound.", "weaknesses": "1. **Image size** All datasets are resized to $HW=224\\times224$. While this is a natural choice for natural image datasets, no practitioner would classify cancer or other abnormalities on such small images. However, the nearest-neighbor distance is dependent on $d_\\text{data}$ and $d_\\text{data}$ itself should also be dependent on $HW$. Couldn't this effect be the major explanation for the generalization error discrepancy we observe on real-world medical image data (also influencing $K_\\mathcal{F}$)? In the Supplementary the authors only investigate the effect of much smaller resolutions ($32\\times32$ px). I am not convinced this makes sense for medical imaging, and I doubt one could achieve above random accuracy on such small images ($d_\\text{repr}$ could be dependent on this).\n\n3. **Discrepancy between imaging domains** The analysis of the generalization discrepancies between imaging domains (Sec. 5.2) could be improved by computing the likelihood that the observed shift in Fig. 2 is indeed caused by Eq. 2 (similar for Fig. 5 and Eq. 4, respectively). In its current form it is hard to see that the derived law holds empirically. Particularly for Fig. 5, I doubt that this likelihood would be very high. Overall, I am not convinced that the conducted experiments support the theoretical results sufficiently. To some extent, the authors acknowledge this themselves, and openly discuss the fact that there are many (possibly much more contributing) other explanations for the observed discrepancy.\n\n4. **Adversarial robustness** I find the analysis on adversarial robustness somewhat limited.\n    - How does the scaling law behave w.r.t $K_\\mathcal{F}$ estimates in the feature space of the trained classifier?\n    - The chosen perturbation budgets $\\epsilon \\in \\{ 1/255, 2/255, 4/255, 8/255\\}$ have vastly different interpretations for medical and natural images because medical images are *always* represented using floating point numbers. For example for CT data a budget of $8/255$ on images rescaled to $[0,1]$ could alter the pixel values by several hundreds Houndsfield units (HU), a perturbation easily detectable due to the physical interpretation of HU.\n\n5. **Investigate different architectures and tasks** Not that much of a weakness as it is a suggestion for future work. The authors limit their analysis to standard CNNs and a binary classification task. I think it would be very interesting to consider newer architectures and multi-class classification or even segmentation (also briefly mentioned by the authors w.r.t. relation between $d_\\text{repr}$ and $d_\\text{data}$) tasks. In particular it would be very interesting to see whether we can use these insights to predict uncertainty of a classification given the $K_\\mathcal{F}$ between similar labels (e.g. types of metastasis).\n\n6. **Source Code** Unfortunately the authors did not provide the source code for their experiments in the Supplementary.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KVT5wdInzc", "reviewer": "Reviewer_MU2A", "summary": "The authors proposed a metric called label sharpness K_F to measure the similarity between images belonging to different classes in a dataset and investigated how this metric correlates with the generalisation performance and adversarial robustness. The new metric was validated on a variety of natural and medical image datasets through extensive experiments.", "questions": "The proposed label sharpness metric K_F relies on having label information to calculate, yet the authors suggest it could guide estimates of required annotated data. It is unclear how K_F could be used for this purpose if labels are not yet available. The authors should clarify the practical utility of K_F for data annotation planning, since this appears unfeasible without existing labeled data. Potentially K_F could be estimated using a small initial labeled sample, but further analysis is needed on the variability of K_F to small labeled subsets.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Present a theoretical understanding of the generalisation among natural and medical image datasets\n2. Practical estimation of K_F\n3. Validation through extensive experiments", "weaknesses": "1. Task dependence. The proposed label sharpness metric is inherently dependent on the specific tasks, whereas intrinsic dimension is a fixed data property. While the authors have made efforts to rule out alternatives, the medical datasets used may not directly correspond to the natural image classification tasks. For instance, the medical datasets tackle lesion detection where backgrounds are similar, likely making it more difficult than ImageNet classification. To better match ImageNet, the authors could also evaluate on RadImageNet by designing some easier tasks (e.g., CT/MRI/ultrasound discrimination). This also gives a benchmark on the scaling law when the training size is large.\n2. Image preprocessing. All images were resized to 224x224 in this study, though prior work suggests intrinsic dimension is insensitive to the resolution of natural images. The authors should verify this holds for medical images, where a minimum resolution is needed to capture lesions. Providing comparisons across multiple resolutions could reveal if label sharpness or intrinsic dimension changes substantially.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6P6YJmmCuo", "reviewer": "Reviewer_fAwr", "summary": "This paper tackles the problem of measuring dataset complexity for predicting test-set generalization, showing that the trends in natural images don't match the trends in medical images. This work offers three main contributions, with theoretical results provided throughout. The first is a proposed metric they refer to as \"label sharpness\", which is meant to serve as a proxy for difficulty in generalizing by looking at the worst-case scenario between two data points where the images are very similar (by the L2 norm) but the labels are different. Second, they demonstrate that the sharpness of the dataset label distribution is negatively correlated with the adversarial robustness of a neural network. The third contribution is connecting their notion of d_data to d_repr, and showing how their scaling laws are related, with d_data serving as an approximate upper bound. The authors do this over a variety of both medical and natural image datasets and architectures.", "questions": "-  What was meant by \"We ensure the standardization of KˆF across all datasets\"? Is it not the case that each dataset has its own K^F?\n- Why are there no natural image datasets without d_data less than 7.5? These seem like they would be important to draw trends with for scaling laws.\n- I am very confused why there is a theorem saying that d_data is an upper bound for d_repr, when clearly the experimental results show that this isn't the case. What are the issues that cause this mismatch?\n- Why is there not a clear trend with models that have trained on more data having lower test loss? (Figure 2)\n- Taking the L2 norm between two high-dimensional images can result in near-zero distance even if the images are very different, why not work with distances of embeddings from pre-trained models? It would be helpful if there were examples of two images that are very close (by their metric) but have different labels.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 2, "strengths": "- The authors make an interesting attempt to provide a scaling law that is independent of the model itself, and rather depends on qualities of the data. Building insights which can be drawn from the training data alone seem very valuable.\n- The authors investigate the effects of their proposed metrics thoroughly across a variety of architectures and datasets, at both training and inference.", "weaknesses": "- A central claim of this paper is that \"medical images are typically more challenging to generalize to\". I don't think that this is a widely held belief or has been consistently shown throughout the literature (to this the authors heavily cite a work from 2022, which shows that in some cases maybe the scaling laws are different).\n- The measure of data sharpness, in the context of medical imaging, in my opinion is not well grounded. For medical images, especially those where you need to identify minor changes or tumors to correct classify things, the majority of the image will be the same as healthy images because the anatomies will be aligned. \n- The results seem quite weak across models and datasets, and for some figures there are lines drawn in which don't represent proper trend lines (Figure 2 in particular). Additionally, in the adversarial setting, regression coefficients are computed across both medical/natural image datasets, even though it's clear that within the natural image datasets and medical image datasets that there is very little correlation (visually) (Figure 3, Figure 6).\n- A claim was that models trained on datasets with similar data and of the same size N tend to perform much worse if the data is medical images, but the architectures chosen stem from the natural image domain and were tuned to those datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)