Why is SAM Robust to Label Noise?
Authors: Christina Baek
J Zico Kolter
Aditi Raghunathan
Venue: ICLR 2024 poster (2024)
Keywords: generalization
sharpness
robustness
SAM
Primary area: optimization

Abstract: Sharpness-Aware Minimization (SAM) is most known for achieving state-of the-art performances on natural image and language tasks. However, its most pronounced improvements (of tens of percent) is rather in the presence of label noise. Understanding SAM's label noise robustness requires a departure from characterizing the robustness of minimas lying in ``flatter'' regions of the loss landscape. In particular, the peak performance under label noise occurs with early stopping, far before the loss converges. We decompose SAM's robustness into two effects: one induced by changes to the logit term and the other induced by changes to the network Jacobian. The first can be observed in linear logistic regression where SAM provably up-weights the gradient contribution from clean examples. Although this explicit up-weighting is also observable in neural networks, when we intervene and modify SAM to remove this effect, surprisingly, we see no visible degradation in performance. We infer that SAM's effect in deeper networks is instead explained entirely by the effect SAM has on the network Jacobian. We theoretically derive the  implicit regularization induced by this Jacobian effect in two layer linear networks. Motivated by our analysis, we see that cheaper alternatives to SAM that explicitly induce these regularization effects largely recover the benefits in deep networks trained on real-world datasets.

Published as a conference paper at ICLR 2024
WHY IS SAM ROBUST TO LABEL NOISE?
Christina Baek
Zico Kolter Aditi Raghunathan
Carnegie Mellon University (kbaek, zkolter, raditi) Bandrew. cmu, edu
ABSTRACT
Sharpness-Awart Minimization (SAM) is most known for achieving state-of the-art performances on natural image and language tasks. However, its most pronounced improvements (of tens percent) is rather in the presence of label noise. Under- standing SAM's 's label noise robustness requires departure from characterizing the robustness of minimas lying in "flatter" regions of the loss landscape. In particular, the peak performance under label noise occurs with early stopping, far before the loss converges. We decompose SAM's robustness into two effects: one induced by changes to the logit term and the other induced by changes to the network Jacobian. The first can be observed in linear logistic regression where SAM prov- ably up up-weights the gradient contribution from clean examples. Although this explicit up-weighting is also observable in neural networks, when we intervene and modify SAM to remove this effect, surprisingly, we see no visible degradation performance. We infer that SAM's effect in deeper networks is instead explained entirely by the effect SAM has on the network Jacobian. We theoretically derive the implicit regularization induced by this Jacobian effect in two layer linear networks. Motivated by our analysis, we see that cheaper alternatives to SAM that explicitly induce these regularization effects largely recover the benefits in deep networks trained on real-world datasets.
INTRODUCTION
In recent years, there has been growing excitement about improving the generalization of deep networks by regularizing the sharpness of the loss landscape. Among optimizers that explicitly minimize sharpness, Sharpness Aware Minimization (SAM) (Foret et al., 2020) garnered popularity for achieving state-of-the-art performance on various natural image and language benchmarks. Compared to stochastic gradient descent (SGD), SAM provides consistent improvements of several percentage points. Interestingly, less widely known finding from Foret et al. (2020) is that SAM's most prominent gains lie elsewhere, in the presence of random label noise. In fact, SAM more robust to label noise than SGD by tens of percentage points, rivaling the current best label noise techniques (Jiang et al., 2017; Zhang al., 2017: Arazo al., 2019). In Figure 1, we demonstrate this finding in CIFARIO with 30% label noise, where SAM's best test accuracy is 17% higher. In particular, we find that the robustness gains are most prominent in particular version of SAM called I-SAM which applies the perturbation step to each sample in the minibatch separately.
An important caveat about the random label noise setting is that the test accuracy does not improve with further training, but instead peaks in the middle. Consequently, we argue understanding SAM in this regime requires departure from reducing SAM to the sharpness of its solution at convergence, but instead reasoning about SAM's "carly learning" behavior. In fact, even in settings with a unique minimum, the best test accuracy may change based the optimization trajectory. Indeed, the performance achieved by SAM does not diminish with underparamettrizaton, with the gains above SGD sometimes increasing with more data (Appendix F).
In this work, we investigate why 1-SAM is more robust label noise than SGD at a more mechanistic level. Decomposing the gradient of each example ("sample-wise gradient) by chain rule into V.l(f(w, 22., y) de/ōf V.. f... we analyze the effect of SAM's perturbation on the terms 0e/0! ("logit scale") and v.. ("network Jacobian"), separately. We make the following key conclusions about how these components improve early-stopping test accuracy. We begin our study in linear models, where the only difference between SAM and SGD is the logit scale term. Here, we show that SAM reduces reweighting scheme that explicitly up-weights the gradient contribution of

---

Published as a conference paper at ICLR 2024
Test Accuracy
Training Accuracy
Training Loss
07
Accurary
Loos
35-1
0.
02-
200
225
153
175
300
100
151
175
300
75
120
120
200
Epoch
Epoch
Epoch
SAM SGD
Clean
Nony
Figure 1: CIFARIO training accuracy and loss in clean versus noisy data. SAM achives higher clean training accuracy before fitting the noisy data, i.e., when accuracy of noisy training data surpasses random chance. This corresponds with a higher peak in test accuracy.
low loss points. This effect is particularly useful in the presence of mislabeled examples. When training with gradient descent, correctly labeled or clean examples initially dominate the direction of the update and as a result, their corresponding loss decreases first before that of mislabeled or noisy examples (Liu et al., 2020; 2023). Similar to many existing label-noise techniques (Liu et al., 2020), SAM's explicit up-weighting keeps the gradient contribution of clean examples large even after they are fit, slowing down the rate at which noisy examples are learned in comparison. We hypothesize that higher peak test accuracy corresponds with achieving higher clean training before overfitting to noise. Empirically, the gap between the training accuracy of clean and noisy examples closely tracks the test accuracy in earlier epochs (Figure 2).
In deep networks, SAM's logit scale term empirically in- duces similar effect of explicitly up- weeeiigtingg the gradients of low loss examples. However, for the magnitude of SAM's perturbation utilized in practice, scale has negligible impact on SAM's s robustness. On the other hand, just keeping SAM's perturbation the network Jacobian term retains nearly identical performance SAM. This suggests that there is fundamentally different mech- anism that originates in SAM's Jacobian term that results in most of SAM's s label noise robustness in the nonlinear case.
Clean Noisy Train Accuracy
Accouu Acceosy
find that SAM's logit
0.6
5G0
0.4
022
0.0
0
50
100
350
200
Figure 2: SAM learns clean examples faster than noisy examples.
Motivated by this finding, we analyze the Jacobian-only SAM for a 2-layer linear network, and show that the resulting update decomposes into SGD with 8g regularization activations. We argue that the benefits of such regularization could partially be reasoned about in terms of gradient contribution correctly fit points high by constraining the magnitude of the network output. Furthermore, including just this regularization for deep networks, while not achieving the full benefits of SAM, nonetheless substantially improves the performance of SGD. We emphasize that these methods are meant to be illustrative, and not intended to be standalone method for label noise robustness. But in this vein, our findings suggest that SAM's label noise robustness may not come via sharpness properties at convergence, but rather from the optimization trajectory taken.
the final layer weights and intermediate
an implicit up-weighting scheme. Namely, it keeps the loss of
2
PRELIMINARIES
2.1 PROBLEM SETUP
Model We consider binary classification. The sign of the model's output f Rd R maps inputs X' to discrete labels t E 11,,1}. We will study two kinds of models a linear model and 2-layer deep linear network (DLN) in this work. We do include the bias term.
Linear: fw, x) (w,z)
(2.1)
DLN: fv. w. (v. Wz) where W e ddd e R²a
Let us denote the intermediate activation as = Wa E RRA, We will abuse the notation to also refer to generic parameterized model f(w, when clear from context.
2

---

Published as a conference paper at ICLR 2024
Objective We consider the logistic loss L(w,,,
x, t) log( f(w, x))) for sigmoid function
Given n training points [(x, 4))] sampled from the data distribution D, our training objective is
a(=) [+exp(-a]
min Lw) where L(w) Σ l(w, 2ig 4,)
(2.2)
By chain rule, we can write the sample-wise gradient with respect to the logistic loss f(w, 2, t) as (2.3)
-V () = L. (oi (w)
Jw,
logit scale
Jacobian
The logit scale, which is the model's confidence that x belongs in the incorrect class - scales the Jacobian term. The logit scale grows monotonically with the loss. We refer to the network Jacobian [wf(w, as the "Jacobian term".
Although our mathematical analysis for binary classification, the cross-entropy loss for multiclass classification observes a similar decomposition for its sample-wise gradient:
-v = (ec (f + E,, x)), V f x))
(2.4)
logit scale
Jacobian
where a-) is the softmax function and e, is the one-hot encoding of the target label. Empirically, we will observe that the conclusions from our binary analysis transfer to multi-class.
2.2 SHARPNESS AWARE MINIMIZATION
Sharpness-aware Minimization (SAM) (Foret al., 2020) attempts find flat minimum of the training objective (Eq. 2.2) by minimizing the following objective
min max L(w + c), |ellasp
(2.5)
where p is the magnitude of the adversarial weight perturbation c. The objective tries find a solution that lies in a region where the loss does not fluctuate dramatically with any e-perturbation. SAM uses first-order Taylor approximation of the loss to approximate worst-case with the normalized gradient pV
1-SAM However, the naive SAM update that computes a single does not observe performance gains over SGD in practice unless paired with a small batch size (Foret et al., 2020; Andriushchenko & Flammarion, 2022a). Alternatively Foret et al. (2020) propose sharding the minibatch and calculating SAM's adversarial perturbation for each shard separately. At the end of this extreme is 1-SAM which computes e for the loss of each example in the minibatch individually. Formally, this can be written as
V Vwl(r;tt 4.) P || (x, 1/)l2
V owteel e (w ti) where
(2.6)
1=1
In practice 1-SAM is the version of SAM that achieves the most performance gain. In this paper, we focus on understanding 1-SAM and will use SAM refer to 1-SAM unless explicitly stated otherwise.
2.3 HYBRID 1-SAM
In our study of I-SAM, we try to isolate the robustness effects of 1-SAM coming from how the perturbation e; affects the logit scaling term and the Jacobian term of each sample-wise update. To do so, we will also pay attention to the following variants of 1-SAM:
I-SAM : V Vwte,li [(w + C. G. t.) =to (-tf w + x)) V Vwterff
w + E, x))
(2.7)
Logit SAM A ALSAM ((w, (i, - + 6
x: V
w
x4)
(2.8)
3

---

Published as a conference paper at ICLR 2024
Test Accuracy
Clean vs Noisy Grad Norm
0.75
1.1
Accuracy
0.70
Clean NorroNnissy
1.0
0.65
0.60
0.8-
0.7
0.55
200
400
600
800
1000
50
100
150
200
Timesteps
Timesteps
(a) SAM test accuracy for é [0, 0.18.. Bluer curves denote larger p. Accuracy improves with larger p.
(b) Ratio average sample-wise gradient norm clean versus noisy points
Figure 3: Linear models trained on the toy Gaussian data using SAM. SAM's preferential up- weighting of low loss points (right) corresponds with higher early stopping test accuracy (left).
Jacobian SAM : A J-SAM f(w. (w,,,,t)) =to
W F3.)
wt, f( w x3))
(2.9)
Logit SAM (L-SAM) only applies the SAM perturbation the logit scale for each sample-wise gradient while Jacobian SAM (J-SAM) only applies the SAM perturbation to the Jacobian term. We will observe that deep networks, J-SAM observes close the same performance as 1-SAM while L-SAM does not.
LINEAR MODELS: SAM UP-WEIGHTS THE GRADIENTS OF LOW LOSS EXAMPLES
We first study the robustness affects of the logit scale term in linear models. Not only can SAM's boost in strly-stopping performance be observed in linear models, but the Jacobian term V [w, x)) for linear models and is independent of the weights. Thus, any robustness obtained by SAM in this setting is specifically due to SAM's logit scale.
3.1 EXPERIMENTAL INVESTIGATION INTO SAM EFFECT IN LINEAR MODELS
We train our linear models over the following toy Gaussian data distribution D Rdd x {-1,1}.
True Label: y 1-1,1] by flipping fair coin
Input: y B BER B N (0. 72
d (a-1xd-1)
(3.1)
Target: t = y. E where E ~ {-1 w.p A, 1 w.p - -]}
In x, the first dimension contains the signal yB while the remaining d 1 dimensions is uncorrelated Gaussian noise. We sample training datapoints (x, () from this distribution where the random label noise corrupts A of the training data. We expect A 0.5 meaning the majority of the data is still clean. In the test data, we assume there are no mislabeled examples (t = y).
In Figure 3, compare the performance of full-batch gradient descent and SAM on toy Gaussian data with 40% label noise (See Appendix A for experimental details). Even in this simple setting SAM observes noticeably higher early stopping test accuracy over SGD. We run grid search for p between and 0.18 and observe that the early stopping test accuracy monotonically increases with p. Correlated with this improved performance, when we plot the average sample-we wise gradient norm of clean examples versus noisy examples along training, we observe that this ratio decays slower with larger p. This leads us to suspect that SAM's superior test performance is due to clean examples dominating the gradient update for longer. Previously, Liu al. (2020) proved that at the beginning of gradient descent training in linear models, the clean majority dominates the gradient, causing the clean examples be fit first. However, the dynamic quickly changes training progresses. As the loss of clean points quickly decays, the contribution of noisy outliers to the gradient update begins to outweigh that of the clean examples. This results in the test accuracy dropping back down.
4

---

Published as a conference paper at ICLR 2024
In the next section, we will prove that SAM, by virtue of its adversarial weight perturbation, preferen- tially up up-weights the gradient signal from low-loss points. This keeps the gradient contribution from clean points high in the early training epochs. Consequently, SAM achieves higher test accuracy by prioritizing fitting more clean training data before overfitting to noise.
3.2 ANALYSIS OF SAM'S S LOGIT SCALE
Recall that 1- I-SAM update of datapoint (zz, t2) is the gradient evaluated at the weights perturbed by the normalized sample-wise gradient. In linear models, the perturbation is simply the example scaled by the label e, = - pla | Evaluating the gradient at this perturbed weight, SAM's update reduces to constant adjustment of the logit scale by the norm of the datapoint.
-Vw+e, [(w + c,. 24, ve) = (-o -t+ < w, F4 > +
pl|z,1la
)
(3.2)
constant adjustment
Since the sigmoid function increases monotonically, the extra positive constant increases the gradient norm of all training points. However, among points the same norm || |l, this adjustment causes low loss points where the confidence towards the incorrect class (- (w, xx;) is small to be
up up-weighted by larger coefficient than high loss points where the incorrect class confidence high, as proven in the following lemma.
Lemma 3.1 (Preferential weighintting of low loss points) Consider the following function.
f(z) o o(-2+C)
1 1 exp(2)
(3.3)
o(-2)
1 exp((=== C)
This function is strictly increasing if >
Proof The first derivative is non-negative.
df dz
exp(2)
+ exp(2)) exp(2 C)
(3.4)
1 1 exp(==
+ exp(2 (= C))²
cxp(2)(1 cxpp()) > AEER
(3.5)
(1+exp(2 C))²
We can interpret 1-SAM as gradient reweighting scheme, where the weight for example x; is set to V w f(w e;, 24, 4)]l af (-,4 xx)) + p|
(3.6)
V (ww, x4, 4]
(-44(w, (ww,)
We directly apply Lemma 3.1 by setting
to (w zz) and = ع||دااا to prove that across points of the same norm, low loss points are more affected by the up- up-weighting than high loss points. Since the loss decreases faster for clean points over noisy points, SAM preferentially up-weights the gradients of clean points.
The fact that the resulting early stopping test accuracy of SAM is higher than gradient descent follows by induction. For our toy data distribution, we note that test accuracy saturates as goes to infinity. In particular, 1-SAM converges the Bayes optimal solution. Furthermore, consistent with previous literature, we find that even in this linear setting, 1-SAM behaves very differently from the naive SAM update (Section 2.2); the latter does not achieve any performance gains from SGD. We further discuss the asymptotic behavior of I-SAM and the behavior of n-SAM Appendix B.
NEURAL NETWORKS: SAM'S ROBUSTNESS COMES FROM THE JACOBIAN
From our linear analysis, we learned that SAM's logit scale term preferentially up- op-weights the gradients of low-loss points. We verify that this effect of SAM is also visible in neural networks. While the effect persists, we will show that, on the contrary, 1-SAM's 's logit scale component is not the main reason for SAM's improved robustness in deep networks. In particular, just applying the 1-SAM perturbation to the Jacobian term (J-SAM) recovers most of 1-SAM's gains while logit reweighting alone (L-SAM) cannot. Finally, we find that large proportion of the performance gains can be recovered through a simpler regularization that mimics the effect of the 1-SAM Jacobian on just the last layer weights and activations.
5

---

Published as a conference paper at ICLR 2024
SAM Logit Scale Norm
2NN SAM Logit Scale Norm
ResNet SAM Logit Scale Norm
Portureed Orriiaa
1.06-
Perturbed Original
14x
2.06-
Pertubed
12
1.04-
11x10"
59
100 Epoch
150
200
0
50
100
150
200
10
0
50
300
150
Spoch
Epoch
Clean
Noby
DLN Test Accuracy
2NN Test Accuracy
ResNet Accuracy
0.40
0.6
0.39
0.5
0.38
Accuracy
0.5
0.37
0.4
0.38
0.3
0.3
0.35
02
50
100 150
200
50
150 150
200
0.1
55
100
150
200
Epoch
LSAM
Figure 4: In 2-layer deep linear networks (DLN), 2-layer MLP with ReLU activation (2NN), and ResNet18 trained on noisy CIFAR10, we observe that SAM's perturbation to the logit scale preferen- tially upweights the gradient norm for clean examples (top row). Yet, J-SAM i... SAM absent the explicit reweighting effect, preserves SAM's label noise robustness (bottom row).
4.1 EXPLICIT REWEIGHTING DOES NOT FULLY EXPLAIN SAM'S GAINS
We first note that the upweighting of low-loss points can be observed even in multi-class classification with neural networks. Recall the general form of the gradient for multi-class cross-entropy loss is V (xx t) (f (f(, æ)) et, [w, æ)) where is the softmax function and et is the one-hot encoding of the label f. The analogous "logit scale" component for multiclass classification is the K dimensional vector g(w, xr t) = o (f(w,zz)
whose & norm scales with the loss. In Figure 4, we measure the change in the norm of this quantity for each example z; in the minibatch after the SAM perturbation, i.e., [l + es, Fi, (:) (l/l//////// Ii, (.) In ResNet1 8 trained on CIFAR 10 using SAM, indeed observe that this quantity higher in clean examples than noisy examples (Figure 4).
This result alone seemingly implies that the explicit reweighting also explains SAM's robustness in deeper models. However, when isolate this effeet by applying SAM just the logit scale term, i... L-SAM, with the optimal perturbation magnitude found for SAM p = 0.01, we observe marginal carly-stopping performance gains above SGD (Figure 4). Alternativel. J-SAM recovers almost all of the gains of SAM. This suggests that SAM's reweighting of the logit scale is not the main contributor to SAM's robustness in neural networks. We also find that this observation does not require arbitrarily deep network and also holds true in simple 2-layer deep linear networks (DLN) and ReLU MLP's (2NN) trained on flattened CIFAR10 10 images with 30% label noise. A similar analysis of SAM under label noise in linear models was conducted by Andriushchenko & Flammarion (2022b), however they attribute the label noise robustness in neural networks to logit scaling. We claim the opposite: that the direction or the network Jacobian of SAM's update becomes much more important.
4.2 ANALYSIS
Motivated by this, we study the effect of perturbing the Jacobian in a simple 2-layer DLN. In the linear case, the Jacobian term was constant, but in the nonlinear case the Jacobian is also sensitive to perturbation. In particular, for 2-layer DLNs, J-SAM regularizes the norm of the intermediate activations and last layer weights, as proven by the following proposition.
Proposition 4.1 For binary classification in a 2-layer deep linear network [(vv W, = (v, Ws), J-SAM approximately reduces to SGD with L.2 norm penalty on the intermediate activations and last layer weights.

---

Published as a conference paper at ICLR 2024
Intermediate Activation Narm
Last Layer Weight Norm
17.5
SAM
560
[[
SAN
Clean
12.5
10.0
25
50
75
100 Epoch
125
150
175
200
50
100
150
200
Epoch
Figure 5: When training ResNet18 with SAM, the norm of the final intermediate activations and last layer weights decreases significantly, consistent with 2-layer DLN analysis.
Proof We write the form of the J-SAM update for the first layer W of the deep linear network:
-Vw+ea> e, t) = oi (w,, x)) to (z) xT
(4.1)
--Vwl(w,ae x, po -tff(w ((tf(w,x))
(4.2)
where Wæ is the intermediate activation and J
[Vʃ(z)] = v|=
12 is
normalization factor. the second layer, the gradient with respect to v
tz -|==1=11
-
o f(w + e, 2, = (f
(4.3)
= x), (((-tf(w,x))latt)
(4.4)
From Equation 4.1, note that SAM adds an activation norm regularization to the first layer a. Vw 2 I|=ll2 scaled by some scalar dependent on f(w, x), and J. Similarly, from Equation 4.3, note that SAM adds a weight norm penalty to the second layer weights V, 1 || also multiplied by some scalar. The normalization factor J scales the regularization be closer to the norm than the squared norm.
Empirically, that similar effect is present in SAM for deeper networks. As networks become deeper, the exact J-SAM update becomes more complicated than simply SGD with weight and feature norm regularization. However, when we train ResNet18 with SAM and measure the norm of the final intermediate activations and last layer weights, the norms still decrease significantly in this setting (Figure 5).
4.3 EXPERIMENTS
Inspired by our analysis, we train deep networks using SGD with & regularization on the last layer weights and last hidden layer intermediate activations. Namely, we simplify down SAM's regularization the following objective
min L(w) +
Y N Σ | + 1ol1o112
(4.5)
where is the last layer weights and is the last hidden layer intermediate activation.
We conduct our experiments on CIFARIO with ResNet18. 1-SAM leads to unstable optimization with batch normalization as it requires passing through the datapoints individually through the network. Thus, we replace all batch normalization layers with layer normalization. Keeping all other hyperparameters such as learning rate, weight decay, and batch size the same, we compare the performance of SGD, 1-SAM, L-SAM, J-SAM, and the regularized SGD (Eq. 4.5). Although regularized SGD does not achieve exactly the same test accuracy as SAM, the gap is significantly closed from 17% to 9%. On the other hand, under no label noise, regularized SGD has neglible improvement of 1% with hyperparameter search, while SAM still achieves 8% higher test accuracy than SGD (Figure 9). Thus, while insufficient explain all of SAM's generalization benefits, suspect that a similar regularization of final layers in SAM is particularly important for generalization under heavy label noise.
7

---

Published as a conference paper at ICLR 2024
Algorithm
Best Test Accuracy
1-SAM (0- = 0.01)
69.47%
L-SAM (p 0.01)
54. 13%
J-SAM (p- -0=00 =0.01)
69.17%
SGD
52,48%
SGD w/ Proposed Reg
60.8%
Table 1: Adding our proposed regularization on the last layer weights and logits boosts SGD performance by 8%.
4.4 CONNECTION BETWEEN LOGIT SCALE AND JACOBIAN TERMS
We hypothesize that the benefits of regularizing the Jacobian could also partially be reasoned about
in terms of gradient contribution or as an implicit wp-weighting scheme. By regularizing the norm of
the weights and features, the magnitude of the network output remains small. Given [|](,)] C,
note that the loss of any single datapoint is lower and upper bounded by log (1 + (K 1)1-1)exxp expexp((0) and log (1 (K 1) exp(C)), respectively. By keeping C small, clean training loss may remain non-negligible even as the clean training accuracy increases, and the loss of noisy misfit examples is capped. Indeed, can be observed in Figure and 7, the loss of clean examples is much higher in SAM than SGD for the same gap between clean and noisy training accuracy. In linear models, weight decay and SAM's logit scale adjustment have equivalent effects (Appendix B). A small weight norm and SAM's s logit scale both balance the gradient contribution of examples. Furthermore, weight decay and small initialization is well-known improve robustness in overparametrized settings (Advani & Saxe, 2017).
5 RELATED WORK
5.1 IMPLICIT BIAS OF SAM
While the overall mechanics of SAM remains poorly understood, several papers have independently tried to elucidate why the per-example regularization I-SAM may be important. Andriushchenko & Flammarion (2022a) show that in sparse regression on diagonal linear networks, 1-SAM is more biased towards sparser weights than naive SAM. Wen et al. (2022) differentiate 1-SAM and naive SAM by proving that the exact notion of "flatness" that each algorithm regularizes is different. Our observation of feature regularization is of close connection to Andriushchenko et al. (2023a) which show that SAM drives down the norm of the intermediate activations in a 2 layer ReLU network and this implicitly biases the activations be low rank. Meng et al. (2023) analyze the per-example gradient norm penalty, which also effectively minimizes sharpness and show that if the data has low signal-to-noise ratio. penalizing the per-example gradient norm dampens the noise allowing more signal learning. Recent works also make connections between naive SAM and generalization (Behdin & Mazumder, 2023; Chen al., 2024). Our analysis differ from previous works as focus on understanding 1-SA''s robustness to random label noise, which requires reasoning about the best not final test accuracy. Although this is the regime where SAM's achievements are the most notable, it has not been thoroughly studied in previous works which focus on SAM's solution at convergence.
5.2 CONNECTION BETWERN SHARPNESS AND GENERALIZATION
Sharpness of the loss landscape has used in deep learning as generalization measure (Hochreiter & Schmidhuber, 1997; Dziugaite& & Roy, 2017; Bartlett al., 2017; Neyshabur et al., 2017). A family of optimization choices including minibatch noise in stochastic gradient descent (SGD), large initial learning rate, and dropout have shown to implicitly regularize the model towards solutions lying in flat basins areas of low curvature (Keskar et al., 2016; Dziugaite & Roy, 2017: Cohen et al., 2021; Damian al., 2022; Nar & Sastry, 2018: Wei et al., 2020; Damian et al., 2021: Orvieto et al., 2022; Jastrzebski et al., 2021). However, the negative correlation between generalization and sharpness is not universally true, but specific to certain optimization choices (Jiang et al., 2019). For example, strong data augmentation may improve generalization but sharpen the landscape (Andriushchenko al., 2023b). Sharpness regularization also appears in adversarial weight robustness (Wu et al., 2020;
8

---

Published as a conference paper at ICLR 2024
Zheng et al., 2021). However, adversarial weight robustness has direct connection to the label noise robustness we study in our work.
5.3 LEARNING WITH LABEL NOISE
Mislabeled data is persistent problem even in common benchmarks such as CIFAR and ImageNet (Müller & Markert, 2019) and they can have significant impact on model performance (Nakkiran et al., 2021; Rolnick et al., 2018; Gunasekar et al., 2023; West et al., 2021). Our conclusions, which reduce generalization how many more clean examples are learned first, is tied previous literature on the faster learning time of clean versus noisy examples in gradient based optimization. Liu et al. (2020) first prove this in linear models. More recently, Liu et al. (2023) showed that a similar effect is observable in neural networks, where the gradient over clean and noisy examples have negative cosine similarity at the beginning of training, and we may reason about early learning of clean points by the magnitude of their contribution to the average gradient. Many metrics in practice also use learning time to identify examples that are memorized (Zhang & Sabuncu, 2018; Lee et al., 2019; Chen et al., 2019; Huang et al., 2019; Jiang et al., 2017; 2020a; Carlini et al., 2019 9; Jiang et al., 2020b; Arazo et al., 2019; Liu et al., 2022).
DISCUSSION, LIMITATIONS, AND CONCLUSION
Although the SAM optimizer has proven very successful in practice, there is notable divide between the established motivation for SAM of finding a flat minimum, and the empirical gains achieved. Fundamentally, the work we present here aims to justify the usage of SAM by appealing to very different set of principles than those used to originally derive the algorithm. Specifically, we show that in the linear and nonlinear cases, there is an extent to which SAM "merely" acts by learning more clean examples before fitting noisy examples. This provides a natural perspective upon which to analyze the strong performance of SAM, especially in the setting of label noise.
In the linear setting, we identified that SAM explicitly up-weights the gradient signal from low loss points. This is quite similar to well known label noise robustness methods (Liu et al., 2022; 2020) which also utilize learning time as a proxy for distinguishing between clean and noisy examples. In the nonlinear setting, we identify arguably a more interesting phenomena - how clean examples are fit can affect the learning time of noisy examples. We show that SAM regularizes the norm of the intermediate activations and final layer weights throughout training and this improves label noise robustness. Ultimately, the effect may be similar to label noise robustness methods that regularize or clip the norm of the logits (Wei et al., 2023).
Finally, we emphasize that despite their close connection, SAM has been surprisingly underexplored in the label noise setting. The research community has developed a number of methods for understanding and adjusting to label noise, and it has so far been a mystery as to how SAM manages to unintentionally match the performance of such methods. Empirically however, we find that simulating even partial aspects of SAM's regularization of the network Jacobian can largely preserve SAM's performance. As secondary effect of this research, we hope our conclusions can inspire label-noise robustness methods that may ultimately have similar benefits to SAM (but ideally, without the additional runtime cost incurred by sharding the gradients in I-SAM).
7 ACKNOWLEDGEMENTS AND DISCLOSURE OF FUNDING
We thank Hossein Mobahi, Behnam Neyshabur, Dara Bahri, Shankar Krishnan for their insights and guidance which greatly shaped our understanding of SAM. We thank Jeremy Cohen, Tengyu Ma, Maksym Andriushchenko, and Tanya Marwah for the many helpful discussions about sharpness. We thank Jacob Springer, Pratyush Maini, and Alex Li for discussions about memorization, and assistance with building about how SAM behaves in practice. This work was supported in part by Bosch Center for Artificial Intelligence and the A12050 program at Schmidt Sciences (Grant #G2264481).
codebase. We thank Anna Bair and Sanket Mehta for their insights

---

Published as a conference paper at ICLR 2024
REFERENCES
Madhu S. Advani and Andrew M. Saxe. High-dimensional dynamics of generalization error in neural networks, 2017.
Maksym Andriushchenko and Nicolas Flammarion. Towards understanding sharpness-aware mini- mization. In International Conference on Machine Learning, pp. 639-668. PMLR, 2022a.
Maksym Andriushchenko and Nicolas Flammarion. Understanding sharpness-aware minimization, 2022b. URL https: /wwppeeeeeeeeeeeeeeeeeeeeee nwt. wwwp:/eeeeetttnteeeeeenetter (erpmmiid=cae Laarummidd=xx0OnhTTRR0.
Maksym Andriushchenko, Dara Bahri, Hossein Mobahi, and Nicolas Flammarion. Sharpness-aware minimization leads to low-rank features. arXiv preprint arXiv:2305. 2023a.
Maksym Andriushchenko, Francesco Croce, Maximilian Müller, Matthias Hein, and Nicolas Flam- marion. A modern look at the relationship between sharpness and generalization. arXiv preprint arXiv:2302.07011, 2023b.
Eric Arazo, Diego Ortego, Paul Albert, Noel O'Connor, and Kevin McGuinness. Unsupervised label noise modeling and loss correction. In International conference on machine learning, pp. 312-321. PMLR, 2019.
Peter L Bartlett, Dylan J Foster, and Matus J Telgarsky. Spectrally-norraaiized margin bounds for neural networks. Advances in neural information processing systems, 30, 2017.
Kayhan Behdin and Rahul Mazumder. On statistical properties of sharpness-awarc minimization: Provable guarantees, 2023.
James Bradbury, Roy Frostig, Peter Hawkins, Matthew James Johnson, Chris Leary, Dougal Maclaurin, George Necula, Adam Paszke, Jake VanderPlas, Skye Wanderman-Milee and Qiao Zhang. JAX: composable transformations of Python+NumPy programs, 2018. URL
http: / /ggthtb.tttu///gg com/ hom/ggogle/////oooo jax.
Nicholas Carlini, Ulfar Erlingsson, and Nicolas Papernot. Distribution density, tails, and outliers in machine learning: Metrics and applications. arXiv preprint arXiv: 1910. 13427, 2019.
Pengfei Chen, Ben Ben Liao, Guangyong Chen, and Shengyu Zhang. Understanding and utilizing deep neural networks trained with noisy labels. In International Conference on Machine Learning, pp. 1062-1070. PMIR, 2019.
Zixiang Chen, Junkai Zhang, Yiwen Kou, Xiangning Chen, Cho-Jui Hsieh, and Quanquan Gu. Why does sharpness aware minimization generalize better than sgd? Advances in Neural Information Processing Systems, 36, 2024.
aware
Jeremy M Cohen, Simran Kaur, Yuanzhi Li, J Zico Kolter, and Ameet Talwalkar. Gradient descent on neural networks typically occurs the edge of stability. arXiv preprint arXiv:2 2021.
Alex Damian, Tengyu Ma, and Jason Lee. Label noise sgd provably prefers flat global minimizers. Advances in Neural Information Processing Systems, 34:27449-27461, 2021.
Alex Damian, Eshaan Nichani, and Jason D Lee. Self-stabillizatio:: The implicit bias of gradient descent at the edge of stability. arXiv preprint arXiv:2209.15550) 2022.
Gintare Karolina Dziugaite and Daniel Roy. Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data. arXiv preprint arXiv:1703.1 11088, 2017.
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412. 2020.
Suriya Gunasekar, Yi Zhang. Jyoti Aneja, Caio César Teodoro Mendes, Allie Del Giomo, Sivakanth Gopi, Mojan Javaheripi, Piero Kauffmann, Gustavo de Rosa, Olli Saarikivi, et al. Textbooks are all you need. arXiv preprint 2xXiv:2306.11644 2023.
Sepp Hochreiter and Jürgen Schmidhuber. Flat minima. Neural computation, 9(1):1-42, 1997.
10

---

Published as a conference paper at ICLR 2024
Jinchi Huang, Lie Qu, Rongfei Jia, and Binqiang Zhao. O2u-net: A simple noisy label detection approach for deep neural networks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 3326-3334, 2019.
Stanislaw Jastrzebski, Devansh Arpit, Oliver Astrand, Giancarlo B Kerg, Huan Wang. Caiming Xiong. Richard Socher, Kyunghyun Cho, and Krzysztof Geras. Catastrophic fisher explosion: Early phase fisher matrix impacts generalization. In International Conference on Machine Learning, pp. 4772-4784. PMLR, 2021.
I. Jiang, Z.Zhou, T Leung, LJ Li, and L. Fei-Fei. Mentornet: Regularizing very deep neural networks on corrupted labels. arXiv preprint arXiv:1712.0505: 2017.
Lu Jiang, Huang, Mason Liu, and Weilong Yang. Beyond synthetic noise: Deep learning on controlled noisy labels. In International conference on machine learning, pp. 4804-4815. PMLR, 2020a.
Yiding Jiang, Behnam Neyshabur, Hossein Mobahi, Dilip Krishnan, and Samy Bengio. Fantastic generalization measures and where to find them. arXiv preprint 191v:2192.00278, 2019.
Ziheng Jiang, Chiyuan Zhang, Kunal Talwar, and Michael C Mozer. Characterizing structural regularities of labeled data in overparameterized models. arXiv preprint arXiv:2002.03206 2020b.
Nitish Shirish Keskar, Dheevatsa Mudigere, Jorge Nocedal, Mikhail Smelyanskiy, and Ping Tak Peter Tang. On large-batch training for deep learning: Generalization gap and sharp minima. arXiv preprint arXiv:1609.04530 2016.
Kimin Lee, Sukmin Yun, Kibok Lee, Honglak Lee, Bo Li, and Jinwoo Shin. Robust inference via generative classifiers for handling noisy labels. In International conference on machine learning, pp. 3763-3772. PMLR, 2019.
Chaoyue Liu, Amirhesam Abedsoltan, and Mikhail Belkin. On emergence of clean-priority learning in early stopped neural networks. arXiv preprini arXiv:2306.02533. 2023.
Sheng Liu, Jonathan Niles- Narges Razavian, and Carlos Fernandez-Grann Early-learning regularization prevents memorization of noisy labels. Advances in neural information processing systems, 33:20331-20342, 2020.
Sheng Liu, Zhihui Zhu, Qing Qu, and Chong You. Robust training under label noise by over- parameterization. In International Conference Machine Learning, pp. 14172. PMLR, 2022.
Xuran Meng, Yuan Cao, and Difan Zou, Per-example gradient regularization improves learning signals from noisy data. arXiv preprint arXiv:2303. 2023.
Nicolas M Müller and Karla Markert. Identifying mislabeled instances in classification datasets. In 2019 International Joint Conference on Neural Networks (ICCN), pp. 1-8. IEEE, 2019.
Preetum Nakkiran, Gal Kaplun, Yamini Bansal, Tristan Yang. Boaz Barak, and Ilya Sutskever. Deep double descent: Where bigger models and more data hurt. Journal of Statistical Mechanics: Theory and Experiment, 2021(12):220033 2021.
Kamil Nar and Shankar Sastry. Step size matters in deep learning. Advances in Neural Information Processing Systems, 31, 2018
Behnam Neyshabur, Srinadh Bhojanapalli, David McAllester, and Nati Srebro. Exploring generaliza- tion in deep learning. Advances in neural information processing systems, 30, 2017.
Antonio Orvieto, Hans Kersting, Frank Proske, Francis Bach, and Aurelien Lucchi. Anticorrelated noise injection for improved generalization. In International Conference Machine Learning, pp. 17094-17116. PMLR, 2022.
David Rolnick, Andreas Veit, Serge Belongie, and Nir Shavit. Deep learning robust to massive label noise, 2018
Colin Wei, Sham Kakade, and Tengyu Ma. The implicit and explicit regularization effects of dropout. In International conference on machine learning, pp. 10181-10192. PMLR, 2020.

---

Published as a conference paper at ICLR 2024
Hongxin Wei, Huiping Zhuang, Renchunzi Xie, Lei Feng, Gang Niu, Bo An, and Yixuan Li. Mitigating memorization of noisy labels by clipping the model prediction. International Conference on Machine Leurning, pp. 36868-36886. PMLR, 2023.
Kaiyue Wen, Tengyu Ma, and Zhiyuan Li. How does sharpness-aware minimization minimize sharpness? arXiv preprint (..Xvv:2211.07720 2022.
Peter West, Chandra Bhagavatula, Jack Hessel, Jena D Hwang. Liwei Jiang, Ronan Le Bras, Ximing Lu, Sean Welleek, and Yejin Choi. Symbolic knowledge distillation: from general language models to commonsense models. arXiv preprint WXXv:2210.00777. 2021.
Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. Advances in Neural Information Processing Systems, 33:2958- 29699, 2020.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint 17X.0:1710.094112 2017.
Zhilu Zhang and Mert Sabuncu. Generalized cross entropy loss for training deep neural networks with noisy labels. Advances in neural information processing systems, 31, 2018.
Yaowei Zheng, Richong Zhang, and Yongyi Mao. Regularizing neural networks via adversarial model perturbation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8156-81188 116681666222 2021.
12

---

Published as a conference paper at ICLR 2024
A
METHODS
All code was implemented JAX (Bradbury et al., 2018), and we utilize the Flax neural network library. We utilize normally distributed random initialization scheme. Our experiments were NVIDIA Quadro RTX A6000.
A.1 SYNTHETIC LABEL NOISE
We add synthetic label noise in the following We randomly select A proportion of the training data to corrupt. For each datapoint (z, we select corrupted label randomly from t {i [M] v}-
A.2 EXPERIMENTS ON CIFAR10
For experiments conducted CIFARIO, train with 30% label corruption. We hyperparameter tuned the model for the best learning rate using SGD, and then hyperparameter tune 1-SAM's hyperparameter utilizing the same learning rate. We do not utilize any learning rate schedule or data augmentation other than normalizing the image channels using mean (0.4914, 0.4822, 0.4465) and standard deviation (0.2023, 0.1994, 0.2010).
ResNet18 We have modified the ResNet18 architecture by replacing all Batch Norm layers with Layer Norm. This is necessary to safely run 1-SAM which requires a separate forward pass for each datapoint the minibatch.
Parameter
Value
Batch size
128
Learning rate
0.01
Weight decay
0.0005
Epochs 200
P (for SAM) 0.01
2 Layer DIN/MLP with ReLU We do not include bias at any layer. The width of the intermediate layer is to 500. We use the same hyperparameters the ResNet18 experiments.
A.3 EXPERIMENTS ON ToY DATA
Linear We set the parameters of our toy data distribution to be the following
Parameter
Value
A
0.4
B
2
1000
Training samples Test samples
500
1000
There is no weight decay. Learning rate set to 0.01.
13

---

Published as a conference paper at ICLR 2024
B LINEAR MODEL ANALYSIS
Toy Data Setting D Rd (-1,1).
We train our linear models over the following toy Gaussian data distribution
True Label: y ~ (-1, by flipping fair coin
Input: y B R R. N (o. 72
d La- (a-1xd-1)
(B.1)
Target: t = y- where E ~ {-1 w.p A, 1 w.p ap(11 (1-A)}
The test data is generated from a related distribution where the target is noiseless y.
Test Accuracy
The expected accuracy over the test distribution can be written as
((w x) > o]] (v(w) x) > 0)
Acc(w) -Re.yy-Deon
(B.2)
db Byd 1w1
13-
T W Wi
(B.3)
Vd
>|1w1+11
where W1+ Rd-2 denotes the vector consisting of the entries in excluding the first. Therefore, the accuracy monotonically increases with w1/ //1l and optimal linear classifier in this setting is proportional to the first elementary vector:
W X 61
(B.4)
B. 1-SAM ASYMPTOTICS
We are interested in assessing the early-stopping test accuracy naive SAM (n-SAM) versus 1-SAM. As we can observe in Figure 3, the best test accuracy monotonically increases with p. We analyze 1-SAM in the limit as the perturbation magnitude converges limit p oc and observe that converges to the optimal classifier. In this regime, the 1-SAM update for each example simply becomes
V Awte,llu Es, ve, lim -,o ( (-t,(w,, 2.) + (|xal1)) -4,0
(B.5)
p-000
and the ratio between the magnitude of any two points converges to 1, specifically for any two datapoints F; and Tj
w wez, flw + Es, [1)l
lim σ (-ti(w, 2.) + -||=;11
lim 0000
(B.6)
V
mie ((w + Ej ws)ll
8000 a (-1r(w, mz) + ,||>;||)
1 + exp(L((wxx)) |||
lim
1 + exp(t, (w, x,) pl|z; =1
(B.7)
As a result, each gradient update of 1-SAM is precisely equal the empirical mean of the data scaled by the label up X.. Say that we given fixed training examples [a:a][_ independently sampled from D where A is corrupted. Note that as d or n grows (and < 0.5), up converges to the Bayes optimal classifier. Notably,
up (1-2A) BA)
d_
(1 BA)
(B.8)
nyd
Note that the ridge regression also converges to the empirical mean scaled by the label in the limit
(xxT + - A+00 x
(B.9)
This gives us reason to believe that SAM and weight decay have similar regulatory propertics.
14

---

Published as a conference paper at ICLR 2024
n-SAM Test Accuracy
0.70
Gradient Descert
0.75
Test Accuracy
0.68
100000
0.70
Accuracy
0.62
0.85
0.60
0.88
0.56
0.55
200
800
250
500
750
1750 2000 Timesteps
1000
1250
1500
Timestops
Hessian Trace
1-SAM Clean / Mislabeled
SAM 0-5AM
200
1.0
150
0.8
Trace
200
0.6
50-
0.4
0.2
250
500
750 1000
1500 1750 Timesteps
1250
2000
Timesteps
Figure 6: We train linear models on our toy model using 1-SAM. Bluer curves denote larger p. We randomly initialize the model, although we observe similar curves when initialized at the origin.
B.2 ANALYSIS N-SAM
We also analyze the naive SAM (n-SAM) update
w w -
1 71
Σ
n
(w (w Mi) + Aw
(B.10)
where c= PIV Lla and L(w)= = - ll. v1) and p is a hyperparameter. The original and follow up works Foret al. (2020); Andriushchenko & Flammarion (2022a) show that n-SAM does not have any advantage over gradient descent in practice. We observe that even in the linear setting with toy Gaussian data, n-SAM observes little early stopping improvements unless p is scaled up dramatically. In Figure 4 for example, we set p 100000 for n-SAM.
(ww)
Comparing 1-SAM and n-SAM in the linear setting, find that they have fundamentally different effects. n-SAM's ' perturbation is not a constant that is only a function of the data norm. The magnitude of the perturbation is proportional to the loss, so SAM does not preferentially upweight low loss points except for the early training steps. Let us consider that the noise 2, of the datapoints are orthogonal for ease of analysis. Then
VR-SAM f(w, I4,31)) t1o (ti/(w + (w "I to L(w)] 2i) CB2 22112:110 (-) x;),
Iz
(B.11)
P =-40 (w + nll [w)]l
Tr.
(B.
for some scalar C that remains constant across the examples. Assuming gradient descent starting at = O, class balance, and the same number of mislabeled datapoints in each class, n-SAM each iteration, perturbs each point proportional to ((-t(w, (w)) which is smaller for low loss points and higher for high loss points. This does not guarantee preferential ap-weighting. We do observe in Figure (see orange curve) that if p is sufficiently large, we are able to see some gains with n-SAM in the first couple timesteps. Finally, we do not any correlation between test accuracy and flatness measured by the Hessian trace. In fact, n-SAM with large achieves smaller Hessian trace by the end of training but lower test accuracy.
15

---

Published as a conference paper at ICLR 2024
C IMPLICIT UP- WEIGHTING
Previously, we showed that the gap between the training accuracy of clean and noisy examples correlates highly with the test accuracy (See Figure 7). This led to reason about improved generalization with learning clean examples faster than noisy examples. In particular, we use the "sample-wis" wise update norm" average update. For example, with SGD, the update is the gradient evaluated at the model parameters w, and for SAM, the update is the gradient evaluated at the perturbed w + We showed that in the linear setting, the logit scale term SAM up-weights the update norm clean examples. Next, for non-linear setting, we showed that SAM's Jacobian term regularizes the magnitude of the function output, and we suspect that this has a similar implicit effect of balancing the gradients of clean and noisy examples as the loss of clean examples decreases first.
proxy for how much each clean and noisy example contribute to the
Below, we plot the average clean versus noisy ratio of the loss, sample-wise update norm, and logit scale norm from Section 4.1. We desire these quantities to be high even as the clean-noisy accuracy gap increases. For the same clean-noisy accuracy gap, SAM and J-SAM's ratio of clean/noisy loss is higher (across the training trajectory, before the accuracy gap peaks). As a result, the clean/noisy update norm ratio is also higher with SAM and J-SAM, meaning clean examples have higher influence on the direction of the update.. Notably, this up- weigtttg effect is implicit, not due to explicit upweighting.
Clean Noisy Train Accuracy Gap
0.6
SAM
1-SAM
J-SAM
Accotan
0.2
50
100
150
200
Loss Ratio vs Train Accuracy Gap
Update Norm Ratio vs Train Accuracy Ga
1.0
Logit Scale Ratio vs Train Accuracy Gap
0.9
SGD
08
SAM
L-5AM
0.9
0.7
15AM
0.8.
0.7
3.5
0.8
0.4
0.3
0.4
0.0
0.2
04 0.6
0.
0.2
Clean Noley Accuracy Gap
Clean No Accuracy Gap
Clean Noisy Acturacy Gap
Figure 7: We plot the clean/noisy ratio of the loss, sample- wise gradient norm, and logit scale norm versus the clean-noisy accuracy gap. The ratios are higher with SAM and J-SAM than SGD and L-SAM for the same accuracy gap. Orange marker denotes the beginning of the training trajectory and purple denotes the end.
16

---

Published as a conference paper at ICLR 2024
D EVIDENCE OF LABEL NOISE ROBUSTNESS ON OTHER DATASETS
Tiny-ImageNet Test Accuracy
Tiny-ImageNet Clean Noisy Train Accuracy
SAM
ACCovan ACCAtoiy
U.6
SGD
Accuracy
0.3
0.4
0.2
0.2
0.1
20
80
100
20
40
100
Epoch
Epoch
Flowers102 Test Accuracy
Flowers102 Clean Noisy Train Accuracy
0.4
ACCGuen AcCaaay
9GD
0.5
Accuracy
0.3
0.2
0.0
0.1
-0.5
100
200
300
100
500
0
100
200
300
400
500
Epoch
Epoch
Figure 8: SAM observes higher true accuracy of noisy examples and this corresponds with better test accuracy on Tiny-Imagen ImageNet with 30% label noise and Flower102 with 20% label noise. Do note that contrary to trends in 1I,AR10, in low data settings such as Flowers the test accuracies of SAM and SGD do not drop even when the model starts overfit. Models are ResNet18.
E REGULARIZED SGD UNDER NO LABEL NOISE
Under 0% Label Noise
0.80
iest Accuracy
0.70
0.65
0.60
SAM
0.55
SGD
SGD+Reg
0.50
100
150
200
EDoch
Figure 9: SAM (p = 0.01) and SGD have smaller 8% difference in performance (less in compar- ison to the 20% difference with 30% label noise). Our weight and feature norm penalty observes improvements but only by small factor of 1% and the performance degrades over time.
17

---

Published as a conference paper at ICLR 2024
F ABLATION STUDIES
We observe that the improved benefits of SAM in the label noise setting does not dimish with underparametrization. Furthermore, SGD with large learning rate cannot match SAM's performance.
Test Accuracy LR=0.01 N=100
Test Accuracy LR=0.01 N=300
Test Accuracy LR=0.01 N-500
0.70
0.70
0.70
0.65
0.55
0.53
0.55
620
200
1000
622
Timesheps
Timesteps
Accuracy UR=0000
Accuracy N-0000
Accuracy
0.75
0.75
0.75
0.70
0.70
0.70
0.00
0.400
0.60
0.55
0.50
203
654
200
47/0
1000
0.50
203
650
605
Timestops
Timestops
Timestops
Figure 10: Behavior with number of training examples for linear model/toy Gaussian data with 40% label noise. Linear models trained with different subsets of the toy Gaussian data observe different levels of benefit with SAM. p is scaled between 0.03 and 0.18, bluer curves signifying higher The data is 1000 dimensions. Note that performance improves with SAM even in underparametrized regimes.
Test Accuracy LRm0 001 N=500
Test Accuraty LRm0.01 N=500
Test Acturac LRte, 1 N=500
0.70
0.55
0.05
0.00
0.55
0.50
203
450
635
003
1000
0.30
203
420
600
D00
1000
030
25
50
75
700
125
150
175
350
Tirsstaps
Timesleps
limesleps
Test Accuracy 1R=0. N=500
0.65
0.55
13%
Figure 11: Behavior with learning rate for linear model/toy Gaussian data with 40% label noise As the learning rate increases, we generally observe a slight improvement in early stopping accuracy in both SGD and SAM.
18

---

Published as a conference paper at ICLR 2024
Dataset Size: 10%
Dataset Size: 50%
Dataset Size: 100%
Test Accuracy
0.6
Test Accuracy
0.6
Text Acturacy
0.6
0.5
0.3
SGD
0.3
SCC
0.3
SGD
0.2
SAM
0.2
SAM
0.2
SAM
50
100
150
200
50
300
150
200
50
100
150
200
Epoch
Epach
Epoch
Figure 12: Behavior with number of training examples for ResNet18/IIFAR0 with 30% label noise We compare SGD and SAM trained on different number of training examples (10, 50, 100% of the training data). We see that the difference between SAM (p 0.01) and SGD increases as the dataset size increases.
ResNet18 Number Initial Filters: 16
ResNet18 Number of Initial Filters: 32
ResNet18 Number of Initial Filters:
0.7
0,7
0.7
0.6
0.3
0.3
0.3
SGD
0.2
0.7
0.7
100
300
200 400
100
700
Figure 13: Behavior with model width for ResNet18/CIFARI with 30% label noise ResNetl starts with 64 convolutional filters, and the filters double every two convolutional layers. We reduce the width ResNet18 by 1/2 and 1/4 by starting with 32 and 16 initial number filters, respectively. We see that SAM (p- 0.01) and SGD both improve in terms of performance as model width increases.
Learning Rale:
Learning
Learning 0.05
Learning
Test Accuracy
0.b
0.6
0.8
0.6
0.5
0.4
0.4
0.4
0.4
0.3-
0.3
0.3
0.3
SAM
SAM
SAM
SAM
300
460
200
6
150
200
Epech
Epoch
Epoch
Epoch
Figure 14: Behavior with learning rate for ResNet18/CIFAR10 with 30% label noise. For each learning rate, we choose the best for SAM found by hyperparameter search. As learning rate increases, we observe that both SAM and SGD both improve in terms of performance as learning rate increases. For small learning rate 0.001, found it difficult for SAM observe significant improvements upon SGD unless trained for at least double the time.
19


Reviews:
[{"review_id": "DZpPC17VYe", "reviewer": "Reviewer_ATLV", "summary": "The submission studies early stopping performance of Sharpness-Aware Minimization (SAM) under label noise. The effect of SAM on optimization is first decomposed into a logit term and a Jacobian term. In logistic regression, the Jacobian term is ineffectual and the effect is totally explained by the logit term which upweights the gradients of clean labels and delays fitting the noise. In neural networks, the logit term plays a similar role of reweighting gradients. However, here this term has little effect on the overall performance and the beneficial effects are due to the Jacobian term. A simple theoretical analysis on a two-layer linear network shows that the Jacobian term regularizes the representation and the last layer weights.", "questions": "See Weaknesses 1, 2, and 3.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Understanding the effect of SAM is of paramount interest due to the popularity of this technique. The baselines and the experiments are designed to directly answer the questions. The theory, although rather simple, is not known nor trivial. The related work is adequately covered.", "weaknesses": "The following concerns are the reasons for the low score and I can raise the score if all three are addressed.\n\n**1. Little evidence on the role of early stopping.** Most of the narrative highlights that SAM is especially effective when combined with early stopping. The importance of early stopping in the analysis is emphasized throughout the paper. However, when I look at the ResNet experiments in Fig 1 and 3, early stopping seems to have little to no effect, and the difference in performance is already largely present in the final stage of training. I ask the authors to either provide more evidence on the special role of early stopping or edit the text in the abstract, introduction, and sections 5 and 6 to deemphasize the importance of early stopping. In addition, the presentation of the middle plot in Figure 1 is problematic: The caption says \"SAM fits much more clean data however before beginning to overfit to mislabeled data\" but the evidence is hard to infer from the plot. The revision should present this result more clearly.\n\n**2. Little insight on the effects of the regularization.** Section 4.2 shows that the role of the Jacobian term is similar to a certain regularization on the representation and the final layer weights. The discussion does not properly connect this regularization effect to the overall narrative about robustness to label noise and the role of early stopping. The text below the theory only briefly says \"In linear models, weight decay has somewhat equivalent effects to SAM’s logit scaling in the sense that it balances the contribution of the sample-wise gradients and thus, prevents overfitting to outliers,\" but I did not find any basis for this claim, nor any discussion on the effect of regularizing the representation. \n\n**3. Inadequate empirical support.** The large-scale experiments in the submission are only on Cifar-10. This is not nearly enough for an ICLR publication and hardly supports the claims in the paper. There are many other medium- to large-scale datasets (Tiny ImageNet, ImageNet, MS-COCO, flowers102, places365, food101, etc.) and the revision should include at least one of these datasets (the new dataset should not be too similar to Cifar-10 like Cifar-100 or too small like MNIST). \n\nOther comments:\n- In regression there is a rigorous theoretical framework for studying the role of early stopping on performance under label noise [1,2]. The type of task and label noise in this framework is different from the submission and discussing these tools is outside the scope of this paper but the authors may find them interesting for future work.\n\n[1] Advani, Madhu S., Andrew M. Saxe, and Haim Sompolinsky. \"High-dimensional dynamics of generalization error in neural networks.\" Neural Networks 2020.\n\n[2] Ali, Alnur, J. Zico Kolter, and Ryan J. Tibshirani. \"A continuous-time view of early stopping for least squares regression.\" AISTATS 2019.\n\n-----\nPost-Rebuttal: I raised the score to accept since the original comments have been addressed. Here are a few minor comments for the final version:\n- Section 2.1: The first line defines the input space as R^d and the second line as $\\mathcal{X}$. If the input is always a d-dimensional vector then there is no need for the extra notation $\\mathcal{X}$.\n- Eq 2.1: It seems to me that W is an h by d matrix\n- The new plot in Fig. 1 is a good addition. It's better to reorganize this figure now the reduce the empty space.\n- There is still some extra space at the end of the paper. Bringing some of the results from the appendix to the main paper would be helpful.\n- Eqs 4.1 and 4.3: The derivation of the Jacobian term is not obvious to me. I suggest laying out the one or two intermediate steps either in the main paper or in the appendix. Also, the left-hand side uses a gradient notation even though J-SAM is not the true gradient.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "C0tntVLy4Y", "reviewer": "Reviewer_M3rX", "summary": "This paper provides analysis to understand robustness of SAM to label noise through the lens of implicit regularization. The key idea is that the benefits of SAM can be primarily attributed to the network Jacobian part appearing in the sample-wise gradient. Analysis of the Jacobian term is then provided in simplified settings and empirical experiments are also provided to illustrate the general applicability of the idea (in CIFAR-10 classification).", "questions": "- How does robustness of SAM depend on the network width/number of parameters (d) and number of training samples (n)? Are there additional benefits (or otherwise) that SAM provide in the overparametrized regime (or some non-trivial regimes in terms of n and d)?\n- How does robustness of SAM in the stage of SGD training depends on the learning rate? Does the learning rate need to be small enough  to better isolate the benefits of SAM? \n- Perhaps one could investigate the above  questions in the setting of Section 3.1 and also perform empirical studies on benchmark tasks like CIFAR-10 classification?\n\n\nMinor comments:\n- typos in the formula for $\\epsilon_i$ in Eq. (2.6): $y_i \\mapsto t_i$", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- Provide refreshing insights on robustness of SAM to input labels through the lens of implicit regularization\n- Overall the paper is well written and is easy to follow", "weaknesses": "- No analysis/empirical demonstrations on tasks other than classification are provided (e.g., regression tasks)\n- Missing discussions/analysis on how the robustness benefits depend on parameters such as number of parameters, number of training samples, learning rate , etc. (see also Questions below)\n- Missing some references in Related Work, e.g.: https://arxiv.org/abs/1609.04836, https://arxiv.org/abs/1705.10694", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jZYU4pZxBB", "reviewer": "Reviewer_WpDM", "summary": "This paper examines why SAM has better generalization performance than SGD in the presence of label noise. This phenomenon can't be explained by flatness minimization because the best performance is usually reached before the loss converges. The author decomposed SAM's robustness into two effects, one induced by the logit term and the other induced by changing network Jacobian. In the linear setting, the Jacobian is independent of weight, and the logit effect upweights the gradient of clean examples. In a neural network setting, however, the logit effect is neither necessary nor sufficient for performance improvement. The authors conclude by deriving a regularization method that is cheaper than SAM and can almost recover the benefit of SAM for experiments on CIFAR10.", "questions": "* How would the regularization method perform when there is no label noise present?\n\n* Is the performance gain bring by SAM additive to current robust training algorithm or will this performance gain diminishes when more sophisticated training algorithm than SGD is used?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* **Originality.** Although the robustness of SAM towards label noise has been discussed, this paper shows surprisingly logit effect is in fact not important for this robustness.\n\n* **Clarity.** The paper is well-written and easy to read.\n\n* **Significance.** The paper examines an interesting and important question in understanding SAM.", "weaknesses": "* Equation 4.5 includes a stop gradient operator in a minimization target, which, to the reviewer's knowledge, is a non-standard way of writing. The reviewer would recommend to rephrase into an update rule.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "x7rYxIHpMd", "reviewer": "Reviewer_Cbxh", "summary": "This paper analyzes the label noise robustness of the SAM (Sharpness-Aware Minimization) optimizer. SAM is known to achieve large gains in test accuracy over SGD when there is label noise, but the reasons are not well understood. The authors decompose SAM's sample-wise gradient into a logit term and Jacobian term. In linear models, they show SAM's logit term acts like an explicit reweighting that upweights low-loss (likely clean) examples. However, in neural networks, SAM's gains come primarily from regularization effects induced by the Jacobian term rather than explicit reweighting. The authors analyze the Jacobian term in a 2-layer linear network, showing it induces feature norm regularization. Adding just these implicit regularization terms recovers much of SAM's performance.", "questions": "Does the analysis for 2-layer linear networks provide insights into deep nonlinear networks? What are the limitations?\n\nCould you compare the proposed simplified method to existing techniques like MentorNet?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. Provides theoretical analysis and experiments investigating an important practical phenomenon - SAM's label noise robustness.\n\n2. Careful decomposition and ablation studies (logit vs Jacobian SAM) elucidate the source of gains.\n\n3. Analysis of the Jacobian term shows it induces implicit regularization that aids robustness.\n\n4. Proposes a simplified method motivated by analysis that recovers much of SAM's gains.", "weaknesses": "1. Analysis limited to 2-layer linear networks, unclear if insights extend to deep nonlinear networks.\n\n2. Lacks comparison to other label noise robust methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)