Leveraging Unlabeled Data to Track Memorization
Authors: Mahsa Forouzesh
Hanie Sedghi
Patrick Thiran
Venue: ICLR 2023 poster (2023)
Keywords: memorization
label noise
generalization
unlabeled data
deep learning

Abstract: Deep neural networks may easily memorize noisy labels present in real-world data, which degrades their ability to generalize. It is therefore important to track and evaluate the robustness of models against noisy label memorization. We propose a metric, called $\textit{susceptibility}$, to gauge such memorization for neural networks. Susceptibility is simple and easy to compute during training. Moreover, it does not require access to ground-truth labels and it only uses unlabeled data. We empirically show the effectiveness of our metric in tracking memorization on various architectures and datasets and provide theoretical insights into the design of the susceptibility metric. Finally, we show through extensive experiments on datasets with synthetic and real-world label noise that one can utilize susceptibility and the overall training accuracy to distinguish models that maintain a low memorization on the training set and generalize well to unseen clean data. 

Published as a conference paper at ICLR 2023
LEVERAGING UNLABELED DATA TO TRACK MEMORIZATION
Mahsa Forouzesh', Hanie Sedghi", Patrick Thiran' 'École Polytechnique Fédérale de Lausanne Google Research, Brain Team (mahsa. forouzesh, patrick, thinkk/ wwpfl......o..ee....e ch, hsedgghi@goolle.com
ABSTRACT
Deep neural networks may casily memorize noisy labels present in real-world data, which degrades their ability to generalize. It is therefore important track and evaluate the robustness of models against noisy label memorization. We propose metric, called susceptibilityy gauge such memorization for neural networks. Susceptibility is simple and easy to compute during training. Moreover, it does not require access to ground-truth labels and only uses unlabeled data. We empir- ically show the effectiveness of our metric in tracking memorization on various architectures and datasets and provide theoretical insights into the design of the susceptibility metric. Finally, we show through extensive experiments on datasets with synthetic and wolldwrldd label noise that one can utilize susceptibility and the overall training accuracy to distinguish models that maintain low memorization on the training set and generalize well to unseen clean data.
INTRODUCTION
Deep neural networks are prone to memorizing noisy labels in the training set, which are inevitable in
many real world applications (Frénay& & Verleysen 2013] Zhang et al. 2016 Arpit al.] 2017 [Son et al. 2020a Nigam et al. 2020 Han et al. (020)] Zhang et al. 2021a Wei et al. [202]. Given a new dataset that contains clean and noisy labels, one refers the subset the dataset with correct labels (respectively, with incorrect labels due to noise), as the clean (respectively, noisy) subset. When neural networks are trained on such dataset, is important find the sweet spot from no fitting at all to fitting every sample. Indeed, fitting the clean subset improves the generalization performance of the model (measured by the classification accuracy on unseen clean data). but fitting the noisy subset, referred to as "memorization" degrades its generalization performance. New methods have been introduced to address this issue (for example, robust architectures (Xiao et al.) 2015 [.i et al. 2020). robust objective functions (Li ct al.) 2019 Ziyin et al. 2020), regularization techniques (Zhang ct al. 2017 Pereyra et al. 2017 Chen et al., 2019 Harutyunyan et al.) 2020)), and sample selection methods (N [gguyen 2019)), but their effectiveness cannot be assessed without oracle access to the grruhd-truth labels to distinguish the clean and the noisy subsets, or without a clean test set.
Our goal in this paper is to track memorization during training without any access to ground-tree -tuth labels. To do so, we sample a subset of the input data and label uniformly at random from the set of all possible labels. The samples can be taken from unlabeled data, which is often easily accessible, or from the available training set with labels removed. This new held-out randomly-labeled set is created for evaluation purposes only, and does not affect the original training process.
First, we compare how different models fit the held-out randomly-labeled set after multiple steps of training on it. We observe empirically that models that have better accuracy on unseen clean test data show more resistance towards memorizing the randomly-labeled set. This resistance is captured by the number of steps required fit the held-out randomly-labele set. In addition, through our theoretical convergence analysis on this set, we show that models with high/low test accuracy are resistant/susceptible memorization, respectively.
FFitting samples that have incorrect random labels is done by memorizing the assigned label for each particular sample. Hence, we refer it memorization, similar spirit as Feldman & 7hang 2020

---

Published as a conference paper at ICLR 2023
Tan Coon
Improvas Test Acturacy
Desirable Mocel
sers
Oracle
Lobel:
effdinnd net
222
High reanabitty
ICt Act
Label
Epeors
ACC
Fit on the Nolty Subset
Tran ACC holoy
Epechs
Train ACC Voosy
Degrades Test Accuracy
Delisoet Labai Corract
Ebochss 20
Low memorization
Our Metric
Practice
de isonet
efficien iencevt
Train ACC
Datasel Label - Bird Correct Label =?
Assign Random Label wx Cat
216
Memorication is delected for demeenel
Susceptibillly g
Dargner Label Deor Correct Label +?
Assign Randor Label ** Dog
Figure 1: Models trained CIFAR-IO with 50% label noise. Top (Oracle access ground-truth labels): We observe that the on the clean subset the training set (shown in the top left) and the fit on the noisy subset (located below the on the clean subset) affect the predictive performance (measured by the classification accuracy) on unseen clean test data differently. Fitting the clean (resp.. noisy) subset improves (resp.. degrades) test accuracy, as shown by the green (resp., red) arrow. With oracle access ground-truth label, one can therefore select models with a high on the clean subset and low fit on the noisy subset, as it is done in the top right to find desirable models, Bottom (Our approach in practice): In practice however, the ground-truth label, and hence the fit on the clean and noisy subsets are not available. In this paper, we propose the metric called susceptibility ( to track the fit on the noisy subset of the training set. Susceptibility is computed using mini-batch of data that are assigned with random labels independently from the dataset labels. We observe strong correlation between susceptibility and memorization. Morcover, the susceptibility metric together with the training accuracy on the entire set, is used to recover models with low "memorization" (low on the noisy subset) and high "trainability" (high fit on the clean subset) without any ground-truth label oracle access. The average test accuracy of models in the top-left rectangle of the right figures are 77.93=4 % and 76.15% 15. for the oracle and approach, respectively. Hence, our method successfully recovers desirable models.
Building on this result, we then propose an cas-too-omppue metric that we call susceptibility to noisy labels, which the difference in the objective function of a single mini-batch from the held-out randomly-labelo set, before and after taking an optimization step it. At each step during training, the larger this difference is, the more the model is affected by (and therefore susceptible to) the noisy labels in the mini-batch Figure I (bottom left) provides illustration of the susceptibility metric. We observe a strong correlation between the susceptibility and the memorization within the training set, which is measured by the fit the noisy subset. We then show how one utilize this metric and the overall training accuracy to distinguish models with a high test accuracy across a variety of state-of-the-art deep learning models, including DenseNet (Huang al. 2017). EfficientNet Tan & Le| 2019), and ResNet (He et al. (2) architectures, and various datasets including synthetic and real-world label noise (Clothing- IM, Animal-ION, CIFAR-ION, Tiny ImageNet, CIFAR-I00 CIFAR-10, 10, MNIST, Fashion-MNIST, and SVHN), see Figure (right). Our main contributions and takeaways are summarized below:
1. We empirically observe and theoretically show that models with a high test accuracy are resistant to memorizing a randomly- llbbled held-out set (Sections (
2. We propose the susceptibility metric, which is computed of the available data. Our extensive experiments show that susceptibility closely tracks memorization of the noisy subset of the training set (Section 3).
randomly-labeled subset
3. We observe that models which are trainable and resistant to memorization, i.e., having a high training accuracy and a low susceptibility, have high test accuracies. We leverage this observation to propose a model-selection method in the presence of noisy labels (Section 4
4. We show through extensive experiments that our results are persistent for various datasets, architectures, sypee--paramtery label noise levels, and label noise types (Section 6).
2

---

Published as a conference paper at ICLR 2023
Prediction
Network1
deer
cat
others
Network2
25
50
75
100
125
150
175
200
Epochs (k)
The evolution of output prediction of two neural networks during training on single sample with a wrong audoolly-asiggne label (assigned label is "cat" while ground-truth label is "deer") versus the number of epochs (steps) k. Network1 is a Googl.eNet (Szegedy et al. 2015) (pre-)trained on CIFAR-10 dataset with clean labels and has initial test accuracy of 95.36%. Network2 is GoogL.eNet (pre-)trained on CIFAR- dataset with 50% label noise level and has initial test accuracy of 58.35%. Network2 has a lower test accuracy compared to Network1, and we observe that it memorizes this new sample after only & = 2 steps. In contrast, Network1 persists in predicting the correct output for this sample for longer, and memorizes the new sample only after k = 99 steps. More examples and an ablation study on the effect of calibration are given in Figures 12
Figure 2:
and 14 in Appendix D respectively.
Related work Garg et al. (2021a) show that for models trained on a mixture of clean and noisy data, low accuracy on the noisy subset of the training set and high accuracy on the clean subset of the training set guarantee a low generalization error. With oracle access to the ground-truth labels to compute these accuracies, one can therefore predict which models perform better on unseen clean data. This is done in Figure (Oracle part). However, in practice. there is no access to ground-truth labels. Our work therefore complements the results of (Garg et al., 2021a) by providing a practical approach (see Figure [ ( (Practice part)). Moreover, both our work and (Zhang et al. (2019c) emphasize that a desirable model differentiates between fitting clean and noisy samples. Zhhang al.] (2019c) showcase this intuition by studying the drop in the training accuracy of models trained when label noise is injected in the dataset. We do it by studying the resistance/usseetibillly of models to noisy labels of held-out set. Zhang et al. (2019c) only study the training accuracy drop for settings where the available training set is clean. However, when the training set is itself noisy, which is the setting of interest in our work, we observe that this training accuracy drop does not predict memorization, unlike our susceptibility metric (see Figure D (left) in Appendix[A) (A). Furthermore, even though the metric proposed in Lu & Hc (2022) is rather effective an early stopping criterion, it is not able to track memorization, contrary to susceptibility (see Figure T (middle)). For thorough comparison to other related work refer to Appendix
2 GOOD MODELS ARE RESISTANT TO MEMORIZATION
Consider models fw(x) with parameter matrix W trained on a dataset S {xx, y)) which is collection of n input-output pairs that are drawn from data distribution D over X x y in multi-class classification setting. We raise the following question: How much are these models resistant/uusceptbble to memorization of new low -ww-lab--quality (noisy) dataset when they are trained on it? Intuitively, we expect a model with a high accuracy on correct labels to stay persistent on its predictions and hence to be resistant to the memorization of this new noisy dataset. We use the number of steps that it requires to fit the noisy dataset, as measure for this resistance. The larger this number, the stronger the resistance (hence, the lower the susceptibilitt). In summary, we conjecture that models with high test accuracy on unseen clean data are more resistant to memorization of noisy labels, and hence take longer to fit a randomly-labele
held-out set.
To mimic a noisy dataset, we create set with random labels. More precisely, we define a randomly- labeled held-outset of samples š { K.) which is generated from ñ unlabeled samples {x.) X' that are either accessible, or are subset of (x:]r. 1n. The outputs S of dataset S are drawn independently (both from each other and from labels in S) and uniformly at random from the set of possible classes. Therefore, to fit. S, the model needs to memorize the labels. We track the fit (memorization) of model on S after le optimization steps on the noisy dataset S.
We perform the following empirical test. In Figure 2 we compare two deep neural networks. The first one has high classification accuracy on unseen clean test data, whereas the other has low
3

---

Published as a conference paper at ICLR 2023
test accuracy. We then train both these models single sample with incorrect label ($ contains a single incorrectly- long time (in terms of number of training steps) to fit this sample; hence this model is resistant to memorization as the number of steps required fit S is large. In contrast, the model with a low test accuracy memorizes this sample after taking only few steps; hence this model is susceptible to memorization as k required to fit S is smal This observation reinforces our intuition, that good models, measured by a high test accuracy, are more resistant to memorization of noisy labels.
sample). We observe that the model with a high test accuracy takes a
Next, we further validate this observation theoretically by performing convergence analysis on the held-out set SS, where the input samples {x: of S are the same the inputs of dataset S (and hence = n)). We consider the binary-classfficttio setting. The output vector y = (. ),)" is a vector of independent random labels that take values uniformly in {-1,1). Therefore, creating this dataset S does not require extra information, and particular no access the data distribution D. Consider the network fw(x) as two-layer neural network with ReLU non-linearity (denoted by (a) = max (x, 0}) and m hidden-unine
m Σ
fw(()
vm 0, ( x):
where x E Rd is the input vector, W (W1,-.- Wm) E Rdxm (01, 4m) I the weight matrix of the first layer, and the weight vector of the second layer, respectively. For simplicity. the outputs associated with the inputs {x,] are denoted by vector fw R" instead of {.f (x.))
The first layer weights are initialized as (0) A (0, x²1) Vr [m]] where 0 K S is the magnitude of initialization and N denotes the normal distribution. a,S are independent random variables taking values uniformly in {-1, 1}, and are considered be fixed throughout training.
We define the objective function on datasets S and S, respectively, as
1 Φ< ((W) - ffw y11
(fw(x.)) vi) ((W) = 2 Σ (/w(x:) -g:)²
m
(1)
2
Label noise level (LNL) of S (and accordingly of the label vector y) is the ratio /n, where n; is the number of samples in S that have labels that are independently drawn uniformly in { 1, 1]. and the remaining n which is the clean dataset, and with LNL = 1, which is a dataset with entirely random labels.
samples in S have the ground-truth label. The two extremes are S with LNL 0,
To study the convergence of different models on S, we compute the objective function क (W) after steps of training on the dataset S. Therefore, the overall training/evaluation procedure is as follows; for [m]. the second layer weights of the neural network are updated according gradient descent:
-- O (W(t))
wr + 1) (t)
Ow,
where for 0 S t k: क5 Φ and for k St 1s k: T T. whereas 17 is the learning rate. Note that we refer to @ (f)) (t) and (W(()) as (t)-
When a model fits the set 5, the value of + becomes small, say below some threshold 8. The resistance of a model to memorization (fit) on the set S then measured by the number of steps Te* (E) such that (Ak + A>) < for To > (e). The larger (respectively, smaller) k- is, the more the model is resistant (resp, susceptible) to this memorization. We can reason on the link between good model and memorization from the following proposition.
Proposition (Informal). The objective function at step + a decreasing function of the label noise level (LNL) in S. and of the number of steps k.
è Interestinnly, we observe that the situation is different for a correctly- labeled sample. Figure 13 in Ap- pendix D shows that models with higher test accuracy typically fit unseen correctly-labeled sample faster than models with lower accuracy.
4

---

Published as a conference paper at ICLR 2023
100
Train ACC Noiay
Susceptibiiity ga
80
0.3
chn
resnext
60
0.2
densenet
shuft enetv2 simpledia
40
efficientnet
0.1
resnet
20
0.0
50
100
150
200
Epochs
Epochs
Figure 3: Accuracy the noisy subset of the training versus susceptibility <()) (Equation (2) for deep convolutional neural networks (ranging from 5 layee ean more sophisticated structures such as EfficientNet (Tan & Le 2019)) trained on CIFAR-10 with 50% label noise. We observe a strong Pearson correlation coefficient between Train ACC Noisy and ((f): = 0.884.
Proposition yields that models trained on S with a low LNL (which are models with high test accuracy on clean data) push ( + k) to become large. The number of steps k* (:) should therefore be large for & become less than these models resist the memorization of S. Conversely, models trained on S with a high LNL (which are models with a low test accuracy), allow for k* (e) to be small and give rapidly to the memorization of S. These conclusions match the empirical observation in Figure 2 and therefore further support the intuition that good models are resistant to memorization. Please refer to Section for the formal theoretical results that produce Proposition !
3 EVALUATING RESISTANCE TO MEMORIZATION
In Section 2 we showed that desirable models in terms of high classification accuracy unseen clean data are resistant to the memorization a randomly-labeled set. In this section, we describe a simple and computationally efficient metric to measure this resistance. To evaluate it efficiently at each step of the forward pass, we propose to take a single step on multiple randomly labeled samples, instead of taking multiple steps single randomly labeled sample (as done in Figure 2). To make the metric even more computationally efficient, instead of the entire randomly labeled set S (as in our theoretical developments), we only take a single mini-batch of S. For simplicity and with some abuse of notation, we still refer to this single mini-batch as S.
To track the prediction of the model over multi- ple samples, we compare the objective function on before and after taking a single optimiza- tion step on it. The learning rate, and its sched- ule, have direct effect on this single optimiza- tion step. For certain learning rate schedules, the learning rate might become close to zero (e.g.. at the end of training), and hence the magnitude of this single step would become too small to be informative. To avoid this, and to account for the entire history of the optimization trajectory?) we compute the average difference over the learning trajectory (a moving average). We propose the following metric, which we call susceptibility to noisy labels, ((1). At step l of training,
Algorithm 1 Computes the susceptibility noisy labels Ç
1: Input: Dataset S, Number of Epochs T
2: Sample a mini-batch Š from S; Replace its labels with random labels
3: Initialize network fw(o)
4: Initialize ((0) =0
5: for = 1,... T do
6: Update fw(r) from Sw(r-1) using dataset S
7: Compute T (W()))
8:
Update fw(+1) from fw(1) using dataset Š
9: Compute ((W(t+ +1) 1))
10: Compute (()) { (1- 1)((1 1) +
=(t)= = Σ Th (W(T)
3े (w (w(++1))
((W(t)) क6 (W((+ ((W(++ 17)]
11: end for
where W (7). W (T 1) are the model param- eters before and after a single update step on S. Algorithm describes the computation of Ç.
12: Return Ç.
'he importance of the entire learning trajectory including its early phase is emphasized in prior work such Jastrzebski al. 2020)
5

---

Published as a conference paper at ICLR 2023
100
80
Test ACC
Test ACC
40
20
0.608
20
= 0.951
20
40
60
80
100
%
20
40
60
80
100
Train ACC
Train ACC
(a) Test accuracy versus train accuracy for all models at all epochs
(b) Test accuracy versus train accuracy for models that have ((t) < 0.05
Figure 4:
The effect of filtering the models based on the susceptibility metric ((t) for models trained on CIFAR-10 with 50% label noise. We observe that by removing models with high value of ((t), the correlation hetween the training accuracy (accessible to in practice) and the test accuracy (not accessible) increases lot, and we observe that among the selected models, higher training accuracy implies higher test accuracy. Refer to Figures [ 2 26 for similar results on 5 other datasets. We use threshold such that half of the models have Ç < threshold and hence remain after filtration.
The lower (tt) is, the less the model changes its predictions for S after single step of training and thus the less it memorizes the randomly-labele samples. We say therefore that a model is resistant (to the memorization of aadomly-llablles samples) when the susceptibility to noisy labels ((t) is low.
Susceptibility ( tracks memorization for different models The classification accuracy of a model on set is defined as the ratio of the number of samples where the label predicted by the model matches the label on the dataset, to the total number of samples. We refer to the subset for which the dataset label is different from the ground-trute label as the noisy subset of the training set. Its identification requires access to the ground-truth label. Recall that we refer to memorization within the training set as the fit on the noisy subset, which is measured by the accuracy on it. We call this accuracy "Train ACC. Noisy" in short. In Figure 3 we observe a strong positive correlation between the memorization of the held-out randomly labeled set, which is tracked by ((t) (Equation (2) and the memorization of noisy labels within the training set, tracked by Train ACC Noisy. Susceptibility S, which is computed on a mini-batch with labels independent from the training set, can therefore predict the resistance memorization of the noisy subset of the training set. In Figure we show the robustness of susceptibility ( to the mini-batch size, and to the choice of the particular mini-batch.
Susceptibility ( tracks memorization for single model It is customary when investigating different capabilities of model, keep checkpoints/snapshotss during training and decide which one to use based on the desired property, see for example (Zhang et al. 2019a] Chatterji et al. 2019 Neyshabur et al., 2020 Andreassen al., [021 Baldock et al. (021)) With access to ground- labels, one can track the fit on the noisy subset of the training set to find the model checkpoint with the least memorization, which is not necessarily the end checkpoint, and hence an carly-stopped version of the model. However, the ground-truth label is not accessible in practice, and therefore the signals presented in Figure 3 (left) are absent. Moreover, as discussed in Figure 7 the training accuracy on the entire training set is also not able to recover these signals. Using susceptibility Ç. observe that these signals can be recovered without any ground-truth label access, as shown in Figure 3 (right). Therefore, Ç can be used to find the model checkpoint with the least memorization. For example, in Figure 3 for the ResNet model, susceptibility Ç suggests to select model checkpoints before it sharply increases, which exactly matches with the sharp increase in the fit on the noisy subset. On the other hand, for the MobileNet model, susceptibility suggests to select the end checkpoint, which is also consistent with the selection according to the on the noisy subset.
4 GOOD MODELS ARE RESISTANT AND TRAINABLE
When networks are trained on dataset that contains clean and noisy labels, the fit on the clean and noisy subsets affect the generalization performance of the model differently. Therefore, as we observe in Figure 4a for models trained on a noisy dataset (details are deferred to Appendix B the

---

Published as a conference paper at ICLR 2023
150
125
Train ACC
Reglon1
Region2
ww|lL
100
DL--03
+
75
50
Region
Region4
2000
6000
Epoch (k)
Susceptibility 5(0)
For models trained on CIFAR- 10 with 50% label noise, using the average values of {(t) and of the training accuracy over the available models can obtain 4 different regions. Region 1: Trainable and resistant, with average test accuracy of 76%. Region 2: Trainable but not resistant, with average test accuracy of 70.59%. Region 3: Not trainable but resistant, with average test accuracy of 52. 42.. Region 4: Neither trainable resistant, with average test accuracy of 58. 58.23%. We observe that the models in Region generalize well on unseen data, as they have a high test accuracy.
Figure 5:
Figure 6: The lower (dashed lines) and upper (solid lines) bound terms of Theorem 2 that de- pend on the label noise level (LNL). They are computed from the eigenvectors and eigenval- ues of the Gram-matrix for 1000 samples of the MNIST dataset, computed over random draws computed with hyper-parameters 7 = 10 -. k = 10000 and 0.05. We observe the bounds in Theorem 2 are decreasing func- tion of LNL.
correlation between the training accuracy (accuracy on the entire training set) and the test accuracy (accuracy on the unseen clean test set) is low. Interestingly however, we observe in Figure (4b) that if we remove models with a high memorization susceptibility to noisy labels {(t). then the correlation between the training and the test accuracies increases significantly (from p = 0.608 of ((L) have a good generalization performance: a higher training accuracy implies a higher test accuracy. This is especially important in the practical settings where we do not know how noisy the training set is, and yet must reach a high accuracy on clean test data.
the noisy subset, as indicated by a large
0.951), and the remaining models with low values
After removing models with large values of ((t), we select models with low label noise memo- rization. However, consider an extreme case: a model that always outputs a constant is also low at label noise memorization, but does not learn the useful information present in the clean subset of the training set either. Clearly, the models should be "trainable" on top of being resistant to memorization. "trainable model" a model that has left the very initial stages of training, and has enough capacity to learn the information present in the clean subset of the dataset to reach high accuracy on it. The training accuracy on the entire set is a weighted average of the training accuracy on the clean and noisy subsets. Therefore, among the models with a low accuracy the noisy subset (selected using susceptibility Ç in Figure 4b). we should further restrict the selection to those with a high overall training accuracy, which corresponds to high accuracy on the clean subset.
We can use the two metrics, susceptibility to noisy labels (() and overall training accuracy, to partition models that are being trained some noisy dataset in four different regions using their average values, as shown in Figure 5 Region 1: Trainable and resistant to memorization, Region Trainable but not resistant, Region 3: Not trainable but resistant, and Region 4: Neither trainable resistant. Note that the colors of each point, which indicate the value of the test accuracy are only for illustration and are not used find these regions. The average test accuracy is the highest for models in Region (i.e., that are resistant to memorization on top of being trainable). In particular, going from Region 2 to Region increases the average test accuracy of the selected models from 70. to 76%. i.e., a 7.66% relative improvement in the test accuracy. This improvement is consistent with other datasets as well: 6.7% for Clothing- 1M (Figure 29a). 4.2% for Animal- 1ON (Figure 29b). 2.06% for 1ON (Figure (Figure(29c). 31.4% for noisy MNIST (Figure 15 33% for noisy Fashion-MNIST
(Figure 17 ,, 33.6% for noisy SVHN (Figure 19p. 15. % for noisy CIFAR-100 (Figure 22 and 8%
for noisy Tiny ImageNet (Figure 25 datasets (refer to Appendix for detailed results).
Comparison with noisy validation set: Given dataset containing noisy labels, correctly- labeled validation set is not accessible without ground-truth label access. One can however use subset of the available dataset and assess models using this noisy validation set. An important advantage of our approach compared to this assessment is the information that it provides about the memorization within the training set, which is absent from performance test noisy
7

---

Published as a conference paper at ICLR 2023
validation set. For example, in Figures 34a and 35a we observe models (on the very top right) that have memorized 100% of the noisy subset of the training set, and yet have a high test accuracy. However, some models (on the top middle/left part), which have the same fit on the clean subset but lower memorization, have lower or similar test accuracy. Even the test accuracy was therefore not able to compare these models in terms of memorization. For more details, refer Appendix [
Moreover, as formally discussed in (Lam & Stork 2003), the number of noisy validation samples that are equivalent to a single clean validation sample depends on the label noise level of the dataset and on the true error rate of the model, which are both unknown in practice, making it difficult to pick an acceptable size for the validation set without compromising the training set. If we use a small validation set (which allows for a large training set size), then we observe a very low correlation between the validation and the test accuracies (as reported in Table and Figure T0 Appendix CC. In contrast, our approach provides much higher correlation to the test accuracy. We also conducted experiments with noisy validation sets with larger sizes and observed that the size of the noisy our
validation set would need to be increased around ten-fold to reach the same correlation approach. Increasing the size of the validation set removes data out of the training set, which may degrade the overall performance, whereas our approach leaves the entire available dataset for training.
5 CONVERGENCE ANALYSIS
In this section, we elaborate on the analysis that leads to (the informal) Proposition | A matrix, a vector and scalar are denoted respectively by A, a, and a. The identity matrix denoted by I. The indicator function of random event A is denoted by I(AA) The (2,5) th entry of Matrix A is Aij.
and ly] S for (x. y) D X y. where X' Rdd and y R. For input samples {x: the n x Gram matrix H has entries
Consider the setting described in Section 2 with ||I|||
[ x ( x; 2 0, w x 0}] xTxx, (x arccos (xT x,)) Vi,j E [n], (3)
1 Ew-
2x
and its eigen-dccooposition H Σi= A.v.v," where the eigenvectors v; E R" are orthonormal and λ min H- Using the eigenvectors and eigenvalues of H we have the following theorem.
Theorem 1. For = O
evōdo na/2
m = Ω ( >ge=x=81) ) and 17 O (~2) ) with probability at least
1 - over the random parameter initialization described in Section 2 we have:
a T v. (1 - ----)))** vTy] (1 11-,,,,22 +c.
( =
The proof is provided in Appendix y
Theorem enables us approximate the objective function on dataset 5 (Equation as follows:
( + k)) ~
1
Σ ps -1- Ps (1-1),,)22 22
(4)
where p5- = v.Ty y and p3 = v y.
Let us define
Σ i=1
E [p?] | (1-
m2dd) m
(1-
n,,)
Σ = Varp.p
( + R3)
(5)
We numerically observe that /// / E are both decreasing functions of the label noise level
(LNL) of the label vector y. and of le (see Figures 6 and 40 values of the learning rate 7), number of steps k. and datasets). The approximation in Equation together with the above observation then yields the following lower and upper bounds for 2 + k).
41 42 43 in Appendix K for different
Theorem 2. With probability least - 8 over the draw of the random label vector y. given the approximation made in Equation
1
Σ (k + R.)
<
Σ
(1
n7n 26
1 <
+
(6)
2
8
2
2
8
1=1
8

---

Published as a conference paper at ICLR 2023
The proof is provided in Appendix K Because the term Σx=1 (1 - -)2, 2h
is independent of LNL of the label vector y. we can conclude that ( + k) is decreasing function of LNL. Moreover, Since O < 1 - n < 1, the term Σ
j== (1 n,,,) 2 is also a decreasing function of k. Therefore, similarly,
we can conclude that ( k) is a decreasing function of k. Proposition summarizes this result.
ON THE GENERALITY OF THE OBSERVED PHENOMENA
In this section, we provide additional experiments that show our empirical results hold across different choices of dataset, training and architecture design as well as label noise level and form.
we provide a walk- talk-thhouuhh on how to use our method for real-world noisy-labeled datasets Clothing- IM. Animal-10N and CIFAR- 10N. Our results consistently hold for MNIST, Fashion MNIST, SVHN, CIFAR-100, and Tiny ImageNet datasets; see Figures 15 29
Dataset: In Appendix E.I
Learning rate schedule: Our results are not limited to a specific optimization scheme. In our experiments, we apply different learning rate schedules, momentum values, and optimizers (SGD and Adam) (for details see Appendix B More specifically, we show in Figure 33 (in Appendix F)) that the strong correlation between memorization and our metric (() stays consistent for both learning rate schedulers cosineanneal ing and exponential.
Architecture: Results of Sections 3 and 4 are obtained from a variety of architecture families, such
as DenseNet (Huang et al.] 2017). MobileNet (Howard et al. 2017). VGG (Simonyan & Zisserman 2014), and ResNet (He et al. 2016a). For the complete list of architectures, see Appendix B We observe that ((t) does not only detect resistant architecture families (as done for example in Figure 3 but that is also able to find the best design choice (e.g., width) among configurations that are already
resistant, see Figure 30 in Appendix F
Low label noise levels: For models trained on CIFAR-10 and CIFAR-100 datasets with 10% label noise (instead of 50%). we still observe high correlation between accuracy on the noisy subset and (()) in Figures 32 and 33 in Appendix FF. Moreover, we observe in Figures 34 and (35 in Appendix
that the average test accuracy of the selected models using our metric is comparable with the average test accuracy of the selected models with access to the ground-truie label.
Asymmetric label noise: In addition the real-world label noises and synthetic symmetric label noise, we have also performed experiments with synthetic asymmetric label noise as proposed in (Xia et al., 2021). Using our approach, the average test accuracy of the selected models 66.307% whereas the result from oracle is 36.793% (see Figure 38 in Appendix
7 CONCLUSION
We have proposed a simple but surprisingly effective approach to track memorization of the noisy subset of the training set using a single mini-batch of unlabeled data. Our contributions are three-fold. First, we have shown that models with high test accuracy are resistant to memorization of held-out randomly-labeled set. Second, we have proposed a metric, susceptibility, to efficiently measure this resistance. Third, we have empirically shown that one can utilize susceptibility and the overall training accuracy to distinguish models (whether they are a single model at various checkpoints, or different models) that maintain low memorization clean data while bypassing the need to access the ground-truth label. We have studied model selection in variety of experimental settings and datasets with label noise, ranging from selecting the "best" models from "good" models (for easy datasets such as Animal-1ON) to selecting "good" models from "bad" models (for more complex datasets such as Clothing-IMM
the training set and generalize well unseen
Our theoretical results have direct implications for online settings. When the quality of the labels for new data stream is low, Theorem T can directly compare how different models converge on this low quality data, and help in selecting resistant models, which converge slowly on this data, Our empirical results provide new insights on the way models memorize the noisy subset of the training set: the process is similar to the memorization of purely randomly- held-out set. Finally, an important direction for future work to study how susceptibility performs as regularizer.

---

Published as a conference paper at ICLR 2023
Ethics Statement: This work is foundational investigation into the theory of deep learning. We believe our submission does not raise ethical concerns. We use open public datasets and implementa- tions. Our study does not involve human subjects, potentially harmful insights, potential conflicts of interest and sponsorship, discriiination/iasfffireess concerns, privacy and security issues, legal compliance, and research integrity issues.
The source code to reproduce our results is available in the supple- mentary material. All the datasets and architectures used in this paper are publicly available and properly cited. Reproducibility of all our experiments is ensured by providing the experimental setup details in Appendix The data processing steps are provided both in Appendix and in the source code. The assumptions and preliminaries needed for the proofs of our theoretical results are provided in Appendix G
Reproducibility Statement:
The proofs are provided in Appendices
and K
Acknowledgement: We thank Chiyuan Zhang and Behnam Neyshabur for their valuable feedback on the draft of this work. We would also like to thank anonymous reviewers, area chairs, and program chairs for their constructive comments, which helped us to improve the quality of this paper.
REFERENCES
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. leee Access, 6:14410-14430, 2018.
Zeyuan Allen-Zhu, Yuanzhi Li, and Yingyu Liang. Learning and generalization in overparameterized neural networks, going beyond two layers. arXiv preprint arXiv: 18100048, 2018.
Anders Andreassen, Yasaman Bahri, Behnam Neyshabur, and Rebecca Roclofs. The evolution of out-of-distribution robustness throughout fine-tuning. arXiv preprint ar6iv:2106. 2021.
Sanjeev Arora, Simon Du Wei Hu, Zhiyuan Li, and Ruosong Wang. Fine-grained analysis of optimization and generalization for overparameterized two-layer neural networks. International Conference Machine Learning, pp. 322-332. PMLR, 2019.
Devansh Arpit, Stanislaw Jastrzębski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S Kanwal, Tegan Maharaj. Asja Fischer, Aaron Courville, Yoshua Bengio, et closer look at memorization in deep networks. In International Conference Machine Learning, pp. 233-242.
PMLR, 2017.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pp. 283. PMLR, 2018.
Robert Baldock, Hartmut Maennel, and Behnam Neyshabur. Deep learning through the lens of example difficulty. Advances in Neural Information Processing Systems, 34, 2021.
Alberto Bietti and Julien Mairal. On the inductive bias of neural tangent kernels. arXiv preprint arXiv: 0ttp//995.22755 12173, 2019.
Gavin Brown, Mark Bun, Vitaly Feldman, Adam Smith, and Kunal Talwar. When is memorization of irrelevant training data necessary for high-accuracy learning? In Proceedings of the 53rd Annual ACM SIGACT Symposium Theory of Computing, pp. 123-132, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39-57. IEFE, 2017.
Satrajit Chatterjee. Coherent gradients: An approach to understanding generalization in gradient descent-based optimization. arXiv preprint arXiv:2002.10657) 2020.
Niladri S Chatterji, Behnam Neyshabur, and Hanie Sedghi. The intriguing role of module criticality in the generalization of deep networks. arXiv preprint arXiv:1912.0055: 2019.
Pengfei Chen, Ben Ben Liao, Guangyong Chen, and Shengyu Zhang. Understanding and utilizing deep neural networks trained with noisy labels. In International Conference on Machine Learning, pp. 1062-1070. PMLR, 2019.
10

---

Published as a conference paper at ICLR 2023
Pengfei Chen, Junjie Ye, Guangyong Chen, Jingwei Zhao, and Pheng-Ann Heng. Robustness of accuracy metric and its inspirations in learning with noisy labels. In Proceedings of the AAAI Conference Artificial Intelligence, volume 35, pp. 11451-11461, 2021.
Simon S Du, Xiyu Zhai, Barnabas Poczos, and Aarti Singh. Gradient descent provably optimizes over-paramettrized neural networks. arXiv preprint arXiv:1810.02055 2018.
Vitaly Feldman. Does learning require memorization? a short tale about a long tail. In Proceedings of the 52nd Annual ACM SIGACT Symposium Theory of Computing, pp. 954 954,959, 2020.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. arXiv preprint arXiv:2008.0311 037003 2020.
Benoît Frénay and Michel Verleysen. Classification in the presence label noise: a survey, IEEE transactions neural networks and learning systems, 25(5):845-86) 869, 2013.
Saurabh Garg, Sivaraman Balakrishnan, J Zico Kolter, and Zachary C Lipton. Ratt: Leveraging unlabeled data to guarantee generalization. arXiv preprint arXiv:2105.00303 2021a.
Saurabh Garg, Sivaraman Balakrishnan, Zachary Chase Lipton, Behnam Neyshabur, and Hanie Sedghi. Leveraging unlabeled data to predict out-of-distrion distribtiitiittionnn performance. In NeurIPS 2021 Workshop on Distribution Shifts: Connecting Methods and Applications, 2021b.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6577 2014.
Jindong Gu and Volker Tresp. Neural network memorization dissection. arXiv preprint arXiv:1911.09537, 2019.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International Conference Machine Learning, pp. 1321-1330. PMLR, 2017.
Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversarial attacks. In International Conference on Machine Learning, pp. 2484-2493.
PMLR, 2019.
Bo Han, Quanming Yao. Tongliang Liu, Gang Niu, Ivor W Tsang, James T Kwok, and Masashi Sugiyama. A survey label-noise representation learning: Past, present and future. arXiv preprint arXiv:2011.04406, 2020.
Hrayr Harutyunyan, Kyle Reing, Greg Ver Steeg, and Aram Galstyan. Improving generalization by controlling label-noise information in neural network weights. International Conference on Machine Learning, pp.
PMLR, 2020.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pp. 630-645. Springer. 2016b.
Andrew Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint (TX.vv:70440466// 2017.
Jie Hu, Shen, and Gang Sun. Squeeze-and-excitaae networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 7132-7141, 2018.
Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Weinberger. Densely connected convolutional networks. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700 4708, 2017.
Forrest N landola. Song Han, Matthew W Moskewicz, Khalid Ashraf. William Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and< 0.5 mb model size. arXiv preprint arX2: 2016.
11

---

Published as a conference paper at ICLR 2023
Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. arXiv preprint arXiv:1806.075220 2018.
Stanislaw Jastrzebski, Maciej Szymczak, Stanislav Fort, Devansh Arpit, Jacek Tabor, Kyunghyun Cho, and Krzysztof Geras. The break-even point on optimization trajectories of deep neural networks. arXiv preprint arXiv:2002.09572 2020.
Albert Q Jiang and Lisa Schut Clare Lyle Yarin Gal. Can network flatness explain the training speed-generrlisatioon connection?
Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep con- volutional neural networks. Advances in neural information processing systems, 25:1097-11055, 2012.
David Krueger, Nicolas Ballas, Stanislaw Jastrzebski, Devansh Arpit, Maxinder S Kanwal, Tegan Maharaj, Emmanuel Bengio, Asja Fischer, and Aaron Courville. Deep nets don't learn via memorization. 2017.
Chuck P Lam and David G Stork. Evaluating classifiers by means of test data with noisy labels. In IJCAI, volume 3, pp. 513-518. Citeseer, 2003.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 23/N, 7(7):3, 2015.
Jaehoon Lee, Lechao Xiao, Samuel Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl- Dickstein, and Jeffrey Pennington. Wide neural networks of any depth evolve as linear models under gradient descent. Advances in neural information processing systems, 32:8572-8583, 2019.
Jingling Li, Mozhi Zhang, Keyulu Xu, John P Dickerson, and Jimmy Ba. Noisy labels induce good representations. arXiv preprint vrXiv:2012.12890 2020.
Jingling Li. Mozhi Zhang, Keyulu Xu, John Dickerson, and Jimmy Ba. How does a neural network's s architecture impact its robustness to noisy labels? Advances Neural Information Processing Systems, 34, 2021.
Junnan Li, Yongkang Wong, Qi Zhao, and Mohan S Kankanhalli. Learning to learn from noisy labeled data. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5051-5055 2019.
Sheng Liu, Jonathan Niles Weed, Narges Razavian, and Carlos Fernandez-Grandaa Farly-learning regularization prevents memorization of noisy labels. arXiv preprint arXiv:2007.0015L. 2020.
Yangdi Lu and Wenbo He. Sele: Self-ensemble label conrection improves learning with noisy labels. arXiv preprini urXiv:2205.0/ 156, 2022.
Clare Lyle, Lisa Schut, Binxin Ru, Yarin Gal, and Mark van der Wilk. A bayesian perspective on training speed and model selection. arXiv preprint arXiv:2010. 14499, 2020.
Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, and Jian Sun. Shufflenet v2: Practical guidelines for efficient enn architecture design. In Proceedings of the European conference on computer vision (ECCV), pp. 116-15 131, 2018.
Xingjun Ma, Hanxun Huang, Yisen Wang, Simone Romano, Sarah Erfani, and James Bailey. Nor- malized loss functions for deep learning with noisy labels. In ICML, 2020.
Hartmut Maennel, Ibrahim Alabdulmohsin, Ilya Tolstikhin, Robert JN Baldock, Olivier Bousquet, Sylvain Gelly, and Daniel Keysers. What do neural networks learn when trained with random labels? arXiv preprint arXiv:2006. 10455, 2020.
Preetum Nakkiran, Gal Kaplun, Yamini Bansal, Tristan Yang, Boaz Barak, and Ilya Sutskever. Deep double descent: Where bigger models and more data hurt. Journal of Statistical Mechanics: Theory and Experiment, 2021(12):24003, 2021.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. 201 1.
12

---

Published as a conference paper at ICLR 2023
Behnam Neyshabur, Hanie Sedghi, and Chiyuan Zhang. What is being transferred in transfer learning? Advances in neural information processing systems, 53:512-5233 2020.
Duc Tam Nguyen, Chaithanya Kumar Mummadi, Thi Phuong Nhung Ngo, Thi Hoai Phuong Nguyen, Laura Beggel, and Thomas Brox. Self: Learning to filter noisy labels with self-ensembling. arXiv preprint arXiv:1910.0/842 2019.
Nitika Nigam, Tanima Dutta, and Hari Prabhat Gupta. Impact of noisy labels in learning techniques: survey, Advances in data and information sciences, pp.
Springer, 2020.
Nicolas Papernot, Patrick McDaniel, and Goodfellow. Transferability in machine learning: from phenomena to black-box attacks using adversarial samples. arXiv preprint arXiv:1605.07277, 2016a.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, 7. Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS&P) P), pp. 372-387. IEFE, 2016b.
Deep Patel and PS Sastry. Memorization in deep neural networks: Does the loss function matter? In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pp. 131-142. Springer, 2021.
Anibal Pedraza, Oscar Deniz, and Gloria Bueno. On the relationship between generalization and robustness to adversarial examples. Symmetry, 13(5):817, 2021.
Gabriel Pereyra, George Tucker, Jan Chorowski, Lukasz Kaiser, and Geoffrey Hinton. Regularizing neural networks by penalizing confident output distributions. arXiv preprint arXiv: 1rXiv:1701.06555 2017.
Geoff Pleiss, Tianyi Zhang, Ethan Elenberg, and Kilian Q Weinherger. Identifying mislabeled data using the area under the margin ranking. Advances in Neural Information Processing Systems, 33: 17044-17056, 2020.
Vaibhav Pulastya, Gaurav Nuti, Yash Kumar Atri, and Tanmoy Chakraborty. Assessing the quality of the datasets by identifying mislabeled samples. In Proceedings of the 2021 IEEE/ACM International Conference on Advances Social Networks Analysis and Mining, pp. 18-22, 2021.
Ilija Radosavovic, Raj Prateck Kosaraju, Ross Girshick, Kaiming Hc, and Piotr Dollár. Designing network design spaces. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 00428-10436, 2020.
Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred Hamprecht, Yoshua Bengio, and Aaron Courville. On the spectral bias of neural networks. International Conference on Machine Learning, pp. 5301-5310, PMLR, 2019.
Robin Ru, Clare Lyle, Lisa Schut, Miroslav Fil, Mark van der Wilk, and Yarin Gal. Speedy performance estimation for neural architecture search. Advances in Neural Information Processing Systems, 34, 2021.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang Liang-Chieh Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4510 4510-4520, 2018.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 1rXiv:1409. 1509,156, 2014.
Hwanjun Song, Minseok Kim, and Jac-Gil Lee. SELFIE: Refurbishing unclean samples for robust deep learning. ICML, 2019.
Hwanjun Song, Minseok Kim, Dongmin Park, Yooju Shin, and Jae-Gil Lee. Learning from noisy labels with deep neural networks: A survey. arXiv preprint arXiv:2007.0811 08999999..99 2020a.
Jiaming Song, Yann Dauphin, Michael Auli, and Tengyu Ma. Robust and on- dataset denoising for image classification. In European Conference on Computer Vision, pp. 556-572. Springer, 2020b.
13

---

Published as a conference paper at ICLR 2023
David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generaliza- tion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 6976-6987, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 1rXiv:1312.61999 2013.
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Du- mitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1-9, 2015.
Mingxing Tan and Quoe Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning pp. 3105-6110 14. PMLR, 2019.
Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint 1805,
2018.
Jiaheng Wei, Zhaowei Zhu, Hao Cheng, Tongliang Liu, Gang Niu, and Yang Liu. Learning with noisy labels revisited: A study using real-world human annotations. arXiv preprint arXiv:2 10.0088, 2021.
Jiaheng Wei, Zhaowei Zhu, Hao Cheng, Tongliang Liu, Gang Niu, and Yang Liu. Learning with noisy labels revisited: A study using real-world human annotations. International Conference Learming Representations, 2022.
Xiaobo Xia, Tongliang Liu, Bo Han, Nannan Wang. Mingming Gong, Haifeng Liu, Gang Niu, Dacheng Tao, and Masashi Sugiyama. Part-dependent label noise: Towards instance-dependent label noise. Advances in Neural Information Processing Systems, 33:7597-7610, 2020.
Xiaobo Xia, Tongliang Liu, Bo Han, Chen Gong, Nannan Wang, Zongyuan Ge, and Yi Chang. Robust early-learning: Hindering the memorization of noisy labels. In ICLR, 2021.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint 17Xiv:1708.07747, 2017.
Tong Xiao, Tian Xia, Yi Yang, Chang Huang, and Xiaogang Wang. Learning from massive noisy labeled data for image classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2691-2699, 2015.
Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1492-1500, 2017.
Zhi-Qin John Xu, Yaoyu Zhang, Tao Luo, Yanyang Xiao, and Zheng Ma. Frequency principle: Fourier analysis sheds light on deep neural networks. arXiv preprint arXiv: 096.29901..63,, 2019a.
Zhi-Qin John Xu, Yaoyu Zhang. and Yanyang Xiao. Training behavior of deep neural network in frequency domain. In International Conference Neural Information Processing, pp. 264-274. Springer, 2019b.
Yao Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaud- huri. A closer look at accuracy vs. robustness. arXiv preprint (xXiv:2003002460 2020.
Dong Yin, Ramchandran Kannan, and Peter Bartlett. Rademacher complexity for adversarially robust generalization. In International conference on machine learning, pp. 7085-7094. PMLR, 2019.
Fisher Yu, Dequan Wang, Evan Shelhamer, and Trevor Darrell. Deep layer aggregation. In Pro- ceedings of the IEEE conference on computer vision and pattern recognition, pp. 2402-2412, 2018.
Chiyuan Zhang, Samy Bengio, and Yoram Singer. Are all layers created equal? arXiv preprint (000:/992.01999 2019a.
14

---

Published as a conference paper at ICLR 2023
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communications of the ACM, 64(3):107-115, 2021a.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning. pp. 7472-7482. PMLR, 2019b.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.0941,, 2017.
Jie Zhang. Earl Barr, Benjamin Guedj, Mark Harman, and John Shawe-Taylor. Perturbed model validation: A new framework to validate model relevance. 2019c.
Jing Zhang, Xindong Wu, and Victor S Sheng. Learning from crowdsourced labeled data: a survey. Artificial Intelligence Review, 46(4):543-576, 2016.
Xiao Zhang, Haoyi Xiong, and Dongrui Wu. Rethink the connections among generalization, memo- rization and the spectral bias of dnns. arXiv preprint arXiv:2004. 13954, 2020.
Xuanyang Zhang, Pengfei Hou, Xiangyu Zhang, and Jian Sun. Neural architecture search with random labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10907-10916, 2021b.
Zhaowei Zhu, Zihao Dong, Hao Cheng, and Yang Liu. A good representation detects noisy labels. arXiv preprint 10..v22110.06283. 2021.
Liu Ziyin, Blair Chen, Ru Wang, Paul Pu Liang, Ruslan Salakhutdinov, Louis-Philippe Morency, and Masahito Ueda. Learning not to learn in the presence of noisy labels. arXiv preprint a0X1v:2002.06541, 2020.
15

---

Published as a conference paper at ICLR 2023
A ADDITIONAL RELATED WORK
2017) describe memorization as the behavior shown by neural networks when trained on noisy data. Patel & Sastry (202T) define memorization as the difference in the predictive performance of models trained on the clean data and on the noisy data distributions, and propose a robust objective function that resists to memorization. The effect of neural network architecture their robustness noisy labels is studied in eLi al. (021), which measure robustness to noisy labels by the prediction performance of the learned representations on the ground-trun -ruth target function. |Felmman & Zhang (2020) formally define memorization of sample for an algorithm as the inability of the model to predict the output of a sample based on the rest of the dataset, so that the only way that the model can fit the sample is by memorizing its label. Our definition of memorization as the fit on the noisy subset of the training set follows the same principle; the fit of a randomly-labele labeled individual sample is only possible if the totally random label associated with the sample is memorized, and it is impossible to predict using the rest of the dataset.
Memorization Arpit et al.
Learning before Memorization Multiple studies have reported that neural networks learn simple patterns first, and memorize the noisy labeled data later in the training process (Arpit et al. 2017; Gu & 'Tresp 2019; Krueger et al.] 22017 Liu et al. 2020). Hence, early stopping might be useful when learning with noisy labels. Parallel to our study, [u & He (2022) propose early stopping metrics that are computed on the training set. These early stopping metrics are computed by an iterative algorithm (cither a GMM or k-Mcans) on top of the training loss histograms. This adds computational overhead compared to our approach, which is based fly. Moreover, we can observe in Figure that the metric proposed in Lu & Hc (2022). which is the mean difference between distributions obtained from the GMM applied on top of the training losses, does not correlated with memorization on the training set, as opposed to our metric susceptibility. Hence, can conclude that, even though the mean difference metric might be rather well early stopping criterion for single setting, it does not perform well in terms of comparing different settings to one another. Moreover, Rahaman al. (2019): Xu al. (2019a b) show that neural networks learn lower frequencies in the input space first and higher frequencies later. However, the monotonic behaviour of neural networks during the training procedure is recently challenged by the epoch-wise
simple metric that can be computed on the
double descent (Zhang et al.] [2020) Nakkiran et al. (021). When certain amount of fit is observed on the entire training set, how much of this fit corresponds to the fit on the clean and noisy subsets, respectively, is still unclear. In this paper, we propose an approach to track the fit to the clean subset and the fit to the noisy subset (memorization) explicitly.
Training Speed Lyle et al. 2020) show there is a connection between training speed and the marginal likelihood for linear models. Jiang & Gal also find an explanation for the connection between training speed and generalization, and Ru et al. (202T) use this connection for neural architecture search. However, in Figure we observe that sharp increase in the training accuracy (a high training speed), does not always indicate an increase in the value of accuracy on the noisy subset. This result suggests that studies that relate training speed with generalization (Lyle al. 2020 Ru et al. 2) might not be extended as such to noisy-label training settings. On the other hand, we observe a strong correlation between susceptibility Ç and accuracy on the noisy subset.
Leveraging Unlabeled/Randoolyyllaae
Data Unlabeled data has been leveraged previously to predict diit----dittibbtionn performance (when there is a mismatch between the training and test distributions) (Garg et al.) 20211). Li et al. (2019) introduce synthetic noise to unlabeled data, to propose a noise-tolerant meta-learning training approach. [Zhang et al. (2021b) use randomly labeled data to perform neural architecture search. In our paper, we leverage unlabeled data to track memorization of label noise.
Benefits of Memorization Studies on long-tail data distributions show potential benefits from memorization when rare and atypical instances are abundant in the distribution (Feldman) 2020 Feldman & Zhang 2020 Brown et al.) (021). These studies argue that the memorization of these rare instances is required to guarantee low generalization error. On a separate line of work, previous empirical observations suggest that networks trained noisy labels can still induce good representa- tions from the data, despite their poor generalization performance (Li et al. 2020 Maennel et al.) 2020). In this work, we propose an approach to track memorization when noisy labels are present.
16

---

Published as a conference paper at ICLR 2023
100
Train ACC Noisy
100
cnn
Train ACC
80
cnn+ mixup
60
cnn+NNC
60
40
40
20
50
100 Epochs
150
200
0
50
100 Epochs
150
200
Train ACC Clean
100
80
Susceptibility
0.15
60
40
0.05
20
0.00
100
150
200
0
50
150
200
Epochs
Epochs
Figure 7: Accuracy on the entire, the clean and the noisy subsets of the training set, versus suscepti- bility in Equation ( for 5-layer convolutional neural network trained on CIFAR-10 with 50% label noise without any regularization, with Mixup (Zhang et al.) (017), and with Active Passive loss using the normalized cross entropy together with reverse cross entropy loss (denoted by NCE) (Ma et al. 2020p. The sharp increases in the overall training accuracy (illustrated by the red and yellow stars) can be caused by increase in the accuracy of either the clean (the yellow star) and noisy (the red star) subsets. Therefore, this sharp increase could not predict memorization, contrary to the susceptibility Ç. which is strongly correlated with the accuracy the noisy subset (Pearson correlation between Train ACC Noisy and susceptibility Ç is 0.636).
Theoretical Results To analyze the convergence of different models on some randomly labeled
set, we rely on recent results obtained by modelling the training process of wide neural networks by neural tangent kernels (NTK) (Du et al. 20188
Jacot et al.) 2018 Allen et al. 2019 Bietti & Mairal 2019]] Lee et al. 2019). In particular, the analysis in our paper is motivated by recent work on convergence analysis of neural networks (Du al., 2018 Arora et al. 2019) Arora
2018 Arora et al.)
et al. (2019) perform fine-grained convergence analysis for wide two-layered neural networks using gradient descent. They study the convergence of models trained on different datasets (datasets with clean labels versus random labels). In Section we study the convergence of different models trained on some randomly-labeled set. In particular, our models are obtained by training wide two-layered neural networks datasets with varying label noise levels. As we highlight in the proofs, our work builds on previous art, especially (Du et al.) 20188 Arora et al. 2019), yet we build on a non-trivin way and for problem statement.
Robustness to Adversarial Examples Deep neural networks are vulnerable to adversarial samples (Szegedy et al., 2013] Goodfellow al.) 2014 Akhtar & Mian 2018): very small changes to the input image can fool even state-of-the-an art neural networks. This is an important issue that needs to be addressed for security reasons. To this end, multiple studies towards generating adversarial examples and defending against them have emerged (Carlini & Wagner] [0077 Papernot et al.) [206bb a Athalye al. 2018). As a side topic related to the central theme of the paper, we examined the connection between models that are resistant to memorization of noisy labels and models that are robust to adversarial attacks. Figure compares the memorization of these models trained on some noisy dataset, with their robustness adversarial attacks. We do not observe any positive or negative correlation between the two. Some models are robust to adversarial attacks, but perform poorly when trained on datasets with noisy labels, and vice versa. This means that the observations made in this paper are orthogonal to the ongoing discussion regarding the trade-off between robustness
to adversarial samples and test accuracy (Tsipras al. 2018 Stutz al. 2019 Yang al. 2020
Pedraza et al. 2021 Zhang et al. 2019b Yin et al. 2019).
17

---

Published as a conference paper at ICLR 2023
0.7
0.7
Success Rates
Success Rates
0.6
0.6
0.4
0.4
0.3
0.2
0
20
40
50
80
100
0.1
0.3 Susceptibility ((1)
0.2
Train Acc Noisy
(a) Success rate accuracy the noisy subset of the training set
(b) Success rate versus susceptibility to noisy labels
Figure 8: SimBa Guo al. 2019) adversarial attack success rate versus accuracy on the noisy subset of the training set for networks trained on CIFAR-10 with 50% label noise. To evaluate robustness of different models with respect adversarial attacks, we compare the success rate of the adversarial attack SimBa proposed in (Guo et al., (2019) after 1000 iterations. We observe no correlation between the success rate and neither accuracy on the noisy subset nor susceptibility Ç.
Train ACC Noisy
Train ACC Noiey
Train ACC Nolsy
75
52
0.31
0.69
-0 25
p = 0.91
0.
0.5
1.0
15 2.0
0.
15 Moan Differences
05
1.0
2.00 005 030
0.5 0.30
Train ACC Drop
Susceptibility ((d)
Figure 9: Left: Accuracy the noisy subset of the training set, versus the training accuracy drop presented in (Zhang et al. 2019c) for the following neural network configurations trained on the CIFAR-10 dataset with 50% label noise: 5-layer convolutional neural network, DenseNet, EfficientNet, MobileNet, MobileNe1V2, RegNet, ResNet, ResNeXt, SENet, and ShuffleNetV2. As proposed in (Zhang al. 2019c), to compute the training accuracy drop, create new dataset from the available noisy training set, by replacing 25% of its labels with random labels. We then train these networks on the new dataset, and then compute the difference in the training accuracy of the two setups, divided by 25 (the level of label noise that was injected). This is reported above as Train ACC Drop. (Zhang et al. 2019c) state that desirable networks should have large drop: therefore there should ideally be negative correlation between the training accuracy drop and the accuracy on the noisy subset. However, we observe a slight positive correlation. Therefore, it is difficult to use the results of Zhang al. (2019c) to track memorization, i.c., training accuracy on the noisy subset. Middle: Accuracy on the noisy subset the training set, versus the mean difference between the distributions obtained by applying GMM the training losses, which is proposed in Lu & He (2022) as an early stopping criterion. We observe a negative correlation between the two, and hence conclude that this metric cannot be used compare memorization of different settings different stages of training. Right: As opposed to the other two metrics, we observe a strong positive correlation between our metric susceptibility and memorization.
18

---

Published as a conference paper at ICLR 2023
B EXPERIMENTAL SETUP
Generating Noisy-labeled Datasets We modify original datasets similarly to Chatterjje 2020); for a fraction of samples denoted by the label noise level (LNL), we replace the labels with independent random variables drawn uniformly from {1.... . c) for dataset with number of classes. On average (1 LNI.) + (LNL.) 1/c of the samples still have their correct labels. Note that LNL. for is 1.
Experiments of Figures 2 12 13 and The models at epoch 0 are pre-trained models on either the clean noisy versions of the CIFAR-10 dataset for 200 epochs using SGD with learning rate 0.1, momentum 0.9, weight decay
10-1, and cos i neanneal ing learning rate schedule with T max 200. The new sample is sample drawn from the training set, and its label is randomly assigned to some class different from the correct class label. In Figure 13 the new sample is an unseen sample drawn from the test set.
CIFAR-1Q" Experiments The models are trained for 200 epochs on the cross-entropy
objective function using SGD with weight decay 5 10 and batch size 128. The neural network architecture options are: cnn (a simple 5-layer convolutional neu- ral network), DenseNet (Huang et al.] 2017). EfficientNet (Tan & Le (019)) (with sca scale=005. 0.75, 1, 1.25, 1.5), GoogLeNet (Szegedy et al.
allal1101110 2015). MobileNet Howard al.) 2017) (with scale-0.. 0.75, 1, 1.25, 1.5). ResNet (He
al. 2016a).
MobileNetV2 (Sandler et al. 2018) (with scale-0.5 0.75, 1, 1.25, 1.5. 1)5). Preact
ResNet (He et al. 2016b), RegNet (Radosavovic al. 2020), ResNeXt (Xie et al. 2017) 7), SENet (Hu
et al. 2018), ShuffleNetV2 (Ma et al.] 2018) (with scale=0.. 5, 1, 1.5, 2), DLA (Yu et al. 2018), and VGG (Simonyan & Zisserman 2014). The learning rate value options are: 0.001, 0.005, 0.01, 0.05, 0.1. 0.5. The learning rate schedule options are: cosineannea ling with T max 200, wwsineannealingg with T max 100, cosi rosineannealing with max 50, and no learn- ing rate schedule. Momentum value options are 0.9, O. In addition, include experiments with Mixup /Zhang et al. (017), active passive losses: normalized cross entropy with reverse cross entropy (NCE+RCE) Ma al. 2020), active passive losses: normalized focal loss with reverse cross entropy (NFL+RCE)
Ma et al. 2020). and robust early learning (Xia et al.) 2021) regularizers.
CIFAR-100 Experiments The models are trained for 200 epochs the cross-entropy objective function using SGD with learning rate 0.1, weight decay 5 10-4, momentum 0.9, learning rate schedule cosines neinnnannnllll iing with T max 200 and batch size 128. The neural network archi- tecture options are: cnn, DenseNet, EfficientNet (with scale=0. 0.5. 5, 0 75, 1, 1.25, 1)5), GoogLeNet, MobileNet (with scale=0. 5, 0. 7.75, 1, 1. 1.25, 1) ResNet, MobileNetV2 (with scale=0.2 5, 0. 75, 1, 1. 1.25, 1)5), RegNet, ResNeXt, ShuffleNerV2 (with sca scale=0.55 5, 1, 1.5, 2), DLA, and VGG. In addition, we include experiments with Mixup, active passive losses: NCE+RCE, active passive losses: NFL+RCE, and robust early learning regularizers.
SVHN (Netzer et al. 2011) Experiments The models are trained for 200 epochs on the cross-entropy objective function with learning rate 0.1 and batch size 128. The optimizer choices are SGD with weight decay 5 10-4, and momentum 0.9, and Adam optimizers. The learning rate schedule options for the SGD experiments are: cosineannealing with max 200, and exponential. The neural network architecture options are: DenseNet, EfficientNet (with scale=0.25, 0.5, 0.75, 1), GoogLeNet (with
scale= 0.25, 1, 1.25), MobileNet (with scale= 1, 1.25, 1.5, 1.75), MobileNetV2
scale= 1, 1.25, 1.5, 1.75). scale=0. 25, 0.5, 1, 1.25, 1.5, 1.75),
(with
ResNet SENet (with
(with
ResNeXt,
25, 0.5, 0.75, 1), ShuffleNetV2 (with scale=0.25, 252 0.5, 0.75, 1). DLA (with scale=0.25, 0.5, 0. 75, 1).
and VGG (with
sca 0aale=0.25, 0.5, 0.75, 1, 1.25, 1.5, 1575).
MNIST and Fashion-MNIST (Xiao et al., 2017) Experiments The models are trained for 200 epochs on the cross-entropy objective function with batch size 128, using SGD with learning rate 0.1, weight decay 5 10-4 and momentum 0.9. The learning rate
https://www.cs http://www..oooooooeoooooooo ham
http://yann. Tecun. com/exdb/mni st.
19

---

Published as a conference paper at ICLR 2023
schedule options are: cosineannealing with T max 200, and exponential.
The neural network architecture options are: AlexNet (Krizhevsky et al.] 2012) (with
scale=0.25, 0.5, 0.75, 1), ResNet18 (with scale=0.25, 0.5, 0.75, 1), scale=0.2 25, 0.5, 0.75, 1), ResNet50
ResNet34 (with scale=0. 25, 0.5, 0.75, 1). VGGI1 (with scale=0 25, 0.5, 0.75, 1), VGG13 (with scale=0.222... 25, 0.5, 0.75, 1), VGG16 (with scale=0.25, 0.5, 0.75, 1), VGG19 (with scale=0.25, 0.5, 0.75, 1).
(with
Tiny ImageNet (Le & Yang, 2015) Experiments The models are trained for 200 epochs on the cross-entropy objective function with batch size 128, using SGD with weight decay 5 1004, and momentum 0.9. The learning rate schedule options are: cosineannealte inng with T max 200, exponenti a and no learning rate schedule. The learning rate options are: 0.01, 0.05, 0.5. The neural network architecture options are: AlexNet, DenseNet, MobileNetV2, ResNet, SqueezeNet (landola al. 2016), and VGG.
Clothing-IMI IM (Xiao et al., 2015) Experiments The models are trained for 20 epochs on the cross- entropy objective function with batch size 128 using SGD with weight decay 5 10 10-4, and mo- mentum 0.9. The learning rate schedule options are: cos wew.nnnnllllllnnmmmammmmm...
with T max 20, and exponentio ial. The learning rate options are: 0.01, 0.005, 0.001. The neural network architecture options are: AlexNet, ResNet18, ResNet 34, ResNeXt, and VGG. Note that because this dataset has random labels we do not introduce synthetic label noise to the labels.
Animal-10N (Song et al., 2019) Experiments The models are trained for 50 epochs on the cross- entropy objective function with batch size 128 using SGD with weight decay 5 10 10-4, and mo- mentum 0.9. The learning rate schedule options are: poosneeaneel
with T max 50, and exponent aall The learning rate options are: 0.001, 0.005, 0.01. The neural network architecture options are: ResNet18, ResNet34, SqueezeNet, AlexNet and VGG. Note that because this dataset has random labels we do not introduce synthetic label noise to the labels.
CIFAR-1ON (Wei et al. 2022) Experiments On these experiments, we work with the aggregate version of the label set which has label noise level of 9% (CIFAR-ION-aggregate in Table I Wei al. (022)). The models are trained for 200 epochs on the cross-entropy objective function with batch size 128 using SGD with weight decay 5- 5-10-4, and momentum 0.9 with cos i inannne ing learning rate schedule with max 200. The learning rate options are: 0.1, 0.05. The neural network architecture options are: cnn, EfficientNet, MobileNet, ResNet, MobileNetV2, RegNet, ResNeXt, ShuffleNetV2, SENet, DLA and VGG.
Each of our experiments take few hours to run single Nvidia Titan X Maxwell GPU.
C COMPARISON WITH BASELINES
Comparison to a Noisy Validation Set Following the notations from Chen et al. (202)) let the clean and noisy data distributions be denoted by and D, respectively, the classifiers by h, and the classification accuracy by A. Suppose that the optimal classifier in terms of accuracy on the clean data distribution is h", i.e., h² = arg max, (h). (Chen et al. 2021) ) states that under certain assumptions on the label noise, the accuracy on the noisy data distribution is also maximized by h², that is ht = arg max, A (h). However, these results do not allow us to compare any two classifiers by and f2g because we cannot conclude from the results in (Chen al.) 2021) that if AD(hz) > AD (h2), then A (h1) > (h2)). Moreover, it is important to note that these results hold when the accuracy is computed on unlimited dataset sizes. As stated in (Lam Stork 2003), the number of noisy validation samples that are equivalent to single clean validation sample depends on the label noise level and on the true error rate of the model, which are both unknown in practice. Nevertheless, below we thoroughly compare our approach with having a noisy validation set.
As discussed in Section 4 the susceptibility Ç together with the training accuracy are able to select models with high test accuracy. Another approach to select models is to use subset of the available noisy dataset as a held-out validation set. Table D provides the correlation values between the test accuracy the clean test set and the validation accuracy computed noisy validation sets with varying sizes. On the one hand, we observe that the correlation between the validation accuracy and the test accuracy is very low for small sizes of the noisy validation set. On the other hand, in the same
20

---

Published as a conference paper at ICLR 2023
Size the set
Train Acc
Val Acc
Our approach
10
0.244
0.792
128
0.458
0.890
256
0.707
0.878
512
0.799
0.876
1024
0.513
0.830
0.877
2048
0.902
0.917
4096
0.886
0.912
8192
0.940
0.923
10000
0.956
0.914
Table 1: The Kendall 7 correlation between each metric and the test accuracy for CNN, ResNet, EfficientNet, and MobileNet trained on CIFAR-I0 with 50% label noise, where the validation accuracy (Val Acc) on a held-out subset of the data and the susceptibility Ç use set with the size indicated in each row. We observe that our approach results much higher correlation compared using a noisy validation set. Furthermore, our approach is less sensitive to the size of the held-out set, compared using a noisy validation set. In particular, reach the same correlation value, our approach with set size 10 is equivalent to using a noisy validation set with size = 512 (highlighted red). Also, our approach with set size = 128 is almost equivalent to using noisy validation set with size 1024 (highlighted in blue). Hence, to noisy validation set, requires around ten-fold the amount of held-out data.
table, we observe that if the same size is used to compute Ç, our approach provides high correlation to the test accuracy, even for very small sizes the held-out set.
In our approach, first filter out models for which the value of ( exceeds threshold. We set the threshold so that around half of the models remain after this filtration. We then report the correlation between the training and test accuracies among the remaining models. As sanity check, doubled checked that, with this filtration, the model with the highest test accuracy was not filtered out.
Moreover, in Figure T0, report the advantage of using our approach compared to using noisy validation set for various values of the dataset label noise level (LNL) and the size of the set that computes the validation accuracy and susceptibility Ç. We observe that the lower the size of the validation set, and the higher the LNL, the more advantageous our approach is. Note also that for high set sizes and low LNL.s, our approach produces comparable results using a noisy validation set.
Comparison Label Noise Detection Approaches Another line of work is studying methods that detect whether label assigned to a given sample is correct or not (Zhu et al. [021 [ong et al.) 2020bb] Pleiss et al. 2020, Pulastya et al., 202I). Such methods can estimate the clean and noisy subsets. Then, by tracking the training accuracy on the clean and noisy subsets, similar to what is done in Figure 5 they can select models that are located in Region 1, i.c., that have a low estimated accuracy on the noisy subset and high estimated accuracy the clean subset. In Figure [I] we compare the average test accuracy of models selected by our approach with those selected by such subset-selection methods. Let X be the accuracy of the detection of the correct/incorrect label of sample by the subset selection benchmark: if X = 100%, then the method has full access to the ground truth label for each label, if X 90% the method correctly detects 90% of the labels. We observe clear advantage of our method for X up to 96%, and comparable performance for X > 96%.
21

---

Published as a conference paper at ICLR 2023
Test ACC of Region 1 models
17.
Test ACC
Ground Truth
730
02
subset selection
Accuracy of the Subset-Selection Method
Set Size
Figure 10: The Kendall correlation between our approach and the test accuracy minus the Kendall correlation between validation curacy (computed on a noisy set) and the test accuracy for various label noise levels (LNL) and set sizes. We observe the advantage of our approach to using a noisy validation set particularly for high LNLs and low set sizes. For other combinations, we also observe com- parable results (the correlation difference is very close to zero). Note that the last row can be recovered from the difference in correla- tion values Table
Figure 11: curacy obtained using our approach and the average test accuracy obtained using method that detects correctly-labeled samples within the training set from the incorrectly- labelldd ones with X% accuracy (the axis). The results are obtained from training (CNN, ResNet, EfficientNet, MobileNet) without regulariza- tion, +Mixup. +NCERCE, + NFLRCE. +robust early learning) on CIFAR-10 10 with 50% label noise. We ob- serve that to have the same performance as our approach, such methods require very high accuracy (above 96%), and even with higher accuracies, our approach gives comparable results.
Comparison between the average test ac-
22

---

Published as a conference paper at ICLR 2023
D ADDITIONAL EXPERIMENTS FOR SECTION 2
In this section, we provide additional experiments for the observation presented in Section 2 In Figure 12 we observe that networks with a high test accuracy are resistant memorizing new incorrectly-laeele sample. On the other hand, in Figure [3] we observe that networks with a high test accuracy tend fit new correctly-labeled sample faster.
Prediction
Network1
horse
prediction
Network1
Cat
oehr
others
Netwark2
Network2
25
100
125
150
175
200
25
50
100
125
150
200
Epochs (K)
Epochs (K)
(a) Example 1: original label: horse, assigned label: frog
(b) Example 2: original label: cat, assigned label: truck
Prediction
Network1
dog
Prediction
Network1
ship
automobile
others
others
Network2
Network2
25
125
175
100
150
200
Epochs (R)
Epochs (R)
(c) Example 3: original label: dog, assigned label: automobile
(d) Example 4: original label: ship, assigned label: deer
The evolution of output prediction of two networks that are trained on single randomly labeled sample. all sub-figures, Network 1 has higher test accuracy compared to Network 2, and we observe it is less resistance to memorization of the single mecorectly-labeles sample. Example 1: Network a ResNeXt trained on CIFAR- dataset with 50% random labels and has test accuracy of 58.85%. Network 2 is a ResNeXt that is not pre-trained and has test accuracy of 9.74.. Example 2: Network a SENet trained on CIFAR- 10 dataset with original labels and has test accuracy of 95.35%. Network is SENet that is trained CIFAR- 10 with 50% label noise and has test accuracy of 56.38%. Example 3: Network is a RegNet trained on CIFAR-10 dataset with original labels and has test accuracy of 95.28%. Network 2 RegNet that is trained CIFAR-10 with 50% label noise and has test accuracy of 55.36%. Example 4: Network is a MobileNet trained on CIFAR-10 dataset with original labels and has test accuracy 90.56%. Network is a MobileNet that is trained on CIFAR-I0 with 50% label noise and has test accuracy of 82.76%.
Figure 12:
Moreover, we study the effect of calibration on the observations of Figures and 12 calibration of a model may affect the confidence its predictions, which in turn might affect the susceptibiliityrrrsittaeee to new samples. Therefore, in Figure 14 compare models that have almost the same calibration value. More precisely, Network 1 is trained on the clean dataset, and Network 2 (calibrated) is calibrated version of the model that is trained the noisy dataset using the Temperature scaling approach (Guo et al.) (017).. We observe that even with the same calibration level, the model with higher test accuracy is more resistant memorizing a new ceoorrctly-labellee sample.
A poor
23

---

Published as a conference paper at ICLR 2023
Prediction
Network1
Prediction
Network1
dog
frog
Network2
Network2
25
75
100
125
150
175
200
25
50
75
100
125
250
175
200
Epochs (k)
Epochs
(a) Example original label: dog, assigned label: dog
(b) Example 2: original label: frog, assigned label: frog
Prediction
Network1
medicco Coon
Network1
horse
Gat
Network2
Network2
25
75
100
125
150
175
200
25
50
75
100
125
150
175
200
Epochs (R)
Epochs (8)
(c) Example 3: original label: horse, assigned label:
(d) Example original label: cat, assigned label: cat
horse
Predicton
Network1
truck others
Network2
50
100
125
150
175
200
Epochs
(c) Example 5: original label: truck, assigned label: truck
Figure 13: The evolution of output prediction of two networks that are trained on a single unseen correctly-labcled sample. In all sub-figures, Network I has a higher test accuracy compared to Network 2. We observe that give new correctly-labeled sample Network 2 learns it later, unlike our observation in Figure 2 for new incorrectl-labele GoogLeNet trained on CIFAR-10 dataset with clean labels and has test accuracy of 95.36%. Network is a GoogLeNet trained on CIFAR-10 dataset with 50% label noise level and has test accuracy of 58.35%. Example 2: Network is a ResNeXt trained on CIFAR- 10 dataset with 50% random labels and has test accuracy of 58.8552 85%. Network 2 is ResNeXt that is not pre-trained and has test accuracy of 9.7 3.74.. Example 3: Network 1 is SENet trained on CIFAR- 10 dataset with original labels and has test accuracy of 95.35%. Network is a SENet that is trained on CIFAR-10 10 with 50% label noise and has test accuracy of 56.38%. Example 4: Network is RegNet trained CIFAR-10 dataset with original labels and has test accuracy of 95.28%. Network 2 a RegNet that is trained CIFAR-I0 with 50% label noise and has test accuracy of 55.36%. Example 5: Network I is a MobileNet trained on CIFAR-10 dataset with original labels and has test accuracy of 90.56%. Network 2 is MobileNet that is trained on CIFAR-10 with 50% label noise and has test accuracy of 82.76 82.76%.
sample. Example 1: Network is
24

---

Published as a conference paper at ICLR 2023
Networci
Natwork1
100
125
150
175
200
25
100
125
150
Epocho
(a) Example I: original label: ship, assigned label:
(b) Example original label: cat, assigned label: truck
dog
Figure 14: The evolution of output prediction of networks that are trained on single randomly labeled sample. In all sub-figures, Network I (trained on the clean dataset) has higher test accuracy than Network (trained on the noisy dataset), and we observe it less resistant to memorization of the single incorrectly-labele sample. Furthermore, we have ensured using the temperature scaling method (Guo et al., (017) that the two models have the same calibration (ECE) value. Example Network is GoogleNet trained on CIFAR- 10 dataset with original labels and has test accuracy of 95.36%. Network is GoogleNet that trained on CIFAR-10 with 50% label noise and has test accuracy of 58.35%. Example 2: Network is RegNet trained on CIFAR- 10 dataset with original labels and has test accuracy of 95.28%. Network a RegNet that is trained on CIFAR- 10 with 50% label noise and has test accuracy of 55.36%.
25

---

Published as a conference paper at ICLR 2023
E ADDITIONAL EXPERIMENTS FOR SECTION
In this section, we provide additional experiments for our main results for MNIST, Fashion-MNIST, SVHN, CIFAR-I00, and Tiny Imagenet datasets. Later in the section, we provide additional experiments on the Clothing- IM, Animal-1ON and CIFAR-ION datasets, where as stated in Appendix datasets with real-world label noise.
In Figure 15
observe that for networks trained on the noisy MNIST datasets, models that are resistant to memorization and trainable have on average more than 20% higher test accuracy compared to models that are trainable but not resistant (similar results for other datasets are observed in Figures 17 19 22 and 25 Furthermore, without access to the ground-truth, the models with
high (respectively. low) accuracy on the clean (resp., noisy) subsets are recovered using susceptibility < as shown in Figures 20 and 23 Moreover, in Figure 16 we observe that by selecting models with
low value of ((t) the correlation between training accuracy and test accuracy drastically increases from 76. to 0.863, which shows the effectiveness of the susceptibility metric ((t) (similar results
for other datasets are observed in Figures 18 and 26
Train ACC
Region1
Region2
20
Region 3
Regian4
Susceptibility {(t)
Figure 15: Using susceptibility ((t) and training accuracy, can obtain 4 different regions for models trained on MNIST with 50% label noise (details in Appendix B). Region 1: Trainable and resistant, with average test accuracy of 95.38%. Region Trainable and resistant, with average test accuracy of 72.65%. Region 3: Not trainable but resistant, with average test accuracy of 47.69%. Region 4: Neither trainable nor resistant.
100
80
80
ACC
Test ACC
60
40
0.766
p 0.863
%
100
%
40
Train ACC
(a) Test accuracy versus train accuracy for all models at all epochs
(b) Test accuracy versus train accuracy for models
that have ((t) S 0.05
Figure 16: For models trained on MNIST with 50% label noise (details in Appendix B) the correlation between training accuracy and test accuracy increases lot by removing models based the susceptibility metric {tt).
26

---

Published as a conference paper at ICLR 2023
:00
Train ACC
20
Region1
Region2
Region3
Region4
70
Susceptibility <(t)
Figure 17:
Using susceptibility (()) and training accuracy we obtain 4 different regions for models trained on Fashion-MNIST with 50% label noise (details in Appendix Bp. Region 1: Trainable and resistant, with average test accuracy of 95.82%. Region 2: Trainable and but resistant, with average test accuracy of 72.04%. Region 3: not trainable but resistant, with average test accuracy of 52.68%. Region 4: Neither trainable nor resistant.
100
100
Test ACC
20
0 0.77
20
0.919
%
20 40
60
80
100
20
40
60
80
100
Train ACC
Train ACC
(a) Test accuracy versus train accuracy for all models all epochs
(b) Test accuracy versus train accuracy for models that have <(t) s 0.05
Figure 18: For models trained on Fashion-MNIST with 50% label noise (details in Appendix B). the correlation between training accuracy and test accuracy increases a lot by removing models based on the susceptibility metric (()).
100
Train ACC
s0
Region1
Regian2
20
40
Region
Region4
20
Susceptibility ((t) 2.0
obtain 4 different regions for models trained on SVHN with 50% label noise (details in Appendix B). Region 1: Trainable and resistant, with average test accuracy of 88. 68.64%. Region 2: Trainable and but not resistant, with average test accuracy of 66.34%. Region 3: Not trainable but resistant, with average test accuracy of 53. 33.25%. Region 4: Neither trainable nor resistant, with average test accuracy of 85.17%.
Figure 19: Using susceptibility ((t) and training accuracy
27

---

Published as a conference paper at ICLR 2023
Train ACC Clean
ACC
Test
Train
Test
Train ACC Noisy
300
Suscēptibility
(a) With oracle access to the ground-truth label. Average test accuracy of the selected models
(b) Without access to the ground-truth label.
Average test accuracy of the selected models
87.56%
85.44%
Figure 20: For models trained on SVHN with 50% label noise (details in Appendix B with the help of our susceptibility metric (()) and the overall training accuracy, we can recover models with high/low accuracy the clean/noisy subset.
Test ACC
Test ACC
60
60
40
40
20
0.408
20
0.989
%
60
80
100
%
20
60
80
100
Train ACC
Train ACC
(a) Test accuracy versus train accuracy for all models at all epochs
(b) Test accuracy versus train accuracy for models that have ((t) S 0.05
Figure 21: For models trained on SVHN with 50% label noise (details in Appendix B the correlation between training accuracy and test accuracy increases lot by removing models based on the susceptibility metric (()).
Region1
Region2
Train ACC
Test ACČ
40
20
Reglon3
Region4
0.0
Susceptibility Z(t)
10
2.0 2.5
Figure 22: Using susceptibility <(t) and training accuracy we can obtain 4 different regions for models trained CIFAR-100 with 50% label noise (details in Appendix B). Region 1: Trainable and resistant, with average test accuracy of 47.09%. Region 2: Trainable and but not resistant, with average test accuracy of 40.96%. Region 3: Not trainable but resistant, with average test accuracy of 22.65%. Region 4: Neither trainable nor resistant, with average test accuracy of 39.07%.
28

---

Published as a conference paper at ICLR 2023
100
Train ACC Clean
Test ACC
Train ACC
Test ACC
Train ACC Noisy"
Susceptibility
(a) oracle access to ground-truth label. Average test accuracy of the selected models =
(b) Without access to ground-truth label. Average test accuracy of the selected models =
51.39%
49.57%
Figure 23: For models trained on CIFAR- 100 with 50% label noise, with the help of our susceptibility metric ((t) and the overall training accuracy, we can recover models with a high/low accuracy on clean/noisy subset.
100
80
80
ACC
Test ACC
60
60
40
40
p 0.578
p 0.962
%
%
ACC
Train ACC
(a) Test accuracy versus train accuracy for all models at all epochs
(b) Test accuracy versus train accuracy for models
that have ((1) < 0.1
Figure 24: For models trained on CIFAR-100 with 50% label noise (details in Appendix B the correlation between training accuracy and test accuracy increases lot by removing models based on the susceptibility metric ((t).
Region1
Region2
Train ACC
Test
Region3
Region4
4 Susceptibility g(o
Figure 25: Using susceptibility <(t) and training accuracy we can obtain 4 different regions for models trained Tiny Imagenet with 10% label noise (details in Appendix B). Region I: Trainable and resistant, with average test accuracy of 57.51% %. Region 2: Trainable and but not resistant, with average test accuracy of 53.25%. Region 3: Not trainable but resistant, with average test accuracy of 18.53%. Region 4: Neither trainable nor resistant, with average test accuracy of 53. 53.26%.
29

---

Published as a conference paper at ICLR 2023
100
100
Test ACC
Test
20
0.801
20
0.97
%
20
40
60
80
100
20
40
66
80
100
Train ACC
Train ACC
(a) Test accuracy versus train accuracy for all models all epochs
(b) Test accuracy versus train accuracy for models that have <(t) < 0.05
Figure 26: For models trained on Tiny Imagenet with 10% label noise (details in Appendix B the correlation between training accuracy and test accuracy increases by removing models based on the susceptibility metric {()).
30

---

Published as a conference paper at ICLR 2023
E. WALK-THROUGH ON REAL-WORLD NOISY-LABALED DATASETS
To evaluate the performance our approach on real-world datasets, we have conducted additional experiments on the Clothing-IM dataset (Xiao et al.) 2013), which is dataset with 1M images of clothes, on the Animal-10X 1ON dataset (Song et al. 2019), which is a dataset with 50k images of animals and on the CIFAR-ION dataset (Wei et al. 2022). which is the CIFAR- 10 dataset with human-annotated noisy labels obtained from Amazon Mechanical Turk. In the Clothing- M dataset, the images have been labeled from the texts that accompany them, hence there are both clean and noisy labels in the set, and in the Animal- 1ON dataset, the images have been gathered and labeled these datasets, some images have incorrect labels and the ground-truth labels in the training set are not available. Hence in our experiments we cannot ex explicitly track memorization as measured by the accuracy on the noisy subset the training set.
from search engines.
We train different settings on these two datasets with various architectures (including ResNet, AlexNet and VGG) and varying hyper-parameters (refer to Appendix B for details). We compute the training accuracy and susceptibility& Ç during the training process for each setting and visualize the results in Figure 27 below.
300
10
Train ACC
Train ACC
Susceptibility 7
Susceptibility ?
(a) The Clothing- IM datasct
(b) The Animal 1Oi dataset
Train ACC
04 21 Susceptibility ? (c) The CIFAR-ION dataset
Figure 27: Training accuracy and susceptibility Ç for various models trained on real-world noisy-
labeled datasets.
We divide the models of Figure 27 into 4 regions, where the boundaries set to the average value of the training accuracy (horizontal line) and the average value of susceptibility (vertical line) over the available models: Region Models that are trainable and resistant memorization. Region Trainable and but not resistant, Region 3: Not trainable but resistant and Region 4: Neither trainable nor resistant. This shown in Figure 28
Our approach suggests selecting models in Region 1 (low susceptibility, high training accuracy).
In order assess how our approach does in model-selection, we can reveal the test accuracy computed on a held-out clean test set in Figure 29 We observe that the average (# standard deviation) of the test accuracy of models in each region as follows:
Clothing- M dataset: Region 61.799% + 1,643; Region 2: 57.893% 3.562; Region 51.250% + 17.209; Region 4: 51.415% + 9.709.
Animal- JON dataset: Region 1: 96.771% 1.649; Region 92.508% 2.185; Region 91, 6.601; Region 4: 89.352% 3.142.
31

---

Published as a conference paper at ICLR 2023
143 Region1
Region2
Region1
Region2
Train ACC
Train ACC
Region3
Region4
Region3
Regions
Susceptibility
uae Susceptibility
(a) The Clothing- IM dataset
(b) The Animal-ION dataset
Region1
Region2
Train ACC
Region3
Regioné
Susceptibility ?
(c) The CIFAR-ION dataset
Figure 28: Training accuracy and susceptibility for various models trained real-world noisy- labeled datasets. According to the average values the training accuracy and susceptibility Ç the figure is divided into 4 regions.
CIFAR-ION dataset: Region 1: 87.2% + 0.99; Region 2: 85.44% + 2.52; Region 3: 77.87% - 8.15; Region 4: 78.45% = 3.86.
We observe that using approach addition, the test accuracies models in Region have the least amount of standard deviation. Note that susceptibility metric Ç does not any information about the label noise level the label noise type that is present in these datasets. Similarly to the rest of this paper, random labeling is used for computing Ç. Interestingly,
able to select models with very high test accuracy. In
though within the training sets of these datasets the label noise
type is different than random labeling (label noise type is instance-dependent (Xia et al. 2020 Wei al. 2022 Ç is still successfully tracking memorization.
Therefore, our approach selects trainable models with low memorization even for datasets with real-world label noise. Observe that selecting models only on the basis of their training accuracy or only on the basis of their susceptibility fails: both are needed. It is interesting to note that in the Clothing- M dataset, as the dataset is more complex, the range of the performance of different models varies and our approach is able to select "good" models from "bad" models. On the other hand, in Animal-ION and CIFAR- 1ON datasets, as the datasets are easier learn and the estimated label noise level is lower, most models are already performing rather well. Here, our approach is able to select the "best" models from "good" models.
32

---

Published as a conference paper at ICLR 2023
122
Reglon
RegianZ
Region1
Region2
302
Train ACC
Train ACC
Region3
Region4
Regiona
Region4
Susceptibility ç
0.00
6.00
Susceptibility [
0.0
026
0.00
6400
0.22
0.14
(a) The Clothing- IM dataset
(b) The Animal- Hiimal-ION dataset
Region
Region
Train ACC
ieegion3
Region4
Susceptibility
30
13
(c) The CIFAR- ION dataset
Figure 29; Training accuracy and susceptibility Ç for various models trained on real-world noisy- labeled datasets. According to the average values the training accuracy and susceptibility the figure is divided into regions. The test accuracy of the models is visualized using the color of each point and only for illustration and used find different regions.
33

---

Published as a conference paper at ICLR 2023
F EXPERIMENTS RELATED TO SECTION 6
In this section, we provide some ablation studies that are discussed Section 6
In Figure 30) observe that among neural network architectures with a good resistance to memorization, susceptibility to noisy labels ((t) detects the most resistant model. We observe that the high correlation between ( and memorization of the noisy subset is not limited to specific learning rate schedule in Figure 31 or a label noise level in Figures 32 and 33 Moreover, in Figures [asuures34aand [4 we observe that for datasets with label noise level of 10%, the susceptibility noisy labels ( and training accuracy still select models with a high test accuracy. The same consistency is observed in Figure 38 for models trained with asymmetric label noise.
In the paper, we choose Š to be only a single mini-batch of randomly-labeled set for computational efficiency. But we also made sure that this does not harm the correlation between Train ACC Noisy and ((t). We analyze the effect of size of in Figure 36 (left), which confirms that a single mini-batch is large enough to have a high correlation between Train ACC Noisy and <(t). Moreover, we observe the robustness of the susceptibility metric to the exact choice of the mini-batch in Figure 36 (right).
To better illustrate the match between Train ACC Noisy and (()). we provide the overlaid curves in Figure 37 This figure clearly shows how using Ç, one can detect/select checkpoints of the model with low memorization.
study on different thresholds used to select models We would like to point out that we can tune these thresholds (instead of using the average values of training accuracy and susceptibility over the available models), we can select models with even higher test accuracies than what reported in our paper. For example, for models of Figure [5] by tuning these two thresholds one could reach a test accuracy of 79. 75.15 (instead of the reported 76%) as shown in Figure (39 (left). However, we want remain in the practical setting where do not have any access to clean validation set for tuning, As a consequence, we must avoid any hyper-parameter tuning. And indeed, throughout our experiments, these thresholds are never tuned nor set manually to any extent. Among thresholds that can be computed without access to a clean validation set, we opted for the average values of susceptibility and training accuracy (over the available models) for simplicity. We empirically observe that this choice is robust and produces favorable results in various experimental settings. We could take other percentiles for the threshold, but they are more complex to obtain than simple averages, because they would then depend on the distribution among models. In Figure 39 we study various values percentiles for these thresholds. We observe that depending on the available models and the given dataset, some other percentiles might give higher test accuracies than simply using the average values. These percentiles range however typically from 35 to 55 and are therefore not far from the mean, hence their benefit in increasing test accuracy appears small compared to the increased complexity to compute them or to rely on additional assumptions on the distribution of susceptibility and training accuracy. We observe in Figure 39 (right) that except for very extreme values of the thresholds (which basically select all models as resistant to memorization), the average test accuracy of models in Region is much higher than the averge test accuracy of models in Region 2. Hence, our proposed model selection approach is robust to the choice of these thresholds.
34

---

Published as a conference paper at ICLR 2023
80
mobilenct scale
0.20
Train ACC noiss
mobilenet
60
mobilenet scale 1.5
Susceptibility
0.15
shuffleett22 scale 0.5
shufflenetv2 scale 1
40
shufflenetv2 scale 1.5
0.10
0.05
0.00
100
150 200
50
100
150
200
Epochs
Epochs
Figure 30: Accuracy the noisy subset of the training set versus the susceptibility ((t) (Equation 22) for MobileNet and ShuffleNerV2 configurations trained on CIFAR- 100 with 50% label noise. Pearson correlation between the Train ACC Noisy and susceptibility < is 0.749. Scale is hyper- parameter that proportionally scales the number of hidden units and number of channels in the neural network configuration.
80
alexnet
Susceptibility 5
Train ACC Noisy
resnet18
1.0
resnet34
resnet50
40
vgg16
0.5
vgg19
20
0.0
Epochs
Epochs
(a) Exponential
100
1.5
alexnet
Train ACC Noisy
Susceptibility
80
resnet18
resnet34
resnet50
vgg16
0.5
vgg19
0.0
Epochs
100
150
200
Epochs
150
200
(b) Cosincancealing
Figure 31: Accuracy the noisy subset of the training set versus the susceptibility <(t) for net- works trained on MNIST with 50% label noise. On top and bottom we have models trained with exponent ial and mosineanneal ing learning rate schedulers, respectively. Pearson correla- tion between Train ACC Noisy and for exponent al and cosineannea ing schedules are p 0.89 and p 0.772, respectively.
35

---

Published as a conference paper at ICLR 2023
100
resnet
0.6
Train ACC noisy
resnet+ mesuet+mixup
80
shufflenetv2
Susceptibility
shufflenetv2 mixup
0.4
40
0.2
0.0
100
100
150
Epochs
Epochs
Figure 32: Accuracy the noisy subset of the training set versus susceptibility to noisy labels ((t)
for networks trained on CIFAR-10 with 10% label noise. Pearson correlation between Train ACC Noisy and Ç is 0.634.
100
1.75
resnet
Train ACC noisy
imixup
1-50
Chn
Susceptibility
1.25
60
mobilenetv2
1.00
mobilenety2+mikkn
0.75
20
100
150
200
0
100
150
200
Epochs
Epochs
Figure 33: Accuracy on the noisy subset of the training set versus susceptibility to noisy labels ((t)
for networks trained on CIFAR-100 with 10% label noise. Pearson correlation between Train ACC Noisy and ( is 0.849.
100
Train ACC Clean
Train ACC
000000000
Test
10000
8
Train ACC Noisy
Susceptibility'
(a) With access to the ground-truth label. Average test accuracy of the selected models
(b) Without access to the ground-truth label.
Average test accuracy of the selected models
82.93%
86.08%
Figure 34: For models trained CIFAR-10 with 10% label noise for 200 epochs, using susceptibility C and the overall training accuracy, the average test accuracy of the selected models is comparable with (even higher than) the case of having access the ground -ouund-truth label.
36

---

Published as a conference paper at ICLR 2023
Train ACC Clean
Train ACC
Test
Train ACC Noisy
Susceptibility Ç
(a) With access the ground-truth label. Average test accuracy the selected models
(b) Without access the ground-trutt truth label.
Average test accuracy the selected models
62.61%
64.33%
Figure 35: models trained on CIFAR-100 with 10% label noise for 200 epochs, using susceptibility and the overall training accuracy, the average test accuracy of the selected models is comparable with (even higher than) the case of having access to the ground boound-tuuth label.
Correlation
1.00
Susceptibllity <(
0.25
resnet
mobilenet
0.75
0.20
0.15
0.50
0.10
0.25
0.05
0.00
0.00
10a
50
100
150
200
Size of
Epochs
Figure 36: Left: Pearson correlation coefficient between the accuracy the noisy subset of the training set and susceptibility Ç (Equation (2) for different choices of dataset size for Š for ResNet (He et al., 2016a), MobileNet (Howard et al. 2017). and 5-layer cnn that are trained on CIFAR-100 dataset with 50% label noise. We observe that unless the dataset is very small, the choice of the dataset size Š does not affect the correlation value. Therefore, throughout our experiments, we choose the size 128 for this set, which is the batch size used for the regular training procedure as well. Note that this size very small compared to the size of the training set itself, which 50000, hence computational overhead to compute ( is negligible compared to the original training process. Right: We can observe the variance the susceptibility metric over 10 different random seeds. We can observe that as the variance is quite low, the metric is robust to the exact choice of the mini-batch and to the random labels that are assigned to the mini-batch.
37

---

Published as a conference paper at ICLR 2023
022
densenet
Train ACC Noisy
efficientnet
0.20
Susceptibility ((
googlenet
mobilenet
0.13
0.00
Epochs
Figure 37: Accuracy the noisy subset (solid lines) versus Susceptibility <(t) (dashed lines) for neural networks trained on CIFAR-10 with 50% label noise. We observe a very strong match between the two, which suggests that susceptibility can be used perform early stopping by selecting the checkpoint for each model with the least memorization. For example, for MobileNet and EfficientNet, does
about memorization, hence can select the end checkpoint. On the other hand, for DenseNet and GoogleNet, ( suggests selecting those checkpoints that are before the sharp increases. This is also consistent with the signal given by the on the noisy subset, which requires ground -turth label access, unlike susceptibility Ç which does not require such access.
Train ACC Clean
Region1
Region2
ACC
Train ACC
Region1
Reaion2
Regiosa
Region4
Region3
Regioné
Train ACC Noisy
Susceptibility <
6.2
(a) With access to the ground-truth label. Average test accuracy of the selected models
(b) Without access to the ground-truth label. Average test accuracy of the selected models
66.793%
66.307%
Figure 38: For models trained for 200 epochs CIFAR-10 with 50% asymmetric label noise as proposed in (Xia et al.] 2021). using susceptibility and the overall training accuracy, the average accuracy of the selected models is comparable with the case of having access the ground-truth label.
38

---

Published as a conference paper at ICLR 2023
12 Percentile Treining ACC
Percentile of Treining ACC
Test Accucary Difference
Test Accucary
-000
Percentile Susceptibility
Percentile Susceptibility
Figure 39: Left: Average test accuracy of models in Region of Figure for various thresholds used find Region 1. In Figure and throughout this paper, Region has models with susceptibility ( tI and training accuracy > 12, where tI and 12 are average Ç and training accuracy over the available models, respectively. Here, we study different values of these thresholds and t2 and their effect on the average test accuracy of models of Region 1. We explore different percentiles of Ç and training accuracy over all models be used find these thresholds. The extreme would be to have 100th percentiles for both thresholds (low rightmost item of this table), which means models of Region have Ç maximum susceptibility and training accuracy > minimum training accuracy. In this extreme case, all models selected in Region 1. Overall, might give higher test accuracies than simply using the average values. These percentiles range however typically from 35 to 55 and therefore not far from the mean, hence their benefit in increasing test accuracy appears small compared to the increased complexity to compute them or to rely additional assumptions difference in the average test accuracies of models in Region I and models in Region 2 for various values of percentiles used to find different regions. positive value implies that models in Region 1 have higher average test accuracy. We can observe that except for very extreme values of the thresholds. which basically select all models as trainable, the average test accuracy of models in Region is much higher than the average test accuracy of models in Region 2. Hence, our approach select resistant and trainable models is robust to the choice of these thresholds.
observe that some other percentiles
the distribution of susceptibility and training accuracy. Right: The
39

---

Published as a conference paper at ICLR 2023
G THEORETICAL PRELIMINARIES
In this section, we provide some technical tools that we use throughout our proofs. Recall from Section 2 that the first layer weights of the neural network are initialized
(, N (0, 1²). Vr E [m/]
where 0 < A I 1 the magnitude of initialization and / denotes the normal distribution. And the second layer weights a,S are independent random variables taking values uniformly in {-1, 1 at initialization.
G.1 PROPERTIES OF THE GRAM-MATRIX
Properties Here, we recall a few useful properties of the Gram-matrix (Equation
1. As shown by (Du al. 2018 o is positive definite and Ag Amin (H >
2. The matrix H has cigen decomposition H >i= Avv.y"" where the eigenvectors orthonormal. Therefore, v V وú, for j, E [n]. the x n identity matrix I is decomposed
as >>= v.v. and any n-dimentional (column-wist vector y can be decomposed as I y
> i= yv.T)v,,
3. (Recalled from (uu et al. 2018
Arora et al. 2019)) We have H
1l2 S tr(H =
Σ λ₁, and
Ag 0 n
Amin (
0
H 11
Hence,
112
1 -
G.2 COROLLARIES ADAPTED FROM (Du ET AL.
2018
ARORA ET AL., 2019)
Corollary 1. (Adapted Theorem 3.1 of (Arora et al.
2019) to our setting) For m =
and
O (22) ( for any 8 E (0, 1}, with probability at least
over random initialization
& ((((0) 0 (
and
① (W(t+ 1)) < (1 - nde
2 & W(t)).
ft
+ (W(t+ 1)) < (1 ndo (W(t))
f k
Therefore, by replacing Equations
I and T throughout the proof we can use:
(w)))) >112 0 (V²
and
(w((ta)-1 - -1112
[Ewc)) - -8112
5
1
Ddo
||Ew(O -112 if0 <tk,
4
[Ew(+1)) - -
1
ndo 4
||EwC) -5112
ft
where we use inequality VI- a/2, which holds for 0 S a 11
Corollary 2. (Adapted from Equation (25) of Arora et al.
2019)) If the parameter vector is updated
step by one gradient descent step on 1/4 [| u 1| for some label vector u, and for such that with probability at least 1 6:
n
H(t)) - ((00)
(
VmL
40

---

Published as a conference paper at ICLR 2023
then the output of the neural network is follows
[w(++1) fw() = - (fw()) - u) + E(t),
where 5(-) considered to be perturbation term that be bounded with probability at least over random initialization 7 by
[| (
Tp
|6(())22 0
-u112
(8)
Remark: our setting, this corollary holds for 0 < t < k with u = y, and for <t with y. We only need show that for setting for 2 k. H(t) H()l bounded, which is done in Lemma 3
Corollary 3. (From Equation (27) of (Arora et al. 2019 We have for 1 istsk
fw()) - = -I- (fw(o) - y)
E(- 1),
8=0
where (15(-)122 is some perturbation term that can be bounded using Equation
8 with u =
G.3 ADDITIONAL LEMMAS
Lemma 1. For the setting described in Section 2 we have
fw(k) - y (vTT) - (vTy) - (vT3)) v, + x(b),
where x(k) is some perturbation term that with probability at least 1 8 over the random initializa- tion 7
1/3/2K
9/2
lIx(k)]l2 =
(10)
Vodo
VMA3RR0
G.3.1 LEMMAS TO BOUND H()) WITH D
Because the two datasets S and have the same input samples, the Gram matrix defined in Equa- tion is the same for both of them. We now recall lemmas from (Du al., 2018 Arora et al. 2019 and provide lemma extending them to bound H(t) with H where
H1
(1),
and (t) = I[W (t)x; 0).
Lemma 2. (recalled from (Du et al. Ω n
2018 Arora et al.
2019)) For No Amin (II 0, m
Agxa8a and 17 O (2a with probability at least
8 over the random initialization for
all t S k, we have:
(
n
H(t - H(O]] =
(
Lemma 3. (Our extension) For No Amii (oii( m Ω
and v ( with
A
probability at least 8 over the random initialization for all le + S t S k + k. we have:
((t)) - H(O)) =0
(0
72
41

---

Published as a conference paper at ICLR 2023
Lemma 4. (recalled from (uu et al. 2018 the random initialization
Arora al. 2019
With probability at least 8 over
we have:
ny ny log m
H()))
H 1 =0
Remark for Lemma The indicator function [tw, 0} is invariant to the scale of w,- hence (0) = H even though the expectation on the left hand side is taken with respect to
x,
~ (O, I) and the expectation on the right hand side is taken with respect to w ~ (0, I).
H PROOF OF LEMMA 3
Proof. We recall from the proof of Lemma C.2 of (Arora et al. 2019) that if with probability at least
1 6, [w, (r) I R, then with probability at least 8, we have ||H(()) H(O))l S
4n R.
+ 2nd
So, first find an upper bound [[w,(() w. for & k and replace its value
V2
m
R in An2R 2n
To find an upper bound on (() w, (0) for / >> kt, we can follow similar approach as in the proof Lemma C.1 of (Arora et al. 2019):
[[w,(t) - w. (0)l2 S
ww (T + w
(T wr-(r)l2 +
(r. + -
1-1 n
[(w() - -y/12 + Σ
[wwC)) - F112
vm
(Ew(o) - -x112
Vm
4
VV
1110
1
[[w(()) - -512
Vm
mm
17
V
T=0
1710
T-k
- 2112 + l1y y112]
Vm
IAG
m
k-1
M7Au
mm
[-k
n7d0
1
+0
1
Vmo
4
Vmd
4
T=U
T=0
m
n
0
(11)
Vmà
4
where (a) holds because for an update step on label vector u according to gradient descent, we have
w.(T + 1) - wr( ||
v
(Iw())xs)) - u4) (k)x,
1=1
7 m
Σ [xi)) - -uil
nyn vm
[fw(r) -u/l,
42

---

Proof. Note that throughout the proof, we refer to events with probability least 5, as high probability events. Using the union bound, the probability of intersection of a high-probability events an event with probability at least ad. Therefore, we can again refer to this event as a high probability event with probability at least - 5, but re-scale ò in the event accordingly. Because only appears on bounds of the perturbation terms, and therefore in the form of 0 ) then re-scaling ó would not change the order of these perturbation terms. Hence, throughout the proof we do not Published as a conference paper at ICLR 2023
inequalities (b) and (c) use Corollary so again by using Corollary
Inequality (d) holds because have | S
and l3s
[[EWCC)) - -112 by yll S
7
O
n +
+0(V))
(0
(12)
(
Therefore, with probability at least over random initialization
for
4n²R
2n
3
H(()) H(O))lr S
V2
1AA083/2/m
where we replaced A with the upper bound in Equation
PROOF OF LEMMA 1
put concerns on the exact probability of events, we only refer to them as high probability events, and eventually we know that the probability of computations is at least 1 over the random initialization Equation
Because Lemma holds for L -
Corollary with L k and y:
fW(()) fW(A-1) - H (fw(k-1) - y) E(K 1),
where with probability least 1 - δ
\m>ond8772 ( [[W(K-1) -1112
Ik 1)ll2 =
because of Equation 8 We then compute
[W(K) y fw(k-1) - r/ (fw(k-1)- yy) + E(k 1)
k-1
k-1
= -wi() - -n Σ
H (fwice) - y) + Σ E(L)
(13)
==
1=
Let
x(k) 7 Σ H (I 7/ fw(n
k-1 ΣΣ (I (I -- 1)+
k-1 E(t) + fw()
(14)
1=
Then Equation
13 becomes:
k-1
fw(K) - - == Σ H (I - o y + x(k).
(15)
1=0
where we have replaced Pw()) y for 1 < ( < k in Equation 13) using Corollary 3 by
(I - 1 (fwro) -y) + Σ (I
n 0 E(t- - s-
==0
43

---

Published as a conference paper at ICLR 2023
Next, would like to find upper bound for [Ix As shown in Du al. (2018 Arora et al.
(2019), with probability at least 5 over random initialization (7) we have
[wwo
l12 -
n 5
(16)
The first term in ( (Equation [4 is bounded because of Equation (66] from above with high probability
Σ t=
H (I-n WWO)
H
H 11' fw(())
Vvn
(1
no0o'0 0
1=0
k
VoAO
where the second inequality uses Property 3 The second term of x{k) in Equation [14 can also be bounded with high probability by
(1-n H E(t --11) 1)
| 12 ||- IIE(1 8 1)ll2
mm3
(1 '10
[| - -1112
VmAuKo03/2
n
(1 7
m
(I- 17.0
(v n
VmAuk88/2
V
==0
1 9/2
1
1710
x-a-1
(1 n7o
4
n/2
nnd
1-1 1-1-1 1-1
1 - n7uo
0
Vmdgk882
4
n//o/4
n/22/2
n7
1-1
17:00
( 1 (1-72o
ndo
) I
|
4
37120
1 1-
n/2
(4 - n7A1)
k-1
1 11A0
4 ) (1 - n)o
0
mm
(3mdo)
(1
7uu04 44)
1=1
n/2
4
(1
/4/
1 (1 - */
Vmdgk5
3m
7//0/4 /
n/
<0
VmAjk88
where (a) uses Property algebraic tricks.
3 and Equation 8 (b) uses Corollary
and the rest of the computations
44

---

Published as a conference paper at ICLR 2023
The third term of x(k) in Equation (4
can be bounded with high probability using Equation 8 by:
k-1 Σ
R-1
E(t)
[6(1)12
Σo
|[Ewee) - -1122
t=
1=
0o
mm
(v
11
k-1
1/20
Vmdono3/2
4
t=0
n2/2
0
VmA3R882
where we use Corollary Summing up. and using Equation high probability:
16 to bound the last term of Equation
14
we showed that with
n 3/22
n 9/2
7/2
Vnk
1x(h)lg
0o
Voāo
+
Vm2Bk882
Vmi2r182 +
v8
n//
9/2
=0
(17)
vōAo
We now reformulate Equation (15) in terms of the eigenvectors and eigenvalues of the Gram matrix (Equation (3) as follows, by repeatedly using Property 2
(w(())
Σ
H (I
nyy +((()
k-1
Σ
(1-
Σ (y Σ (
1=1
x nAy
Σ
(1- 7 Σ +
X (1- (1-クン)) (TM) Σ +.
1=
1=1
I - (1 (1-1112)) (VTy),. - Σ +
1=1
Σ - (1 (1- (vTy) (v))) v. + x(,),
-1-))
(18)
where in (a) with some abuse of notation ōi, and و/.- refer to the Kronecker delta function. This concludes the proof.
J PROOF OF THEOREM 1
Proof. We start similarly to the proof of Lemma Because for t = k: + Te Lemma holds, using
Corollary for t. = le + and u = y, we have:
Bw(k+R) - ( - (fwAAtR-1- -8) 3)+ + E(k + T. 1),
45

---

Published as a conference paper at ICLR 2023
where from Equation 8 with high probability
[((k + k- -1)111/ =0
(Vmdgko312 )
mm
(wiRth-1) 88112-
Therefore, recursively we can write:
W(*+B) - y -w - - (fw(Eth-1)-88 -8) + E(k + 1)
=(1 (1-1)1?)) (fW(R+E-1) + E(k + --1)
k-1
= (I - - (fw(A)) -8) +
(I nn 1 E(k: k 1- -)
1=0
= (I - pooe
y y-
Σ
(1 - ndn (v.y) v. + x(())
i=1
1/ H E(K + k - - 1)
1=
= (I Hoo
y y- -
Σ (1 - n)2s)* (vfy) v;
i=1
k-1
+ (I - 1
x(k) + Σ (1 ,
(k + (
(19)
where the 4th operation follows from Lemma Now, we find bounds for the perturbation terms. Let
K = 0 EVōāAo 31322
n
m = 2
(20)
2
22
Then, using Lemma[] the first perturbation term of Equation
19 is upper bounded as
n3/22
n 9/2
[a- H x(k) 2 (1 ~ 0
+
V52D
Vm
= (11 md00&e)) O(e).
46

---

Published as a conference paper at ICLR 2023
where the last line comes from inserting our choices of K and from Equation (20). The last term of Equation (19) can be upper bounded with high probability as
H y E(K: k - 1)
S
Σ
7f
H
C([ + k- -1) 1)11
(1 1--no 7
mm
[ -311 3812
VmAAnt53/22
mm
k-1
(1 noo
(1-14)
17000
k-1-t
[[W(R) -5112
Vmdgne83/2
4
k-1-t
(1- 17200
(1 (1-1A0)
[|| [[ - -x112 + 11 1--y -ylla
VmAoR88/2
Tm
(1 (1-
11A00
R-1-t
0 V (V²))
]
(1 n7do)*
VmAnk53/2
4
1m7/2
1/A0
k-1 k-1
1 11o0
Σ
Vmdono8
4
1//0/4
t=
4
7m2/2
7/7/2
(1)
Ane
O
= 0
37720
VmAgkk82
/miAfr02
where (a) uses Property 3 and Equation (8. (b) uses Corollary 1 and (c) uses Equation 12 Finally
(d) follows from inserting our choice of m from Equation (20). Because we have Σ X n/2
from Property 3 and Ào mi then λ S 1/2. Both perturbation terms in Equation 19) are
therefore at most in the order of e with our choices of m and k from Equation
20
Using Property the squared norm of the first term in Equation 19 is
2
Σ (1 n2,1 (v.y) (1 7A," (vTT) (v/
v.
Σ ΣΣO (1 n21) / [(vTy) (1 n2) (1fi)) (1/3)
1=1
(1 (1- 1- [(v)T)) (1 - 11 (,fi)) - (1/8) v.'v;
= Σ (vr')) - (1 nA,1) (v5r)) - (
(1 - n72.)
(21)
The norm of Equation 19 is therefore, for our choice of x and m given in Equation probability at least 1
20 with
(
V. V. (1 me vTyp (1 12, te,
+e,
which concludes the proof.
K
PROOF AND NUMERICAL EVALUATIONS OF THEOREM 2
Proof. Because Vi U((-1,1)) and Ū5 1 Jú for + j. and ||vlll2 1, for i [n], we have:
12
n
12
E
Vo ViR
Yi. V.
F=1
47

---

Published as a conference paper at ICLR 2023
Recall from Equation 4 that
(k+ R)) 2 _
P. P: (1 n2,)))² (1 (1-m)d,) (1-n2,)
This expression is random variable that depends on random vectors p and which are functions of the random label vectors and y, respectively. We now compute the expectation of the above objective function with respect to p and
Φ + k)]
Σ
E
1- (1- mZi)* (1 (1-))
p.
Σ
E [p
(1 n)d:)) )
Σ
R (prii]
1 1 (1 -111))))) (1-1)d,)a
Σ
E [p
[ 1 1- (1 (1 m7:i)
+
Σ (1 - 172,)22
2 1=1
2 i=1
Σ
Va. V. [u
[ (1- m)a)* (1 - (1-122-22
2=1
j=l k=1
= 2" (1 (1-1));) 122
(22)
where follows with μ given by Equation 5). and because 3 1 yıe for all j. E [m].
Because of Chebyshev inequality and Equation with probability at least 1 - 8, we have:
(kk - k)
Σ
(1
m/A:)) 2
(23)
2 1=1
where
= Varp
t + k))
(24)
which concludes the proof.
Numerical Evaluations We now empirically evaluate the lower and upper bounds in Equation 23
for networks trained on label vector y with varying label noise levels (LNL). To do so, we discard the
middle term of the left hand side of Equation (23). as it does not depend on y. We then study the rest
in Figures 40) [41 42 and [43 for different datasets and values of 1) and k. We observe consistently that
both the lower and the upper bounds are a decreasing function of the label noise level (LNL. in the label vector y.
48

---

Published as a conference paper at ICLR 2023
1.
135
10
3P1
Epoch (k)
Epoch (R)
Epoch (R)
(a) A = 100
(b) lt 1000
(c) A: 10000
10-3
100
14 0.330
0,5%
Epoch (k]
Epoch (k)
Epoch (k)
(d) l: 10
(c) l: 100
(f) k 1000
Figure 40: The lower (dashed lines) and upper (solid lines) bound terms of Theorem that depend on the label noise level (LNL) are depicted hyper-parameter values (the learning rate 7) and k) with 5 = 0.05. The eigenvector projections p; that appear in f and Σ are computed from the Gram-matrix of 1000 samples from the MNIST dataset. The resulting values are obtained from an average over 10 random draws of the label vector y. We observe that both the lower and the upper bounds of Equation (23) are decreasing functions of LNL and of
function of the number of epochs k for different
0332
10
1:/2
In by
2.14
6000
630
105
1000
1000
0200
14002
Epoch (R)
Epoch (k)
Epoch (A)
(a) k = 100
(b) l: = 1000
(c) = 10000
In
RJN
100
Epoch
Epoch
(d) l: 10
(c) l: 100
(f) 1: 1000
Figure 41: The lower (dashed lines) and upper (solid lines) bound terms of Theorem 2 that depend on the label noise level (LNL) are depicted as function of the number of epochs k. for different hyper-parameter values (the learning rate 1) and k) with 5 = 0.05. The eigenvector projections that appear in y and Σ are computed from the Gram-matrix dataset. The resulting values are obtained from average over 10 random draws of the label vector y. We observe that both the lower and the upper bounds Equation (23 are decreasing functions of
1000 samples from the Fashion-MNIST
LNL and of k.
49

---

Published as a conference paper at ICLR 2023
14 -1300
#1
2.9
0.31
0331
0300
(k)
Epoch (K)
Epoch (K)
(a) k = 100
(b) A: 1000
(c) 10000
11 10-3
191
Id
200
Epoch
Epoch (A)
Epoch
(d) 100
(c) A: 1000
10000
Figure 42: The lower (dashed lines) and upper (solid lines) bound terms of Theorem that depend on the label noise level (LNL) are depicted as function of the number of epochs k for different hyper-parameter values (the learning rate 7) and k) with 5 0.05. The eigenvector projections pt that appear in μe and E are computed from the Gram-matrix of 1000 samples from the CIFAR-10 dataset. The resulting values are obtained from an average over 10 random draws of the label vector y. We observe that both the lower and the upper bounds of Equation (23) are decreasing functions of LNL and of k.
10
0.55
Epoch
Epoch
(a) 100
(b) le 1000
10000
10-3
16
220
13
Epoch
Epoch (R)
Epoch
(d)
(e) k 1000
10000
Figure 43: The lower (dashed lines) and upper (solid lines) bound terms of Theorem that depend on the label noise level (LNL) are depicted as function of the number of epochs k. for different hyper-parameter values (the learning rate and k) with 8 0.05. The cigenvector projections p; that appear in and Σ are computed from the Gram-matrix of 1000 samples from the SVHN dataset. The resulting values obtained from average 10 random draws of the label vector y. We observe that both the lower and the upper bounds of Equation (23) are decreasing functions of LNL and of k.
50


Reviews:
[{"review_id": "jxkfz9Q3WT9", "reviewer": "Reviewer_ZDzu", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new metric, called susceptibility, along with training acc to select good models trained on datasets with label noise. Authors observe that models with high training accuracy and low susceptibility will lead to higher acc on the clean test set. The authors also provide a convergence analysis of their methods.\n\n", "summary_of_the_review": " -I like the motivation. But currently, this paper fails to convince me that their metric is useful in practice. (See weakness). \n\n", "strength_and_weaknesses": "Strength: \n\n - Interesting and well-motivated idea. The proposed susceptibility is verified on many datasets including CIFAR, MNIST, and CLothing1m.Ting-ImageNet and Animal-10N.  \n\n - This paper is well written and easy to follow\n\nWeaknesses:\n\n - [1] already shows that the noisy validation is reliable. The authors state that [1] can not lead to comparing two trained models. However, from the experiments in [1], it seems that the models with higher acc on noisy validation also have higher acc on clean test acc. I think if the authors want to prove the efficiency of susceptibility. More experiments should be done to compare with [1]. From my perspective, it is hard to use susceptibility in practice since one also needs to set some threshold to remove models with higher susceptibility.\n\n\n[1] Robustness of accuracy metric and its inspirations in learning with noisy labels. AAAI 2021.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "UuZ4yHBow7M", "reviewer": "Reviewer_E6P4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a metrics called \"susceptibility\" that measure the model's resistance to memorization by using randomly labeled data. The authors provide both theoretical and empirical observations that the models which are resistant to memorization will have high test accuracies. Therefore, the extent of memorization to noisy labels can be used for picking models. The authors demonstrate how to pick models based on the values of susceptibility and training ACCs. \n", "summary_of_the_review": "This paper introduces an interesting metric, and the authors justify that the metric is useful for selecting models. However, I feel the correlation or the relationship between the metric and the final performance is vague (or at least need to be better illustrated). ", "strength_and_weaknesses": "Strengths: \n\n- The paper is well-motivated and the presentation is clear. \n- The experiments are extensive. \n- Theoretical understanding is also provided.\n\nWeakness & Questions:\n- The method for picking a \"good\" model is slightly ad-hoc. The thresholds to separate regions are obtained by fitting a lot of models and then find the median. Therefore, for different datasets and models we need to repeat this process. More specifically, in Figure 5 the accuracy threshold is 40% and in Figure 15 it is 50%. The difficulties in deciding these values make the practical benefit of the proposed method questionable. \n- What is the optimal value of \"susceptibility\" if we want to achieve good performance? It seems that there would be an optimal range, but is it possible to clearly find such a point that can achieve the best performance?  Ultimately, can the \"susceptibility\" be a predictive indicator for the performance? \n- Can we use \"susceptibility\" to regularize the models' training rather than just observe? ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "DR6dwCOMM9", "reviewer": "Reviewer_QKAt", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "It has been an convention that uses noisy validation seperated from training set to determine the model performance trained on dataset with label noise. The authors claim that noisy validation is not efficient and thus proposes a new evaluation protocal based on the susceptibility which meaures the difficulty for model to fit on a random labeled set.  Combining \"susceptibility\" with training accuracy can select good models that performs well on clean test set.", "summary_of_the_review": "The proposed metric is intersting. The results make sense but I find it hard to use the proposed metric to guide training in learning with noisy labels.", "strength_and_weaknesses": "**Strengeth:** \n\n- Using random labeled dataset to track memorization is new and interesting. The efficiency of susceptibility is supported by extensive experiments on multiple datasets including synthetic label noise and real-world label noise.\n\n- The proposed metric is supported by theoretical analysis.\n\n**Weakness:**\n\n- It would be better to perform some experiments based on instance-dependent label noise [R1].\n\n- This paper proves that a model with higher acc and lower susceptibility has better performance. But in pratice, it is hard to decide when should I stop training based on susceptibility and training acc. It seems one needs to set some specific thresholds to guide decision. Why noisy validation is not enough to guide decision since [R2] shows that the acc of noisy set is also robust.\n\n\n[R1] Learning with bounded instance-and label-dependent label noise.\n\n[R2] Robustness of accuracy metric and its inspirations in learning with noisy labels. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "0mZYGbmTNXj", "reviewer": "Reviewer_QseH", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a novel susceptibility metric to trace the memorization of noisy signals when the model is trained on a dataset with noisy labels. The computation of this metric does not require ground-truth labels. Both empirical evidence and theoretical analysis are presented to support the intuition behind this metric. Moreover, the authors conduct extensive experiments to demonstrate the effectiveness of this metric across different network architectures, datasets and noise types. ", "summary_of_the_review": "The finding of the relation between memorization and the easiness of fitting to a randomly-labeled held-out set is interesting from both theoretical and empirical perspectives. The proposed susceptibility metric is simple yet practical. Though the investigations could be extended in more depth, I would like to recommend the publication of this work.\n\n\n------------------20221123----------------\nAs my concerns are all addressed by the helpful discussion with the authors, I decided to increase my rating from 6 to 8.", "strength_and_weaknesses": "Strength:\n- The proposed susceptibility metric is novel and interesting. \n- Both empirical results and theoretical analysis are included to support the intuition that good models are resistant to memorization.\n- The authors carried out extensive experiments to demonstrate the effectiveness of the proposed susceptibility metric.\n\n\nWeaknesses:\n- The discussion on different noise types is not sufficient. Only one kind of asymmetric noise is considered, and only the average test accuracy of the selected models is provided.  The basic idea of this paper is to connect the easiness of fitting one noisy signal (in the held-out set) and the memorization of the other noisy signal (noisy subset in the training set). Mostly, the paper assumes the two noisy signals are of the same type, i.e., produced by randomly labeling. However, it is likely the type of noisy signal could play a crucial role. If the noise type in the training set is completely different from the one in the held-out set, e.g., the feature-dependent noise, the corresponding susceptibility metric may not be able to reflect the memorization within the training set faithfully.\n- The dependence of the effectiveness of the susceptibility metric on network architecture is not fully explored and discussed. For example,  the susceptibility metric is not that discriminative for the 5-layer CNN as shown in Fig.7 of the paper. Why is it so? In addition, it would be better to include more recently popular architectures such as the transformer. \n- In section 4, the division of the train ACC - Susceptibility space into four regions is interesting. However, I did not find anywhere in the paper mentioning how to choose the threshold for the division. \n- The discussion on different label noise levels is insufficient. The low label noise level situation deserves more emphasis since the noise levels of real-world datasets are not likely to be as high as 50%.\n- Presentation:\n    - Fig 1 needs better resolution.\n    - Symbol [m] is used without a definition.\n    - At the end of section 2, please indicate that the fully extended analysis is placed in section 5.\n    - Symbol in Algorithm 1 could be confusing. t indicates the index of the epoch of normal training. However, at epoch $t$ the weight \\tilde{W} is indexed with $t+1$. I understand that this refers to the “single optimization step” on $\\tilde{S}$. Nonetheless, it is weird to have an index $t+1$ in the $t$-th epoch.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster