Gradient-Free Adversarial Training Against Image Corruption for Learning-based Steering
Authors: Yu Shen
Laura Yu Zheng
Manli Shu
Weizi Li
Tom Goldstein
Ming Lin
Venue: NeurIPS 2021 Poster (2021)
Keywords: robustness
autonomous driving

Abstract: We introduce a simple yet effective framework for improving the robustness of learning algorithms against image corruptions for autonomous driving. These corruptions can occur due to both internal (e.g., sensor noises and hardware abnormalities) and external factors (e.g., lighting, weather, visibility, and other environmental effects). Using sensitivity analysis with FID-based parameterization, we propose a novel algorithm exploiting basis perturbations to improve the overall performance of autonomous steering and other image processing tasks, such as classification and detection, for self-driving cars. Our model not only improves the performance on the original dataset, but also achieves significant performance improvement on datasets with multiple and unseen perturbations, up to 87% and 77%, respectively. A comparison between our approach and other SOTA techniques confirms the effectiveness of our technique in improving the robustness of neural network training for learning-based steering and other image processing tasks.

Gradient-Free Adversarial Training Against Image Corruption for Learning-based Steering
Yu Shen University of Maryland College Park, MD 20742 yushen@und. edu
Laura Zheng University of Maryland College Park, MD 20742 lyzhengGumd edu
Manli Shu University of Maryland College Park, MD 20742 manlis@und edu
Weizi Li University Memphis Memphis, TN 38152 <li@memphis. edu
Tom Goldstein
Ming C. Lin University of Maryland College Park, MD 20742 linecs. umd. edu
University of Maryland College Park, MD 20742 tomg@cs umd edu
Abstract
We introduce a simple yet effective framework for improving the robustness learning algorithms against image corruptions for autonomous driving. These ruptions can occur due to both internal (c.g., sensor noises and hardware abnormali- ties) and external factors (e.g., lighting, weather, visibility, and other environmental effects). Using sensitivity analysis with FID-based parameterization, we propose a novel algorithm exploiting basis perturbations to improve the overall performance of autonomous steering and other image processing tasks, such as classification and detection, for self-driving cars. Our model not only improves the performance on the original dataset, but also achieves significant performance improvement on datasets with multiple and unseen perturbations, up to 87% and 77%, respectively. A comparison between our approach and other SOTA techniques confirms the ef- fectiveness of our technique improving the robustness of neural network training for learning-based steering and other image processing tasks.
Introduction
Autonomous driving is complex task that requires many software and hardware components to operate reliably under highly disparate and often unpredictable conditions. this work, we study "learning-bar based steering" as it contains both perception and control, both critical components for autonomous driving. While on the road, vehicles are going to experience day and night, clear and foggy conditions. sunny and rainy days, well bright cityscapes and dark tunnels. All these external factors in conjunction with internal factors of the camera (c.g., those associated with hardware) can lead to quality variations in input data for image-based learning algorithms. One can harden machine learning systems to these degradations by simulating them at training time [6]. However, algorithmic tool for analyzing the sensitivity of real- real-world neural network performance on the properties of (and corruptions to) training images is lacking. More importantly, a mechanism leverage such sensitivity analysis for improving learning outcomes needs be developed. In this work, we quantify the influence of image quality on the task of "learning to steer," study how training degraded and low-quality images boost robustness image corruptions, and provide systematic approach to improve the performance of learning algorithms using quantitative analysis.
Image degradations can be simulated by varying attributes such blur, noise, distortion, color representations (such as RGB or CMY) hues, saturation, and intensity values (HSV). However, identifying the correct combination of the simulated corruptions to obtain optimal performance
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

Data Generation
Pertubee Datased Oi
Pemurbed Dataset Dul
froquoncy space
Perturiation
Propenny
Oiginal baokbone ploof spaco
Base Dataset
Perturbes Dataset
Faret goa)
hadl
Resuls
Pr
Parturbation
Doce Datbeet
Sersitivity Andlysis
Training Process
Start
Pertubot Dataset Di:
Pertutted Datiset Dis
Portubbed Dataset Cip
Achersarisl
Learning
Post Learning
Prasses
Start
Farturbed
Penatter Dotaset
Frocess
Donti
nLC
End
Yes
Pipeline of method. Data generation. We generate perturbed datasets of each factor multiple levels based on the FID- ilDapaameterized sensitivity analysis results. Training process. First stage: in each iteration, first augment the training dataset with "adversarial images" generated by applying an image corruption; we then combine the base and perturbed datasets to train our model to maximize the overall performance. A requenncysspace branch is added to the backbone when frequency-related perturbations (e.g.. blur, noise) need to be handled. Second stage: in post-learning, the model is fine-tuned solely on clean data to boost accuracy, while performing validation both clean and perturbed data with early break when overall performance decreases to maintain the performance on the perturbed data.
Figure I:
real data a difficult-if not impossible task, requires domain transfer and exploring a high dimensional parameterized space.
We design systematic method for measuring the severity of image degradation and predicting the impact of such degradation on model performance. Inspired by the use of image feature variance in sensitivity analysis [33], measure the difference between real-world image distributions and simulated/degraded image distributions using Fréchet Inception Distance (FID). Our results confirm that FID can help predict the performance of model trained using simulated data and deployed in the real world. Next, we use FID between different simulated datasets as a unified metric to parameterize the severity of various image degradations due different factors.
Borrowing concepts from the adversarial attack literature 28 35 43 we build a scalable training scheme for enhancing the robusiness of autonomous driving against various combinations of image degrudations, while increasing the overall uccuracy of the steering task on clean data. Our proposed method constructs dataset of ad adversarially degraded images by applying optimization within the space of possible degradations during training. As shown in Fig. [ the method begins by training on set of real and simulated/degraded images using arbitrary degradation parameters. During each training iteration, the parameters are updated to generate a new degradation set so that the model performance is (approximately) minimized. The network is then trained these adversarially degraded images to promote robustness. A post-training step is applied to further improve the FID-
performance clean data without weakening robustness. Our proposed algorithm based parameterization to discretize the search space of degradation parameters and accelerates the process of finding optimal parameters.
Experiments show that our algorithm improves the performance of "learning to steer" up to 97% in mean accuracy over baselines, and especially improves the performance on datasets contaminated with complex combinations of perturbations (up to 87 %... It additionally boosts the test performance on degradations that are not seen during training, including simulated snow, fog, and frost (up to 77%). We also compare our approach with other SOTA techniques (e.g., data augmentation and adversarial training) visual processing tasks such as detection and classification. Our method consistently achieves higher performance. In addition, our method is easy to implement and can be readily integrated with other frameworks such object detection, classification, regression, etc.
Finally, we propose comprehensive robustness evaluation standard under four different scenarios: clean data, singlc-petturbation data, nulti-pprtuurbation data, and previously unseen data. While

---

state-of-the trrt studies usually conduct testing under one or two scenarios (e.g., ImageNet-C (20). our work tests and verifies results under four meaningful scenarios. We plan to release code and datasets for benchmarking "autonomous driving under perturbations" using unseen factors such as image corruptions in ImageNer-C [20]. totaling 480 datasets and 26M images.
2 Related Work
The influence of noise and distortion on real images for learning tasks has been well explored. For example, researchers have examined the impact of optical blur on convolutional neural networks and present a fine-tuning method for recovering lost accuracy using blurred images [41]. This fine-tuning method resolves lost accuracy when images are distorted instead of blurred [49]. While these fine- tuning methods are promising, Dodge and Karam [T] find that tuning to one type of image quality reduction effect would cause poor generalization to other types of effects. The comparison of image classification between deep neural networks and humans shows similar performance on good-quality -uallityy,
images [12]. However, deep neural networks struggle significantly more than humans distorted, and noisy images. One study shows that adversarial perturbations are more prevalent in the Y channel in the YCbCr color space of images than the other two channels, while perturbations in RGB channels are equally distributed [29]. Wu et al. 42 studies the effect of Instagram filters on learning tasks, and introduces lightweight de-stylization module that predicts parameters used for scaling and shifting feature maps to "undo" the changes incurred by filters.
Researchers have also explored how to improve the robustness of learning algorithms under various image quality degradations. One recent work provides a novel Bayesian formulation for data augmentation [39]. Cubuk et al. [9] proposes an approach to automatically search for improved data augmentation policies. Ghosh et al. [17] analyzes the performance of convolutional neural networks on quality degradations due to compression loss, noise, blur, and contrast, and introduces method to improve the learning outcome. Another work [21] shows that self-supervision techniques can be used to improve model robustness and exceeds the performance of fully supervised methods. A recent method, Aug.ix [22] improves model robustness using data augmentation, where transformation compositions are used to create a new dataset that is visually and semantically similar to the original dataset. AugMix is compared to several other augmentation methods, which comprise Cutout [10), MixUp 45, and CutMix 44]. Gao et al. [4] proposes technique to re-purpose software testing methods to augment the training data of DNNs, with the objective to improve model robustness. A recent work improves model generalizability by first augmenting the training dataset with random perturbations, and then minimizing worst-cast case loss over the augmented data [18].
Our work differs from these studies in several regards. First, we simulate adversarial conditions of image factors instead of using commonplace image conditions. Second, we conduct a systematic sensitivity analysis for preparing datasets that are representative of image degradations from multiple factors at various levels. Third, our algorithm can work with the discretized parameter space while generalizing well to the continuous parameter space. Another advantage of our approach is that we can augment the training dataset without the derivatives of the factor parameters, which may not exist or are difficult to compute.
3 Background and Setup
Task. Our target task is end-to-end steering: given a single image input (e.g. captured by front-facing camera on a self-driving car), output a steering angle that drives the car safely on the road [4) A steering angle of 0 represents the forward direction. We use mean accuracy (MA) to evaluate the task since it represents overall performance under a variety of measures (See Sec. (5).
Datasets. We choose four real-world driving corpuses our datasets: Audi [16] Honda K1 Waymo (37), and SullyChen [7]. The Audi dataset is the most recent (2020); the Honda dataset has 100+ long-time driving videos; Waymo includes many environmental conditions such as weather and lightening and is a large dataset (390k frames for perception); and the SullyChen dataset focuses on the steering task and has the longest continuous driving image sequence without road branching. The details of these datasets are provided in Appendix A.3 Other datasets, such as CIFAR-100, for various computer vision tasks are also used to demonstrate the generalizability of our technique.
Basis perturbation. We study nine basis perturbations: blur, noise, distortion, three-color (RGB) channels, and hues, saturation, and intensity values (HSV). Blur, noise, and distortion are among the most commonly used perturbations that can directly affect image quality. R, G. B, H, S, V channels chosen because they are frequently used to represent image color spaces: RGB represent three
3

---

Blur
Noise
Distortion
low
Severiy
high
Figure 2: Example images quality degradation. Left: Five levels of quality reduction using blur, noise, and distortion effects (three levels are shown). Right: The original images shown the middle row. The top row shows examples in the lighter direction per channel for R. G. B. H. S, V, while the bottom row shows examples in the darker dircction per channel.
basic color values of an image, while HSV represent three common metrics an image. Other color spaces such HSL or YUV have similar properties, hence excluded.
We use Gaussian blur 2 (parameterized by standard deviation), additive white Gaussian noise (AWGN) (parameterized by standard deviation), and radial distortion 44 48) (with radial distortion parameters k1, k2). For representing channel-leve perturbations, we use linear model: denote the value range of one channel C' as [ac, in the darker direction, we set eyg aac + (1 a)uc. while the lighter direction, we set eic = abc + (1 -1-00 a)uc. where a is the severity parameter, ve the pixel value clean image and 1/c is the perturbed pixel value. The default values are ac 0 and be 255, with two exceptions. We set av = 10 to exclude a complete dark image on channel, and 6и = 179 according to H channel definition. See examples in Fig. and detailed description in Appendix A.2
Test scenarios. While other studies usually test in only one or two scenarios [20] we test the performance of all methods in four scenarios with increasing complexity. Scenario Base dataset. Test on the base dataset. Scenario 2: Single perturbation. Test the datasets with perturbations, but each dataset only experiences one level one perturbation (within blur, noise, distortion, R, G, .B, H. S, V). Scenario 3: Combined perturbations. Test on the datasets with combinations of various perturbations at different levels, and each dataset has different levels of all perturbations. Scenario 4: Unseen perturbation. Test the datasets with unseen perturbations at different levels. Specifically, we use "motion blur", "zoom blur". "pixelate", "jpeg compression", "snow", "frost", "fog" from ImageNet-C [20). We apply the same perturbations/leeels all images within one dataset. (See details in Appendix A.1
Improving Robustness of Learning-based Steering
In this section, we introduce our gradient-free adversarial training method to improve the robustness of learning-basee based steering using Sensitivity Analysis. Our method is among the first to treat complex unforeseen perturbations as a functional combination of multiple simple "basis perturbations". result, the robustness of model to several individual perturbations can lead to robustness against combined or unseen perturbations. In addition, via discretized sensitivity analysis, our approach the first to use FID enuble cross-fuctor performance comparison, i.e., making task sensitivity w.r.t different perturbations comparable. Mcanwhile, sensitivity analysis helps minimize the discretization level number, thus speed up the adversarial training process.
4.1 Basis Perturbations
There are various types of image corruptions due to different environmental effects or sensor variations, and often these corruptions can be approximated using combination of basis perturbations, e.g., snow/frost may be simulated using water drop corruptions, Gaussian blur, and image whitening. Inspired by the concept of basis function, we explore the possibility of training model on a few "basis perturbations" and the resulting model is robust against complex perturbations.
Our basis perturbation contains "basis" representations of the color space in RGB and of image metrics in HSV, which span color and intensity/brightness spaces, respectively. Blur and noise are designed to produce low and high frequency corruptions, while distortion captures the 2D positional transformation that may appear from small vibrations and motions of camera. See comparison of different basis perturbations in Appendix. A.2. We also introduce two metrics to evaluate how well training method can enable model to perform on combined perturbations and previously unseen perturbations when learning only on single perturbations. Using basis perturbations to represent

---

blur
noise
distortion
GD
VD
VL
MEAN ACCURACY DIFFERENCE (%)
50
30
10
0
50
100
200
250
300
350
400
450
HID BETWEEN THE BASE DATASET AND PERTURBED DATASETS
Figure 3: The relationship between FID and MA differences. GD/GL denotes G channel in darker/lighter direction, and VD/VL denotes V channel in darker/lighter direction, respectively. Sensitivity is represented by the first-order derivative the curve. Note that the values in the near-zero FID range (i.e., < 50) are more commonly found in real-world scenarios.
image corruption, then design an algorithm train neural networks to cope with quelity images as input for autonomous driving.
4.2 Sensitivity Analysis
We use adversarial training process in which we optimize corruption parameters maximally disrupt model performance. If this was done using gradient optimization, would require us to differentiate through the corruption operator to update the parameters describing the corruption. Not all gradients of basis perturbations can be easily derived, and corruptions such as distortions may have parameters with non-differentiable effects. Rather than rely on gradient optimization, an simple, discretized gradient-free free method. We use Sensitivity Analysis (SA) to evenly discretize the space of parameters; we choose discrete subset of values for each parameter that are equally "far apart" in terms of their impacts on the classifier. This is achieved using the Fréchet Inception Distance (FID) 23 to perform SA across a range of corruption types.
introduce
SA is commonly used to understand how the uncertainty of the model output (numeric or otherwise) can be apportioned to different sources of uncertainty of the model input 32 33
SA to study how distortions to model input (blur, noise, distortion, and RGB/HSV brightness shifts) can be apportioned to model output. We also SA to quantify the level of degradation caused by an corruption, and prepare datasets that are representative of image qualities at various degradation levels.
Here,
We adopt the Fréchet Inception Distance (FID) 23 as a unified metric for our SA (The reasons for adopting FID and quantitative comparison between FID and other metrics such as L2 norm can be found in Appendix [A.4). In addition, we focus on the changes in model performance according to the changes in input and define the sensitivity the first-order derivative of MA w.r.t FID:
3M (R @ F(p)) OFID F(p))'
sensitivity =
where (D) is the MA test result on dataset with the model trained on the base dataset R: FID(A, B) is the FID between dataset A and dataset B (where FID is calculated in its standard formulation using a pretrained Inception V3 network (23);; F(p) is the perturbation with parameter (e.gg. the standard deviation of the Gaussian kernel), and D @ F denotes the dataset obtained by applying perturbation to
Starting from empirically-selettee parameters of each factor, we generate perturbed datasets and compute their corresponding MA using the trained model on (see numeric results in Appendix AA.9). We then map the MAs and their corresponding parameter values into the FID space. By leveraging this new MA-FID space, we aim to minimize the number of sampled parameters for each perturbation for efficient training (see Sec (.3). while preserving similar parameter curves. At high level, we sample points more densely the value range that has high sensitivity (closer FID values between sample points), while sampling points sparsely in the value range that has low sensitivity (See specific equation in Appendix. A.4)). Examples of the resulting images are shown in Fig. (more in Appendix A.I. Detailed descriptions of the final perturbed datasets are provided in Appendix A.2
5

---

The final MA differences in the FID space are visualized in Fig. 3 (for blur, noise, distortion, and G and V channels; see the entire figure in Appendix/A.4 We first observe that learning- basedd steering is more sensitive to the channel-level perturbations (i.e., R. G, B, H, S. V) than the image-level perturbations (i.e., blur, noise, distortion). Second, the task is least sensitive blur and noise but most sensitive to the V channel (the intensity value). Third, for the same color channel, darker and lighter levels appear to have different MAs at the same FID value. Compared to other "learning to steer" studies [38 46). our method is the first to transfer perturbations from multiple parameter spaces into one space to enable fross-factor comparison.
4.3 Gradient-Free Adversarial Training
Our training process consists of two stages. In the first stage, we iterative min-max training. At each iteration, we first choose one dataset from the datasets (with different quality degradations) of each basis perturbation (i.e., G. B, H. V, blur, noise, and distortion) minimize validation MA, then we merge the nine chosen datasets with the base dataset to train our model while maximizing MA. The first stage stops when a pre-specified number of iterations reached or the MA loss is below a certain threshold. Our method resembles conventional adversarial training: we improve model robustness by training the model to maximize accuracy using the base dataset plus the perturbed datasets with the minimum accuracy, The loss function is the following:
max M A(0, Up),
where p represents the union of all parameter levels of all basis perturbations; 0 denotes the model parameters; and Up is the training dataset. Furthermore, we add a branch in the frequency space to the backbone network to address requency-relatee perturbations such blur and noise (See details in Appendix. A.5). The effectiveness is demonstrated in our ablation study (see Table [T).
The second stage is to boost "clean" accuracy, where the model is fine-tuned solely on the base dataset. To maintain the performance on perturbed datasets, we terminate this stage if the overall validation accuracy (on both clean and perturbed datasets) start to decrease; otherwise, this stage until reaches the maximum number of iterations or the MA loss decreases to our expected threshold. See Algorithm I (Detailed explanations and the ablation study of the second stage provided in Appendix A.6
continue
Algorithm 1: Improve robustness of learning- based steering
Result: a trained model parameterized by 0
Pre-processing:
Conduct sensitivity analysis and discretize the parameters of n factors into their corresponding 4=1..... levels (Sec. 4.2)
Generate new datasets for each factor with the discretized values from the base dataset R (Sec.
Basis Perturbation): (Dr, -................22...
Initialization:
Initialize = 0, the maximum number of iterations T, the number of epochs kn and k2, and model parameters ((0)
First stage:
while t < T do
For each factor, select Di.p. that can minimize the validation MA, where
p: = arg miny A(O()), Dr.s)
Merge all selected datasets Up = (U',, UR
Train the network for ki epochs and update ((++1) train Up. ki) to maximize
M M UU))))))))p))))))))))
Break if stop conditions are met; otherwise set +1+1
end Second stage:
Train the network with @(final) = train(B(T), R, k2) and validate the network on Up (for ko epochs or early break conditions are met)
Our method offers several advantages: 1) the training data augmented without re-train the model, thus improving efficiency; 2) it provides the fiexibility to generate datasets at various discretized levels

---

of the factor parameters; 3) it does not require the derivatives of factor parameters; other methods that optimize factor parameters in the continuous space require computing derivatives, which can be difficult (e.g., for distortion); 4) it generalizes to not only unseen parameters of individual factors but also the composition of unseen parameters of multiple factors; and 5) it is easy to implement and can be readily integrated with other frameworks such as object detection, classification, and regression.
5 Experiments and Results
Setups. All experiments are conducted using one Intel(R) (T))(TM) W-2123 CPU, two Nvidia GTX 1080 GPUs, and 32G RAM. We use the Adam optimizer 24 with learning rate 0.0001 and batch size 128 for training. The maximum number of epochs is 2,000. The dataset setup is explained in
Sec. 3 We use the maximum MA improvement (MMAI,, the average MA improvement (AMAI). and mean Corruption Errors (mCE) [0] as the evaluation metries.
Backbone. We choose the model descrihed in as the main backbone. We select this model as it has been used to steer an autonomous vehicle successfully in both real world [4] and virtual world (23). In addition, six other networks are tested to show the generalizability of our method.
Evaluation metrics. We define the accuracy w.r.& a threshold T as acc, = count((ppredicted
Vantuol| < r)/n, where denotes the number of test cases; Upredicted and Unctual indicate the predicted and ground-truth value, respectively. We compute mean accuracy (MA) as Σ, accyeT//1 where T {1.5, 3.0, 7.5, 15, 30, 75} contains empirically selected thresholds of steering angles. Lastly, we use the maximum MA improvement (denoted as MMAI), the average MA improvement (denoted as AMAD, and mean Corruption Errors (mCE) 20
as the evaluation metries.
Scenarios
Cleun
Single Perturbation
Combined Perturbution
Unseen Perturbation
Method
AMAI
MMAIf
AMAI
mCE4
MMAI
AMAIT
mCE1
MMAH1
AMAIT
mCCE).
Data Augmentation
-0.44
46.88
19.97
51.34
36.1
11.97
75.84
27.5
7.92
81.51
Adversarial Training
-0.65
30.06
10.61
74.42
17.89
6.99
86.82
16.9
8.17
89.91
MaxUp
-7.79
38.30
12.83
66.56
26.94
16.01
72.60
23.43
5.54
81.75
AugMix
-5.23
40.27
15.01
67.49
26.81
15.45
68.38
28.70
8.85
87.79
Ours w/o FS
0.93
48.57
20.74
49.47
33.24
17.74
63.81
29.32
9.06
76.20
Ours
2.12
49.97
23.92
37.30
33.15
22.12
54.38
33.16
13.81
61.61
Table 1: Performance of different methods against the baseline 4 on SullyChen dataset. We compare the
basic data augmentation method (simply combine all perturbed datasets into training), adversarial training method [6), MaxUp [8] and AugMix [22]. Overall, our method outperforms other methods (i.e., highest MA improvements and lowest error in mCEs) in practically all scenarios. Notice ours w/o FS (without frequency space) also outperforms other techniques.
Comparison with different methods. We compare method with four other methods: adver- sarial training method (36). a basic data augmentation method, MaxUp [18), and AugMix (22), to see the performance improvement over the baseline method [4]. For the basic data augmentation method, we simply merge all perturbed datasets for model training.
From Table I we observe that our method outperforms other methods under all metrics in all scenarios: not only on the clean dataset but also on perturbed datasets. Notably, our algorithm improves the performance of "learning to steer" up to 50% in MMAI, while reducing mCE by 60% over the baseline (Scenario 2). Our method also improves the task performance using the combined datasets (Scenario 3) up to 33%. Lastly, when tested on unseen factors (Scenario 4), our algorithm maintains the best performance by 34% in MMAI, while reducing mCE to 62%.
Compared to AugMix (22), our adversarial approach can select the most challenging datasets for training, thus improving model robustness. MaxUp [18] selects only the worst case among all augmentation data, which may lead to the loss of data diversity. In contrast, our method selects the worst cases in all perturbation types (i.e., one dataset per factor), thus improving generalizability. Compared to (36). which performs the adversarial process in feature space by perturbing feature statistics, our method is able to utilize vast prior information generated by sensitivity analysis to reduce the search space. Lastly, compared to the basic data augmentation method, which uses all generated data training, our method selects the most useful data for training, and thus improves computational efficiency while minimizing data generation.
7

---

Scenarios
Clean
Single Perturbation
Combined Perturbation
Unseen Perturbation
Method
AMAI
MMAIt
AMAIf
mCEL
MMAI
AMAI
mCE,
MMAIf
AMAI
mCE]
AugMix+Nvidia
-0.12
40.64
10.94
76.48
25.97
16.79
64.41
22.23
5.99
84,95
Ours+Nvidia
2.48
43,51
13,51
67.78
28.13
17.98
61.12
16.93
6.70
80.92
AugMix+Comma.ii
-5.25
55.59
9.56
86.31
31.32
0.77
106.1
37.91
7.97
89,99
Ours+Comma.ai
0.36
62.07
15.68
70.84
38.01
0.74
108.32
42.54
12.15
77.08
Nee1
-4.23
20.84
1.45
96.24 24
12.21
6.71
80.19
1.5.40
2.87
97.62
Ouss+ReNNet152
-0.96
24.29
5.19
79.76
16.05
8.02
75.16
16.58
5.33
85.68
Table 2: Performance improvement of different backbones against the baseline performance using the Honda dataset. Our method outperforms AugMix in most cases. Notice that the methods with 55 do not improve as much as the first two networks (since the ResNet152 baseline already has high performance).
Scenarios
Clean
Single Perturbution
Combined Perturbation
Unseen Perturbation
Method
AMAII
MMAI
AMAIT
mCE]
MMAII
AMAI
mCE]
MMAI
AMAI1
mCE]
AugMix on SullyChen
-5,23
40.27
15.01
67,49
26,81
15,45
68.38
28.70
8.85
87.79
Ours on SullyChen
1.46
49.76
22.87
40.84
33.15
22.12
54.38
33.87
13.51
62.50
AugMix on Audi
-8.24
81.89
32.22
55.27
75.49
50.23
41.98
73.06
27.39
77.51
Ours on Audi
5.98
97.57
48.50
10.27
87.56
62.38
25,80
77.22
32.71
39.14
AugMix on HondalOk
-0.12
40.64
10.94
76.48
25.97
16.79
64.41
22,23
5.99
84,95
Ours on Honda1
2.48
43.51
13.51
67.78
28.13
17.98
61.12
16.93
6.70
80,92
AugMix Honda 100k
-11.41
63.85
14.08
70.64
68.95
47.69
40.12
61.68
16.32
36
Ours Honda100k
-2.55
67.35
19.88
53,26
65.10
48.60
36.94
51.90
18.29
72.84
AugMix on Waymo
18.27
45.40
23.30
59.31
22.95
16.92
66.36
57.65
29.10
55.63
Ours on Waymo
20.34
46.85
26.76
$2.84
21.34
18.24
64,58
56.98
31.12
53.18
Table 3: Performance improvement of different datasets with different sizes against the baseline using the Nvidia backhone. Our method outperforms AugMix considerably most cases.
Comparison with different backbones. We test three backbones: Nvidia network Comma.ai network [34], and 52 19), on the Honda dataset. The results shown in Table 2 indicate that our method outperforms AugMix in most cases. In general, our method achieves better performance on shallow networks than deep networks. But even on very deep networks such as ResNet152. our method achieves more than 5% improvement in all cases, except Scenario
Comparison on different datasets. To demonstrate that our method does not overfit a particular dataset, we experiment four independent datasets: Audi [16). Honda (31]. SullyChen 7 and Waymo (37). We use the Nvidia network as the backbone for these experiments. Table 3 shows that our method achieves consistently better performance across all four datasets. Furthermore, our method obtains up to 97 87 37%,17 77% % accuracy improvement on the single, combined, unseen perturbations, while achieving 90%, 74 74% 61 % relative error reduction in some cases, respectively.
Comparison on efficiency. To analyze the efficiency of our method, we visualize the relationship between training time vs. robustness in Fig. 4 using the Nvidia backbone [4] and SullyChen dataset 7 The x-axis is training time (in seconds) and the y-axis represents the overall robustness, i.e., the average accuracy of the test scenarios (clean, single, combined, and unseen perturbations). Our method outperforms other methods with higher accuracy and efficiency, e.g., after 1/10 the training time (2,500 sec), our performance is already better than others' final performance (with 25,000 sec of training time). Our method is more efficient than others due to discretization of the augmentation space and selection of the most effective augmentation data during the sensitivity analysis. Furthermore, we select the hardest data during training to enable the system to learn more efficiently. Notice that although the frequency space increases the training time per epoch (>2x longer. mainly in the Fast Fourier Transform process), it can help to obtain better performance after 7,000 sec even with the same amount of training time, compared with our approach without the frequency-space method.
Performance on other image processing tasks. To show the generalizabilityy of our method, we test it on classification using CIFAR-100) 100. For fair comparison, we use the same setting as of Aug (i.e., same perturbations, training and testing data, backbone, and code). As shown in Table 4 our method consistently outperforms all backbones, reducing 16.3% % to 34.1% % in mean errors. The data
8

---

Robustness Training Efficiency Comparison
AugMix
MarUp
Adv
Ours wro FS
Ours
Robusiness Accuracy
70
5000
10000
15000
20000
25000
Training Time (Seconds)
Figure 4: Efficiency comparison between method and other SOTA methods with the Nvidia Network 4 on the SullyChen dataset (7]. The x-axis is training time (in seconds), while the y-axis displays overall robustness, i.e., the average accuracy of the 4 test scenarios (clean, single perturbation, combined perturbation and unseen perturbation). Our method outperforms other methods with higher accuracy and better efficiency. For example, after 1/10 the training time (2500 sec), our performance is already better than others' final performance (after 25,000 sec of training).
Standard
Cutout
Mixup
CutMix
AutoAugment*
Adv Training
AUGMIX
Ours
AllConvNet
56.4
56.8
53.4
56.0
55.1
56.0
42.7
25.6
DenseNet
59.3
59.6
55.4
59.2
53.9
55.2
39.6
26.3
WideResNet
53.3
53.5
50.4
52.9
49.6
55.1
35.9
20.5
ResNeXt
53.4
54.6
51.4
54.1
51.3
54.4
34.9
15.4
Mean
55.6
56.1
52.6
55.5
52.5
55.2
38.3
22.0
Table 4: Average classification error (in %) across several architectures. Our method is able reduce mean corrpption errors than the previous SOTA methods by (6.3%--44.19 % on CIFAR- 1-PAR-100-C data.
for other methods come from the AugMix paper (22). We also test method detection in driving. Specifically, we use the Audi dataset [16] and the Yolov4 network 3 as base settings, and implement ours based Yolov4. The result shows that algorithm improves robustness. in most scenarios (about 3%-5% mAP on average). See Appendix A.7
Decoupling Ratio and Generalization Ratio. We propose two new metrics to evaluate how well training method can allow a model to perform on combined perturbations and unseen perturbations respectively, while only learning single perturbations one at time.
Definition 5.1 (Decoupling Ratio) Let M A(D1, D22) be the mean accuracy (MA) result of a model
trained on dataset D2 and test on dataset D2. Let P. be the ith (i = 1,.... n) perturbation taking dataset as input and producing perturbed dataset. Let NP) (datasets with combined/nested perturbations), UP* UK= (D) (the union of datasets with single perturbations), Der be the training set, and Dre be the test set, then the decoupling ratio is
(P= (... (D))..)
Td MA(U (* N P**
(D.)
Ta = means when the model is trained using the union of single-perturbatioo images, the test performance on combined- combined-perturbation images (not training domain) can be as good as the test performance on the union of perturbaatn images (training domain). Note that different models and training methods may influence the MA function, thus potentially affecting the decoupling ratio.

---

Definition 5.2 (Generalization Ratio) Keeping the definitions of MA(D1. D2), (D Der. Die- and U (D) as of Decoupling Ratio, let Q7 be the jth (j 1,..,,m) perturbation where P + Q3, and (D) = -ド (D) (the union of datasets with unseen single perturbations), then the generalization ratio is
(D,) (Die)
rg (D.)) UP-,
rg means when the model trained using the union of single- sesee--etturbation images, the test perfor- mance on unseen-peree peceen-perturbation images (not training domain) can be as good as the test performance on the union of known single-peturrbation images (training domain). Similarly, different models and training methods may influence the MA function, thus potentially affecting the generalization ratio.
Tested
dataset (UP* (Drr) ) is the training set with our basis perturbations, (Dte) is the data in Scenario 3, and UQ" (Dte) is the data in Scenario 4), our method can achieve a high
0.8291 0.94. We exclude decoupling ratio ra- 0.8836 0.84 and high generalization ratio ra- 0.8336
0.7463
these two ratios for other methods because they did not trained on only single perturbations.
Effectiveness visualization. Using the salience map on several combined samples in Fig. shown in Appendix [A88] we demonstrate that our method can help the network to focus on important areas (e.g.. the road in front) instead of random areas on perturbed images. We also show t-SNE (26 of feature embeddings from the baseline and our method in Fig. 9 shown in Appendix [A.8) As a result, features from our method are more uniformly distributed, indicating the reduction of the domain gaps created by the perturbations, thus improving robustness.
Benchmarking datasets. We plan release our perturbed datasets for benchmarking, which will contain augmented datasets from Audi [16), Honda [31]. Wayme [37], and SullyChen dataset [7]. Each will include a base dataset and datasets with five levels of perturbation in blur, noise, and distortion, ten levels of variations in the channels R, G, B, H, S. V. multiple combined perturbations over all nine factors using our implementation, and five levels of each unseen simulated factor, including snow, fog, frost, motion blur, zoom blur, pixelate, and jpeg compression using ImageNet-C. In total, there are 480 datasets and about 26M images. The ground-truth steering angles (or angular velocity of the vehicle) for all images will also be provided for validation, along with the code to generate the perturbed datasets. The parameters for data generation can be found in Appendix A.2
Conclusion and Future Work
In this paper, we first analyze the influence of different image- image-quality attributes on the performance of the task "learning to steer". We study nine image attributes and find that image degradations due perturbation these 9 attributes can impact task performance various degrees. By using FID as a unified metric, we conduct sensitivity analysis in the MA-FID space. Leveraging the sensitivity analysis results, we propose effective and efficient training method to improve the generalization of learning- based steering under various image perturbations. Our model not only improves the task performance on the base dataset, but also achieves significant performance improvement on datasets with mixture of perturbations (up to 87%), as well as unseen adversarial examples including snow, fog, and frost (up to 77%).
Our method can be easily extended and applied beyond the set of factors and the learning algorithms analyzed in this study. It can also generalize to analyzing any arbitrarily high number of image/input factors, other learning algorithms, and multimodal sensor data. Lastly, other autonomous systems where the perception-to-commme functionality plays a key role can possibly benefit from our technique as well. We will release the generated datasets for benchmarking the robustness study of learning algorithms for autonomous driving, as well as the code. Our method currently uses discretization to achieve efficient training, but further optimization for our implementation is possible. Our framework is generalizable to other image factors, learning algorithms, multimodal sensor data, and other perception-to-contre) tasks.
This work was supported in part by ARO SI Program, DARPA GARD program, ONR MURI program, Elizabeth S. Iribe Chair, Barry Mersky, Capital One and Pier G. Perotto E-Nnovate Endowed Professorships.
Acknowledgements
10

---

References
[1] Siddharth Agarwal, Ankit Vora, Gaurav Pandey, Wayne Williams, Helen Kourous, and James McBride. Ford multi-av seasonal dataset. arXiv preprint arXiv:2003.07969, 2020.
[2] Isabelle Bégin and Frank Ferrie. Blind super-resolution using a learning-based approach. In Proceedings of the 17th International Conference on Pattern Recognition (ICPR), volume pages 85-89, 2004.
[3] Alexey Bochkovskiy, Chien- Yao Wang, and Hong- Yuan Mark Liao. Yolov4: Optimal speed and accuracy object detection. arXiv preprint arXiv:2004. 2020.
[4] Mariusz Bojarkki, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp. Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars. arXiv preprint 1r0xiv:604.000
2016.
[5] Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh Vora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. arXiv preprint arXiv: /903. / 1027, 2019.
[6] Qianwen Chao, Huikun Bi, Weizi Li, Tianlu Mao, Zhaoqi Wang, Ming C. Lin, and Zhi- gang Deng. A survey on visual traffic simulation: Models, evaluations, and applications in autonomous driving. Computer Graphics Forum, 39(1)2887-308, 2019.
[7] Sully Chen. A collection of labeled car driving datasets, http://gtthhbccomm/llllyyheervrt datasets, 2018.
[8] Marius Cordts, Mohamed Omran, Sehastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke. Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 3213-3223, 2016.
[9] Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoe V Le. Autoaugment: Learning augmentation policies from data. arXiv preprint arXiv:/805.00550 2018.
[10] Terrance VeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. arXiv preprint arXiv:1708.04553 04552, 2017.
[11] Samuel Dodge and Lina Karam. Quality resilient deep neural networks. arXiv preprint /703v:/703.08/ 19, 2017.
[12] Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recogni- tion performance under visual distortions. In 2017 26th international conference computer communication and networks (ICCCN), pages 1-7. IEEE, 2017.
[13] Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Proceedings of the 1st Annual Conference Robot Learning, pages 1-16, 2017.
[14] Xiang Gao, Ripon Saba, Mukul Prasad, and Abhik Roychoudhury. Fuzz testing based data augmentation to improve robustness of deep neural networks. In Proceedings of the ACM/IEED 42nd International Conference on Software Engineering, pages 1147-1158, 2020.
[15] Andreas Geiger, Philip Lenz, Christoph Stiller, and Raquel Urtasun. Vision meets robotics: The kitti dataset. International Journal of Robotics Research (IJRR), 2013.
[16] Jakob Geyer, Yohannes Kassahun, Mentar Mahmudi, Xavier Ricou, Rupesh Durgesh, Andrew S. Chung, Lorenz Hauswald, Viet Hoang Pham, Maximilian Mühlegg, Sebastian Dorn, Tiffany Fernandez, Martin Jänicke, Sudesh Mirashi, Chiragkumar Savani, Martin Sturm, Oleksandr Vorobiov, Martin Oelker, Sebastian Garreis, and Peter Schuberth. A2D2: Audi Autonomous Driving Dataset. 2020.
[17] S. Ghosh, R. Shet, P. Amon, A. Hutter, and A. Kaup. Robustness of deep convolutional neural networks for image degradations. In 20/8 IEFE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 2916-2920, 2018.

---

[18] Chengyue Gong, Tongzheng Ren, Mao Ye, and Qiang Liu. MaxUp: A Simple Way to Improve Generalization of Neural Network Training, arXiv e-prints, page arXiv:2002.09024, February 2020.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[20] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint urXiv:1903.12233 122611,,,,2,, 2019.
[21] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. In H. Wallach, H. Larochelle, A. Beygelzimer, d'Alché-Buc, E. Fox, and R. Garnett, editors, Advances in Neural In- formation Processing Systems, volume 32. Curran Associates, Inc., 2019.
[22] Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminnrayanann Augmix: A simple data processing method to improve robustness and uncertainty. In ICLR, 2020.
[23] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to local nash equilibrium. arXiv preprint arXiv: 1706.08500, 2017.
[24] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
[25] Weizi Li. David Wolinski, and Ming C. Lin. ADAPS: Autonomous driving via principled simulations. In IEEE International Conference on Robotics and Automation (ICRA), pages 7625-7631, 2019.
2019.
[26] Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, (7ov):2579-260,, 2008.
[27] Will Maddern, Geoff Pascoe, Chris Linegar, and Paul Newman. Year, 1000km: The Oxford RobotCar Dataset. The International Journal of Robotics Research (IJRR), 36(1):3-15, 2017.
[28] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, Towards deep learning models resistant to adversarial attacks. In ICLR, 2018
[29] Camilo Pestana, Naveed Akhtar, Wei Liu, David Glance, and Ajmal Mian. Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space. arXiv e-prints, page arXiv:2003.00883, February 2020.
[30] Matthew Pitropov, Danson Garcia, Jason Rebello, Michael Smart, Carlos Wang, Krzysztof Czarnecki, and Steven Waslander. Canadian adverse driving conditions dataset. arXiv preprint 10X1v:2001.00117, 2020.
[31] Vasili Ramanishka, Yi-Ting Chen, Teruhisa Misu, and Kate Saenko. Toward driving scene understanding: A dataset for learning driver behavior and causal reasoning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 7699-7707, 2018.
[32] Andrea Saltelli. Sensitivity analysis for importance assessment. Risk analysis, 22(3):579-590,
2002.
[33] Andrea Saltelli, Marco Ratto, Terry Andres, Francesca Campolongo, Jessica Cariboni, Debora Gatelli, Michaela Saisana, and Stefano Tarantola. Global sensitiviry analysis: the primer. John Wiley & Sons, 2008
[34] Eder Santama and George Hotz. Learning a driving simulator. arXiv preprint arXiv:1608.01230. 2016.
[35] Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NeurIPS, 2019.
12

---

[36] Manli Shu, Zuxuan Wu, Micah Goldblum, and Tom Goldstein. Preparing for the worst: Making networks less brittle with adversarial batch normalization. arXiv preprint Sati::20090089663 2020.
[37] Pei Sun, Henrik Kretzschmar, Xerxes Dotiwalla, Aurelien Chouard, Vijaysai Patnaik, Paul Tsui, James Guo. Yin Zhou, Yuning Chai, Benjamin Caine, et al. Scalability in perception for autonomous driving: Waymo open dataset. arXiv, pages arXiv-1912, 2019.
[38] Yuchi Tian, Kexin Pei, Suman Jana, and Baishakhi Ray. Deeptest: Automated testing of deep- noural-netorr--driver autonomous cars. In Proceedings of the 40th international conference on software engineering, pages 303-314, 2018.
[39] Toan Tran, Trung Pham, Gustavo Carneiro, Lyle Palmer, and Ian Reid. A bayesian data augmentation approach for learning deep models. In Advances in neural information processing systems, pages 2797-2806, 2017.
[40] Frederick Tung, Jianhui Chen, Lili Meng, and James Little. The raincouver scene parsing benchmark for self-driving in adverse weather and at night. IEEE Robotics and Automation Letters, 2(88:218,, 2017.
[41] Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur on recognition by convolutional networks. arXiv preprint 16 2016.
[42] Zhe Wu, Zuxuan Wu, Bharat Singh, and Larry Davis. Recognizing instagram filtered images with feature de-stylization. Proceedings of the AAAI Conference on Artificial Intelligence, 34:12418-12425, 04 2020.
[43] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, and Quoc V. Le. Adversarial examples improve image recognition. In CVPR, 2020.
[44] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In International Conference Computer Vision (ICCV), 2019.
[45] Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. International Conference on Learning Representations, 2018.
[46] Mengshi Zhang, Yuqun Zhang, Lingming Zhang. Cong Liu, and Sarfraz Khurshid. Deeproad: Gan-based metamorphic testing and input validation framework for autonomous driving systems. In 2018 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 132 142. IEEE, 2018.
[47] Zhengyou Zhang. flexible new technique for camera calibration. Technical Report MSR-TR- 98-71, Microsoft Research, 1998.
[48] Zhengyou Zhang. A flexible technique for camera calibration. IEEE Transactions pattern analysis and machine intelligence, 22(1 13:11)1333-134 2000.
[49] Yiren Zhou, Sibo Song, and Ngai-Man Cheung. On classification of distorted images with deep convolutional neural networks. In 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1213-1217. IEEE, 2017.
13

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Sec. 6
(c) Did you discuss any potential negative societal impacts of your work? [No] Our method
improves the robustness of target algorithms (methodology). and improve the safety for autonomous driving (application).
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full of assumptions all theoretical results? [Yes] See Sec.??.
(b) Did you include complete proofs of all theoretical results? [Yes] See Sec.??.
3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as URL)? [Yes] Data provided
dataset, see Sec. [ Code will be provided after the paper is accepted.
(b) Did you specify all the training details (c.g.. data splits, hyperparameters, how they were chosen)? [Yes] See Sec. 5 Appendix. A.2 and Appendix. A..3
(c) Did you report error bars (e.g., with respect to the random seed after running exper- iments multiple times)? [No] We show experiment result on different backbones, different datasets, different tasks, compare to different methods, and perform consis- tently better. Also error bars for each them will be too computationally expensive to get.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] See Sec. 5
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) your work uses existing assets, did you cite the creators? [Yes] See Sec. Boc.Band Sec.
(b) Did you mention the license of the assets? [No] We specify the source the assets.
People can find the asset's license in their official website.
(c) Did you include any assets either the supplemental material
URL? [Yes]
We plan to provide a new benchmark, see Benchmarking Datasets subsection in Sec. 5
(d) Did you discuss whether and how consent was obtained from people whose data you' 're using/curating? [No] We use public data or code from their official website or git, no special data code.
(c) Did you discuss whether the data you using/curating contains personally identifiable information or offensive content? [Yes] See Benchmarking Datasets subsection in Sec.
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "zNW8VwB2Vg9", "reviewer": "Reviewer_ss88", "summary": "The proposed work uses a concept similar to adversarial training to improve robustness against image corruptions. The authors consider different basis perturbations which can account for different complex perturbations and vary their parameters during the min-max procedure to perform adversarial training.  Empirical results are shown on multiple datasets and different tasks such as classification, detection. ", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n\n— The proposed method is intuitively well motivated and empirical results are shown on multiple datasets and tasks to show the effectiveness of the approach.\n\n— The idea of breaking down complex perturbations into different basis to simplify the problem is interesting. \n\n— The method is shown to perform better against unseen corruptions as well.\n\nWeaknesses:\n\n— Due the min-max nature of the training, the method seems to be computationally expensive.\n\n— The presentation of the paper can be significantly improved. \n\n1. Precise definitions of MMAI and AMAI would have made the metrics easier to understand.\n2. A formal description of the second stage which relies on the frequency component is missing from section A.5 in the appendix. \n3. Fig 6 from A.4 can be presented differently. It is difficult to distinguish between different curves.\n\n— Other baselines such as the Data Augmentation and Adversarial training considered in Table 1, are not considered for the detection task.\n\n— It is mentioned that 5 different levels of perturbations are applied for each type of corruption and other levels decreased performance. An experiment which illustrates this effect and explanation for this would improve understanding. \n\nAdditional comments:\n\n— Looking at Figure 7 in Appendix A.7, it is difficult to understand where the saliency map of the baseline model is focussed on. It also seems that the proposed approach is focussing on the center potion of the image. Other qualitative examples might be helpful here.\n\n— An experiment where all the generated datasets are used in training, rather than choosing a dataset based on MA, serves as a baseline. It would be interesting to see if the improvement for the proposed approach is due to the additional data or min max procedure. \n\n— An experiment where different basis perturbations are considered during training( more or less in number, different subset) serves as an ablation and would motivate the use of the selected perturbations. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Limitations and societal impact are addressed in the paper.", "review_text": "", "extra_scores": {"ethical_concerns": "There are no ethical concerns with the paper.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "7"}, "extra_text": {}}, {"review_id": "VD1WhaFC3k", "reviewer": "Reviewer_cGjr", "summary": "This paper introduces an adversarial training framework to help autonomous driving classification systems defend against image corruptions caused by internal and external factors. Motivated by the complex application scenario of auto-driving, the authors study the influence of low-quality images on auto-driving tasks. The authors employ the adversarial training concept of adversarial attack to stimulate image distributions in real-world image corruption to better train auto-driving models. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper proposes an effective gradient-free adversarial training framework for improving the robustness of autonomous driving. The framework will generate a perturbed dataset to stimulate the real-world image corruption distribution and better train auto-driving models. The experimental results show that the proposed method can boost both the robustness and accuracy of the learning to steer models. \n\nMoreover, the authors apply FID to measure the distribution gap between the generated datasets and the real-world images.  Therefore, the authors also propose a comprehensive robustness evaluation standard for learning to steer models. \n\nGood things of this paper: \n\n(a)This paper is well-organized and easy to follow. The pipeline of figure 1 is helpful to understand the proposed research method. \n\n(b) The proposed method has been clearly stated and is easy to be implemented. The authors will also release their codes. \n\n(c) Extensive experiments demonstrate the effectiveness of the proposed methods. The improvement is significant. \n\nQuestions of this paper: \n\n(a) The proposed method can be robust to the unseen image corruptions(snow, fog and frost). However, will the proposed training framework also be robust to gradient-based adversarial examples? If no, can the proposed framework add gradient-based adversarial examples for robust training? \n\n(b)In algorithm1, the finding of p is the augment to minimize the MA; how to select p without gradient information? \n\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The limitations are listed in the main review. ", "review_text": "", "extra_scores": {"ethical_concerns": "N.A", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "1BS8J6uXnLA", "reviewer": "Reviewer_jMnL", "summary": " In this method, a new augmentation method is proposed to boost the robustness of the supervised “learning-to-steer” and classification tasks for autonomous driving. The proposed approach is based on finding a combination of common perturbations that minimizes the prediction accuracy, and the model is trained in an adversarial manner. The method was evaluated on the driving datasets (Honda, Audi and SullyChen) and CIFAR-100.", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is generally difficult to read and needs to be restructured (e.g., L185-193 should be in the experiments section). Some abbreviations and names are used without a clear definition or explanation (e.g. it is not obvious to the non-specialist in autonomous driving what “learning-to-steer” or “steering” is in this context). \n\n“Supervised Contrastive Learning”, Khosla et al. is a very relevant paper that should be included in the related work section.\n\nIt is not clear and never discussed in the paper whether the FID is computed using the target model that is currently being trained or a fixed pretrained model. If the latter is true, this approach would always result in a single worst-case composite perturbation. \nThe overall description of the proposed method in section 4.3 is very confusing and lacks structure. For example, L200-201 state that in stage 2, the model is trained only on the clean data; then later in L204-207, it says that in the same stage 2, the model is trained in an adversarial fashion, and both the clean and perturbed data are used. The description in the Algorithm 1 is too vague: what exactly does it mean: “Conduct sensitivity analysis and discretize the parameters of n factors into their corresponding levels”? Or similarly, “Generate new datasets for each factor with the discretized values from the base dataset”? A reference to a section or equation that clearly describes what is done in this stage is needed.  An exact description of how exactly the new dataset is generated based on the sensitivity analysis is not provided in the paper.\n\nThe experimental setup is satisfactory and convincing. An appropriate set of metrics and baseline methods is used to support the main claim of the paper. The empirical results on all driving datasets as well as on CIFAR-100 indicate the efficiency of the proposed approach. \n\nThe new metrics proposed in L 279-289, seem to be redundant without a supporting analysis or empirical evidence of their correctness for the evaluation of robustness and generalization. \n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Some limitations, such as the need to store the augmented data, are included. However, no practical limitations concerning the speed and efficiency of the proposed method are discussed. Authors claim that their method with composite augmentations requires less training examples as opposed to the methods that use single perturbations. However, this has not been shown experimentally. Ideally, a plot with convergence speed of the proposed vs baseline methods should be included in the paper. Also, an additional preprocessing stage is introduced in the paper, as well as the adversarial training stage, which might be time-consuming, and how much it slows down the training compared to other methods must be shown.\n", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a new approach for adversarial training. The idea seems novel and interesting and the result seems to be promising. The paper presentation and organization should be further improved. The meta reviewer recommends acceptance of this paper.
Decision: Accept (Poster)