Controlled Training Data Generation with Diffusion Models
Authors: Teresa Yeo
Andrei Atanov
Harold Luc Benoit
Aleksandr Alekseev
Ruchira Ray
Pooya Esmaeil Akhoondi
Amir Zamir
Venue: Accepted by TMLR ()

Abstract: We present a method to control a text-to-image generative model to produce training data useful for supervised learning. Unlike previous works that employ an open-loop approach via pre-defined prompts to generate new data using either a language model or human expertise, we develop an automated closed-loop system that involves two feedback mechanisms. The first mechanism uses feedback from a given supervised model to find adversarial prompts that result in generated images that maximize the model's loss and, consequently, expose its vulnerabilities. While these adversarial prompts generate training examples curated for improving the given model, they are not curated for a specific target distribution of interest, which can be inefficient. Therefore, we introduce the second feedback mechanism that can optionally guide the generation process towards a desirable target distribution. We call the method combining these two mechanisms Guided Adversarial Prompts. The proposed closed-loop system allows us to control the training data generation for a given model and target image distribution. We evaluate on different tasks, datasets, and architectures, with different types of distribution shifts (corruptions, spurious correlations, unseen domains) and illustrate the advantages of the proposed feedback mechanisms compared to open-loop approaches.

Published in Transactions on Machine Learning Research (03/2025)
Controlled Training Data Generation with Diffusion Models
Teresa Yeo" Andrei Atanov' Harold Benoit Aleksandr Alekseev
Ruchira Ray Pooya Esmaeil Akhoondi Amir Zamir
Swiss Federal Institute of Technology Leusanne (EPEL)
net/forum? Reviewed on OpenReview: https: // openreview. net/ forum? id= ES0
Project page: adversarral-ppromtts epfl. ch
Abstract
We present method to control a text-to text-to-imagee to-image generative model to produce training data useful for supervised learning. Unlike previous works that employ open-loop approach via pre-defined prompts to generate new data using either language model or human expertise, we develop an automated closed-loop system that involves two feedback mechanisms. The first mechanism uses feedback from a given supervised model to find adversarial prompts that result in generated images that maximizo the model's loss and, consequently, expose its vulnerabilities. While these adversarial prompls generate training examples curated for improving the given model, they are not curated for a specific target distribution of interest, which be inefficient. Therefore, introduce the second feedback mechanism that can optionally guide the generation process towards desirable target distribution. We call the method combining these two mechanisms Guided Adversarial Prompts. The proposed closed-loop system allows us to control the training data generation for a given model and target image distribution (sce Fig. [ tasks, datasets, and architectures, with different types of distribution shifts (corruptions, spurious correlations, unseen domains) and illustrate the advantages of the proposed feedback mechanisms compared open-loop approaches
(Right)). We evaluate on diffcrent
1 Introduction
The quality of data plays crucial role in training generalizable deep learning models (Taori et al. 2020 Miller ctt al. 2021 Gadre et al. 2023). For a model to generalize well, its training data should be representative of the test distribution where will be deployed. However, real-world test conditions change over time, while training datascts are typically collected once and remain static due high collection costs. This also contrast evidence showing that being able control the input data is key contributor to how children are able to learn with only few examples (Braddick & Atkinson
2013 Lewis & Maurer 2005). We, therefore, focus generating training datasets that can adapt to novel test distributions and are more sample-efficient.
Diffusson generative models Rombbch et al. 2022 Ho et al.
2020
Sohl-Dickstein et al. 2015 Nichol et al.
2022 Saharia et al. 2022 are trained on large-scale collections of images (Schuhmann et al. 2022 and exhibit remarkable generalization abilities by being able to produce realistic images not seen during training. Additionally, unlike static datasets that they are trained on, these generative models allow us to adapt the generation process produce images that. follow certain conditioning. For example, they be conditioned geometric information such depth maps (Zhang & Agrawala,
textual prompts (Rombach et al. 2022
2023
Recent works explore the use of diffusion models to generate training data for supervised learning with
promising results (Sariyildiz et al. 2023 Dunlap et al. 2023: He et al. 2022). They guide the generation process using text prompts to accomplish two goals: 1) produce aligned image-label pairs for supervised
See the uploaded overview video.

---

Published in Transactions on Machine Learning Research (03/2025)
Controlling prompts controlled training data generation:
Controlled training data generation find prompts useful for
Fool: the model?
Similart to target (log/?
different target distributions:
different models:
Agnostic Prompts
feecback, open-loop
X
X
Fog
LINet
DPT
Depai exlimation
Adversarial Prompts (ours)
Generative model
Y
X
w/ model feedback
Guided Prompts w/ largel distribution feedback
Night
ResNet50
VI
Classification
Guided Adversarial Prompts (ours) w/ both Teedbacks
Figure 1: We propose framework for the automatic generation of training examples curated for given model and target distribution. Left: The method controls the prompts of a conditional text-to-image generative model via two feedback mechanisms. The 'model feedback' ensures that generated examples expose vulnerabilities by fooling a given model, resulting in Adversarial Prompts. The 'target distribution feedback' guides the generations towards a desirable target distribution (fog in this example.) Combining both feedback mechanisms results in Guided Adversarial Prompts, leading to generations that both fool the model and fit the desirable target distribution. Right: This approach allows us to find prompts that generate training examples useful for different target distributions, supervised models, and tasks (the oval highlights the effect of defocus blur in the corresponding example.) While the differences in generations for different models might appear subtle unintuitive, they, indeed, result in more useful training data (see
Sec. 4.3
training and 2) adapt the generated images to a certain target distribution. However, these methods find conditioning text prompts in an open-loop way, ie,, uninformed of the specific training scenario hand, by either using a language model (Dunlap et al. 2023) or heuristics (Sariyildiz et al., (023). In other words, they lack an automatic feedback mechanism that can refine the found text prompts to produce more curated and usefull training data.
In this work, we propose two leedback mechanisms to find prompts for generating useful training data. The first mechanism finds prompts that result in generations that maximize the loss of a particular supervised model, thus, reflecting its failure modes. We call them Adversarial Prompts (AP). This mochanism ensures that we find not only novel prompts, which may still produce images that the model already performs well on, but adversarial prompts that produce images with high loss, and, thus, useful for improving the model (Deng let al. 2021) (see exemplar generations for AP in Figs. and 5
One given model can perform poorly on multiple distribution shifts, and hoping to cover all of the shifts via Adversarial Prompts is an inefficient. strategy (e.g., see the difference between the AP generation and the target distribution, fog, in Fig. I (Left)). Therefore, we introduce an additional target iattributtonninformenr feedback mechanism that can find prompts that generate images fitting a desirable target distribution we want to adapt to. To implement. it, we assume access to a textual description of the target distribution and/or few unlabeled images from We then optimize a similarity metric between CLIP (Radford et al. 2021) embeddings of the generated examples and the target description. We call prompts that combine both mechanisms Guided Adversarial Prompts (GAP). Compare the Adversarial Prompts and Guided Adversarial Prompts in Figs. D and to 5 to see the effect of the guidance feedback in steering the generations towards a specific target distribution.
We perform evaluations on different tasks (image classification, depth estimation), datasets with distribution shifts (Waterbirds (Sagawa al. 2019). iWildCam (Beery al.] 2002 Koh et al. (202)). Common Cor- ruptions (Hendrycks Dietterich 2019). 3D Common Corruptions (Kar et al. 2022)), and architectures (convolutional and transformer) and show supportive results.
2

---

Published in Transactions on Machine Learning Research (03/2025)
2
Related Work
Open-loop data generation methods use pre-defined controls to guide the generative process and produce novel training examples. One line of work uses GANs (Jahanian et al., 2021 Chai et al. 2021 Ravuri & Vinyals 2019 and pre-define a perturbation in their latent space to generate novel examples. More recent
works adopt text-to-image diffusion models and use pre-defined prompt templates (Sariyildiz et al. 2023
Yuan el al.
He el al. 2022) use a language model to generative variations of a given prompi Yuan These methods require anticipating the kind of data that will be seen at test-time when defining the prompts. On the other hand, our CLIP guidance mechanism allows us to generate images similar to the target distribution. Dunlap et al. (2023) also approach this problem by using a captioning and language model to summarize a target distribution shift. into a text prompt. However, this summarization process is not informed of the generations, and, thus, does not guarantee that the text prompt will guide the generation process to images related to the target distribution. Finally, these methods are not model-informen and do not necessarily generate images useful for training given model.
2022
et al. 2022
Closed-loop data generation methods guide the generation process via an automatic feedback mechanism. They control the latent space of GANs (Besnier et al., 2020) or VAEs (Wong & Kolter 2020) models, NeRF (Dong et al.) 2022), or the space of hand-crafted augmentations (Cubuk et al.) 2018 to generate data that maximizes the loss of the network on the generated data. Similarly, [Jain et al. (2022) uses an
SVM to identify the failure modes of a given model and uses this information to generate training data with a diffusion model. Our method employs similar adversarial formulation (in conjunction with target distribution guidance) but performs the optimization in the text prompt space of recently developed diffusion models.
"Shallow" data augmentation techniques apply simple hand-crafted transformations to training images to increase data diversity and improve the model's generalization. Examples of such transformations are color jitter, random crop, and flipping, etc. To produce more diverse augmentations, methods like RandAugment (Cubuk al. 2020) and AugMix (Hendrycks et al. 2019) combine multiple of such simple transformations, and Mixup [Zhang et al. 2017) and CutMix (Yun et al 2019) methods use transformations that can combine multiple images. AutoAugment (Cubuk et al. 2018) and adversarial training (Madry et al., 2017) build closed system to tune the parameters of the applied augmentations but are inherently limited by the expressiveness of the simple transformations. In contrast, our method uses expressive diffusion models, which results in images that are more diverse and realistic than those produced by "shallow" augmentations.
Controlling diffusion models. Methods like ControlNet (Zhang & Agrawala, 2023) and T2I-Adapter [Moul et al. 2023) adapt pre-trained diffusion model to allow for additional conditioning c.g., edge, sogmentation, and depth maps. We employ these models for generation as it allows to generate paired data for different tasks, given the labels from an existing dataset. Editing methods aim to modily given image, either via the prompt (Hertz et al., (022), masks [Couairon et al.] 2022), instructions (Brooks et al., 2023) or inversion of the latent space (Mokady et al. 2023 Huberman- Spiccelllaa et al.) 2023). In contrast, personalization methods aim to adapt diflusion models to a given concept. e.g., an object, individual, or style. Popular examples include textual inversion (Gal al.) 2022) and DreamBooth (Ruiz et al. (023), which aim to find token to represent a concept given several images of that concept. The former freezes the diffusion model, while the latter fine-tunes it. Extensions of these works learn to represent multiple concepts (Avrahami et al. 2023 Han et al. 2023). In our work, we adopt an approach similar to textual inversion to steer the diffusion model, but our method can also be used with other controlling mechanisms.
3 Method
We begin this scction by formalizing our problem sctting and describing how diffusion models can be used to generate training data (Sec. 3.1). We then introduce two feodback mechanisms to find prompts that are informed of the failure modes of given model (Sec. 3.2 and relevant to given target distribution (Sec. 3.3)
3

---

Published in Transactions on Machine Learning Research (03/2025)
Target Distribution Feedback
Prompt Space
Image Space
Depth Conditioning
Collapsed Generation
Original Image
Early stopping
SDEdit
Tarout Oxiritation
I
So.
Iro
y
Model Feedback
y
Figure 2: Left: An overview of how we generate training data for given supervised model f and target distribution. Suppose g is generative model that generates images conditioned on text prompt, S and label, y. A supervised model trained to perform a task, e.g., image classification or depth estimation, is denoted by f. We aim to find prompts that would generate training data useful for f. and we do so via two leedback mechanisms. The first mechanism makes use of Teedback from ʃ lo get Adversarial Prompls. Since there can be many adversarial examples not relevant a particular target distribution, we introduce a second feedback mochanism that guides the prompts towards certain target distribution. Combining the two mechanisms results in Guided Adversarial Prompts. This results in generations that are both relevent to the target distribution and where f does not perform well. Right: Ways to alleviate the misalignment of the generation with its conditioning. The third column onwards shows some examples of generations from depth maps that do not follow the depth conditioning. See the first and second columns for the original image and its depth label. There are several ways to constrain the generation to alleviate this misalignment. 1. Early stopping involves stopping the adversarial optimization when the loss reaches a certain threshold. The resulting generations from early stopping are shown in the fourth column. 2. SDEdit (Meng al., 2021b) involves conditioning the generation process on the original image. This mechanism is applied during generation with the adversarial prompts i.c., applying SDEdit to the prompts that generated the images in the third column results in the last column generations. Both SDEdit and early stopping are able to improve the alignment of the generations with depth conditioning.
3.1 Preliminaries
Problem Formulation. We consider the supervised learning problem, where a model f X y learns a mapping from the image space X, to target space y, c-g., depth estimation or semantic classification. The model f is trained using a training dataset Dirain and tested on new set Drest that exhibits distribution shift w.r.t. the training data, e.g., corruptions Hendrycks & Dietterich (2019). Our goal is to generate additional synthetic training data Dayn to adapt the model and improve its performance under the distribution shift.
Text-to-image Diffusion Models. We use the Stable Diffusion (Rombach et al.- 2022 text-to-image diffusion model as the basis for our generator g. Given a textual prompt c, Stable Diffusion is capable of synthesizing realistic images following the textual conditioning. However, in general, for given task, e.g., depth estimation, a textual prompt alone may not be sufficient for controlling the generation well enough to produce aligned image-label examples.
Generating aligned training examples. We employ the following two approaches to condition the generative model on a label y from the given training datasets and sample aligned training examples (). For the depth estimation task, we use the ControlNct (Zhang Agrawala, 2023) model which extends the conditioning mechanisms of the Stable Diffuusio to accept various spatial modalities, e.g., depth maps and segmentation masks. Specifically, classification tasks, we utilize the foreground object masks and use an in-painting technique proposed by Lugmayr et al. 2022) that preserves the masked region throughout the denoising process, essentially keeping it intact. These mechanisms provide us with a generative model conditioned both on a text prompt e and label y. We denote the resulting distribution modeled by this generative model as g(y c).
use ControlNet v1.0 with depth conditioning" For semantic
4

---

Published in Transactions on Machine Learning Research (03/2025)
3.2
Model-Informed Generation with Adversarial Prompt Optimization
Our first leedback mechanism aims al generating training examples that reflect the failure modes of a given model f. An automatic way to do so is via adversarial optimization, which finds the "worst case" failure modes of f. More preciscly, we find a prompt e that generates images ă ~ g(y, c) that maximize the supervisod loss C(f()).)) y), e.g., I loss for depth estimation. Since the usual prompt space is discrete (text tokens) and challenging to optimize over; we employ the approach introduced by [al et al. (2022) and, instead, optimize over the corresponding continuous embedding space. For ease of notation, "prompt space" will implicitly refer to the contimuous embedding space instead of the discrete token space. We construct prompt cw out of new "placeholder" tokens, iee, Cw (Cw):..... Cw,,), ), and find their corresponding embedding weights far]e by solving the following optimization problem:
WAP = arg min By Ex-g(v.ww) Ladv (f(2), v),
(1)
where Ladv = - L and y is sampled from Durin- Note that the sample T is differentiable w.r.t. the embeddings w which allows us to use gradient-basie based optimization. We call the prompts that result from solving the above optimization problem Adversarial Prompls (AP).
Avoiding (ě. y) alignment collapse. While the adversarial objective in Eq. ( aims to fool the model f, it may instead fool the label-conditionng mechanism of the gencrative model g, resulting in Cusav generating samples ā s(y, Grasv) that are not faithful to y (see Fig. 2 (Right)). To avoid this collapse, we use the following techniques.
First, we limit the expressivity of the generative model using the SDEdit method (Meng et al. 2021a). It conditions the generation process on the original image x by starting the denoising process from its noised version instcad of pure noise, constraining the expressive power of the generative model and producing samples closer to the original image x, and, therefore, more faithful to y.
Additionally, implement constraints w.r.t. Ladv. For depth estimation, we employ early stopping criterion and stop the adversarial optimization when the loss reaches certain threshold. We also experimented with constraining the embedding weights w to be close to existing vectors from the vocabulary in E.q. [ However, we found that this significantly reduces the expressivity of the generations. Thus, we do not constrain w during optimization. For image classification, we found that adversarial optimization of the standard cross-cntropy loss can lead to the generation of images of another class (e.g., generating clephant, when y girafTe). We, therefore, maximize the entropy of the model's predictions, i.e., its uncertainty, instead, which we found to lead to the generation of aligned (ž, y) examples. Please see Appendix B.5.2 for more details and examples.
3.3 Target Distribution Informed Generation
The adversarial formulation above finds prompts that reflect the failure modes of f. Without any information about the target distribution, improving the model on the worst-performing distributions is one of the best strategies, which, indeed, improves performance in multiple cases (see Fig. 4 and Tab. D. However, a given model typically has many failure modes and many possible distribution shifts that can occur at test time. Adapting to all of them using only the adversarial feedback mechanism might be inefficient if the goal is to adapt to a specific target distribution instead of improving average performance. Thus, we introduce the second feedback mechanism to inform the prompt optimization process of the target image distribution. It only requires access to simple text descriptions (e.g., 'fog' to adapt to foggy images) small number (~ 100) of unlabelled images.
We implement the target-informed feedback mechanism using CLIP Radford et al. 2021 b guidance. Specifi- cally, we assume access to either textual descriptions of the target image distribution ( a few unlabeled image samples { or both. We construct the corresponding text and image guidance embeddings as e, = avg( (vg((E((tt)) and e; = avg((E((z))),, where E, and E, denote, respectively, the CLIP text and image encoders, and avg stand for averaging. We then use the following guidance loss:
La (w)) (F) (
(F. es),
(2)
5

---

Published in Transactions on Machine Learning Research (03/2025)
where we take L, to be l2 norm between two embeddings and Cj to be the negative cosine similarity, we found it to perform the best. See the Appendix |.. for the results of this ablation. Note that our formulation allows the use of only text or only images for guidance (setting corresponding As to 0) based on the available information. In Appendix [36 we also show that one can construct a similarly effective guidance mechanism without relying on the CLIP model.
Finally, we combine both adversarial, Eq. ( and guidance, Eq.
losses to form the final objective:
WGAP arg min By Bangly.e)) [Cadv (f(2), v) Ca(ă, cw)]
We call the prompts that result. from solving Eq. (3), Guided Adversarial Prompts (GAP). See the Appen-
dices B.4.2 and B.5.3 for further implementation details.
4
Experiments
We perform experiments in three settings: domain generalization via camera trap animal classification on the iWildCam (Beery et al. 2021) dataset, bird classification with spurious correlation with the Waterbirds (Sagawa
et al. 2019) dataset, and depth estimation with the Taskonomy dataset (Zamir et al.) 2018b 2020 For depth estimation, we evaluate distribution shifts from Common Corruptions (Hendrycks & Dietterich
2019) (CC), 3D Common Corruptions (Kar et al.) 2022) (3DCC) applied on the Taskonomy (Zamir et al.
2018b test set and cross dataset shift from the Replica (Straub el al. 2019) dataset.
4.1 Semantic Image Classification
Waterbirds (Sagawa el al. 2019) is a dataset constructed by pasting an image of a waterbird or landbird from the CUB (Wah et al. 2011) dataset, which represents the label y, onto a background image of "land" or "water" from the Places (Zhou et al., 2014) datasct. We follow Dunlap et al.] (2023) and use only images of waterbirds on water and landbirds on land as Diraiu i.e., the background completely correlated with the
label in training data (see Fig. 3 rightt). The test. set Drest contains all four combinations of bird types and
backgrounds (see Fig. 7).
iWildCam (Beery et al. 2021 Koh et al., 2021 is a domain generalization dataset made up of images captured from camera traps placed in various locations around the world. The goal is to generalize to photos taken from new camera deployments. We follow Dunlap et al. (2023) and create a 7-way classification task (background, cattle, elephant, impala, zebra, giraffe, dik-dik),, use two locations that are not present in the training validation Drest: and fix the number of additional generated images for finetuning to 2224.
For both datasets, we use the ResNet50 (He et al. 2016a) model. We compare the following methods for generating additional synthetic data Day (we provide more details in Appendix B):
No Extra Data:
Only Derain used, without generating extra data.
Augmentation buselines: We use two data augmentation methods commonly used in recent literature: CutMix (Yun et al. 2019) and Randengment (Cubuk et al. 2020 These baselines do not use generative models.
Agnostic Prompts: We use a prompt that uninformed both the model and the specific target distribution. Similar to ALIA (Dunlap et al., 2023), ; we use prompt "nature" for Waterbirds and the prompt template "a camera trap photo of (class name)" " for iWildCam.
Guided Prompls: We compare to ALIA (Dunlap et al. 2023), which uses captioning and language models to summarize a target distribution shift into text prompts. This results seven prompts for Waterbirds and four prompts for iWildCam. See Appendix B.2 for more details, specific prompts, and a discussion on the differences between ALIA and our method.
Adversarial Prompts: We use the model previously trained on Dtrain (i.e., no extra data) as the target model f and find adversarial prompts following Eq. [ We find four prompts per class for Waterbirds, eight in total, and four prompts in total applied to all classes for iWildCam.
Guided Adversarial Prompts: We use the same setting as in Adversarial Prompts and apply additional CLIP guidance to adapt to target distribution shift, following Eq. 3 For Waterbirds, apply text guidance

---

Published in Transactions on Machine Learning Research (03/2025)
Apnosli Prunps
Adws Piorpls
Real OCD Data Randhugment
Agristtic Prompt
Advansarial Prompts
Guided Prompts (ALIA)
Guided Adversarial Prompts
waterbedd wete
Training Data
Guided Prompte (AUAA)
culto: No calre Data
Guided houmar Prorests
denabacd on lend
Landtaird
Das Daaa (AG2 anaiibll
Figure 3: Guided Adversarial Prompts generate counterfactual examples not present in the original training dataset and achieve better data efficiency than other prompts. Left: Test performance on a balanced test set (waterbirds and landbirds appear on both land and water) of model trained on the original spuriously correlated dataset, while varying the number of extra data points generated by different types of prompts (see Appendix C.2.3 for results on 2X data). We run each experiment with three seeds and report the mean and standard deviation. Right: Exemplary generations for each prompt type and original training examples (where background is correlated with the bird type.) Frames show whether the model trained without extra data made a correct prediction (green) or not (red) on the correspouding image. As expected, the adversarial mechanism produces examples that fool the model, and the guidance mcchanism steers the generation toward the target distribution. Combining both mechanisms in GAP leads to the generation of counterfactual examples (waterbirds on land and landbirds on water), missing in the training dataset, and improved data efficiency compared to only target-informed GP.
using ALIA prompts as the textual description of the target distribution. For iWildCam, we use image guidance and partition the target test distribution into four groups based on two attributes that have a significant impact on the visual characteristics of the data: the test location (first or second) and time of the day (day or night). We sample 64 unlabelled images randomly from cach group. We optimize for one guided adversarial prompt per group, resulting in four prompts in total.
Training details. For supervised training, we follow Dunlap et al. 2023) and use the Res.Net50 model for f. In Sec. [.3] we also explore how adversarial prompts change with the model by using ViT (Dosovitskiy lt al. 2020p- For prompt optimization, we use Adam (Kingma & Ba 2017) with 1e-3 learning rate. For efficiency, use five denoising steps during optimization and 15 for the final generations, both using the DDIM (Song el al., (020)) scheduler. As Ladv, we use prediction's 's entropy for iWildCam to avoid aligument
collapse between ă and y as discussed in Sec, 3.2 and negative cross-entropy for Waterbirds where we did not observe collapse. Please see Appendix B for more details on the experimental setup.
Waterbirds results. Fig. 3 (Teft) shows the performance of each method, and Fig. 3 (Right) demonstrates the corresponding generated examples for each method. First, we find that while the performance of Adversarial Prompts is par with Agnostic Prompts in low-data regime, it performs worse with more generated data. Looking at the corresponding generated images, we find that while being adversarial, they appear different from images from the target distribution, which can explain the inferior performance in this particular case. Second, using Guided Prompts informed of the target distribution leads to a consistent improvement over Agnostic Prompts, and the corresponding images look more similar to the real images from the target distribution. Finally, combining both feedback mechanisms in Guided Adversarial Prompts results in more data-cfficient generations, outperforming all other methods in the low-data regime. Looking at the corresponding generations, we find that GAP lends to generate only combinations of the bird type and background that are missing in the training dataset, i.., waterbirds on land and landbirds water, which can explain its higher sample efficiency.
iWildCam results. Fig. shows that similar to Waterbirds, GAP, combining both feedbacks, achieves the best performance. Compared to GP with the target-only feedback, GAP generates images with a "camouflage" effect that fools the classification model. Compared to AP with the model-only foodback that generates images with snow background, GAP's images are more similar to the target domain that is summarized as "grassy " (by GPT-4 in (Dunlap et al. 2023)). We also find that in the case of iWildCam, AP significantly
7

---

Published in Transactions on Machine Learning Research (03/2025)
Guided Prompts (ALIA)
Original Image
Agnostic Prompt
Adversarial Prompts
Adversarial Prompts
Extra Data
Agnostic prompt Adversorial trompts
Guided Prempts (AUA) Guided Aiversria Prompis
Rendlug
CutMix
0.65
0.80
0.75
30.70
0.65
0.60
0.55
0.50
Data
Originll Date Size
Figure Guided Adversarial Prompts generate hard training examples leading the best performance. Left: Performance on the images from unseen camera locations (out-of-distribution) with different numbers of generated synthetic images for iWildCam. We repeat each experiment three times and report the mean and standard deviation. GAP consistently outperforms other types of prompts. We also find that AP significantly outperforms GP in the low-data regime, suggesting that being only target-informet requires a more exhaustive sampling to find useful training examples. Right: Original training examples from iWildCam and generated examples for each type of prompt. For GAP, arrows point to the animals for clarity; from top bottom, they are misclassified as cattle, dik-dik, cattle. GAP generates images that are both visually coherent with the target location (described "grassy field") and introduce an adversarial "camouflage" effect.
outperforms GP in the low-data regime, suggesting that model-informed feedback generates more useful training examples. We also find that AP and GAP outperform standard nhon-generative) angmentation baselines and domain generalization baselines (see Appendix C.2.2 for results).
4.2 Depth Estimation
We use the Taskonomy [Zamir et al. 2018ap and Omnidata Eftekhar et al. (2021a) datasets for training. The former consists of 4 million images of indoor scenes, while the latter is mixture of datasets and contains both indoor and outdoor scenes. We evaluate our method
range of domain shifts, from Common Corruptions (Hendrycks & Dietterich 2019 3D Common corruptions (Kar et al. 2022) to other datasets like Replica. We compare the following methods. They all involve fine-tuning the originally trained model f on different synthetically generated datascts. See Fig. for a comparison of the generations:
Control (No extra dala): We fine-tune f on the original training data. This baseline is to ensure that the difference in performance is due to the generated data rather than, e.g., longer training or other hyperparamoters used during fine-tuning.
Agnostic Prompts: This baseline generates data that is agnostic to the model and the target distribution. We generate images with the prompt "room" as the datasets consist of indoor images from mostly residential buildings.
Agnostic Prompts (Random): As we use 30 tokens for our methods, this bascline controls for the number of lokens used. Here, we sample the same number of tokens as AP randomly from the vocabulary to construct. prompt. See Appendix C.1 for details.
Adversarial Prompls: We perform the optimization as described in Eq. 1 to get 30 adversarial prompts (tokens).
Guided Prompts: We generate data using only the CLIP guidance loss described in Eq. 2 We consider both image and text guidnace. For the former use about 100 unlabelled images from the target distribution, for the latter we use the name of the shift e.g., "fog".
Guided Adversarial Prompts: We combine adversarial and guidance losses. We use the same settings as Adversarial Prompts and apply CLIP guidance loss used for Guided Prompts. This allows generate data that is both useful for the model and target distribution.
8

---

Published in Transactions on Machine Learning Research (03/2025)
No Thrget Distribution
Targeted Distributon: Fog
Targeted Distributtin: Blur
Dupth Gonditoning
Apuoctio Prompts
Advernantal
Advemari
Guided Pronpts
Guididd Adverariia
Oudted Prompts
Guidedd Advemariia
Adeeeeen Promeh
Coited hrmppt
Originol Image
Prompte (S0d20)
Pronptt
Promptt
Prompit
+000
0.00g
4.0
3.
Extra D00a
Figure 5: Left: A comparison of generations with different prompts. Generations with AP results in diverse styles that are distinct from the original training data and with agnostic prompts. AP (SDEdit) generations have slight modifications to the original image, as was conditioned on them. The last 4 columns show the generations with text guidance for target shifts fog and blur. Compared to GP, GAP results in generations with more severe fog or blur. Right: Performance of GAP with different amount of added data. The target distribution here is defocus blur applied to Taskonomy test images. The plot shows the & loss of the UNet model versus the amount of extra data generated and used for fine-tuning. The plot shows that both GP and GAP were able to guide the optimization toward generating training data relevant to the distribution shift. See Fig. 18 for results on other corruptions and Appendix C.2.3 for results on 10 data.
Training details. We consider the following pre-trained models for f: 1) a U-Net (Ronneberger et al,, 2015) model trained the Taskonomy dataset (Zamir et al. 2018b 2020) and 2) a dense prediction transformer (DPT) (Ranftl et al. 2021) model trained Omnidata (Eftekhar et al. 2021b). The adversarial optimization was done with AdamW (Loshchilov & Hutter 2019). learning rate of 5.0 x 10-4, weight decay 1.0 x 10-3, We set the early stopping threshold (mentioned in Sec. 3.. Lo 0.08 for the UNet model and 1.0 for the DPT model. They were trained with & and Midas loss (Eftekhar et al. 2021b) respectively. We
perform a total 30 runs to get 30 different Adversarial Prompts. Similar to classification, for efficiency, we use 5 denoising steps during optimization and 15 for the final generations, with the DDIM (Song et al. 2020) scheduler, which we found to be good trade-off between quality and efficiency. See the Appendix C.1 for more details.
Comparing the generated images with different prompts.
Fig. left shows the generations from the baselines and our methods. The genera- tions with AP are diverse and have com- plex styles. Incorporating SDEdit results in slight modifications to the original im- age, as it was used for conditioning. The last four columns show the results of using text guidance for the target distribution shift fog and blur (see Appendix C.4.2 for a comparison between generations from image and text guidance). The genera- tions for GP results only in mild level of fog blur, In contrast, GAP results in more severe fog and blur corruptions. The generations for GP, using only the guid- ance feedback, result only in a mild level of fog or blur. Finally, incorporating both foedback mechanisms in GAP results in generating images with corruptions that.
Table 1: Quantitative results for depth estimation. 4 errors for the depth prediction task for U-Net and DPT models on Com- mon Corruptions (CC), 3D Common Corruptions (3DCC), and cross-datasels (CDS) like Replica. Results for CC and 3DCC are averaged over all distortions and severity levels. AP outperform basclines for all models and distribution shifts. As GAP requires optimizing for each shift individually, and the benchmarks con- tain ~ 33 shifts in total, we only perform GAP for a few shifts (see Fig, 5 and Fig. 18 for results). See Tab. for results on other baselines.
UNet (x100 1)
DPT (x10 L)
Taskonony
Replica
Taskonomy
Shift
Clean
CC
3DCC
CDS
CC
3DCC
Control (No extra data)
2.35
4.93
4.79
5.38
3.76
3.42
Agnostic Prompts
2.47
5.03
4.17
5.30
4.06
3.58
Agnostic Prompts (Random)
2.38
4.96
4.11
5.14
3.88
3.51
Adversorial Prompts
2.49
4.36
4.02
5.12
3.40
3.28
Adversarial Prompts (SDEdit)
2.59
4.20
3.88
4.96
3.35
3.25
9

---

Published in Transactions on Machine Learning Research (03/2025)
are both relevant to the corresponding target distribution and more severe, making them more useful for improving the model.
Quantitative results. Tab. [ shows the results from finetuning our method and the baseline on the different generated datasets. Adversarial Prompts improves the performance of the model under different distribution shifts for both the UNet and DPT models. Fig. 5 (Right) shows the results with Guided Adversarial Prompts for the defocus blur corruption against the amount of extra generated data used for finetuning. Guided Prompts and Guided Adversarial Prompts result in large performance improvement, compared to Adversarial Prompts or the baseline with only 10 extra data points. This suggests that the guidance loss successfully stecred the generations toward producing training data relevant to the distribution shift. See Fig. 18 for results on other corruptions. As the dataset size increases, GP shows signs of sa saturation, whereas GAP further improves the model, showing the benefit of the adversarial feedback mechanism.
4.3 Additional Analysis
Are adversarial prompts found for one model specialized for that model? We study 1) whether models benefit the most from data generated using their own feedback and 2) whether they benefit at all from using data generated for another model (compared to Agnostic Prompts.) Tab. 2 shows that in most cases, model performs best when trained with data generated using its own feodback, which shows the usefulness of the model-informed feedback mechanism. At the same time, we find that in most cases, prompts found for another model still outper- form Agnostic Prompts, suggesting that adversarial prompls result in useful transfer between models.
Table 2: Transferability of adversarial prompts.
We show the results of different. combinations of the finetuning model and model used to generate additional data via model-informed feedback. We report top-1 accuracy for iWildCam and 4 loss for depth.
iWildCam, Acc. (t)
Depth, &s (1)
Data Model ResNet
VIT
MatalModel
UNet
DPT
ResNet ViT
83.97
72.61
UNet
4.73
3.39
83.87
77.21
DPT
4.88
3.46
Agnostic Prompts
Aguostic Prompts
72.94
73.07
5.27
3.66
Does multiple iterations of adversarial opti- mization further improve performance? We define an ileration as one round of adversarial opti- mization, i.c. optimizing Eq. 1 or Eq. (3), gener- ation and fine-tuning. Given that all of the above results were obtained with a single iteration, we aim to see if there are benefits in performing multiple iter- ations. We perform a total of 8 iterations keeping the total number of generaled images, prompts, elc., the same as for a single iteration for comparison. Fig. G shows that the first itcration of the multi-iterations setting results in the largest performance improve- ment and eventually converges to the performance of the single iteration approach. Thus, we chose to per- form a single iteration for our main experiments. See the Appendix C for additional implementation details and results.
Adversarial Prompts Agnostic Prompts (Random)
Control Single teeration
5.5
41 Loos x100
5.0
4.5
2
Iteration
Figure 6: Comparing the performance from run- ning multiple iterations versus a single iteration of adversarial optimization, generation, and fino-tuning. The plot shows the &1 loss (x100) of the U-Net model against the number of iterations on the depth predic- tion task. The loss is computed on the Taskonomy datasct under common corruptions, averaged over all corruptions and severity levels.
5 Conclusion and Limitations
In this work, we aim to generate training data useful for training a supervised model by steering a text-to- image generative model. We introduced two feedback mechanisms to find prompts informed by both the given model and the desirable target image distribution. Evaluations on diverse set of tasks and distribution shifts show the effectiveness of the proposed closed-loop approach in comparison to open-loop ones. Below we discuss some of the limitations of our work:
10

---

Published in Transactions on Machine Learning Research (03/2025)
Label shift: In this work, we focus generating novel images. However, some distribution shifts can also change the label distribution, e-g., for depth estimation, changing from indoor to outdoor scenes would result in a shift in depth maps. One possible approach could be learning a generative model over the label space (L Moing et al. 2021 to control the generation in both the label and image space.
Computational cost: Estimating the gradient of the loss in Eq. requires backpropagation through the denoising process of the diffusion model, which can be computationally demanding. Using approaches that reduce the number denoising steps (Song et al. 2020 Luo et al., 2023 may be able to reduce this computational cost.
Label Conditioning: As discussed in Sec. 3.2 our method is limited by the faithfulness of the generation conditioned on the given label. For example, we found that the semantic segmentation ControlNet does not follow the conditioning accurately enough to be useful for the supervised model. Further developments more robust conditioning mechanisms are needed to successfully apply our method to other lasks.
References
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Pazz Invariant risk minimization. arXiv preprinl arXio:1907.0280; 2019.
Omri Avrahami, Kfrr Aberman, Ohad Fried, Daniel Cohen Or, and Dani Lischinski. Break-a-scene: Extracting multiple concepts from a single image. arXiv preprint arX:v:2305. 163111 2023.
Sara Beery, Dan Morris, and Siyu Yang. Efficient Pipeline for Camera Trap Image Review, July 2019. URL http:///rxit wraesiivorrr//aa arggabs/1907....m 06772 arXiv:1907.06772 [cs].
Sara. Beery, Arushi Agarwal, Elijah Cole, and Vighnesh Birodkar. The iwildcam 2021 competition dataset.
arXiv preprint arxiv:1106 09494, 2021.
Victor Besnier, Himalaya Jain, Andrei Bursue, Matthien Cord, and Patrick Pérez. This dataset does not cxist: training models from generated images. In ICASSP 2020-2020 IEEE international conference acouslics, speech and signal processing (ICASSP), Pp. 1-5. IEEE, 2020.
Oliver Braddick and Janette Atkinson. Visual control of manual actions: brain mechanisms in typical development and developmental disorders. Developmental Medicine and Child Neurology, 55 Suppl 4:13 18, November 2013. ISSN 1469-8749. doi: hallll/dmen.123000
Tim Brooks, Aleksander Holynski, and Alexei A Firos. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVP conference on computer vision and pattern recognition, pp- 18392-18402, 2023.
Lucy Chai, Jun-Yan Zhu, Eli Shechtman, Phillip Isola, and Richard Zhang, Ensembling with Deep Generative Views, April 2021. URL http://arxiv
www.aaiii.ogggbs///. argg/bss//0000 14551 arXiv:2104.15551 [cs].
Mathieu Chevalley, Charlotte Bunne, Andreas Krause, and Stefan Bauer. Invariant causal mechanisms through distribution matching. arXiv preprint arXiv:2206. 11646, 2022.
Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Malthieu Cord. Diffedit: Dillusion-based semantic image editing with mask guidance. arXie preprint arXiv:2210.11427 2022.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation policies from data. arXic preprint arxiv:1805 09501, 2018.
Ekin D Cubuk, Barret Zoph, Jonathon Shlens, and Quoe V Le. Randaugment: Practical automated data augmentation with a reduced search space. In Proceedings of the LEEE/CVF conference on computer vision and pottern recognition workshops, pp. 702-703, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEFE conference on computer vision and pottern recognition, pp. 248- 255.. Icce, 2009.
11

---

Published in Transactions on Machine Learning Research (03/2025)
Zhun Deng, Linjun Zhang, Kailas Vodrahalli, Kenji Kawaguchi, and James Zou. Adversarial Training Helps Transfer Tearning via Better Representations, June 2021. URL http:///aaxxiv..g/abb////// 1019 arXiv:2106.10189 [cs].
Yinpeng Dong, Shouwei Ruan, Hang Su, Caixin Kang, Xingxing Wei, and Jun Zhu. Viewfool: Evaluating the robustness of visual recognition to adversarial viewpoints. Advances in Neural Information Processing Systems, 35:36789 -5836789-36803, 2022.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, and others. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprinl 2xXu:2010.11992) 2020.
Lisa Dunlap, Alyssa Umino, Han Zhang, Jiezhi Yang, Joseph E Gonzalez, and Trevor Darrell. Diversify your vision datasets with automatic diffusion-based augmentation. orXiv preprint arXi::230516288) 2023.
Ainaz Eftekhar, Alexander Sax, Jitendra Malik, and Amir Zamir. Omnidata: A scalable pipeline for making multi-task mid-level vision datasets from 3D scans. In Proceedings of the IEEE/CVP internalional conference on computer vision, pp. 10786 10796,, 2021a.
Ainaz Eftekhar, Alexander Sax, Jitendra Malik, and Amir Zamir. Omnidata: A Scalable Pipeline for Making Multi-Task Mid-Level Vision Dalasets from 3D Scans. In Proceedings of the IEEE/CVE /CFF International Conference on Computer Vision, pp. 10786 10796, 2021b.
Samir Yitzhak Gadre, Gabriel Ilharco, Alex Fang, Jonathan Hayase, Georgios Smyrnis, Thao Nguyen, Ryan Marten, Mitchell Wortsman, Dhruba Ghosh, Jicyu Zhang, Eyal Orgad, Rahim Entczari, Giannis Daras, Sarah Pratt, Vivek Ramanujan, Yonatan Bitton, Kalyani Marathe, Stephen Mussmann, Richard Vencu, Mehdi Cherti, Ranjay Krishna, Pang Wei Koh, Olga Saukh, Alexander Ratner, Shuran Song, Hannaneh Hajishirzi, Ali Farhadi, Romain Beaumont, Sewoong Oh, Alex Dimakis, Jenia Jitsev, Yair Carmon, Vaishaal Shankar, and Ludwig Schmidt. DataComp: In search of the next generation of multimodal datasets, October 2023. URL httt:://arxiv org/ aaw/abs/////// 14108 arXiv:2304.141 141108 [cs).
Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXie preprint arXiv:2208.0160 2022.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. trageee CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint 1rXiv:1811.1225 2018.
Ligong Han, Yinxiao Li, Han Zhang, Peyman Milanfar, Dimitris Metaxas, and Feng Yang. Svdiff: Compact parameter space for diffusion fine-tuning. arXiv preprint arXiv:2303. 11305, 2023.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-77 (70077788557 2016b.
Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wenqing Zhang, Philip Torr, Song Bai, and Xiaojuan Qi. Is synthetic data from generative models ready for image recognition? arXiv preprint arXi::2210.055% 2022.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. Xr preprint arXiv:1903. 12261, 2019.
Dan Hendrycks, Norman Mu, Ekin Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method improve robustness and uncertainty. orXiv preprint 2019.
12

---

Published in Transactions on Machine Learning Research (03/2025)
Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, and others. The many faces of robustness: A critical analysis of out-of-distribution generalization. In Proceedings of the IEEE/CVP international conference on computer 2021.
vision, pp.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to- prompt image editing with cross attention control. arXiv preprint arXiv:2208 01626,, 2022.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advonces in neural information processing systems, 33:6840-6855 2020.
Inbar Huberrnan-Spiieelglaas, Vladimir Kulikov, and Tomer Michaeli. An edit friendly DDPM noise space: Inversion and manipulations. arXiv preprint arXiv:2304.061: 061400 2023.
Ali Jahanian, Xavier Puig, Yonglong Tian, and Phillip Isola. Generative models as a data source for multiview representation learning. arXie preprint arXiv:2106.0522: 2021.
Saachi Jain, Hannah Lawrence, Ankur Moitra, and Aleksander Madry. Distilling model failures as directions in latent space. aixiv preprint arXiv:2206.144 14754, 2022.
Oguzhan Fatih Kar, Teresa Yeo, and Amir Zamir. 3D Common Corruptions for Object. Recognition. Tn ICML 2022 Stift Happens Workshop, 2022.
Diederik Kingma and Jimmy Ba. Adam: A Method for Stochastic Optimization, January 2017. URL http:// org/ attg///b//411..... 1412. 6980 arXiv:1412.6980 [cs].
Diederik P. Kingma and Max Welling.
Variational Bayes, December 2022. URL http:
6114 arXiv:1312.6114 [cs, stat].
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C. Berg, Wan Yen Lo, Piotr Dollár, and Ross Girshick. Segment Anything, April 2023. URL http://arxxv..or
02643
arXiv:2304.02643 [cs].
Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, and others. Wilds: A benchmark of in-the-wild distribution shifts. In International conference on machine learning, pp. 5637-5664. PMLR, 2021.
Guillaume Le Moing, Tuan-Hung Vu, Himalaya Jain, Patrick Pérez, and Matthicu Cord. Semantic palette: Guiding scene generation with class proportions. In Proceedings of the IEEE/CVF conference on compuler vision and pattern recognition, pp. 11229350 2021.
Terri L. Lewis and Daphne Maurer. Multiple sensitive periods in human visual development: evidence from visually deprived children. Developmental P'sychobioloy,, 46(3):163-18) April 2005. ISSN 0012-1630. doi: 10.1002/dew 20055.
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. BLIP: Bootstrapping Language Pre-training for Unified Vision-Language Understanding and Generation, February 2022. URL http://arxiv.org arXiv:2201.10882 [cs].
0ts/2221.12086
Ily Loshchilov and Frank Hutter. Decoupled Weight Decay Regularization, Jamuary 2019. URL
http:
//andáv.rgg/abb//111..oo
arXiv:1711.05101 (es, math].
Andreas Lugmnarr Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Lue Van Gool. RePaint: Inpainting using Denoising Diffusion Probabilistic Models, August 2022. URL http://arxiv..rg// /bs/ 2201.09865 ar arXiv:2201.09865 [cs].
Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent Consistency Models: Synthesizing High- Resolutonn Images with Few-Step Inference, October 2023. URL arXiv:2310.04378 [cs].
04378
13

---

Published in Transactions on Machine Learning Research (03/2025)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint or arXie: Ni::1706.00 706606083, 2017.
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint 0rXiv:2108.01073, 2021a.
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun- Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint SET.:2108.01077. 2021b.
John P Miller, Rohan Taori, Aditi Raghunathan, Shiori Sagawa, Pang Wei Koh, Vaishaal Shankar, Percy Liang, Yair Carmon, and Ludwig Schmidt. Accuracy on the line: On the strong correlation between out-of-distribution and in-distribution generalization. In International conference on machine learning, pp- 7721-7735. PMLR, 2021.
Ron Mokady, Amir Hertz, Kfrr Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proceedings of the IFEE/CVP conference computer vision and pottern recognition, pp. 6038 6047, 2023.
Chong Mou, Xintao Wang, Liangbin Xie, Jian Zhang, Zhongang Qi, Ying Shan, and Xiaohu Qie. T2i-adapter: Learning adapters to dig out more controllable ability for text-to-image diffusion models. ar preprint arXiv:2302.088 08453, 2023.
Hyeonseob Nam, Hau Lee, Jongchan Park, Wonjun Yoon, and Donggeun Yoo. Reducing domain gap by reducing style bias. In Proceedings of the IEFE/CVI conference on computer vision and pottern recognition, pp. 8690 8699, 2021.
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: Towards Photorealistic Image Generation and Editing with Texi-Guided Diffusion Models, March 2022. URL http://arxixv http://a/aaa//...///////// arXiv:2112.07411 [cs].
OpenAL GPT-4 Technical Report, March 2023. URL http:://arxw..rrr/bbaaat. 08777 arXiv:2303.08774 [cs].
Alec Radford, Jong Wook Kim, Chris Hallacy Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and others. Learning transfcrable visual models from natural language supervision. In International conference on machine learning, pp. 8748 8763. PMLR, 2021.
René Ranftl, Alexey Bochkovskiy, and Vladlen Koltun. Vision transformers for dense prediction. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 12189, 2021.
Suman Ravuri and Oriol Vinyals. Classification Accuracy Score for Conditional Generative Models, October 2019. URL http:///rxiv wwt.aaawwvv.ooogbbaaaaaa/ wwtg/a////////eee 10887 arXiv:1905 10887 [cs, stat].
Sashank J Reddi, Satyen Kale, and Sanjiv Kumar. On the convergence of adam and beyond. orXiv preprint arXiv:1904, 1904.09299, 2019.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolutinn image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pallern recognition, pp. 19644106694 2022.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In International conference on medical image computing and computer-assisted intervention, pp. 234-241. Springer, 2015.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yacl Pritch, Michael Rubinstein, and Kfr Aberman. Dreambooth: Fine tuning tott-eo-mmae diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp.
2023.
14

---

Published in Transactions on Machine Learning Research (03/2025)
Shiori Sagawa, Pang Wei Koh, Tatsunori B Hashimoto, and Perey Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization. Xiv preprinl 1rXi::1911.08711, 2019.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Scyed Kamyar Seyod Ghasemipour, Bureu Karagol Ayan, S. Sara Mahdavi, Rapha Gontijo Lopes, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi. Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding, May 2022. URL http://arxxv..rr//
wwtpeiii.orr//aaoo wwtggbbs//20/../// 11487 arXiv:2205. [cs].
Mert Bulent Sariyildiz, Karteek Alahari, Diane Larlus, and Yannis Kalantidis. Fake it till you make it: Learning transferable representations from synthetic ImageNet clones. In CVPR 2023 IEEE/CVF conference on computer vision and pattern recognition, 2023.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk, and Jenia Jitsev. LAION-5B: An open large-scale dataset for training next generation image-text models, October 2022. URL http://arxiv brg/abs/2210..66
arXiv:2210.08402 [cs].
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibriu thermodynamics. In International conference machine learning, pp. 2256 2265. PMLR, 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arxiv preprinl arXiv:2010. 0.00022 2020.
Julian Straub, Thomas Whelan, Lingni Ma, Yulan Chen, Erik Wijmans, Simon Green, Jakob J. Engel, Raul Mur-Artal, Carl Ren, Shobhit Verma, Anton Clarkson, Mingfei Yan, Brian Budge, Yajie Yan, Xiaqing Pan, June Yon, Yuyang Zou, Kimberly Leon, Nigel Carter, Jesus Briales, Tyler Gillingham, Elias Mueggler, Luis Pesqueira, Manolis Savva, Dhruv Batra, Hauke M. Strasdat, Renzo De Nardi, Michael Goesele, Steven Lovegrove, and Richard Newcombe. The Replica Dataset: Digital Replica of Indoor Spaces. arXiv preprint Xrxi:11906. 05797, 2019.
Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. Mcasuring robustness to natural distribution shifts in image classification, arXiv preprint Xrxiv:2007.00 0.06444 2020.
Riccardo Volpi, Hongseok Namkoong, Ozan Sener, John C Duchi, Vittorio Murino, and Silvio Savarese. Generalizing to unseen domains via adversarial data augmentation. Advances in neural information processing systems, 31, 2018.
Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. The Caltech- UCSD 200-2-200-001 Dataset. California Institute of Technology, July 2011.
Zijian Wang, Yadan Luo, Ruihong Qiu, Zi Huang, and Mahsa Baktashmotlagh. Learning to diversify for single domain generalization. In Proceedings of the IEEE/CVF international conference computer vision, pp. 834-843, 2021.
Eric Wong and J Zico Kolter. Learning perturbation sets for robust machine learning. arXiv preprint arXiw:2007.08// 0845500,,00 2020.
Jianhao Yuan, Francesco Pinto, Adam Davies, Aarushi Gupta, and Philip Torr. Not just pretty pictures: Text-to-image generators enable interpretable interventions for robust representations. arXio preprint arXiv:2212.11227,, 2022.
Sangdoo Yun, Dongyoon Han, Scong Joon Oh, Sanghyuk Chun, Junsuk Choc, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF international conference on compuler vision pp. 6023 6032, 2019.
15

---

Published in Transactions on Machine Learning Research (03/2025)
Amir Zamir, Alexander Sax, Teresa Yeo, Oguzhan Kar, Nikhil Cheerla, Rohan Suri, Zhangjic Cao, Jiten- dra Malik, and Leonidas Guibas. Robust Learning Through Cross- Task Consistency. arv preprint 200vv 200,0060, 2020.
Amir R Zamir, Alexander Sax, William Shen, Leonidas J Guibas, Jitendra Malik, and Silvio Savarese. Taskonomy: Discntangling task transfer learning. In Proceedings of the IEEE conference on computer vision und pallern recognilion, pp. 3712-3722, 2018a.
Amir R Zamir, Alexander Sax, William Shen, Leonidas J Guibas, Jitendra Malik, and Silvio Savarese. Taskonomy: Disentangling task transfer learning. In Proceedings of the IEFE Conference on Computer Vision and Pattern Recognition, pp. 3712-3722 2018b.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv:1710.00413 2017.
Lvmin Zhang and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. arXiv preprinl Xiv:22330 05543, 2023.
Bolei Zhou, Agata Lapedriza, Jianxiong Xiao, Antonio Torralba, and Aude Oliva. Learning Deep Features for Scene Recognition using Places Database. In Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K. Q. Weinberger (eds.), Advances in Neural Information Processing Systems, volume 27. Cur- ran Associates, Inc., 2014. URL httpss//ppooceeddngg wew.gss.eerppppccc wwwpuippcccpppprrrrrc /illee//apee//21/ffll// Bcee480028116177557777eeeeeeed Paper. paperr..pp.ppppp.pp...
16

---

Published in Transactions on Machine Learning Research (03/2025)
A
Appendix Outline
We provide further discussions, details, and evaluations in the appendix, outlined below.
Appendices B and describe additional implementation details for our classification and depth estimation experiments, respectively.
Appendix B.6 describes an image guidance mechanism using Textual Inversion (Gal et al. 2022 and compares with the CLIP guidance mechanism, on Waterbirds.
Appendix C.2 provides additional quantitative results. See Appendix C.2.1 for comparisons with
other data angmentation baselines for depth estimation and Appendix C.2.2 for comparisons with domain generalization baselines on iWildCam. See Appendix C.2.3 for results on training with more synthetic data.
Appendices B.4.3 B.5.4 and C.3 provide qualitative generations from all the Adversarial Prompts and Guided Adversarial Prompts used in the Waterbirds, iWildCam, and depth estimation experiments.
Additionally, for depth estimation, we provide qualitative comparison of Adversarial Prompts generations optimized on different models (UNet (Ronneberger et al. 2015), DPT (Ran- ftl et al. 2021)). For iWildCam, we also provide additional results using ViT-B-16 (Dsovvissii
ct al. 2020 instead of ResNet50 (He et al. 2016b).
Appendix C.4 provides additional analysis on the depth estimation experiments:
the single iteration vs. multi-iteration setting
comparison of CLIP image and text guidance
an assessment of the generalization of Adversarial Prompts from one model to another.
B Implementation Details for Classification Tasks
B.1 Training data generation
Inpainting. As mentioned main paper Sec. 3.1 for semantic classification Lasks, we utilize the foreground object masks and use an in-painting technique proposed in Lugmayr et al.] (2022) that preserves the masked region throughout the denoising process. In this section, we briefly describe this procedure and refer the reader to the original work for more details.
Let m be a binary pixel mask, where pixel is equal to 1 if the pixel contains the object and 0 otherwise, and I be the original image from a training dataset. During generation, after obtaining a denoised sample 3, at time we update as i, <- m @ xz
orig + (1 - m) @ øt, where xt orig the original image noised to have the correct properties of the expected Gaussian distribution at time t.
However, because are using Stable Diffusion Rombach et al. (002), the denoising process is done in latent space (using encoder E), not pixel space. This means that apply inpainting, must resize the mask m to the latent space dimensions, and apply the abovo-described procedure in the latent space: & + my @ 2 ooii + (1 m2) @ 2,, where 20
.rig (irr and 2; orix is its corresponding noised version. While this procedure usually performs well in preserving the original region of interest, we also paste the original masked region in the pixel space to obtain the final sample I = m O orig + - (1-m) O Zo.
SDEdit Meng et al. (2021a). In addition to inpainting, depending on the setting, we also use SDEdit Meng et al. 2021a),, mechanism available all diffusion models that allows to use an initial image condition the generation of new images be closer to the initial image. The mechanism is parametrized by the SDEdit strength 8, which indicates the extent by which the model deviate from the original image.
17

---

Published in Transactions on Machine Learning Research (03/2025)
Text-to-image model. For our diffusion model, use Stable Diffusion v1.5
B.2 ALIA
Here, we give more details on the ALIA Dunlap al. (2023) (Automated Languago-guided Image Augmenta- tion) baseline method, which aims al generating images targeting particular test distribution similar to our guidance mechanism (main paper Sec. 3.3
Given exemplar images from the test distribution, ALLA first captions each image using the BLIP Li et al.
[2022) captioning model. Then, uses the GPT-4 OpenAT [023) L.M to summarize these captions into a list of domains asking to produce descriptions that are agnostic the class information. Dunlap al.
(2023) then these prompls generate additional training data. In order to preserve the original class information in their generations, they use SDEdit Meng al. (2021a) Instruct Pix2Pix Brooks et al. (0223
We refer the original paper for further implementation details. Below, we summarize resulting prompts we use for comparison in our results.
For Waterbirds Sagawa et al. 2019 we found that removing the prefix "a photo of a (class name}" from the original prompts when using the impainting technique (Appondix B.1] to work slightly better for both the ALIA baseline and our CLIP text guidance (main paper Eq. 2 We, therefore, use the following prompts:
"in bamboo forest with a green background."
"flying over the water with city skyline in the background."
"perched window."
"standing in the snow in forest.",
"standing on tree stump in the woods."
swimming in a lake with mountains in the background.",
"standing on the beach looking up.
For iWildCam Beery al. 2021 we keep the original prompts intact:
"a camera trup photo of fclass namej in grassy field with trees and bushes."
a camera trap photo of {class name] in forest in the dark."
"a camera trup photo of fcluss name) near large body of water in the middle of a field."
"a camera trap photo of fclass name} walking dirt trail with twigs and branches."
There are two main differences between ALIA and our method:
1. The target distribution feedback. ALIA aligns its prompts with the target distribution by utilizing captioning and summarizing. However, this summarixing process is not informed of the produced generations when using such prompts, and, thus, does not guarantee that the text prompt will accurately guide the generation process to images related to the target distribution.
2. Model feedback. ALIA is not model-informed.. Thus, it doesn't necessarily generate images useful for training a given model.
Those two differences originate from the fact that ALIA is open-loop method, i.e, it lacks the mechanism to refine the prompt based the generated images. In contrast, our method uses model and target distribution feedback in closed-loop. This allows our method to outperform ALIA and be more tata-efficient
18

---

Published in Transactions on Machine Learning Research (03/2025)
Table Generation and optimization parameters for Adversarial Promptsand Guided Adversarial Promptsfor classification tasks in Sec.
Dataset
SDEdit strength
denoising steps
guidance scale
placeholder tokens
Opt. steps (AP/GAP)
A
Waterbirds
7.0
5
1000/1000 2000/ 100000000
20/0
iWildCam
0.8
5
5.0
10
0/10
Dataset
ALIA sampling steps
Ours sampling steps
SDEdit strength
text guidance
SDEdit strength
text guidance
Waterbirds
0.3
50
7.0
1.
15
7.0
iWildCam
0.5
50
7.5
0.8
5
5.0
Table 4: Generation parameters for the classification experiments
B.3 General implementation details
Generation. We report our generation parameters Tab. We use the DDIM Song el al. (2020) scheduler. We generate 384x384 resolution images. Those parameters were chosen based on visual inspection, ease of optimization and downstream performance (validation accuracy). Training data. After generation, ALIA's method consists of an additional filtering step remove "bad" generations. This step relies using pretrained model to measure confidence on the generated images. However, given our method creates images that are adversarial to an iWildCam pretrained model, the filtering part of ALIA's 's pipeline is not usable on our data. Thus, to keep things comparable, we decided not to apply filtering both our method generated data and ALIA's 's generated data. However, must be noted that, Dunlap et al. (2023) only reports a 2% absolute accuracy drop between fitlering and no filtering on iWildCam (1.4% on Waterbirds), thus we do not expect big difference in performance with ALIA's reported results and our results.
Supervised Training. We report our training parameters in Tab. We use ALIA's codebase finetune our models, which ensures fair comparison the ALIA baselines. For everything except the generated data, the settings are the same in ALIA. For both datasets, the starting model 5esNet50 He et al.) (2016a] model, pretrained ImageNet Deng et al. (2009).
The reported test accuracy is chosen according to the best chockpoint, mcasured by validation accuracy.
B.4
Waterbirds
B.4.1
Dataset details
demonstrates the shift. between train and test distributions in the Waterbirds dataset, (Saawa al. 2019). We follow the sctting suggested in Dunlap et al. (2023) and use 1139 images as Dar, where waterbirds appear only on water background and landbirds on land background. We add additional 839 examples either from the original dataset, where waterbirds appear only land background and landbirds water background ("Real OOD data"), "), or generated by Stable Diffusion with prompts obtained by one of the methods. For the data-efficiency plots (e.g., Fig. 3 we reduced the number of added examples by factor of (1/2, 1/4, 1/8, 1/16].
Fig.1
Since the original Waterbirds datasct does not provide masks for the exact generated images, we used the SAM Kirillov al. (2023) segmentation model obtain bird segmentation masks for training images. We use these masks to condition the generative model the class by using inpainting described in Appendix B.1
19

---

Published in Transactions on Machine Learning Research (03/2025)
Dataset
Training weight decay
learning rate
epochs
Waterbirds WWildCam 0.0001
0.001
le-4
100
le-4
100/20
Table 5: Training parameters for the classification experiments
Training Distribution
Test Distribution
Winer Besiground
Land Beckground
Water Background
Land Bactground
Figure 7: Distribution shift in the Waterbirds dataset. The background is a perfectly predictive spurious feature on the training distribution, but loses predictive power in the test distribution.
B.4.2 Implementation Details
Adversarial Optimization. For adversarial feedback, we use the model trained only using the original training data Dirain with complete spurious correlation. is taken from ALIA checkpoints[] As the task is the binary classification, we use the cross-entropy loss for the opposite class as the adversarial loss: (2) -u- (f y), assuming y E {0,1}. This is equivalent to the negative cross-entropy loss referred in the text. We find four prompts per each class, i.e., eight prompis in lotal. Each prompt is composed of five new learnable tokens. We perform adversarial optimization for 1000 steps with learning rate le-3 using Adam Kingma& & Ba (2017). We use five denoising steps during adversarial optimization and generate images for training with 15 steps. We do not use SDEdit for Waterbirds. See Tab. for summary.
CLIP Guidance. For Waterbirds, we use CLIP text guidance by encoding each of ALIA's summarized prompts (see Appendix B.2 with the CLIP text encoder as described in main paper Sec. 3.3 In addition, we renormalize the averaged target text embedding to have the norm equal to the mean norm of the original prompts, and use the resulting vector the target et. We use guidance loss: We >₂- 20 and \₁ (i.e., image guidance).
e,) (cw.))))a 1l.
B.4.3 Additional Qualitative Results.
In Fig. g and Fig. show a few generations using all 8 prompts used in the Waterbirds experiments for Guided Adversarial Prompts and Adversarial Prompts, respectively.
B.5
iWildCam
B.5.1
Dataset details.
The original iWildCam [eerr et al. (2021) dataset subsampled to create 7-way classification task (background, cattle, elephant, impala, zebra, giraffe, dik-dik). The training set has 6,000 images with some classes having as few as 50 images per example. There are 2 test locations that are not in the training or validation set. Additionally, given h, the hour at which an image was taken, we define an image to be during
http://..ww..a../////////c/////a http:////w.a.ta//o///o/////////e 1-0.001-0.0001 /thhtth/bbsttph
20

---

Published in Transactions on Machine Learning Research (03/2025)
Landbird
Waterbird
Figure 8: Generation examples for Guided Adversarial Prompts. Each column shows generations for the corresponding class. Each row in a column (separated by gray lines) shows generations for one found token. There are eight tokens in total, four for each class. GAP tend to generate landbirds on water (left) and of waterbirds on land (right), the combinations not present in the original training data (see Fig.
"daytime" if 9 < h < 17, and "nighttime" if h S 5V 2 20. As said in main paper Sec. 4.1 for image CLIP guidance, we separate the target test locations into four groups (ocation=(1,2] time=(daytime nighttime)). We provide visualisation of the test locations (at day night) Fig. 10 For more details on the iWildCam subset construction, we refer to Dunlap al. (2023) Scction 8.3. For inpainting, the object masks obtained from MegaDetector Beery et al. (2019).
B.5.2 Alignment collapse solution for iWildCam.
As mentioned in main paper Sec. 3.1 choosing Lady to be the negative cross entropy loss, i.. minimizing the random sample of
probability that the model predicts y, may not be the best choice. Indoed, given 64 images to create our target embedding for the image CLIP guidance, the likelihood that animals were present on these 64 images is very high. This means that the target embedding, although mostly containing the "location concept", also partly contains an "animal concept". This means that the image CLIP guidance does not explicitly forbid the generation of new animals. Combined with optimizing the negative cross entropy loss, this leads to adversarial animal insertions al generation time, where a new animal of class ÿ appears alongside the original animal of class y, destroying the (i, y) alignment. In Fig, II we provide qualitative examples for this behaviour. To counter this behaviour, uncertainty loss. More precisely, this loss is equal to the cross entropy loss where the target label y is replaced by the soft label = [p):"." "*, 1 the uniform distribution over all classes. This loss explicitly encourages generations that either (1) do not contain new animals (2) contain new animals that are not accounted for in the label space y.
choose Lady to be the "entropy" loss,
21

---

Published in Transactions on Machine Learning Research (03/2025)
Landbird
Waterbird
Figure 9: Generation examples for Adversarial Prompts. Fach column shows generations for the corresponding class. Each row in a column (separated by gray lines) shows generations for one found token. There are eight tokens in total, four for each class. While AP finds tokens that fool the model, the generated images are different from the target distribution (land or water background).
Figure 10: iWildCam Test Locations. Random samples from the four target distributions. First row is LOCATION=1, day & night. Second row is 1 day & night.
22

---

Published in Transactions on Machine Learning Research (03/2025)
Figure 11: Using the negative cross-entropy loss may lead to adversarial animal (e.g., elephants) insertions, destroying the alignment between ă and First row contains the original training images. The labels are [background, background, callle]. Second row contains the corresponding generated samples using a guided adversarial prompt, optimized with negative cross-entropy loss as the adversarial loss.
B.5.3 Implementation details
Adversarial optimization. We describe here the parameters and settings used for optimization. If not precised, the same parameters were used for Adversarial Prompts and Guided Adversarial Prompts. As said in main paper Sec. 4.1 we optimize 4 prompts. Fach prompt is composed of 10 placeholder tokens.
For optimization, we use a constant learning rate of 0.001, and a batch size S.
We use the "entropy" loss, described previously. For adversarial prompts, we train for 2000 steps. For guided CLIP guidance cocfficient with A; 10 and and X 0 (i.c., text guidance). We train for total of 10000 gradient steps. However, we don't optimize the adversarial loss for the first 2000 steps to allow the prompt to first converge to the target distribution region. One run takes about 3 hours, using one A100 GPU with 80GB of RAM, on our internal cluster.
adversarial prompts,
For adversarial prompts, to generate 4 different prompls, we simply change the seed. For guided (adversarial) prompts, each prompt is w.r.t a new location & time of the day of the test distribution.
Training data. The generation settings are the same as the ones used during adversarial optimization. For each target domain-guided adversarial prompt, (i.e. location & time of the day), ), the source images (used to condition the generation with object mask and through SDEdit Meng et al. (2021a)) are only images that match the time of the day of the target domain used during generation. Furthermore, for each prompt, we only generate one image per source image.
For ALIA, for each prompt, we generate one image per source image, from the whole training dataset. For the generation settings, given we use a slightly different generation process (inpainting) compared to their original implementation, we search ALIA's pest-performing generation parameters (according validation accuracy) over SDEDit strength [0.4, 0.5, 0.8] and guidance scale [5.0, 7.5). We found the best-performing parameters for ALIA to be the same as the one reported by ALIA in their Githut i.e. SDEdit strength of 0.5 and guidance of 7.5.
Finetuning. The learning rate scheduler is a cosine scheduler, updated every epoch. The batch size is 128. Our iWildCam pretrained model is taken from ALLA checkpoints ALIA trains the model from "scratch" (i.e. the model has never seen iWildCam data), for 100 epochs, on the combination of real + generated data. For our method, given we optimize the prompts based on finetuned model feedback, may not make
http:////ggtubb.commssauuugggg hhttps//apl waddb...bwwwdabbaaaa. wandb.al, http://wwaraaaaaa.ac//////////ta filteredrresme5500-0.00000 1000--000000/e000e pte
23

---

Published in Transactions on Machine Learning Research (03/2025)
much sense to train the model from 'scratch'. Thus, also introduce the variant where the iWildCam pretrained model is finetuned on the combination of real + generated data for 20 epochs, where finetuning means that every layer, except the last, is frozen.
For a fair comparison, both training settings are tested for ALIA and our method. We found that ALIA worked best when training from scratch and our method worked best when using the finetuning setting.
Finally, in their iWildCam experiment, ALIA fixed the number of extra generated points to be used in combination with real data during training to 2224 images. For the sake of comparison, adopt the same limit in our experiments, with the added variant where the limit is 556 images, showcasing the data efficiency of our method.
B.5.4 Additional Qualitative Results.
show few generations using each of the 4 Guided Adversarial Prompts and Adversarial Prompts used in the iWildCam experiments.
In Fig. 12 and Fig. 13
B.5.5
Using ViT model.
In Fig. 4 repeat the iWildCam experiment from the main paper (Fig. with VTT-B-16 Dosovitskiy
ct al. 2020) model. Additionally, we provide qualitative results for generations from adversarial prompts optimized with ViT-B-16 model in Fig. 15
B.6
Image Guidance using Textual Inversion
In addition to the CLIP image guidance introduced in main paper Sec. 3.3 Inversion (TT) Gal et al. (2022) as an image guidance mechanism. Similar to the CLIP guidance, we use a few images { from the target distribution. Now, instead of the similarity in the CLIP embedding space, we use the denoising loss between a generated image and one of the target images (see Eq.. (2) in Gal al. (2022)
we also explore using Textual
CrI(Gw) -e [||e (,
(4)
(5)
where & is the VAE Kingma & Welling (0022 image encoder and eg is the denoising UNet model from the Stable Diffusion model Rombach al. 2002 and Ty is sampled randomly from the set of available target images.
We test the Tl image guidance on the Waterbirds dataset. We use the guidance loss from Eq. (4) with the weight 1000 (we found lower valuos to result generations less faithful to the target images) and randomly sample 50 (unlabeled) images from the validation split of the original Waterbirds dalaset where both types of birds appear on both types of backgrounds. We keep other settings the same as for GAP and AP.
Fig. 16 shows that TI guidance works par with better than CLIP guidance the Waterbirds datasct. We found, however, that the TI guidance does not result in faithful generations for iWildsCam dataset, and further investigations are needed.
B.7 Additional Analysis
We ablate hyperparameters like 1) using & cosine loss for LeLIr, 2) different ways of incorporating guidance e.g., text or image with CLIP or textual inversion (T.I).
The table shows the accuracy from different combinations of 1 and on the Waterbirds dataset. Using & and text guidance worked best, thus, we used this sctting for our results Fig. 3 T.I. compares generations the original images in the pixel space, and Image in the CLIP embedding space, resulting in different guidance mechanisms and, hence, performance.
24

---

Published in Transactions on Machine Learning Research (03/2025)
Figure 12: Generations with the 4 guided adversarial prompts for iWildCam. 1st column is the original image. Then from left from right, have the guided adversarial prompts for LOCATION 1 during the day, during the night, and then LOCATION 2 during the day, during the night. SDEdit (strength 0.8) was used during the adversarial optimization and generation.
Loss' Loss)Guude. Guide.
'Tex
Image
84.0
77.3
83.6
Cosine sim.
82.5
72.7
Table 6: Results from different hyperparameters, namely, loss for CLIP guidance and how guidance is incorporated, on the Waterbird dataset.
25

---

Published in Transactions on Machine Learning Research (03/2025)
no 07
OOT!!
Figure 13: Generations with the 4 adversarial prompts for iWildCam. 1st column is the original image. Then, each column is an adversarial prompt initialized with different seed. SDEdit (strength 0.8)
was used during the adversarial optimization and generation.
No Extra Data Agnastic prompt
Advennr al Prompns Guideed Prompts (ALIA)
Guided Adversdia Frompts
0.70
0.65
0.60
Original
Figure 14: We train a VTT-B/16 model on the combination of the original training data and extra data generated using different types of prompts. We show the average accuracy on two iWildCam test camera trap locations. We run each experiment with three seeds and report the mean and standard deviation.
C Depth Estimation
C.1 Depth training details
Adversarial Optimization. The adversarial optimization was done with AdamW Loshchilov & Hutter (2019). learning rate of 5.0 10 10-4, weight decay of 1.0 x 10-3, and batch size of 8. The token embeddings at the start of optimization are randomly sampled from W/ Jemb) where Pemb and Temb the mean and standard deviation of all embeddings in the vocabulary. We set the early stopping threshold 0.08 for the UNet model and 1.0 for the DPT model. Note that these models were trained with different losses, & for the former and Midas loss Eftekhar et al. (2021b) for the later. Adversarial optimization is performed with the same loss as was used for training these models. One run takes about 15 mins using one 80GB A100, on our internal cluster. We perform a lotal of 32 runs, to get 32 Adversarial Prompts for the UNet model and 30 runs for the DPT model. As the DPT model was trained on Omnidata, which a mix of datasets, we have 6 runs for each datasct. Different number of placcholder tokens were also used for cach rum as suggested in Fig. e of the main paper. For the DPT model, we do 8, 16 tokens runs for each dataset. and also 3 runs with 32 tokens for each dataset. For the UNet. model, 4 runs of 1, 8 and 16 tokens each and
26

---

Published in Transactions on Machine Learning Research (03/2025)
O 07
0.
Figure 15: A comparison generations with adversarial optimization on different models. First. row original image. Second to fith row are generated using the four ResNet-based adversarial prompts. The four last rows are generated using the four ViT-based adversarial prompts.
16 runs of 32 tokens were used, to get total of 32 prompts. We also use a reduced number of denoising steps during optimization i.c., 5, as we found it to be more stable.
Guided Adversarial Optimization. The CLIP guidance coefficient for text and image guidance is set to and 5 respectively. For image guidance, we randomly sampled 100 images from the target distribution. For text guidance, used target distribution's name in the prompt, c.g., "fog" for the fog corruption from CC.
Random prompts. In our proposed method, we optimize for embedding vectors, resulting in prompt, Thus, to match this setting, from a Gaussian distribution fitted on the embeddings from the vocabulary, we sample n random embeddings to create a random prompt to be used in the data generation.
Generation. Generation performed with the DDIM Song et al. (2020) scheduler and 15 sampling steps. We generate 80k images for the UNet model and 60k images for the DPT model for fine-tuning. For the GP runs with SDEdit, used strength 0.6, for the GAP runs, strength 0.9. See
During optimization,
only denoising steps, as it is more stable.
Fine-tuning, For fine-tuning, we optimize the UNet model with AMSGrad Reddi et al. (019 with a learning rale of 5.0 x 10-1, weight decay of 2.0 x 10-6 and batch size 128. For the DPT model, learning rate of 1.0 x 10 weight decay of 2.0 x and batch size 32.
C.2 Additional Quantitative Results
C.2.1 Depth Estimation
Performance of non-SD baselines. In Tab. 7 we show the results for depth estimation for two additional basclines, deep augmentation Hendrycks et al. (2021) and style augmentation Geirhos al. (2018) that do not make use of generative models. Deep augmentation distorts a given image by passing it through an image- to-image model e.g., VAE Kingma & Welling 2022 while perturbing its representations. Style augmentation
27

---

Published in Transactions on Machine Learning Research (03/2025)
Agnostic Prompts
GAP
Adversarial Prompts
TI GP
Guided Prompts (ALIA)
Roal OOD Data No Extra Data
Guided Aversarial Prompts
90
Test Balanced Appuracy
78
1/18
1/2
Extra Data (wint max available real data)
Figure 16: Results of using Textual Inversion image guidance. We use the same plot as in Fig. We add two additional methods using Textual Inversion image guidance described in Appendix B.6 TT GAP is the Guided Adversarial Prompts with Tl image guidance instead of the CLIP guidance. T1 GP uses only Tl guidance to find prompts. The TI guidance works on par with the CLIP guidance when used with adversarial optimization (TI GAP). However, using only TI guidance (TI GP) results worse performance than using only text guidance with prompts found by the ALIA method Dunlap 2023
28

---

Published in Transactions on Machine Learning Research (03/2025)
involves involves applying style transfer to the original training images. Adversarial Prompts.
They perform comparably to
U-Net
DPT
Taskonomy
Replica
Taskonomy
Shift
Clean
CC
3DCC
CDS
CC
3DCC
Control (No extra data)
2.35
4.93
4.79
5.38
3.76
3.42
Agnostic Prompls
2.47
5.03
4.17
5.30
4.06
3.58
Agnostic Prompts (Random)
4.11
5.14
3.88
3.51
Adversarial Prompts
2.49
4.36
4.02
5.12
3.40
3.28
Adversarial Prompts (SDEdit)
2.59
4.20
3,88
4.96
3.35
3.25
Deep Augmentation
2.42
4.24
3.70
5.01
2.83
3.70
Style Augmentation
3.85
5.16
2.80
3.10
Table 7: Additional quantitative results on depth estimation. & errors on the depth prediction task for a pre-trained U-Net and DPT model. (Lower is better. UNet losses are multiplied by 100 and DPT losses by 10, for readability. Note that the two models were trained with different losses, thus their numbers are not comparable to each other.). We evaluate on distribution shifts from Common Corruptions Hendrycks & Dietterich (2019) (CC), 3D Common Corruptions Kar et al. (2022) (3DCC) and cross-datasets (CDS), Replica Straub et al. (201 The results from CC and 3DCC are averaged over all distortions and severity levels on Taskonomy. Our method is able to generate training data that can improve results over the baselines on several distribution shifts. Generations with AP (SDEdit) gives better results than AP under distribution shifts. Thus, also conditioning on the original image seems to be helpful for these shifts. For the DPT model, the trends are similar, AP performs better than the baselines. Deep augmentation and style angmentation do not make use of a generative model for generating extra data. They perform comparably to AP.
C.2.2 Classification with iWildCam
We show experimental results for several domain generalization baselines on iWildCam. The results for the synthetic data generation methods are based on the low-data regime, i.c., where we generate 4X less data. Our proposed methods, both AP and GAP, perporform these domain generalizaton baselines.
Mathod
RaaNes50
GramDRD
Segese
ADA
Wang
ChudRR
Chess ba
Prongex
67.5
79.8
8L2
Table 8: Additional quantitative results on iWildCam. We compare our methods against several domain generalization basclincs. GP and GAP still outperforms.
C.2.3 Training with additional generated data
We experimented with training on more generated data for Waterbirds and Depth estimation. We found that the trends are dataset specific. For Waterbirds, GAP underperforms GP with 2X the amount of extra data (relative to the original training data, see Fig. 3 for the results for up to 1X extra data). However, for depth estimation GAP outperforms GP (see Fig. the results up to 10 extra data).
Dataset
Waterbirds (Acc.")
Depth (f, Err. 100 4)
Extra data
IX
2X
10a
10
GP
84.6
89.2
3.79
3.7
GAP
84
87.2
3.47
3.3
Table 9: Training with additional data. We extend the results in Fig. 3 and Fig. of our method with more generated data.
to show the performance
29

---

Published in Transactions on Machine Learning Research (03/2025)
C.3 Additional Qualitative Results
Generations from all adversarial prompts & comparison of generations from different. models. We show the generations from all Adversarial Prompts from the UNet model, without SDEDit (Fig. [9p with SDEdit (Fig. 20), and multi-iteration (Fig. 21 Additionally,
provide the generations from two DPT models, allowing us to assess the difference the model feedback has on generations. The first DPT model was only trained on Omnidata (Fig. 22 and second was trained on Omnidata with augmentations from CC and 3DCC and with consistency constrains Zamir et al. (0200 (Fig. 23 The quantitative results in the paper were reported only on the former DPT model.
There does not seem to be obvious differences in the styles generated between the two DPT models. However, between the Adversarial Prompts from the UNet model with and without multi-iteration the Adversarial Prompts from the latter seems to result in much more diverse styles.
C.4 Additional Analysis
5.0
Train
Val
4.5
4.0
3.5
3.0
2.5
10
takens
Figure 17: Gencralization to generated images from similar larger number of tokens. This plot shows the performance of the UNet model when trained on Adversarial Prompts with number of tokens and lested Adversarial Prompts with m number of tokens (denoted in the plot as - m). With the exception of 1 + and 1 + 8, training on Adversarial Prompts with n tokens and testing on m, n F m results in higher loss than training and testing on the same number of tokens.
C.4.1 Running multiple iterations of adversarial optimization single iteration
Here, provide additional analysis for the multi-iteration experiments in Fig. G in the main paper. We optimize for 4 prompts in each iteration and noticed that if the number of placeholder tokens in given prompt is kept fixed throughout the iterations, the optimization to find new Adversarial Prompts becomes more difficult. However, if we increase the number of tokens at each iteration e.g., 1 token per prompt for 1st, per prompt for 2nd, etc, we are able to consistently find new Adversarial Prompts. Thus, we aim investigate the generalization of given model different Adversarial Prompts, e.g., model more likely to gencralize to Adversarial Prompts with the same number of tokens.
To perform this analysis, generated data Dn, Dm using AP with n and m tokens per prompt respectively and measured the performance of a model fine-tuned on D, on Dm-
Results for generalization to the same number of tokens. In this setting, m, we use n e (1, 8, 16, 32). For every n, we construct D, and D, to be generated using 4 Adversarial Prompts. We fine-tune the model on D, and and validate both on D, and Dm validation sets during the fine-tuning, The results are shown in Fig. 17
Results for gencralization to different number of tokens. In this sotting, (n,m) are (1,8), (8, (8, 16), 8), 32), (32, 16) respectively. For every n we fine-tune on D, and compute the validation loss on Dn and D.n- The results are shown in Fig. 17 As the loss for m tends to be more
30

---

Published in Transactions on Machine Learning Research (03/2025)
similar then when # m, chose to increase the number of tokens used per prompt in multi-iteration setting.
Target-informed: Text Guidance
Target-Informed: Image Guidance
Targated Distrbution: Fag Targeled Distribution:
Targeted Distributio:: Fog
Targeled Distributiort
Targated Distributions
Depth Condttionnng
Quided Prompte
Guided Adversarial
Quided
Adversanial
Guided
Original Image
Prompte
Prompte
Promots
Prompte
Prompis
Prompte
Prompto
Fog
Blur
Fog
Fog (30)
Dcfocus Blr
Detocus (30)
Outrid Pramott cmnagd
Peggt mor mocu
Extra Data
Extro Data
Extro Doto
Extra 2003
Figure 18: comparison of text and image guidance for two distribution shifts fog and blur. The base model used here the UNet model. Top: Generated images from Guided Prompls and Guided Adversarial Prompts. All images were generated with SDEdit, strength 0.9, thus, they tend to look similar to the original image (2nd column). Using Guided Prompts alone for either text image guidance results in generations with mild fog or blur. With Guided Adversarial Prompts, get generations with more secere fog blur. For image guidance, we sampled random (unlabelled) images with blur and fog from the Common Corruptions evaluation set. See the last two columns for some sample images. Bottom: The plots show the results from fine-tuning with text and image guidance, evaluated on fog and blur for CC and 3DCC. Note that the image guidance here uses (unlabelled) samples from the same target distribution that was sampled on. In all cases, Guided Adversarial Prompts outperforms Guided Prompts with large enough extra data.
C.4.2 CLIP image vs text guidance.
In Fig. 18 compare the qualitative (top) and quantitative (bottom) differences in generations from text. guidance and image guidance on defocus blur and fog. Note that image guidance uses sample (unlabelled) images from the corresponding target distribution that is evaluated on, i.e., fog samples images from the fog corruption from the CC benchmark and fog (3D) samples images from the fog corruption of the 3DCC benchmark. If the target distribution name has (3D) appended it, it from the CC benchmark, otherwisc it is from the 3DCC benchmark.
We observed some differences in the generations with text image guidance (Fig. 18 top). Text Guided Prompts generates corruptions that are more realistic that image Guided Prompts. For example, fog gets denser further away from the camera or around the floor when text Guided Prompts are used for generations. For image Guided Prompts, as it was guided by the image samples from CC where the corruption is applied uniformly over the image, learns also apply a more uniform corruption over the image. We also noticed that the diffusion model was not able to generate certain shifts e.g., compression artifacts, we leave further analysis to future work.
31

---

Published in Transactions on Machine Learning Research (03/2025)
Original
Depth Condition
Adverarial Prompts
Advencaiial Prompit Advercaral Prompts Anverr Prompis
Figure 19: Generations from all Adversarial Prompts with the UNet model as the base model.
Quantitatively, we observed that image guidance tends to perform the best across the target distributions, with large enough extra data (Fig. 18 bottom).
C.4.3 Generalization of Adversarial Prompts to different models.
We show how adversarial generations from Adversarial Prompts found for one model are for another model in Tab. II The generations from Adversarial Prompts found for e.g., the UNet model result in the highest loss when evaluated on the UNet model. However, the generations from Adversarial Prompts from the DPT model also result in similar loss. Similar trends hold for the DPT model. Thus, Adversarial Prompts found for one model are also able to result in high loss for another model.
AP from Eval on Original data
UNet
DPT
UNet DPT
2.55
7.63
5.39
1.76
7.17
6.46
Table 10: Evaluation performance of model on generated images from Adversarial Prompts from another model (without fine-tuning. For the UNet model we report the & loss (x100 for readability) and the DPT model, the Midas loss (x10 for readability). The Adversarial Prompts attained from performing adversarial optimization on a UNet model and evaluated on the same model result in a loss of 7.63. Generations from the DPT model evaluated on the UNet model result in loss of 7.17. Thus, the adversarial prompts found for model seems also be adversarial for another. We also report the loss the original images for comparison.
32

---

Published in Transactions on Machine Learning Research (03/2025)
Original Condition
Advencarial Prompts
Anveraaiaa Promppts
Advercaraal Promprs
Advenariial Prompts
Figure 20: Generations from all Adversarial Prompts with the UNet model the base model. SDEdit (strength 0.6) was used during the adversarial optimization and generation, thus, the generations look similar to the original image. Zoom in to see the different perturbations generated.
33

---

Published in Transactions on Machine Learning Research (03/2025)
Original Image
1st Iter
5th Iter
2nd Iter
6th Iter
3rd Iter
7th
4th Iter
8th Iter
Adver cartal Prompts
Adversarial Proeppts Adversarie Prompiy Adverseria Prompts
Figure 21: Generations from all Adversarial Prompts with the UNet model as the base model for the multi-iteration case ie., multiple iterations of adversarial optimization, generation and mme-tuning. The colored borders denote the iteration number. Note that we set the early stopping threshold to be 0.1 for the first iterations and 0.08 for the other iterations. We optimized for prompts for cach itcration, with an increasing number of tokens for each prompt.
34

---

Published in Transactions on Machine Learning Research (03/2025)
Original Image
Depth Condition
Adversarial Prompts
Blendedwei
byparem
Sepicc
Runicca CSo
Takioomy
Figure 22: Generations from all Adversarial Prompts with the DPT model as the base model. The model was trained on Omnidata which consists of 5 datasets and we optimized for 6 Adversarial Prompts for each data. Each shows the generation from the 6 different prompts for that dataset.
Degth
Promots
Bendealis
syparam
Rupiica
Rupiica 050
Tackooran
Figure 23: Generations from all Adversarial Prompts with a DPT model, also trained on Omnidata. However, this model was also trained with CC and 3DCC augmentations and consistency constraints.
35

---

Published in Transactions on Machine Learning Research (03/2025)
D Broader Impact
We presented a method to control generative models to produce training data for supervised learning models. While our method is not particularly poised for negative use, it should be noted that powerful generative models are a general tool and the method has the potential to be used ways authors did not intent. In addition, the data they are trained on may incorporate various societal biases or contain samples gathered different ways from the internet. Furthermore, we will make our code and models publicly available. Thus, allowing for transparent inspection and safeguarding.
36


Reviews:
[{"review_id": "erskwiZafm", "reviewer": "Reviewer_uNsx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "1. The motivation of the paper is well explained for generating high-quality data within the target distribution so that the generated data can be utilized for training purposes.\n2. Authors have explained the 2 mechanisms clearly in approach section.\n3. Two tasks, classification and dense prediction for depths have been utilized to evaluate the proposed method. And experimental results are good.\n4. Extensive details have been provided in the appendix which help understand the paper better.\n5. Some weaknesses are listed in the below section.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a new mechanism called Guided Adversarial Prompts, which includes searching for adversarial prompts from supervised models as well as guiding generation to target distribution. The proposed method is in closed-loop manner and is designed for generating data  for specific distributions. The proposed method has been evaluated on both classification and dense prediction tasks, and results have shown it can help generate data for training purposes. The proposed method can serve as a powerful approach in the community and help mitigate data shortage in training generative models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. In the abstract, authors introduce the second mechanism as \" Therefore, we introduce the second feedback mechanism that can optionally guide the generation process towards a desirable target distribution.\". I recommend authors add 1 sentence introducing how the second feedback is processed, similar as the way introducing the first mechanism.\n2. In Figure 1, it would be help to add what generative models used for illustrations? \n3. In the subsection of \"Generating aligned training examples.\" in Section 3.1, it is not clear to me how generating process works. Authors can clarify what do you use y or y&c to sample aligned examples. Do you discard texts when do sampling?\n4. In Fig. 4, authors mentioned that \"AP significantly outperforms GP in the low-data regime, suggesting that model-informed feedback generates more useful training examples.\". I wonder do authors have qualitative analysis on it?\n5. I recommend authors double check references across the paper, for example, in Table 1, it would be good to cite UNet and DPT here.", "broader_impact_concerns": "In the paper, authors have not included any broader impact concerns. I would encourage authors to add one section, discussing relevant concerns with generated data and its process.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "nZRHwKom5O", "reviewer": "Reviewer_busS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "- The main strength of the proposed method is the empirical improvements shown in a detailed set of experiments. The improvements over competing methods are significant as shown in Figures 3 and 4. There are also detailed analysis on the results in Section 4 and the Appendix. \n\n- The main weakness in my opinion, also mentioned by the authors in Section 5, is the quality of conditional generation models. It is difficult to generate adversarial examples that match the label or target distribution constraints and one has to rely on tools like SDEdit or other heuristics. This makes the method more difficult to apply in practice and need to be adjusted in a case-by-case basis. \n\n- Equation 1 is not clear. How are the weights w related to the continuous embedding c_{w_i}? Also, are there any constraints like norm constraints on the embeddings? \n\n- One weakness of the proposed method is the possibility of (x, y) alignment collapse that the authors mentioned in Section 3.2. The current solution is to make it less adversarial by running fewer iterations but it does not seem satisfactory, nor does it guarantee that the generated image will follow the provided class label. The generated examples still need to be tuned by rules designed by humans.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors propose a method for generating image training data using diffusion models called guided adversarial prompts (GAP). Their main idea is to use adversarial generation to provide difficult training examples to learn better models, while at the same time use guides/constraints to ensure the generated adversarial examples fall within the target distributions. The empirical results are good and the proposed GAP method beats other state-of-art data augmentation methods using diffusion models. The major difficulty of the applying the proposed method is to ensure the generated adversarial examples are within the target distribution, which requires the use of different conditional generation mmethods and filtering, and can require different adaptations for different applications. Overall the paper is of good technical quality and I would recommend acceptance after minor changes.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Address the weaknesses and questions above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "PklkB9X0A8", "reviewer": "Reviewer_HxDY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n- The paper is well-written and clearly presented. \n- The proposed approach is simple and intuitive\n\n## Weaknesses\n- From Figure 3, the performance difference between GAP and ALIA/Agnostic Prompting decreases considerably as more extra data is added. Does this trend hold if even larger amounts of additional data are used? Since ALIA/Agnostic Prompting avoids prompt learning and is thus less computationally intensive, one could potentially leverage more ALIA-generated data under a fixed computational budget. I believe that this is the biggest weakness of this work.\n- While the baselines for different synthetic data generation methods are present, the methods used for training with no additional data could be improved. While the use of some types of \"shallow augmentations\" are explored, it would be great to also experiment with common domain generalization approaches such as GroupDRO which are specifically designed for these sorts of datasets\n- Some recent papers [1] have demonstrated that training on real data retrieved from the training sets of models such as Stable Diffusion always outperforms training on data generated by these models. It would be interesting to see if the proposed method makes substantial progress towards closing this gap. \n- In Eq. 2, the generative model is pushed towards generating examples that match the average CLIP embedding of the samples that we have for the target distribution. However, this will push all of the generated data towards a single target which can harm the diversity of the final generated distribution. It would be interesting to experiments by using the average clip-embedding to the top-k similar examples.\n- While there is extensive qualitative analysis on the generated images, some qualitative analysis on the learnt prompts would be very interesting as done in [2] by mapping the continuous tokens to the nearest real word. It would be very interesting to see what the learnt prompts that generate the images shown in Figure 9 in the appendix \n\n## References\n- [1] The Unmet Promise of Synthetic Training Images: Using Retrieved Real Images Performs Better\n (https://arxiv.org/pdf/2406.05184) \n- [2] Learning to Prompt for Vision-Language Models (https://arxiv.org/abs/2109.01134)", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a novel approach at generating additional synthetic training data to improve domain generalization of models. The technique learns prompts that encourage the generated images to (1) maximize uncertainty of the supervised model and/or (2) match the CLIP embedding of unlabeled target images or text descriptions of the target data.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Necessary for Acceptance:\n- Justification/experiments for why we would want to use GAP instead of generating more samples with a cheaper generation scheme. Also, it is important to show that this gap does not diminish when we continue increasing the amount of synthetic training data that we add.\n- Additional baselines used in the domain generalization literature are important to include as baselines for the no extra training data setting\n\nNice to Have:\n- Comparison to retrieving real images from the training datasets of models like Stable Diffusion\n- Ablation using the mean of the top-k similar CLIP embeddings as the target for Eq. 2\n- Qualitative analysis of the learnt prompts", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Authors are strongly advised to include discussions (regarding papers' exposition and explanations, asked by all reviewers) or additional materials (especially requested by reviewer HxDY) during the rebuttal phase.
Decision: Accept (poster)