Nuisances via Negativa: Adjusting for Spurious Correlations via Data Augmentation
Authors: Aahlad Manas Puli
Nitish Joshi
Yoav Wald
He He
Rajesh Ranganath
Venue: Accepted by TMLR ()

Abstract: In prediction tasks, there exist features that are related to the label in the same way across different settings for that task; these are semantic features or semantics. Features with vary- ing relationships to the label are nuisances. For example, in detecting cows from natural images, the shape of the head is semantic, but because images of cows often have grass back- grounds but not always, the background is a nuisance. Models that exploit nuisance-label relationships face performance degradation when these relationships change. Building mod- els robust to such changes requires additional knowledge beyond samples of the features and labels. For example, existing work uses annotations of nuisances or assumes erm-trained models depend on nuisances. Approaches to integrate new kinds of additional knowledge enlarge the settings where robust models can be built. We develop an approach to use knowledge about the semantics via data augmentations. These data augmentations cor- rupt semantic information to produce models that identify and adjust for where nuisances drive predictions. We study semantic corruptions in powering different spurious-correlation- avoiding methods on multiple out-of-distribution (ood) tasks like classifying waterbirds, natural language inference (nli), and detecting cardiomegaly in chest X-rays.

Published in Transactions on Machine Learning Research (06/2024)
Nuisances via Negativa:
Adjusting for Spurious Correlations via Data Augmentation
Aahlad Puli!,,, Nitish Joshi', Yoav Wald?, He Hel Rajesh Ranganath 1,2,3 Department of Compuler Science', Center for Dala Science, Deportment of Population Health? New York University
Reviewed on OpenReview: https: // openreview. net/ forun? id= JdFJJSKSYy
Abstract
In prediction tasks, there exist features that are related to the label in the same way across different settings for that task; these are semantic features or semantics. Features with vary- ing relationships to the label are muisances. For example, in detecting cows from natural images, the shape of the head is semantic but because images of cows often have grass back- grounds but not always, the background is muisance. Models that exploit muisance-label relationships face performance degradation when these relationships change. Building mod- els robust to such changes requires additional knowledge beyond samples of the features and labels. For example, existing work uses annotations of nuisances or assumes ERM-trained models depend on muisances, Approaches to integrate new kinds of additional knowledge enlarge the scttings where robust models can be built. We develop an approach to use knowl- edge about the semantics by corrupting them in data, and then using the corrupted data to produce models which identify correlations between nuisances and the label. Once these correlations are identified, they can be used to adjust for where nuisances drive predictions. We study semantic corruptions in powering different spurious-corrclation avoiding meth- ods on multiple out-of-listribution (OOD) tasks like classifying waterbirds, natural language inference (NLI), and detecting cardiomegaly in chest X-rays.
1 Introduction
Relationships between the label and the covariates can change across data collected at different places and times. For example, in classifying animals, data collected in natural habitats have cows appear more often on grasslands, while penguins appear more often on backgrounds of snow; these animal-background relationships do not hold outside natural habitats (Beery et al., 2018; Arjovsky et al., 2019). Some features, like an animal's shape, are predictive of the label across all set singsngs for a lask; these are semantic features, or semantics short. Other features with varying relationships with the label, like the background, are muisances. Even with semantics present, models trained via empirical risk minimization (ERM) can predict using nuisances and thus fail to generalize (Geirhos et al., 2020). Models that rely only on the semantic features perform well even when the nuisance-label relationship changes, unlike models that rely on nuisances.
Building models that generalize under changing muisance-label relationships requires additional knowledge, beyond dataset of features and labels sampled from the training distribution. For example, many works assume knowledge of the nuisance. In the anckal-background example, this would correspond to feature that specifies the image background, which we may use when specifying our learning algorithm. (Mahabadi et al., 2019; Makar et al., 2022; Veitch et al., 2021; Puli et al., 2022); another common type of assumption is access to multiple datasets over which the nuisance-label correlation varies (Peters et al., 2016; Arjovsky et al., 2019; Wald et al., 2021), and some other forms of knowledge have been explored (Mahajan et al., 2021; Gao al., 2023; Feder et al., 2023).
Semantic Corruptions. In this paper, we explore the use of a different type of knowledge: corruptions of semantic features. Intuitively, imagine trying to predict the label from a corrupted input T(x), where all semantic information has been removed. Any better-than--hance prediction provides us a window into the
"Corresponding email: sanlad

---

Published in Transactions on Machine Learning Research (06/2024)
muisances, it must rely on them. We will then use these obtained biased models to guide methods that we identify here as biased-modellbawee spurious-corvelation avoiding methods (B-SCAMS).
B-scams. There is a class of methods in the literature that use predictions of a biased model adjust for muisances, and learn predictors that are free of spurious correlations. Among others, these include Just Train Twice (JTT) (Liu et al., 2021), EILL (Creager et al., 2021), Nuisance- Randomized Distillation (NURD) (Puli et al., 2022), and debiased focus loss (DFL., product of experts (POE) (Mahabadi et al., 2019). The key question arising from these works is how can we obtain biased models? In empirical studies, prior works on B-SCAMs either use annotations of the muisance or an ERM-trained model over the training data as a placeholder for the biased model. The latter approach, based on an F.M--trained model, is successful if that model completely ignores semantic information. In practice, these hcuristics are rather fragile. Annotations for nuisances are seldom available, and we lack a prineipled method to ascertain whether model trained with ERM relies only on semantic features. Therefore, employing semantic corruptions could serve valuable alternative to these heuristics. We claim that semantic corruptions offer a principled and useful approach to obtaining biased models.
Semantic corruptions T(x) must strike delicate balance between removing semantic information and pre- serving muisances. For example, if T(x) replaces all pixels in an image with random noise, it corrupts semantics while simultancously crasing all information about the muisances. An ideal T(x) would isolate nuisances by largeting only the semantic information in the inpul, e.g. by in-painting the animal for the task of classifying cows and penguins. Implementing such ideal corruptions is unrealistic, as they are task- specific and may require human annotations of the semantic features; e.g., one can segment the objects in every image. Doing so for all classification problems extremely laborious. In tasks like NLI, it unclear even how to annotate semantics, as they do not correspond to simple features like subsets of words. Tn summary, after outlining the desired characteristics of semantic corruptions, define corruptions that are beneficial across multiple lasks and do not require human annotation. Our contributions are as follows:
1. Show that acquiring additional knowledge beyond labeled dataset is necessary for effectively learning robust. models (theorem 1). Then, in proposition 1, formalize sufficient conditions under which additional knowledge in the form of a semantic corruption enables B-SCAMS to learn robust models.
2. Develop multiple semantic corruptions for object recognition and natural language inference. These include patch randomization, n-gram randomization, frequency filtering, and intensity filtering. Then, we situate existing procedures, such as intteest masking and premise masking, under the umbrella of semantic corruptions.
3. Empirically, we demonstrate that any semantic corruption can power any B-SCAM. The corruption- powered versions of these methods outperform ERM on out-of-distribution (OOD) generalization tasks like Waterbirds, cardiomegaly detection from chest X-rays, and NLL. Corruptiion-owereed NURD, DFL, and POE achieve performance similar to said methods run with extra observed muisance variables. Corruption- powered JTT outperforms vanilla JTT.
2 biaded- spurious-correlation avoiding methods
A spurious correlation is a relationship between the covariates x and the label y that changes across scttings like time and location (Geirhos al., 2020). The features whose relationship with the label changes are called muisances. With vector of nuisances z, let (tr x),, (vc x) be the training and test distributions.
Achieving robustness to spurious correlations requires additional knowledge. In the presence of spurious correlations, the training distribution Ptr may not equal the test distribution Pte. Without further assumptions, algorithm that only sees data. from per (t, can producc predictor that works well Pte- To achieve generalization when Pte + Ptr, work in the OOD generalization literature assumes relationship between the training and test distributions. We follow the work of Makar et al. (2022); Puli et al. (2022) and assume that only musannce-label relationships test. Formally, we let Ptr. Pte come from a family of distributions whose members have different nuisance-label relationships but share the same relationship between the label and the semantics x":
i.e. the conditional z
changes between training and
2

---

Published in Transactions on Machine Learning Research (06/2024)
Definition 1. (Nuisance-earying family with semantic features x² (Makar et al., 2022; Puli et al., 2022))
F = (pD p = p(y,""()))))))))))))))))) pr(2 y) p(x 2, 2,x*)}.
(1)
Many common tasks in OOD generalization, including some from section 4, fit this definition. For example, in classifying natural images, the background type is the nuisance z and its relationship to the label can change across places, each corresponding to a different member of F. The animal shape however is made of semantic features x" that are related to the label in the same way across places. Like in this example, we assume that the semantic features x" equal a function of the covariates x" = e(x) almost surely under every pD E but neither x* nor e(-) are known. Finally, the semantics and nuisances together account for all the information that x has about y, meaning > xx'2 .z.
Building models that are robust to a shifting nuisance-label relationship relies on additional knowledge, such as nuisance annotations, in the training data (Sagawa et al., 2019; Veitch al., 2021; Makar et al., 2022; Puli et al., 2022; Yao et al., 2022). Given knowledge of 2, work like (Makar et al., 2022; Puli et al., 2022) estimate distribution, denoted P1: under which the label and muisance are independent (y z): p_(,,x) = -e x = x" (zr = 2)p(x z 2, = x² ddzdr". Following Puli ct al. (2022), we call P_ the nuisance-rundmmiee distribution. The model py = 1 x) achieves the lowest risk on any member of the family F amongst the set of risk-invariant models; see Proposition 1 (Makar et al., 2022)). However, even when Ptr.
Pte E F and optimal risk-invariant predictors can be built with nuisances, is impossible to always beat random chance when given data xy,x] ~ Ptr:
Theorem 1. For any learning algorithm, there erists a muisance-varying family F where predicting with ( = 1 | achieves 90% accuracy on all members such that given training data y, from one member Por E F, the algorithm cannot achieve better accuracy than 50% (random chance) some Pte E F.
The proof is in appendix A and proceeds in two steps. With (p) as the expected accuracy of a model h on distribution p, the first step of the proof defines two aussnnc-varying families F1, such that no single model can perform well on both families simultancously; any h(x) for which ACC,, (h) > 50% for all P1 F will have that (h) 50% for some P2 F2 and vice-versa. The second step shows that the two families F2 have member that has the same distribution over y,x; letting the training data come from this distribution means that any learning algorithm that returns a performant model one that beats 50% accuracy on one family must fail to return a performant model on the other. Next, we discuss different methods that use additional knowledge beyond y, x to build robust predictors.
2.1 Biased-modde model-based spurious- cntrious-coorelatioo avoiding methods.
We focus on methods that correct models using knowledge muisances or where they might appear in the covariates (Mahabadi et al., 2019; Liu et al., 2021; Puli et al., 2022). We first establish that the common central part in these mothods model; due to this commonality, we call these biased-modell-essed spurious-correlation avoiding methods (B-SCAMs). At high level, B-SCAM has two components. The first is a biased model that is built to predict the label by exploiting the muisanco-label relationship via extra knowledge or assumptions. The biased model is then used to guide second model to predict the label without relying on muisances.
model that predicts the label using nuisances, which we call the biased
We briefly summarize the different B-SCAMS here, differentiated by the additional knowledge they use to build biased models. The differences between the methods are sunmarized in table 1. We give details for NURD here and defer algorithmic details about the rest to appendix B.
Biased models from knowledge of the muisances. The first category of B-SCAMS from Mahabadi et al. (2019); Puli et al. (2022) assumes additional knowledge in the form of nuisance annotations z. For example. in NLI where the goal is determining if a premise sentence entails a hypothesis compute the fraction of words shared between the hypothesis and the premise for each sample in the training data and use this as one of the nuisance features in building the biased model. The biased model in NURD, POE, DFL is learned by predicting the label from the nuisance annotations in the training data to estimate Per (y z). Using nuisance annotations, Puli et al. (2022); Makar et al. (2022) use the model per (y 2)
(Mahabadi et al., 2019)
3

---

Published in Transactions on Machine Learning Research (06/2024)
Table 1: Summary of NURD, JTT, POE, and DFL. Each method approxinates the biased model: Per(y' 2). This table describes the different biased models, their names, how they are built.
Method
Name
What the biased model is
JTT
Identification model
Perly x)
learned via ERM
ERM learns biased models.
POE/DFL.
Biased model
P z) learned via ERM
z from domain-knowledges
NURD
Weight model
Per ly z) learned via ERM
from lomain-knowledge.
the biased model to define importance weights and minimize risk w.r.t a distribution pa obtained as
p(y) y, v, Py 2) Per (y) z)p(x y,
p(y) Pr 2) Ptr (y, 2, x.).
P. (y, = Per =
The second step in NURD (Puli et al, 2022) trains model to predict y from representation r(x) on data from Pa such that z_I,,yy r(x); this step is called distillation. Due to y_Lp, 2, learning in P2 avoids features that depend only on the muisance and due to p y r(x), distillation avoids features that are mixed functions of the label and the nuisance (e.g. X1 = y + 2). With these insights, NURD builds models of the form p. (y r(x)) that are most informative of the label. Mechanically, NURD'S distillation solves this:
max Ep, log (x)x)) AIp, (y; rx)x)). 8,7
Puli et al. (2022) show that such models best in class of predictors with lower bounds on performance. The mutual information above is zero when y y_Ip, | x; this condition holds for semantic corruptions as we discuss in appendix B. Thus, we run the distillation step as ayportance-weightee ERM on the training data.
Mahabadi et al. (2019) consider two methods to train a biased model and a base predictive model jointly to make the base model predict without relying the biases. They propose 1) POE, where the loss is the sum of the log loss of the two models and 2) DFI, where the biased model is used to weight the cross-entropy loss for the base model. For both methods, Mahabadi et al. (2019) build a biased model as (tr z). Intuitively, the base model focuses on classifying samples that the biased model misclassifics. The methods finc-tunc a BERT model (Devlin et al., 2019) and do not propagate the gradients of the biased model to update the common parameters (token embeddings).
Biased models from assumptions on erm-trained models. The second calegory of B-SCAMS like LFF (Nam et al., 2020), UMIX (Han et al., 2022), and JTT (Liu et al., 2021) require additional knowledge that vanilla ERM builds biased model that exploits the nuisance-label relationship. Given such model, these works use it to reduce second model's dependence on the muisance. We focus on JTT (Liu et al., 2021) which aims to build models robust to group shift, where the relative mass of fixed set of disjoint groups of the data changes between training and test times. The groups here are subsets of the data defined by a pair of values of discrete label and nuisance values. While JTT works without relying on training group annotations, i.e. without muisances, it assumes ERM's missclassifications are because of a reliance on the nuisance. JTT first builds an "identification" model via ERM to isolate samples that are misclassified. Then, JTT trains a model via ERM on data with the loss for the misclassified samples upweighted (by constant A). The epochs to train the identification model and the upweighting constant are hyperparameters that require tuning using group annotations (Liu et al., 2021).
The commonality of a biased model. The central part in NURD, DFL, POE, and JTT is model that predicts the label using nuisances, like Ptr(y 2), which we call the biased model as in He et al. (2019). The predictive models in each B-SCAM are guided to not depend on nuisances used by the biased model. While B-SCAMS reduce dependence on muisances, they build biased models using additional muisance annotations or require assumptions that ERM-trained models predict using the nuisance. In the next section, we describe an alternative: corrupt semantic information with data augmentations to construct biased models.
3 Out-of-distribution generalization via Semantic Corruptions
The previous section summarized how biased models can be built in B-SCAMS using either direct knowledge of nuisances or knowledge that. FRM-trained models rely on the nuisances. We now introduce semantic
4

---

Published in Transactions on Machine Learning Research (06/2024)
corruptions and show how they enable building biased models. Semantic corruptions are transformations of the covariates that do not retain any knowledge of the semantics, except. what may be in the nuisance z: Definition 2 (Semantic Corruption). A semantic corruption is a transformation of the covariates T(x, 8), where 6 is a random variable such that 6 (y, 22, x,,,x"), if
VpD FF T(x, ((x,6)LLP x' z.
Here, we characterize conditions under which biased models built. from semantic corruptions could be used to estimate robust models. As discussed in section 2, P. (y x) is the optimal risk-invariant prodictor, and is the larget of ERM when predicting the label y from x under the nuisance-randomized distribution P1- NURD estimates this distribution as part of the algorithm, and methods like JTT aim approximate Pı: for example, upweighting samples mis-classified by a model that relies on to predict y. We compare pa which is obtained by breaking the nuisance-label relationship against the distribution obtained by breaking the relationship between the label and the data augmentation:
(y, x) J J_Per(y (y 1 =) Per (y, Pt 2,,
(y)
pr(y,x) = - (.08==))pmm
Py) 0) Py T(x, 0))
0)) Per (y,
Per(y, x)dō.
We show here that the I- distance between (y, x) and pr x) is controlled by Tez-distance between the biased models built from the nuisance and the data augmentations respectively:
Proposition 1.
Let T X R + X be a function. Assume the r.v. Ptr(y T(x, 6)) has a bounded second moment under the distribution (y 2, x)p(5), and that Per T(xx, 5)) and Per (y | (2) satisfy
Ep (y.2,))(88) |ptr T(x, 8)) - Ptr =)]== Then, the Li distance between p. (y, x) and pr(y, x) is bounded: [pp, (y, (y x)II S me. For a semantic corruption that also satisfies y p.l....? T(x, 5) the inequalities hold with
Ep, (xxxxpp())Prr T(x, 8)) 8))- < m²
c O, (r( = P. x). which means that almost surely the conditionals match p. (y x) = Then, as (y x) is the optimal risk-invariant. predictor, so is pr(y x). More generally, standard domain adaptation risk bounds that are controlled by the total variation distance between source and target (Ben- David al., 2010, Theorem 1) bound the risk of model under P1 using the L1 bound me me- which upper bounds the total variation - and the risk under pr-
Pp Pr x).
Without nuisance annotations, one cannot test whether estimate the Lg-distance between the two biased models Py 2) and (y T(xx 8)) in proposition 1. This distance can be large when a transformation T(x, 5) retains semantic information. To avoid, we turn to a complementary source of knowledge: semantic features. Using this knowledge, we design families of data augmentations that corrupt the semantic infor- mation in to construct semantic corruptions. Focusing two popular OOD tasks, object recognition and NLI, we use only semantic knowledge to build corruptions that retain some aspects of the covariates. Biased models built on such corruptions will depend on any retained muisances; more retained muisances mcan better biased models.
3.1 Semantic corruptions via permutations
We first build corruptions when semantics appear global structure. We give an intuitive example for such global semantics. Consider the waterbirds dataset from Sagawa et al. (2019) with waterbirds and landbirds appearing predominantly on backgrounds with water and land respectively. Semantic features like the wing shape and the presence of webbed feet are corrupted by randomly permuting small patches. See fig. la. Formally, given subsets of the covariates X1, X2 extracted an order, global seman- ties e(x,,... xx) change with the order of extraction. Formally, with random permutation and recalling that semantics
q())
x" e(x), the information about semantics is lost after permutation: x+(x)))) (x(())) O.
Vpp. "pD_Ipo.g(r)(** (x" ;e(xx(1).
We give an example of a semantic corruption with global semantics. Consider distributions (pD) DER with different muisance-label relationships. With 2 the uniform distribution over (1,2,3), and N as the normal distribution, (y 2, corresponds to y U, M(Dy, 1), and y selecting configuration of x
= = x= 1=,,,, == = x= -Z, z].
y == = x= |z,2, 2, -z]
5

---

Published in Transactions on Machine Learning Research (06/2024)
(a) RND to corrupt global semantics in Waterbirds. The original is the left. most, followed by PATCH-RNNS with sizes 112, 28, 14. At sizes > 28, shape is hard to make out.
(b) Masking to corrupt semantics in chest X-rays. The original is the left most, followed by ROI-MASK of size 112, 154, 196. At sizes > 154, the heart is blocked out.
Figure 1: Semantic corruptions of Waterbirds via PATCI-RNN and chest X-rays via ROI-MASK.
The index of the negated coordinate is the semantic feature x" that equals y and computing requires comparing coordinates: y if X2X3 > 0, y 2 if X1X3 > 0, and y = otherwise. In words, the semantic feature is global. However, z X1 + X2 + X3 is determined regardless of where the negative sign is, i.e. it is not global. A random permutation T(x, d) of the coordinates in x is thus semantic corruption: as T(x, 5) permutes the location of the negation, T(x, 6) y, is distributed identically to T(x,8) z. In turn, T(x, o) z. Further, the product of the three coordinates of T(x, 6) determines z: (1)3 (xx,)))) = -.. Thus, T(x, 5) determines z and y T(xx 6). These two independencies imply that c = 0 in proposition Then, biasod models from T(x) are as good as oncs from z. Next, we give corruptions for global semantics in vision and language tasks, that retain non-global features.
Patch randomization. Object recognition tasks where the object shape that can satisfy the global property. For illustration, consider differentiating cows and penguins in natural images; here, shape a global semantic feature that structures multiple patches. Permuting patches via patch randomization (PATCH-RND), like in fig. la, corrupts global semantics.
N-gram randomization. Tasks like natural language inference (NLI) where the goal is determining if premise sentence entails hypothesis - satisfy the global-semantics property. Consider this example: the sentence 'Bob speaks but Jon does not' contradiets "Jon speaks but Bob does not" but entails "Bob speaks'. The meaning is inferred from a global structure on the words and the order they appear in. Here, randomizing the order of the words corrupts the semantics: For example, one randomized order of the sentence 'Jon speaks but Bob does not' is "Bob speaks but Jon does not'; the former entails "Jon speaks" but the latter contradicts it. We randomize the order by permuting different n-grams in each sentence; we call this n-gram randomization (NGRAM-RND).
3.2 Semantic corruptions via masking
The second corruption we build focuses on cases where cerlain subsets of the covariates are necessary part of semantics. Masking, by removing that subset or setting to a constant, corrupts semantics. Formally, we corrupt the semantics by replacing subsets Xs with value that out of support: for example, in images where pixels lie in (0, we corrupt x= [x5. x-s] as Xcorrupted = [0 + x5, x-s). As an illustrative example, consider family J = {PD) Den den with varying muisance-label relationships. With a, b being uniform binary random variables, e(p) as the exponential distribution with parameter p. and (u) log(1 + exp(u)) softplus, sample from PD x) as: y a b, z~ a>ees * 12)- x = [(2a - 1)z, (2b 1)z].
For such family, we show that masking out coordinate x1 is semantic corruption: T(x) [0, x2] satisfies T(x) and T(x)Hz.. First, due to y being computed b.lly. Then, due to only relying on y and exogenous noise, bil z) which implies b z. Given z, b determines X2, so blyy z = xylly z = T(x)Jyy | z. Further, [[(()ell = z which means yllz Txx). These two independencies imply that e = 0 in proposition 1. Then, using T(x) to build biased models is equivalent to building them with z.
XOR function of a, b, it holds that
ROI-masking for object recognition. Semantics in images can often be localized to a region-of-interest (ROI). For example, in detecting cardiomegaly, the RoI is the chest where the heart resides. Masking out the Roi removes centrally located semantic information from the chest X-ray (fig. 1b). We call this region-offinterrss masking (ROI-MASK).
Premiso-masking for NLI. Semantic features in NLI rely on the meanings of the premise and the hy- pothesis sentences: for example, the premise states the occurrence of event (5 (AAlice sat while Bob stood.")
6

---

Published in Transactions on Machine Learning Research (06/2024)
(a) Corruption via FREQ-FIITT. Original image to the left followed zeroing out 14, 56, 112 of the lowest fre- quencies. The heart features are corrupted at 56.
(b) Corruption via INT-PIIIT. Original image to the left followed by zeroing out pixels with intensities above the 80%, 60%,40%. Heart features look corrupted at 40%.
Figure 2: Semantic corruptions of chest X-rays via FREQ-FILT and INT-FILT respectively.
which can entail (*Alice sat.") or contradict ("Bob sat.") the hypothesis. The information about the setup in the premise is therefore crucial to detect entailment or contradiction. If the context given by the premise is blocked out, the hypothesis sentence can predict the label only due to nuisances. Thus, masking the premise is semantic corruption for NLI that retains hypothesis features; we call this premise masking (PREM-MASK).
3.3 Semantic corruptions via frequency and intensity filters
PATCH-RNN relies on differences in relative size and ROI-MASK relies differences in spatial position. We consider two aspects of the image that are not spatial, frequency and pixel-intensity, and give corruptions for features that depend on these aspects. Semantics can appear as signals in a particular region of the frequency spectrum, or appear at a particular luminosity in the image. For example, consider detecting cardiomegaly from chest X-rays, where the heart appears as an object formed of bright, pixels with little variation in intensity across the pixels; the latter suggests that the heart features are low-frequency signals.
This observation motivates corruptions along the axes of frequency and pixel-intensity: frequency filtering (FREQ-FILT) and intensity filtering (INT-FILT. FREQ-FILT zeroes-out frequencies in the discrete fourier domain, while INT-FILT zero-out pixels based on their intensities. See fig. 2 for how FREQ-FILT and INT-FILT corrupt the heart region. FREQ-FILT and INT-FILT require characterizing semantic features in frequency and intensity spaces; this is in contrast ROI-MASK that is based on characterizing the position in pixel space that the semantics occur in.
3.4 Using semantic corruptions in practice
For each method in table 1, we use a semantic corruption T(x) in building a model Pr | T(x)). For reweighttngg-NRR. NURD, we replace (y z) with (y T(x)), for DFL and POE, we replace the model ptr (y z) with (y T(x)), and for JTT, we use (t [(x)) as the identification model.
Choosing the corruption parameter. To corrupt with PATCH-RND, NGRAM-RND, and ROI-MASK, FREQ- FILT, one must select a size parameter and to corrupl with INT-FILT, one must specify an intensity threshold. For NURD, JTT, POE and DFL, we select corruption parameters with the same validation schemnes used to select other hyperparameters each respective paper. In practice, including the B-SCAMS run without semantic corruptions in the B-SCAM'S validation scheme ensures lower bound on performance. For example, for JTT, this inclusion yields lower bound that corresponds to vanilla JTT's performance. We also report results for all corruption parameters in appendix C.3, showing that all semantic corruptions except INT-FILT are not sensitive to the parameters, and lead to models that outperform ERM.
4 Experiments
We study semantic corruptions in powering NURD (Puli et al, 2022), JTT (Liu et al., 2021), and POE and DPI. (Mahabadi et al., 2019). To be faithful to the original evaluations of cach method, we run them on tasks from their respective papers: NURD on waterbirds, JTT on waterbirds and NLI where the nuisance is the presence of a negation word, and POE and DFL. on NLI evaluated on a challenging test dataset, HANS (McCoy et al., 2019). We run NURD on chest X-rays but focus on detecting cardiomegaly rather than the original pneumonia (Puli et al., 2022) because pneumonia detection even with known-nuisances is not performant. See appendix C for details and appendix C.3 for additional experiments investigating semantic corruptions.
Methods, metrics and model selection. For images, we corrupt semantics with PATCH-RND, central ROI-MASK, FREQ-FILI, and INT-FILTT. To show the value of semantic corruptions relative to existing data
7

---

Published in Transactions on Machine Learning Research (06/2024)
augmentations, we also consider two baseline transformations of images. The first is random cropping (RAND- CROP) like in sell-supervised learning (Bardes et al., 2021; Chen et al., 2020) where patches of random sizes are sampled, covering 2 0.08 fraction of the image. The second is adding gaussian noise (GAUSS-NOISE). For text, we corrupt semantics with NGRAM-RND and PREM-MASK. We report the average test accuracy for every method. To be able to compare to what JTT is trained for Liu et al. (2021), we report worst-group test accuracy for JTT. For cach method, we compare the performance of the original method to that of versions,
the methods run with semantic corruption (including the baselines). For the corruption- group annotations and muisances are unavoilable in the training data. Known-nuisance versions of POE, DFI. and NURD use direct knowledge of one or more muisances during training. In choosing parameters and early stopping, like Liu et al. (2021) do with vanilla JTT, corruption-powered JTT uses validation group annotations. For the other methods, we follow validation schemes from the respective papers: for NURD we follow Puli et al. (2022) and use a validation set weighted to have independent nuisance and label, and for POE/DFL, we follow Mahabadi et al. (2019) and use sct of 1000 samples from the HANS training datasct.
4.1 Object recognition tasks
To be faithful to the original evaluations of each method, we eval- uate JTT on waterbirds, and NURD on both waterbirds and detect- ing cardiomegaly; both tasks have images of size 224 x 224 x 3. Both Puli et al. (2022) and Liu et al. (2021) use the raw wa- terbirds data from Sagawa et al. (2019), where the task is de- tecting the lype of bird (water or land) from images where the background is nuisance. Unlike Liu et al. (2021), Puli et al. (2022) process the waterbirds to get a different setup from Sagawa et al. (2019). To stay true to the original evaluations of the meth- ods, we recreate the setups described in their respective papers. For both tasks, we use PATCH-RNN (of patch sizes 7, 14, 28, 56), ROI-MASK (of mask sizes 112, 140, 168, 196), FREQ-FILT (of high- pass filter sizes 196, 168, 140, 112), and INT-FILT (of thresholds 0.4) as semantic corruptions. For GAUSS-NOISE, we use variances 0.01, 0.25, 4.
Mean and standard error of test accuracy across 10 seeds of NURD with semantic corruptions birds. Known-z NURD uses label for the type of background as the nui- sance. Consider the gap between ERM and known-nuisance NURD. NURD with semantic corruptions PATCH- RND, ROI-MASK, FREQ-FILT, and INT- FILT close 99%, 99%, 82%, 99% of the gap respectively. NURD with seman- lic corruptions oulperforms ERM and NURD with RAND-CROP, NOISE.
Table 2:
water-
Method
test acc.
Nurd on waterbirds. For NURD, we recreate the waterbirds ex- periment from Puli et al. (2022) where the full waterbirds data from Sagawa et al. (2019) was subsampled into training, validation, and test datasets each with label balance. However, unlike Sagawa et al. (2019), the validation data comes from the same distribution as the training data. The training and validation datasets have 90% water- birds on backgrounds with water and 90% landbirds on backgrounds with land. The test data has a flipped relationship. Known-nuisance NURD uses an additional label denoting the background-lype as the nuisance.
Knoun-z NURD
87.2 + 1.0%
BNTCH-RND
86.9 + 1.2%
ROI-MASK
86.9 + 1.7%
FREQ-FILT
83.5 + 1.1%
INT-FILT
86.9 + 1.1%
RAND-CROP
73.7 + 2.0%
GAUSS-NOISE
82.0 + 2.6%
ERM
68.0 + 1.9%
Table gives results. Selecting hyperparameters using NURD'S validation approach gives sizes 14 for PATCH- RND (86.9%), 196 for ROI-MASK (86.9%), 168 for FREQ-FILT (83.5%), and threshold 0.2 for INT-FILT (86.9%). Consider the gap between ERM and kuown-nuisance NURD. NURD with PATCH-RND, ROI-MASK, PREQ-FILT, and INT-FILT close 99%, 99%, 82%, 99% of the gap respectively. NURD with these semantic corruptions outperforms ERM (68.0%) and NURD with RAND-CROP (73.7%) and GAUSS-NOISE (82.0%). Additionally, in table 11 in appendix C, we give the results for all corruption parameters, showing that NURD with semantic corruptions is insensitive to hyperparumeters of the corruption and outperforms ERM. In appendix C.1, we discuss how the baseline NOISE could close 80% of the gap between ERM and known-z NURD.
JTT on waterbirds. For JTT, we repeat the waterbirds experiment from Liu et al. (2021) which uses the original data from Sagawa et al. (2019). The training data has 95% waterbirds on backgrounds with water and 95% landbirds on backgrounds with land, Both the validation and test datasets have bird label independent of the background. The groups here are subsets of the data that correspond to pair of values
8

---

Published in Transactions on Machine Learning Research (06/2024)
of bird-type and background-type. Like vanilla JTT, we use group annotations in the validation data to compute worst-group error and early stop training when using PATCH-RND and ROI-MASK. The results for vanilla JTT are from our run using the optimal hyperparameters from Liu et al. (2021).
Table 3 shows the results. Selecting the corruption hyperparameters the validation worst-group accuracy gives size 14 for PATCH-RND (89%), size 196 for ROI-MASK (88.2%), size 112 for FREQ-FILT (87.2%) and threshold 0.4 for INT-FILT (87.0%). JTT with these semantic corruptions outperforms ERM (72.0%), vanilla JTT (86.5%) and JTT with the baseline corruptions RAND-CROP (75%) and GAUSS-NOISE (71%). Additionally, table 13 shows that JTT with PATCH-RND and ROI-MAKK outperforms JTT with the baseline corruptions and ERM at every patch/ b sizeer-szze.
Table 3: Test worst-group (WG) accuracies of JTT waterbirds. JTT with semantic corruptions out- performs ERM, vanilla JTT, and JTT with baseline corruptions (RAND- CROP, CAUSS-NOISE).
Method
test WG acc.
Vanilla JTT
86.5%
Nurd on detecting cardiomegaly In chest X-ray classification, differences between hospitals, like the scanners used to produce the X- rays, are known to correlate thoracic conditions with non-physiological aspects in the image; for example, only some scanners render the air in the lungs in white (Zech et al., 2018). We consider the chape-based object recognition task of cardiomegaly (an irregularly sized heart) detection and, following Puli et al. (2022), construct a dataset from two chest X-ray datasets: chexpert (Irvin el. al., 2019) and MIMIC (Johnson et al., 2019). The training and validation datasets have 90% cardiomegaly images from MIMIC and 90% healthy images from chex- pert, while the lest data has a flipped relationship. Known-nuisance NURD uses hospital identity as the muisance.
PATCH-RND
89.0%
ROI-MASK
88.2%
FREQ-FILT
87.2%
INT-FILT
87.0%
RAND-CROP
75.0%
GAUSS-NOISE
71.0%
ERM
72.0%
Table 4: Mean and standard error of test accuracy over 10 seeds of NURD on chest X-rays. Knoun-z NURD uses the hospital the nuisance. Consider the gap between ERM and known-z NURD. NURD with PATCH-RND, ROI- MASK, FREQ-FILT, and INT-FILT close 72%, 82%, 65%, 35% of the gap respectively.
See table 4 for results. Selecting the corruption parameters using NURD's validation approach gives size 14 for PATCH-RND (77%), size 196 for ROI-MASK (78.7%), size 168 for FREQ-FILT (76.0%), and thresh- old 0.1 for the INT-FILT (71.0%). Consider the gap between ERM and known-muisance NURD. NURD with PATCU--NN, ROI-MASK, FREQ-FILT, and INT-FILT close 72%. 82%, 65%, 35% of the gap respectively. NURD with all semantic corruptions, outperforms ERM (65.3%) and NURD with the baselines GAUSS-NOISE (69%) and RAND-CROP (59.9%). Ad- dit ditionally, report results for all corruptions in table 11 in appendix C showing that NURD with PATCH-RND and ROI-MASK are insensitive to hyperparameters and outperform ERM.
Except with INT- FILT, NURD with semantic corrup- tions outperforms ERM and NURD with baseline corruptions (RAND- CROP, CAUSS-NOISE
4.2 Natural language inference (nli)
Method
test acc.
For methods POE, DFL, and JTT, we use the MNLI dataset (Williams et al., 2018) to fine-tune a BERT model. The evaluations of these methods in their respective papers have different nuisances and, con- sequently, different lest sets. In accordance, we describe the setup and the results separately. We use NGRAM-RND (sizes 1, 3, 4) to produce nuisances for both sctups.
Knowm-2 NURD
81.7 + 0.3%
PATCH-RND
77.0 + 1.2%
ROI-MASK
78.7 + 0.3%
FREQ-FILT
76.0 + 0.6%
INT-FILT
71.0 +: 1.0%
RAND-CROP GAUSS-NOISE
59.9 + 2.1%
PoE and DFL For POR and DPI, we report test accuracies on the HANS datasot McCoy al. (2019) as in Mahabadi al. (2019). HANS was created to test the reliance of models on three known nuisances: 1) lexical overlap, 2) subsequence match, and 3) constituent matching
69.0 + 1.9%
ERM
65.3 + 1.1%
subtrees in the parse trees. Known-nuisance POE and DFL. use exact knowledge of these muisances. Table 5 gives the mean test accuracies over 4 seeds. For both DFL and POE, selecting the size hyperparameter based on the average accuracy on small subset of the HANS training data (1000 samples) gives n = 3. With this size, POE achieves 66,7%, improving over POE with known nuisances (66.3%). DFL with NGRAM-RND of size 3, achieves 68.4%, closing 84% of the gap between ERM and known-nuisance DFL (69.3%).
9

---

Published in Transactions on Machine Learning Research (06/2024)
POE and DFL with PREM-MASK (PM) close 33% and 28% of the gap between ERM and when the methods have knowledge of 2. We expect the methods with NGRAM-RND do better than with PREM- MASK because the latter corrupts muisances like lexical overlap be- tween premise and hypothesis that HANS focuses on. Additionally, we give results for all n-gram sizes in table 10 in appendix C, show- ing that POE and DFL beat ERM for all n-gram sizes. Further, in appendix C.3.1, evaluate POE and DFL models on the ANLI (Nie et al., 2019) dataset and counteraattually-aggnne et al., 2019) in tables 15 and 16.
Table 5: Mean and standard devi- ation of accuracies (over 4 seeds) on the HANS dataset. The results for POE and DFL that use known nuisances are given under known. POE with NGRAM-RND (NR) performs better than mnionnmuisance POE. DFL with (NR) closes 84% of the gap between ERM and known-nuisane DFL. POE and DFL with PREM-MASK (PM) close 33% and 28% of the gap between ERM and the respective method with known 2.
data (Kaushik
JTT For JTT, we repeat the NLI experiment from Liu et al. (2021), ), where the presence of a negation word in the hypothesis sentence is the muisance. The groups here are subsets of the data that corre- spond a value of the label and whether or not there is a negation word in the hypothesis. Vanilla JTT uses group annotations in the validation data to tune the hyperparameters and early stop train- ing. For each n-gram size, run JTT with NGRAM-RND for two val- ues of the number of epochs of training for the identification model: 2.3. Following the hyperparameter selection procedure from Liu et al. (2021), for each n-gram size, we give the results for the run with the higher validation worst- worst-group group accuracy. Vanilla JTT is run with the optimization hyperparamoters from (Lin ct al., 2021).
Method
HANS test acc.
POE, known-z
66.3 + 0.6% 66.7 1 1.5%
POE,
POE, PM
64.5 + 1.9%
DFL, known-z
69.3 + 0.2%
DFL, NR
68.4 1 1.5%
DFL, PM
65.2 1 0.7%
ERM
63.6 + 1.1%
Table 6 gives the results. Selecting the size hyperparameter for NGRAM-RND using validation worst-group accuracy, like Liu et al. (2021) do for JTT, gives n = 1 with test worst-group accuracy of 74.3%, better than vanilla JTT's 71.3%. Additionally, table 14 shows that JTT using NGRAM-RND at every size or PREM-MASK performs better than both vanilla JTT (71.3%) and ERM (67.9%).
Table 6: gorst-group and avg. test accuracies of JTT on NLI. JTT with PREM-MASK (PM) and NGRAM-RND (NR) outperforms vanilla JTT and ERM.
Worst-group
Avg.
Vanilla JTT 71.3%
79.1%
5 Related work
JTT + PM 72.1%
79.9%
JTT + NR
74.3%
79.7%
Biaseed-odeel-bssed spurious-correlation avoiding methods (B- SCAMS) like (Veitch et al., 2021; Clark et al., 2019; Puli et al., 2022; He et al., 2019; Makar et al., 2022) assume the muisance is available as additional knowledge during training. Semantic corruptions offer complementary approach to hand-crafting muisances or obtaining auxiliary labels, by capluring nuisances that remain after corruption (e-g. non-global nuisances remain after PATCH-RND). B-SCAMS like LFF (Nam et al., 2020), UMIX (Han et al., 2022), and JTT (Liu et al., 2021) all rely on one crucial assumption: that ERM-training builds a biased model that exploits the nuisance and use it to reduce a second model's dependence on the muisance. Each method trains the second model with weighted cross-entropy with higher weights for samples misclassified by the biased model; the methods differ in how they build the biased model and how they compute the weighted loss. The biased models learn to predict the label from the covariates. Such model can also rely on the semantic features and upweighting its misclassified samples produces data with a different label-semantic relationship from the one in the training data. Models trained on such data are suboptimal on test data which has the same semantic relationship as the training data. Using semantic corruptions in these B-SCAMS reduces the biased model's reliance on the semantics and makes the second model rely more on the semantics; thus, B-SCAMS that rely on assump- tions on ERM-trained models being biased achieve better performance when using semantic corruptions. The experiments in scction 4 confirm this empirically: JTT with semantic corruptions improves over vanilla JTT,
ERM
67.9%
82.4%
Two instances of semantic corruptions, PREM-MASK and ROI-MASK, appear in earlier work (Mahabadi et al., 2019; He et al., 2019; Puli et al., 2022) but were designed using knowledge of where muisances appear in the covariates. (Puli et al., 2022) used the borders of X-ray images as features that are related only to the scanner type (the muisance), and not human physiology, to avoid spurious correlations in the detection of cardiomegaly. For NLA, Mahabadi et al. (2019) use knowledge that the test set was constructed from samples
10

---

Published in Transactions on Machine Learning Research (06/2024)
misclassified by model that relies on the hypothesis alone to build a biased model using the hypothesis sentence. These are special cases of ROI-MASK and PREM-MASK from section 3.2 repsectively. Our work widely generalizes the observations from the papers above by formally defining and further realizing the abstraction of semantic corruptions in several instances and across applications.
Bahng et al. (2020) uses CNNs with small receptive fields (RFs), to capture non-global muisances. However, their method is typically limited to very small filters because at size 3x3, deep neural networks like VGG detect global semantics like shapes. In contrast, the size choice in PATCHI-NND has no bearing on the choice of the model; we used default vision models. Bras et al. (2020) automatically identify and remove examples with nuisances using adversarial filtering, but risk removing genuinely easy examples. Qin et al. (2021) work solely with vision transformers and point out that nuisances are the only reason labels can be predicted from transformations akin to pauch-randomized images. They propose to encourage transformers to have predictions and representations of the original images be dissimilar from those of patch-randomized ones. In contrast, our work applics to general flexible models and shows that semantic corruptions can be used to break the label's relationship with nuisances in the original images.
Yao et. al. (2022); Gao al. (2023) use additional knowledge about nuisances or environments to corrupt nuisances in the covariates, Yao et al. (2022) corrupt nuisances in the covariates via the Mixup (Zhang et al., 2017) of samples from different domains that share a label. Gao et al. (2023) directly randomize nuisances; for example, in detecting animals in their natural habitats, they place segmented animal foregrounds onlo random habitat. backgrounds. Unlike these methods, we design semanttc corruptions using the complemen- tary knowledge about semantics, which can be available even without knowledge about nuisances. Clark et al. (2019); Li and Vasconcelos (2019) construct muisances in the training stage using prior knowledge: for example, (Clark et al., 2019) uses the first token of the hypothesis as a nuisance for a synthetic NI.I task which was created to have the first token be spuriously correlated with the label. Another example is the VQA lask where the question-lype is used as the nuisance. The constructed nuisances are then used to build biased (or bias-only) models, or construct per-sample weights to diabias the loss. In contrast, we use knowledge about semantics to corrupt them; for example, the order of the words is a semantic feature that is corrupted by randomizing the order. This construction does not use knowledge of the nuisance.
Sinha et al. (2021) use techniques like PATCH-RND to restrict supports in self-supervised learning and gen- erative modeling. Carlucci et al. (2019) use PATCH-RND images to encourage a model to recover semantic structure. In contrast, we use PATCH-RND to corrupt semantics and build biased models that rely on the nuisances, which help build predictive models that avoid reliance on nuisances. We focus on corrupting semantic features using simple procedures (like permuting, masking, filtering) while papers (Kaushik et al., 2019; Teney et al., 2020; Feder et al., 2022; Kaushik et al., 2020; Eisenstein, 2022; Wang and Culotta, 2021; 2020) focus on perturbing semantic features while keeping other features the same. These transformations produce examples of different labels, and are called counterfactuals. These examples are used to counterfac- tually augment the training data (Kaushik et al., 2019). Constructing counterfactuals can be hard. Works like (Kanshik et al., 2019; Tency et al., 2020; Feder et al., 2022; Kanshik et al., 2020) rely on humans to create counterfactuals because it is difficult to automate semantic perturbation without changing nuisances. For example, consider classifying dogs versus cats. Creating a dog that looks like a specific cat is much harder than removing the cat from the image by masking out those pixels.
Methods like (Wang and Culotta, 2021; 2020) construct counterfactuals automatically, but require additional knowledge of how nuisances appear in the text. For example, Wang and Culotta (2021) matches sentences that have opposite labels while sharing most words. The non-shared words would then be considered so- mantic. Techniques like the matching one above from Wang and Culotta (2020) are unrealistie beyond the task of sentiment classification. For example, consider the label of entailment or contradiction in NLI. Data samples with entailment as the label that contain negation words are rare. This makes it hard to find good counterfactual for data samples labeled with contradiction. Further, matching is difficult in other modalities, like images, where covariates are continuous or high-dimensional and live in spaces where metrics are unclear.
6 Discussion
We study the use of semantic knowledge in models robust to spurious correlations. In theorem 1, we show that additional knowledge is necessary to achieve ooD generalization even when the training and test
11

---

Published in Transactions on Machine Learning Research (06/2024)
distributions are coupled in muisance-varyine family. Then, proposition 1 shows that biased model built from transformation of the covariates T(x, 5) that is Ptr(y [ 6) - can power B-SCAMS to avoid muisances if the biased model Ptr(y | T(x, 6)) is close to Pt z) in L2 distance. There are two scenarios where this distance is large: the transformation does not corrupt semantics and it corrupts muisances. We use knowledge of the semantics to design semantic corruptions to avoid the first. scenario. Since we work without nuisances, to avoid the second scenario that is to choose T(x, 6) that retain nuisances - we use standard validation schemes in B-SCAMS. Using semantic corruptions, practitioners can run different kinds of B-SCAMS (NURD, JTT, DFL, POE). coruption-poweree methods like NURD and DFL perform close to how they would with known nuisances. For methods like JTT, the corruption-powered versions perform better than their vanilla versions that rely on ERM on the raw covariates to yield nuisances.
Limitations. The quality of any semantic corruption, and thus the quality of the results, depends on the extent to which semantics are destroyed and nuisances are retained. PATCI-RND and NGRAM-RND are built to corrupt global semantics, and therefore are most suitable for when the muisances are local. ROI-MASK corrupts semantics in the ROI and PREM-MASK corrupts the semantic context in the premise; these are most suitable for when nuisances lie outside the region-of-interest (ROI) or in the hypothesis respoctively. Finally, FREQ-FILT and INT-PILT corrupt semantics in particular parts of the frequency and intensity spectrum, and are most suitable for when the nuisances and semantics lie in separate parts of the spectra. Knowledge about the kind of nuisances present in dataset can lead to better choices of semantic corruptions. Alternatively, one could use standard validation schemes to select a corruption, like we do in section 4.
When applied blindly, the procedures we describe may relain semantics or corrupt nuisances. PATCH-RND and NGRAM-RND may corrupt global nuisances and retain local semantics, ROI-MASK and PREM-MASK may corrupt nuisances that occur in the same region as the semantics, and FREQ-FILT and INT-FILT may corrupt both semantics and nuisances if they appear al similar frequencies or intensity. For example, when PATCH- RND is used blindly on covariates with non-global semantics, the biased model may rely on said semantics; this in turn guides the predictive model to ignore these semantics and, thus, lose predictive performance. Alternatively, when nuisances are global, PATCH-RND may corrupt them. For example in detecting cows and penguins, other nuisance animals (like dogs) may co-occur with cows more often; PATCH-RND would corrupt this nuisance animal. Using PAICH-RND in B-SCAM for such tasks could lead to non-robust predictive models that rely on corrupted nuisances.
Our experiments suggest that it might be possible to guard against performance degradation due to blind usage of semantic corruptions if the corruption parameter is made hyperparameter and selected using standard validation schemes. In both classifying waterbirds and NLI, there exist non-global semantics, like small beaks and individual words, that are not corrupted by PATCH-RND and NGRAM-RND respectively. However, in our Waterbirds and NLI experiments, we show models built using semantic corruptions, with validated size choicos, close more than 80% of the gap in test performance between ERM and the methods that use known nuisances. Now, imagine the extreme case of running NURD, POE, DFL with a semantic corruption that destroys all information in the covariates. Biased models would predict like random chance, and the resulting predictive models would be no less robust than ERM. On the other hand, methods like JTT perform at least well as their vanilla versions as long as the validation strategy used in vanilla JTT covers the identity function as a corruption. Future work could consider combining semantic corruptions as way to better retain of muisances. Given the validation strategies for B-SCAMS, a practitioner can easily validate over both single and hybrid corruptions.
Summary. Semantic corruptions power B-SCAMS to build models robust to spurious correlations using knowledge about the semantic features. Additional knowledge is always required to achieve such robustness, and existing work assumes access to nuisance annotations or that ERM-trained models rely on nuisances. By developing semantic corruptions, we give an approach to use a new kind of additional knowledge, thereby enlarging the set of tasks where one can build robust models. As discussed above, our experiments show that using semantic corruptions in B-SCAMS leads to models more robust than ERM and JTT even when the corruptions may have corrupted some nuisances. These two properties demonstrate the value of semantic corruptions as a way to build robust models.
12

---

Published in Transactions on Machine Learning Research (06/2024)
Acknowledgements
The authors were supported by NIH/NHLBI Award RO1HL148248, NSF Award 1922658 NRT-HDR: FU- TURE Foundations, Translation, and Responsibility for Data Science, NSF CAREER Award 2145542, Grant ONR N00014-23-1-2634 Apple Scholars AT/ML PhD fellowship, and Samsung Advanced Institute of Tech- nology (Next Generation Deep Learning: From Pattern Recognition to Al). Nitish Joshi is supported by the NSF Graduate Research Fellowship grant number 1839302.
References
Sara Beery, Grant Van Horn, and Pietro Perona. Recognition in terra incognita. In Proceedings of the European conference on computer vision (ECCV), pages 456 473, 2018.
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz. Invariant risk minimization. arxiv preprint arXit:1907.02890 2019.
Robert Geirhos, Jörn-Herrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann. Shortcut lcarning in deep neural networks, 2020.
Rabeeh Karimi Mahabadi, Yonatan Belinkov, and James Henderson. End-to-end bias mitigation by mod- elling biases in corpora. arXiv preprint arXiv:1909.000 06321, 2019.
Maggie Makar, Ben Packer, Dan Moldovan, Davis Blalock, Yoni Halpern, and Alexander D'Amour. Causally- motivated shorteut removal using auxiliary labels. In AISTATS, 2022.
Victor Veitch, Alexander D'Amour, Steve Yadlowsky, and Jacob Eisenstein. Counterfactual invariance to spurious correlations: Why and how to pass stress lests. arXiv preprinl arXiv:2106.0053 2021.
Aahlad Manas Puli, Lily Zhang, Eric Karl Oermann, and Rajesh Ranganath. Out-of-distribution general- ization in the presence mussanc-induuced spurious correlations. In International Conference on Learning Representations, 2022. URL https://openreviiet htt.://arrreeeeeetooooorooeeeeee
Jonas Peters, Peter Bühlmann, and Nicolai Meinshausen. Causal inference by using invariant prediction: identification and confidence intervals. Journal of the Royal Stotistical Society Series B: Statistical Method- ology, 78(5):947-1011 2016.
Yoav Wald, Amir Feder, Daniel Greenfeld, and Uri Shalit. On calibration and out-of-domain generalization. Advances in neural information processing systems, 34:2215 2227, 2021.
Divyat Mahajan, Shruti Tople, and Amit Sharma. Domain generalization using causal matching. In Inler- national Conference on Machine Learning, pages 1324. PMLR, 2021.
Trena Gao, Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Out-of-domain robustness via targeted augmentations. arXiv preprint arXi::2302. 11861, 2023.
Amir Feder, Yoav Wald, Claudia Shi, Suchi Saria, and David Blei. Data augmentations for improved (large) language model generalization. 2023. URL https://api www.ntecscoolala.....eeaaaaaaaae httppp:://app...aaaticccoooo
Evan Z Liu, Behzad Haghgoo, Annie S Chen, Aditi Raghunathan, Pang Wei Koh, Shiori Sagawa, Percy Liang, and Cholsca Finn. Just train twice: Improving group robustncss without training group information. In PMLR, 2021.
International Conference on Machine Learning, pages
Elliot Creager, Jörn-Henrik Jacobsen, and Richard Zemel. Environment inference for invariant learning. Tn International Conference on Machine Learning, pages 2189 2200. PMLR, 2021.
Shiori Sagawa, Pang Wei Koh, Tatsunori Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization. arXiv preprint arXiv:1911.08791 2019.
13

---

Published in Transactions on Machine Learning Research (06/2024)
Huaxiu Yao, Yu Wang, Sai Li, Linjum Zhang, Weixin Liang, James Zou, and Chelsea Finn. Improving out- of-distribution robustness via selective augmentation. In International Conference on Machine Learning, pages 25407 25437. PMLR, 2022.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pro-training of deep bidirectional transformers for language understanding. In NAACL, 2019.
Junhyun Nam, Hyuntak Cha, Sungsoo Ahn, Jaeho Lee, and Jinwoo Shin. Learning from failure: De-biasing classifier from biased classifier. Advances in Neural Information Processing Systems, 53:20673-20685 2020.
Zongbo Han, Zhipeng Liang, Fan Yang, Liu Liu, Lanqing Li, Yatao Bian, Poilin Zhao, Bingzhe Wu,
Changqing Zhang, and Jianhua Yao. Umix: Improving importance weighting for subpopulation shift via uncertainty-awar mixup. Aduances in Neural Information Processing Systems, 1137704-37714 2022.
He Hc, Sheng Zha, and Haohan Wang. Unlearn datasct bias in natural language inference by fitting the residual. Xiv preprint or Xxic:190810076 2019.
Shai Ben-David, John Blitzer, Koby Crammer, Alex Kulesza, Fernando Pereira, and Jennifer Wortman Vaughan. A theory of learning from different domains. Machine learning, 79:151-175, 2010.
R Thomas McCoy, Ellie Pavlick, and Tal Linzen. Right for the wrong reasons: Diagnosing syntactic heuristics in natural language inference. arXw preprint 19020000000007 2019.
Adrien Bardes, Jean Ponce, and Yann LeCun. Vicreg: Varianc-invariance-ovvaaaa regularization for self-supervised learning. arviv preprint arXix:2105.0000 04906 2021.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference machine learning, pages 1597- 1607. PMLR, 2020.
John R Zech, Marcus A Badgeley, Manway Liu, Anthony B Costa, Joseph J Titano, and Eric Karl Oermann. Variable generalization performance of deep learning model to detect pneumónia in chest radiographs: a cross-sectional study. PLoS medicine, :e(11)e 2018
Jeremy Irvin, Pranav Rajpurkar, Michael Ko, Yifan Yu, Silviana Ciurea-Ilcus, Chris Chute, Henrik Mark- lund, Behzad Haghgoo, Robyn Ball, Katie Shpanskaya, et al. Chexpert: large chest radiograph dataset with uncertainty labels and expert comparison. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 590-597, 2019.
Alistair EW Johnson, Tom J Pollard, Nathaniel R Greenbaum, Matthew P Lungren, Chih-ying Deng, Yifan Peng, Zhiyong Lu, Roger G Mark, Seth J Berkowitz, and Steven Horng. Mimic-cxr-jpg, a large publicly available database of labeled chest radiographs. Xrviv preprint arXie: 19901.00043 2019.
Adina Williams, Nikita Nangia, and Samuel Bowman. A broad-coverage challenge corpus for sentence understanding through inference. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Technologies, Volume 1 (Long Papers), Association for Computational Linguistics, 2018. URL http:://cclet org/ angahhohhllgy//
pages
N18-1101.
Yixin Nie, Adina Williams, Emily Dinan, Mohit Bansal, Jason Weston, and Douwe Kiela. Adversarial nli: A new benchmark for natural language understanding. arXiv preprint arXiv:1910.14590 2019.
Divyansh Kaushik, Eduard Hovy, and Zachary C Lipton. Learning the difference that makes a difference with
data. orXiv preprint arXiv:1909.14334 2019.
Christopher Clark, Mark Yatskar, and Luke Zettlemoyer. Don't take the easy way out: Ensemble based methods for avoiding known dataset. biases. Xrxiv preprint ar arxi: 11019999999..9. 2019.
14

---

Published in Transactions on Machine Learning Research (06/2024)
Hyojin Bahng, Sanghyuk Chun, Sangdoo Yun, Jacgul Choo, and Scong Joon Oh. Learning de- repre- sentations with biased representations. In International Conference on Machine Learning, pages 528-568-800 -399. PMLR, 2020.
Ronan Le Bras, Swabha Swayamdipta, Chandra Bhagavatula, Rowan Zellers, Matthew E. Peters, Ashish Sabharwal, and Yojin Choi. Adversarial filters of dataset biases. In ICML, 2020.
Yao Qin, Chiyuan Zhang, Ting Chen, Balaji Lakshminarayanan, Alex Beutel, and Xuezhi Wang. Under- standing and improving robustness of vision transformers through patch- based negative augmentation. arXiv preprint arXim221000078: 07858, 2021.
Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint arXiv: vrXiv:1710.09411, 2017.
Yi Li and Nuno Vasconcelos. Repair: Removing representation bias by dataset resampling. In Proceedings of the IEEE/CVF conference on compuler vision and pattern recognition, pages 9572 9581, 2019.
Abhishek Sinha, Kumar Ayush, Jiaming Song, Burak Uzkent, Hongxia Jin, and Stefano Ermon. Negative data augmentation. arXiv preprint arXiv:2102.05113, 2021.
Fabio M Carlucci, Antonio D'Innocente, Silvia Bucci, Barbara Caputo, and Tatiana Tommasi. Domain generalization by solving jigsaw puzzles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2229-2235 2019.
Damien Teney, Ehsan Abbasnedjad, and Anton van den Hengel. Learning what makes a difference from counterfactual examples and gradient supervision. In Computer Vision ECCV 2020: 16th European Con- ference, Glasgow, UK, August 23-28, 2020, Proceedings, Port X 16, pages 580-599. Springer, 2020.
Amir Feder, Katherine A Keith, Emaad Manzoor, Reid Pryzant, Dhanya Sridhar, Zach Wood-Doughty, Jacob Eisenstein, Justin Grimmer, Roi Reichart, Margaret Roberts, et al. Causal inference in natural language processing: Estimation, prediction, interpretation and beyond. Transactions of the Association for Compulational Linguistics, 10:1138 1158, 2022.
Divyansh Kaushik, Amrith Setlur, Eduard Hovy, and Zachary C Lipton. Explaining the efficacy of counter- factually augmented data. arXiv preprint 2010v:2010.00114, 2020.
Jacob Eisenstein. Informativeness and invariance: Two perspectives on spurious correlations in natural language. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, July 2022. URL https://aclanthol.00 org/2022. maacl-main... 321.
Zhao Wang and Aron Culotta. Robustness to spurious correlations in text classification via automatically generated counterfactuals. In Proceedings of the AAAI Conference on Artificial Intelligence volume 35, pages 14024-14000 2021.
Zhao Wang and Aron Culotta. Identifying spurious correlations for robust text classification. Xrx preprint arXiv:2010.02/3 024458 2020.
Yoav Wald, Gal Yona, Uri Shalit, and Yair Carmon. Malign overfitting: Interpolation and invariance are fundamentally at odds. In The Eleventh International Conference on Learning Representations, 2022.
Yongqiang Chen, Kaiwen Zhou, Yatao Bian, Binghui Xic, Bingzhe Wu, Yonggang Zhang, MA KAILI, Han Yang, Peilin Zhao, Bo Han, et al. Pareto invariant risk minimization: Towards miligating the optimization dilemma in nut-of-distribution generalization. In The Eleventh International Conference Learning Representations, 2022.
Jianyu Zhang, David Lopez-Paz, and Lćon Botton. Rich feature construction for the optimization- generalization dilemma. In International Conference on Machine Learning, pages 26397-26411. PMLR, 2022.
15

---

Published in Transactions on Machine Learning Research (06/2024)
Yongqiang Chen, Wei Huang, Kaiwen Zhou, Yatao Bian, Bo Han, and James Cheng. Understanding and im- proving feature learning for out-of-distribution generalization. Advances in Neural Information Processing Systems, 36, 2024.
Vaishnavh Nagarajan, Anders Andreassen, and Behnam Neyshabur. Understanding the failure modes of out-of-distribution generalization. arXiv preprint orXim:2010.1377: 2020.
Aahlad Manas Puli, Lily Zhang, Yoav Wald, and Rajesh Ranganath. Don't blame dataset shift! shortcut learning due gradients and cross entropy. Advances in Neural Information Processing Systems, 36: 71874-71911 2023.
LIN Yong, Lu Tan, HAO Yifan, Ho Nam Wong, Hanze Dong, WEIZHONG ZHANG, Yujiu Yang, and Tong Zhang. Spurious feature diversification improves out-of-distribttio generalization. In The Twelfth International Conference on Learning Representations, 2023.
Polina Kirichenko, Pavel Izmailov, and Andrew Gordon Wilson. Last layer re-training is sufficient for ro- bustness to spurious correlations. In The Eleventh International Conference on Learning Represenlations, 2022.
Shiori Sagawa, Aditi Raghunathan, Pang Wei Koh, and Percy Liang, An investigation of why overparam- eterization exacerbates spurious correlations. In International Conference on Machine Learning, pages 8346 8356. PMLR, 2020.
Badr Youbi Idrissi, Martin Arjovsky, Mohammad Pezeshki, and David Lopez-Paz. Simple data balancing achieves competitive worst-group-accursey In Conference on Causal Learning and Reasoning, pages 336 351. PMLR, 2022.
16

---

Published in Transactions on Machine Learning Research (06/2024)
A Proofs and Discussion on Semantic Corruptions
In this section we give the proofs of Theorem 1 and Proposition 1. The first result shows that even we know our training and test data are sampled from distributions a nuisance varying family F, additional assumptions are required in order learn a predictor that is robust across the entire family.
Theorem 1. For any learning algorithm, there erists a nuisance-varging family F where predicting with Py = 1 x) achieves 90% accuracy on all members such that given training data y.X x from one member Pir E F, the algorithm cannot achieve better accuracy than predicting at random on some pte E F.
Proof. At high-level, setup two muisance-vary varying families Fi {2 {P2,p} where
1. There members of each family that have the same distribution over (y,x). We let this distribution over x, be the training data.
Thus looking at this training data alone, no algorithm can tell which family the test distribution will come from.
Then, the proof concludes by showing any predictor that performs better than the chance on all members Fi, will perform worse than chance on a member of F2.
Defining the two families. We now define two muisance-varying families Fi {PI,o} and F2 {22.o) For E {-1,1), and a [0,1] let Ra(a) be probability distribution obtained by randomly flipping the sign of a with probability 1 o:
Sp(r a)
Ra(a)
(2)
p(r a0) =-
Then, define the family } as the distributions resulting from the following sampling process:
Ro.
Ry(y)
x" ~ Ro.
x = [x", z]
The second family P2,p follows the same process except that the positions of the semantic feature and nuisance are flipped x = x²). Notice that predicting from X in Fi and from in F2, achieves 90% accuracy. In both families, by construction, the following properties hold
(), (y)
(z, y) = (2, y),
Px,, .y) = =x,,0xx,, y))
XIJLp,, X2 ly.
If p + 0.9, due to the flipping of the positions of x", between Pt,p and p2,0
(x y) # (x y)
(x y) + (x, yy)
But when p = 0.9, the distributions are the same: px,( y) d (x2 yy) = P1,,oy,,x) = x2) With this we let the training data come from Por = P1.0.9
Reducing accuracy computation to summing conditional probabilities. Now, we express the ac- curacy of any predictor f(x1, E (-1,1] of pt.p:
(CC,(P1,)) = xp 1ly = f(x1, x2)]
Σ (y = f(11, xi = =1, = x2)
Σ Pi,p(x1 = = = x2 y = f(21, f(x1.22))
21,22
= 0.5 Σ
x1, =
x2 y = f(11,12))
(3)
Ji .2g
17

---

Published in Transactions on Machine Learning Research (06/2024)
With this expression, have reduced computing the accuracy of model f(21, 222 to taking one from pair of numbers either px,p(x; = 21, X2 x2 y 1) or (x, 11,x2 = 42 -1) based on what f (2), predicts for each possible value of I1, I1 E (-11, 13 summing them and multiplying by 0.5.
(I1, F2) (-1, -1) (-1,1)
(1,-1)
(1,1)
ACC,(P1.0) acc
ACC,(pr.)
min
0
1
1
0.50
0.50
0.50
-1
0.55
0.05
0.05
2
1
0.05
0.55
0.05
3
-1
0.10
0.10
0.10
4
-1
1
1
0.95
0.45
0.45
5
-1
1
-1
1.00
0.00
0.00
6
-1
-1
1
0.50
0.50
0.50
7
-1
-1
0.55
0.05
0.05
1
0.45
0.95
0.45
0.50
0.50
0.50
10
0.00
1.00
0.00
11
-1
-1
-1
0.05
0.55
0.05
12
-1
-1
1
1
0.90
0.90
0.90
13
-1
-1
1
-1
0.95
0.45
0.45
14
-1
-1
-1
1
0.45
0.95
0.45
15
-1
-1
-1
0.50
0.50
0.50
Table 7: The 16 different functions that are possible when predicting a label in {-1, from x (-1,
We compute the accuracies on P1,0: P1,1 and report the minimum the two. The only predictor that achieves better than random chance accuracy (denoted by =) is f x2) 21.
Showing only a semantic predictor can achieve better accuracy than random chance on Fi. Next, we will show that the only way achieve better accuracy than random chance on every member of F1 is to predict with f(11, 22) I1. To show this, we will express the accuracy computation for two distributions P1,0 and P1,1 by constructing table of values of (x Iı, X2 x2 y = 1) and
(x1 = 2ı, = 22 y= -1) for p 0 and p = 1 separately.
P1,1
P1,0
-1
+1
-1
+1
0, 0.9
0,0.1
-1
0.1, 0
0.9,0
X2
X2
+1
0.1,0
0.9,0
+1
0,0.9
0,0.1
By definition of accuracy from eq. (3), the accuracy of any predictor f(x1,02) comes down to picking and right otherwise - from cach element in the table,
from the pair of numbers - left one if prediction summing them and multiplying by 0.5. There are 16 possible functions (2 possible predictions each for 4 combinations of æ1, 42) and we enumerate them in table 7, showing that only f (#1, = 21 will perform better than chance on both distributions Pı,0 and P1.1-
No predictor can achieve better accuracy than random on both F, and Fz. The earlier parts showed that the only predictor that achieves better accuracy than random chance on all of Fi one that only relies on X1, which equals the semantic feature under Pı,0- However, under P2,p X1 is the muisance Then, the predictor (21, Fi has accuracy under P2,0 because under P2,0, have Ro(y)
18

---

Published in Transactions on Machine Learning Research (06/2024)
which means y with probability onc:
ACCy-(P2.0) = Σ
P2.0yy = (2),, x1, = x2) Σ
P2,0 = 21, = X1, = 22) = 0
(4)
21,22
A.1 Semantic corruptions, biased models, and proof of proposition 1
We give the definition of a semantic corruption here and discuss how it implies alternative intuitive definitions before presenting the proof of proposition on using corruptions to build biased models.
Definition 3 (Semantic Corruption). A semantic corruption is a trunsformation of the covariates T(x, 8), where 6 is a random variable such that 6 ( (,,,,,,x'),, if
ED T(x, 0(x,0)
Two other plausible definitions that come to mind are T(x, 8) x' and that y pl T(x, 8) These
are both intuitive properties that can be asked a semantic corruption that is supposed to discards all information about semantics, provided that the z which we wish retain holds no information on (which is the case under p.). We now show that definition implics these two.
From the definition that if T(x, 8) is a semantic corruption, then it also holds that T(x, 8) x": since x" -'
Pa (T((x,)),x)) Po,, (z)P1 (e)Pi (T(x, ()x 8), (2) (x)) 1>)p(x" (x* 2)
(5)
= E (x)P, ( 5) z) = px"xx"") (T(x, 8)).
(6)
A semantic corruption satisfies the second definition also because
px(y|7(xx,,) = po(ylx", T(x), 2))p |2, T(x))dx* "polyix", p T(x))
(7)
f po(y|x", (xpD(x"1z)dl PD(ylz)
First transition adds in integration over the values of x", second one uses the property of the muisance varying family that x X.l 22, x" and therefore is also conditionally independent for any T(x, 6). Then the third transition is due to T(x, 8) being a semantic corruption. The next result shows that the more our semantic corruption captures information about the muisance that is relevant to predicting y, the better we can approximate learning under p., which would yield the optimal risk-invariant predictor over FF (Makar et al., 2022).
A.1.1 Proof of proposition 1.
Now, using the property in eq. (7) that holds for semantic corruptions, we prove proposition
Proposition Let T X x Rd + x a function. Assume the r.v. Ptr(y T(x, 8)) has a bounded second moment under the distribution p. (y, z, x)p(5), and that Prr(y T(x, ()) and Per (y z) satisfy
E (yxxx1111 T(x, < m² Ep (y.x.xp)))))) (p T(x, 0)) - perly 2)) =
Then, the L1 distance between p. (y.x) and (r(y, x) is bounded: lp,, (y.x) x) Pr x) S me. For a semontic corruplion that also satisfies y yll...? T(x, 5) the inequalities hold with
19

---

Published in Transactions on Machine Learning Research (06/2024)
Proof. The L1 distance between the distributions is bounded from above by p. p.-weighted L1 distance between Per (y 2) and (t T())), upto constant:
/ 1p. xx,x) pr(y,x)) dydr
(8)
v.2
per (y))p x))(()
dz dydr
(9)
Ptr 2) pt T(x, 8))
[. per Per(y))er (y.2, x))(6)
Pt T(x)) - Ptr zi)
-1
Ptr k))pr(y [xxx, 8)) -
dz dyde
(10)
Per
(x))()))(()
Per (y T(x, 8)) p(x y, (y T(x, 6)) Ptr(y [)] dydr
(11)
y.
(y)
<
(p(r())p(()
p(x 22 (prrly T(x, 8)) - prrly x)]] dydr
(12)
Py T(x, 5))
1
Ptr (z) (y)(())( y,2)
Prr T(x, 8)) (perly T(x, per(y 2)) dydadz
(13)
y,r
1 (y (xxx8))
Ep (xx,))(())
(y T(x, 8)) Per z)
(14)
(1 (y T(x, 5))3 V /p_(v22x))(0) (po [xx, 8)) Per / 2)}
(15)
Substituting the bounds from the theorem statement completes the proof of the bound. Finally, if T is semantic corruption, by eq. (7), it holds that Per T(x, 6), 2) = ppr (y 2).
Then, if it also holds that y y.l.,. z [xx, 8), ) it holds that (b T(x, 6), z) (y T(x, 8)).
Together this implies that almost everywhere in per per(y, (y, z, x p())
(y T(x, 8)) = Por (y 2) = Ep (vxx))())) Iptr (y T(x, 5)) P 22) This shows that for a semantic corruption such that pl, 2 T(x, it holds that 0.
B Further details about biased-model- model-based spurious-correlation avoiding methods and related work
Nurd. Focusing on mitigating spurious correlations, Puli et al. (2022) identify conditional that has performance guarantees on every test distribution within family of distributions with varying muisance- label relationships: Pte E F. They develop NURD to learn the conditional using data only from Por * Pte- NURD uses 1) the nuisance-nandomizel distribution, p_ (y, 2, x) = (()))_(2))(x y, 2), where 2.l y, and 2) an uncorrelating representation r(x) for which z x.l.p.y y r(x). NURD builds models of the form p. (y rxx)) using r(x) that are most informative of the label.
We run NeWeig which uses a biased model Por(y z) as an importance weight to compute loss pe-(y)
under the muisance-randomizn distribution: 22 = pc-ly 2) Per (y,
To rum reweighting-NURI with semantic corruptions, replace Pr zz) with (er T(x)) for semantic corruption T(x). Semantic corruptions are noisy functions of x: with noise such that (y,z, x) ppp e, T(x) = (xx,), e). This implies
y.lp, e = x. = T(x)
Thus, r(x) = x is uncorrclating and (y x) achieves the optimality guarantocs Puli et al. (2022). These optimality guarantees imply that regardless of the test muisance-label relationship, P, (y x) will achieve optimal performance within the class of models like ( r(x))-
20

---

Published in Transactions on Machine Learning Research (06/2024)
End-to-end bias mitigation. Mahabadi et al. (2019) consider two methods to train a biased model (y 2) and a base predictive model jointly to make the base model predict without relying on the biases. The methods use and fine-tune a BERT model (Devlin et al., 2019) and do not propagate the gradients of the biased model to update the common parameters (token embeddings in this case). They propose 1) POE, where the log of the product of the predictions (the output probabilities) of the two models is used to compute the classification loss and 2) DFI, where the biased model is used to weight the cross-entropy loss for the base model.
The intuition for POE is that the samples for which the biased model classifies correctly will not contribute to the gradients of the base model; thus the base model focuses more on classifying samples that the biased model misclassifics. The DFL algorithm weights cach sample as the biasod model's prodicted probability of all but the label, exponentiated with 7 > This downweights samples that the biased model classifies correctly which in turn mitigates the base model's reliance on nuisance which only helps predict the downweighted samples correctly.
Formally, with a biased model fo(z) and a predictive model fx(x) that output a vector of logits over classes, denoting the soft-max function that maps logits to class-probabilities, and a-)y denoting the softmax- probability of label y
POE
max
Σ
logo logo(So(Zi)))) + log oo
(16)
sEtreining data
DFL
Σ
(1 (1-o(fo(z)))m)) log
(17)
0,7
sEtraining data
Mahabadi et al. (2019) build the biased model Sa using known nuisances z. We build this model from a semantic corruption T(x).
Just Train Twice (JTT). JTT works in two stages: 1) build an "identification model via ERM on the training data to isolate samples that are misclassified due to reliance on the nuisances and 2) train a model via ERM on data with the loss for the misclassified samples upweighted (by constant A). The identification model in JTT is built to be biased model. When the identification model equals Pe-(y | z), it exactly misclassifies the samples in the groups in the minority group'. Upweighting these samples produces dataset with lesser dependence between the nuisance and the label. Models learned on the upweighted data depend more the semantics. See amgorithm 1 for pscudocode.
Algorithm JTT.
Input:
Training set D and hyperparameters T and Aup- Stage one: identification
1. Train identification model fa on D via ERM for T steps.
2. Construct the crrors set of training examples misclassified by fo-
Stage two: upweighting identified points
3. Construct upsampled dataset Dup containing examples in the error set repeated Aup times and all other examples once.
4. Train final model fr Dup via ERM.
In this work, we build the identification model on semantic corruptions i.e. we learn so to predict, y from T(x). The training samples to be upweighted are the ones misclassified when predicting with the identification model on semantic-oorupted versions of the sample, i.e. T(x). The second stage is run as in (Liu et al., 2021) with training data.
iitimizzation-gnnnraliattttooooi Dilemma Like many other algorithms in the OOD gencralization litera- ture, training B-SCAMSS based on semantic corruptions may also suffer from obstacles due to optimization and generalization: employing statistical constraints to handle distribution shift may not build models that perform well OOD due to overfitting (Wald et al., 2022), training difficulties (Chen et al., 2022; Zhang et al.,
The minority group is the set of samples that the muisance misclassifies. For example, when pe- (y 2) pi-(y # z), then the minority group the samples with y & z because using only the nuisance results in predicting y b where
21

---

Published in Transactions on Machine Learning Research (06/2024)
Figure 3: Example of PATCH-RND of a chest X-ray image. The image is followed by PATCH-RNY of size 112, 56, 28, 14, 7,2.
2022; Chen et al., 2024), reliance on inappropriate inductive biases (Nagarajan et al., 2020; Puli et al., 2023). Some approaches in the literature can alleviate these difficulties: two-stage methods incorporate the OOD objective only when training smaller models on top of large ones (Chen et al., 2022; Zhang et al., 2022; Chen et al., 2024; Yong et al., 2023; Kirichenko et al., 2022), subsampling instead of weighting (Sagawa et al., 2020; Idrissi et al., 2022), or large lg regularization (Sagawa ct al., 2019).
In our implementations we use validation data and regularization to tume parameters for the weighted-ERM algorithm as proposed in the original papers of the B-SCAMS we experiment with. As ERM is standard practice; there are no new optimization difficulties but generalization difficulties can occur due to overfitting (Wald et al., 2022; Puli et al., 2023). Any improvements in genoralization in weighted-ERe ERM will lead improvements in models built by B-SCAMS with biased models from semantic corruptions.
C Further experimental details
C.1 Remark on baseline corruptions
NURD with the bascline corruption GAUSS-NOISE outperforms ERM and closes 80% of the gap between ERM and known-z NURD in table 2. We explain such improvement consequence of GAUSS-NOISE corrupting semantics more than it corrupts nuisances; explain below. In tasks like waterbirds, nuisances are present in most if not all patches of the image regardless of where the patches appear. On the other hand, semantic features are localized to a few adjacent patches (like the birds parts appearing next to each other). When nuisances are present is many more patches than the semantics, adding gaussian noise all pixels corrupts semantics more than nuisances. To see why, consider meausurements of a quantity as a gaussian random variable with the quantity as its mean. More measurements lead to better estimates of the mean.
C.2 Implementation details
Each experiment in the paper was run up to 2 RTX8000 GPUs. The hyperparameters for methods that use known nuisances in the training data, like NURD, POE, DFL are tuned on validation data from the training distribution. For NURD, we select corruption hyperparameters using the mean of the balanced validation accuracy across 10 seeds. We do the same when using semantic corruptions.
Experimental details for Waterbirds For the NURD setup, the training, validation, and test datasets have 3020, 756, 800 samples respectively. We use a single architecture to parameterize the predictive model and the weight model in this experiment: two fully connected layers on top of a ResNet18 initialized weights pretrained on Imagenet. We use the same training procedure for NURD with known nuisances with semantic corruptions. Both models are trained with cross-entropy. The weight model is optimized with the default Adam optimizer for 20 epochs with batch size of 64. The predictive model is optimized with the Adain optimizer for 20 epochs with a learning rate of 0.0002, a weight decay of 0.01, and a batch size of 250.
For the JTT setup, the training, validation, and test datasets have 4795, 1199, 5794 samples respectively. For JTT, we use the same model and model parameters as Liu et al. (2021) using their released code. We repeat the details here for completeness. The model for both stages of JTT is a ResNet-50. Both models are optimized by stochastic gradient descent (SGD) with momentum 0.9, weight decay 1.0, and learning rate x 10-5, Both models are trained for 300 epochs with batch size 64, using batch normalization and no data augmentation. The identification model used to select samples to upweight corresponds to epoch 60 and the upweighting constant is X = 100.
22

---

Published in Transactions on Machine Learning Research (06/2024)
Experimental details for cardiomegaly detection. The training, validation, and test datasets are fixed across seeds and have 18000, 2000, 1000 samples respectively. To run reweighting-NRRD, we use a single architecture to parameterize the predictive model and the weight model in this experiment: two fully connected layers on top of a ResNet18 initialized at weights pretrained on Imagenct. In known-mussncc NURD with the hospital as the nuisance, the biased model is an estimate of Pr hospital), which is obtained by binning the samples based on the hospital and averaging the labels. We use the same training procedure for NURD with known nuisances or with semantic corruptions. Both weight and predictive models are trained with cross-entropy. The weight model and the predictive model are optimized with the Adam optimizer over 25 epochs with a batch size of 256, and learning rate 0.001.
Implementation details for nli For POE and DFL, we build classifiers by fine-tuning a pretrained BERT model (Devlin et al., 2019) on the data. We follow the same training procedure and hyperparameter details models were trained on the MNLI training dataset which consists of
as used in Mahabadi et al. (2019) 392k examples, with a learning rate of 2 x 10-5 with a batch size of 8 using the Adam Optimizer. All models are trained for epochs. The development set contains 9815 examples and the HANS test contains 30000 examples. Since the HANS datasct has only two labels "entailment' and 'non-cntailment" - we combine the neutral and contradiction classes during inference on HANS.
For the JTT setup, Liu et al. (2021) mix the training and development sets from MNLI and create their own training, validation, and test sets of sizes 206175, 82462, 123712 respectively. For JTT, we use the same model and model parameters as Liu et al. (2021) using their released code. We use the optimal hyperparameters reported in Liu et al. (2021) for the learning rate, weight decay, and the upweighting constant. We repeat the details here for completeness. The model for both stages of JTT is pretrained BERT model that is finetuned during training. Both models are optimized by the AdamW optimizer with clipping for the predictive model, no weight decay, and an initial learning rate of 2 x 10-5. Both models are trained for 5 epochs with batch size 32 and dropout. The identification model used to select samples to upweight corresponds to epoch 2 for vanilla JTT (reported optimal in Liu et al. (2021)); for JTT with semantic corruption, we select one from 2,3 using validation group annotations. For both, the upweighting constant is A 6. Our runs with these parameters did not yield the test worst-group accuracy reported in (Liu et al., 2021) (72.6%); our experiments yielded test worst-group accuracy 71.3%. We expect this may be due to the differences in the random seed; JTT is sensitive to hyperparameters and differences in order of batches may result in drops in performance.
In NGRAM-RND, when the number of words in the sentence is not a multiple of n, there will be one k-gram (k < n). In implementing NGRAM-RND, we ensure that the position of this k-gram is randomized i.e. we make sure that it does not always occur at the end of the sentence, for example. NGRAM-RND is implemented before word-piece tokenization (which BERT uses), to ensure that we randomize words instead of subwords. We also create a small HANS-like development sct, which is used to tunc the size parameter. This set is constructed by randomly sampling 1000 examples from the HANS training set, which has zero overlap with the HANS test set.
C.3 Full results tables and additional experiments
We give the results for all size parameters; see table 10, table 11, table 12, table 13, and table 14. To report the same metrics in Mahabadi et al. (2019) for POE and DFL and Puli et al. (2022) for NURD, report standard error for NURD and standard deviation for POE and DFL.
C.3.1 Results on Adversarial NLI (Nie al., 2019) and CAD (Kaushik et al., 2019)
In table 15 and table 16, we report evaluations of POE and DFL models on the adversarial ANLI (Nie et al., 2019) and the counterfactually augmented dataset (Kaushik et al., 2019).
C.3.2 Additional experiments
Experiments with weaker spurious correlations. To verify the effectiveness of the semantic corrup- tions for powering B-SCAMS like JTT that rely on assumptions on ERM-trained models, we experiment with a modified version of the Waterbirds dataset. In the modified dataset, the spurious feature predicts the label
23

---

Published in Transactions on Machine Learning Research (06/2024)
only 75% of the time; this is weaker than the 93% in the original dataset and the invariant relationship which achieves >> 85% accuracy across all groups. We ran ERM, JTT, and corruption-poweeal JTT. For both versions of JTT, we tune over the same hyperparameters as in Liu et al. (2021).
The results in table 8 show that corruption-powert than vanilla JTT and ERM. The improvement of coruption-poweree JTT over vanilla JTT increases from 0.5% in table 3 to 4.4% in table 8; this indicates that vanilla JTT is more sensitive to the strength of the spurious correlation than caruption-powered JTT.
JTT is better
Table 8: Test worst-group (WG) ac- curacies of JTT on modified water- birds where the spurious correlation is weaker than the invariant relation- ship. Corruplion-powered JTT out- performs ERM, vanilla JTT, and JTT with baseline corruptions (RAND- CROP, GAUSS-NOISE) by 2 4.4%.
Experiments with multiple spurious features. We run ROI- MASK-powerde NURD with a modified version of the FulMNIII dataset (Vong et al., 2023). The images consist of 42 x 42 x 3 pixels, or
with the middle 14 14 forming the MNIST image showing and the rest being background patches. The digit in the mid- dle predicts the binary label 1 or 0 with 75% accuracy. Given some E [0, 1), this dataset sets cach of the background patch colors de- terministically based on the image in the middle with probability ps with probability 1 1- p, each background is a random color (see figure (Yong et al., 2023).) We generate the training data with p = 0.9, and the validation and test data with p = O.
Method
test WG acc.
Vanilla JTT
78.6%
PATCH-RND
84.6%
ROI-MASK
85.2%
FREQ-FILT
83.2%
INT-FILT
83.0%
RAND-CROP
76.2%
Rol-MAsK-powered NURD with central-Ro1 sizes 14 and 28 achieves test accuracies 71.1% and 70.3% respectively, beating ERM which achieves 51.7% because it relies more on the background colors. PATCI-RNN is not suited for this experiment because the different nuisance colors are chosen based on the patch position, and PATCH-RND randomizes patch positions which corrupt these muisances.
GAUSS-NOISE
75.9%
ERM
76.1%
Experiments showing that corrupting the semantics is the reason behind the improved ood performance in corruption-poweret b-scams. First, we show that corruptions actually do corrupt semantics, taking PATCH-RND as the example. We focus on the Waterbirds dataset to show how patch size affects semantics. For this investigation, we construct training and test datasets where the label and nuisance are independent and build models for predicting the label.
The results are in table 9 and show that as patch-size decreases, more se- mantic information is lost. These results mean that for patch sizes < 28, a biased model built. from the corrupted image cammot predict the label well using semantics alone; the accuracy of random chance is 50%. As the label independent of the muisance, a lower accuracy means more seman- tie information is corrupted. However, on the original dataset, our biased models at these patch sizes achieve at least 85% accuracy in predicting the label from the corrupted images, meaning that they rely mostly on
Table 9: Accuracy of pre- dicting the label from the im- age corrupted by PATCH-RND as patch-size decreases. As the la- bel is independent of the nui- sance, a lower accuracy means that more semantic information is corrupted.
the nuisance.
Second, to show that corruptions actually do help, we ran the full NURD algorithm on the Waterbirds dataset from (Puli et al., 2022) with a biased
PATCH-RNV size
Accuracy
Full image
86%
model built directly on the uncorrupted covariates; that is we train
112
76%
model with ERM to predict y from x and use it as the biased model
56
73%
in NURD. The resulting test accuracy is < 70%. When using patch- sizes under 28, the PATCU-RND-poweree NURD algorithm achieves a test accuracy of nearly 87%. This shows that the corruption of semantics directly responsible for improving model robustness.
28
64%
14
58%
57%
24

---

Published in Transactions on Machine Learning Research (06/2024)
Table 10: Average accuracies and standard deviation 4 seeds of POR and DEL with semantic corruptions the HANS dataset. The results for known POE and DFL from Mahabadi et al. (2019), where both methods use known nuisances. For both methods, selecting the size hyperparameter based on the average accuracy small dataset (1000 samples) from the test distribution gives n = 3. With this size, POE with NGRAM-RND performs better than known-nuisanco POE while DFL with NGRAM-RND closes 84% the gap between ERM and
DFL
Z
POE
DFL
Known
66.3
0.6%
69.3 0.2%
1 1-gram
65.7 2.0%
66.5 1.5%
2- g-gam
66.0 + 0.9%
68.5 + 0.7%
graaam
66.7 1.5%
+ 1.5%
4 4-gram
66.2 + 2.9%
65.0 + 2.0%
FRM
63.6%.
Mean and standard error of lest accuracy across 10 seeds of NURD on classifying waterbirds. Known-nuisance NURD uses a label for the type of background as the nuisance. Selecting the size hyper- parameter based on the average accuracy over sceds on the validation datasct gives 14 for PATCH-RND, 196 for ROI-MASK, 168 for FREQ-FILT, and 0.2 for INT-FIET. Consider the gap between ERM and known- muisance NURD. NURD with PATCH-RND, ROI-MASK, FREQ-FILT, and INT-FILI close 99%, 99%, 82%, 99% of the gap respectively. NURD with these semantic corruptions outperforms ERM and NURD with RAND-CROP and GAUSS-NOISE. NURD with all semantic corruptions outperforms ERM (69.2%).
Table 11:
known
RM
RM
RM
RM
PR
PR
PR
PR
z
196
140
28
56
ERM
Mean 87.2%
86.9%
86.6%
86.2%
86.3%
85.6%
86.9%
82.5%
84.9%
68.0%
Std. err.
1.0%
1.1%
1.2%
1.8%
1.6%
L.4%
1.2%
2.0%
1.4%
1.9%
FF
FF
FF
FF
IF
IF
IF
IF
196
140
0.1
0.2
0.3
0.4
Mean Std. err.
83.8%
83.5%
81.0%
80.3%
81.2%
86.9%
85.0%
81.9%
1.2%
1.1%
1.4%
1.7%
1.7%
1.1%
1.5%
1.7%
RAND-CROP
GAUSS 0.01
GAUSS 0.25
GAUSS 1
GAUSS
Mean Std. err.
73.7%
75.8%
74.1%
78.0%
83.9%
2.0%
3.2%
3.1%
3.4%
1.4%
25

---

Published in Transactions on Machine Learning Research (06/2024)
Mean and standard error of test accuracy across seeds of NURD on detecting cardiomegaly from chest X-rays. Known-nuisance NURD the hospital the nuisance. Selecting the corruption parameters based the mean accuracy MASK, 168 for FREQ-FILT, and 0.1 for the INT-FIETT Consider the gap between ERM and known-muisance NURD, NURD with PATCII-RND, ROI-MASK, FREQ-FILT, and INT-FILT close 72%, 82%, 65%, 35% of the gap respectively. NURD with semantic corruptions outperforms NURD with baseline augmentations RAND-CROP and GAUSS-NOISE. NURD with PATCH-RND and ROI-MASK outperforms ERM for all size parameters.
Table 12:
10 seeds the validation dataset gives 14 for PATCH-RND, 196 for ROI-
known
RM
RM
RM
RM
PR
PR
PRt
PR
196
168
140
112
7
14
28
56
ERM
Mean 81.7%
78.7%
78.3%
77.2%
73.6%
76.2%
77.0%
74.9%
74.3%
65.3%
Std. err.
0.3%
0.3%
0.8%
0.8%
0.7%
1.2%
1.2%
1.0%
1.4%
1.1%
FF
FP
FF
FF
IF
IF
IF
IF
196
168
140
112
0.1
0.2
0.3
0.4
Mean Std. eTr.
74.4%
76.0%
75.3%
71.3%
71.0%
68.0%
62.0%
57.1%
1.5%
0.6%
0.9%
1.6%
1.0%
1.6%
1.8%
3.2%
RAND-CROP
GAUSS
GAUSS
GAUSS
GAUSS 4
0.01
0.25
Mean
59.9%
62.3%
63.5%
68.0%
69.0%
Std. err.
2.1%
3.7%
3.4%
1.1%
1.9%
Table 13: Test worst-group accuracies of JTT with semantic corruptions waterbirds. Selecting the corruption hyperparameters on the validation worst-group accuracy gives size 14 for PATCH-RND, size 196 for ROI-MASK, size 112 for FREQ-FILT, and threshold 0.4 for INT-FILT. JTT with these semantic corruptions outperforms ERM, vanilla JTT, and JTT with the baseline corruptions RAND-CROP and GAUSS-NOISE. JTT with PATCH-RND and ROI-MASK outperforms JTT with the baseline corruptions and ERM for all sizes.
Vanilla
RM
RM
RM
RM
PR
PR
PR
PR
JTT
196
168
140
112
7
14
28
56
FRM
86.5%
88.2%
88.0%
86.9%
86.2%
89.3%
89.0%
88.9%
89.1%
72%
PF
FF
FF
IF
IF
1F
196
168
140
112
0.1
0.2
0.3
0.4
82.5%
84.5%
85.2%
87.2%
69.1%
80.0%
81.7%
87.0%
RAND-CROP
GAUSS 0.01
GAUSS
GAUSS
GAUSS
0.25
4
75%
0.0%
0.0%
71.0%
0.0%
26

---

Published in Transactions on Machine Learning Research (06/2024)
Worst-group and average test accuracies of JIT with semantic corruptions on NLL JTT with PREM-MASK and NGRAM-RND of every size outperforms vanilla JTT. Selecting the size hyperparameter for NGRAM-RND using validation worst-group accuracy, like Liu et al. (2021) do for vanilla JTT, gives 1. A this size, JTT with NGRAM-RND outperforms vanilla JTT by 3% accuracy.
Table 14:
Worst-group
Average
Vanilla JTT
71.3%
79.1%
PREM-MASK
72.1%
79.9%
1-gram
74.3%
79.7%
2-gram
71.9%
80.0%
3-gram
72.0%
80.1%
4-gram
73.4%
80.4%
ERM
67.9%
Table 15: ANLI (Nie et al., 2019) evaluations of models trained on MultiNLI With t-test to measure statistical significance, at the standard significance level of 0.05, we found that POE with NGRAM-RND gave a statistically significant improvement over the baseline on ANLI-RI and ANLI-R2, while DFL gave a statistically significant improvement on ANLI-R1.
Model
ANLI R1
ANLI R2
ANLI R3
ERM POE-known
0.9
2.8
29.8 + 0.4
0.6
2.88
29.8 0.8
DFL-known
1.3
271
3.9
POE n3
24.8
2..2
1.24
DFL. n3
0.6
2.2
0.3
POE PREM-MASK
2.2
2.8
0.8
DFT. PREM-MASK
22.3 0.7
2.67
29.3 1.1
Table Mean and standard deviation of CAD (Kaushik et al., 2019) Lest accuracy over seeds. At the end, we also report the results of finetuning BERT on CAD training data from (Kaushik al., 2019). When trained MNLI, average over the CAD subsets RH and RH, DFL and POE with semantic corruptions, DFL and POE with known-nuisances, and ERM perform par (within one std.) or better than finetuning directly on the training CAD dataset. The improvement over finetuning directly on CAD may be due to the fact that the CAD dataset is much smaller than MNLI ( 7k vs. 400k).
Method
RP
RH
Avg. on R.P and RH
ERM on MNLI
61.1 0.3
76.5 0.4
68.8 + 0.2
POE-known
60.6 0.5
77.0 + 1.1
68.8 + 0.3
POE 3-gram
6..
7.71
68.4 0.2
POE PREM-MASK
6.67
1.0
68.6 0.5
DFL-known
60.6 0.8
7.72
18.40..4
DFL 3-gram
58.4 1.8
72.7 1.7+100
65.5 + 1.4
DPL PREM-MASK
62.4 0.7
76.1 + 0.8
69.3 + 0.6
FRM CAD (from (Kaushik al., 2019))
64.6
67.8
66.2
27


Reviews:
[{"review_id": "L2QG9G37v0", "reviewer": "Reviewer_WqJw", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "(+) The studied problem is important;\n\n(+) The proposed method is new and interesting;\n\n(+) The authors conduct comprehensive experiments to verify the effectiveness of the method;\n\n(-) The proposed method relies on the assumption of the availability of knowledge about the nuisance;", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work studies the OOD generalization by exploiting the relationship between nuisance and labels. Different from previous methods, the authors propose several methods to corrupt the semantics in the input, therefore, the model that can still predict the training labels is likely to rely on the nuisance. Then, they verify the effectiveness of the proposed method with different choices of corruption and datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. It would be better if a summary of the contributions are provided in the paper.\n\n2. To verify the effectiveness of the method in a more realistic setting, it would be better if some additional experiments\n- with a nuisance correlation weaker than that of the invariance as discussed in [1,2,3] that show B-scams methods will fail,\n- with multiple nuisance features [4],\n- with different strengths of the corruption.\n\n**References**\n\n[1] Rich Feature Construction for the Optimization-Generalization Dilemma, ICML'22.\n\n[2] Pareto Invariant Risk Minimization, ICLR'23.\n\n[3] Understanding and Improving Feature Learning for Out-of-Distribution Generalization, NeurIPS'23.\n\n[4] Spurious Feature Diversification Improves Out-of-distribution Generalization, arXiv'23.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "sJd82tXAuf", "reviewer": "Reviewer_rdbj", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "I do not have a strong background in this line of work so this is a low confidence review. The survey of previous work is at times too informal and it is hard to have a crisp idea of the background from the submission. I have clarified some points that could help with the presentation. The proposal is somewhat incremental and domain-specific but appropriate for TMLR and the motivation and the results are promising. The final decision would depend on the discussions with the other reviewers and the authors.\n\nPresentation:\n\n1. The description of previous work is too informal and scattered in my opinion. Ideally, one section would describe an example B-SCAM method (or a prototypical abstract B-SCAM method that would encompass multiple examples) step by step in clear algebraic form or perhaps pseudocode along with a sample application. Such section would clarify, for example, what a nuisance annotation is, how it is employed in the algorithms that require it, or why reweighting the loss would create robustness to nuisances. Right now the reader will have to move back and forth between sections or even different papers to build this background.\n2. The definitions at the bottom of page 4 are claimed to break certain relationships. This part should elaborate further on why these distributions break these relationships.\n3. The proposals are called a form of \"data augmentation\". Given that the corrupted data is used separately to train the biased model, I am not sure whether calling the method \"augmentation\" is appropriate. I leave the decision to the authors who are more familiar with the conventions in this line of research.\n\nCorrectness:\n\n1. The effectiveness of the corruptions relies on breaking semantic information while keeping the nuisances. Evidence that this is in fact the reason behind the improved final performance would be helpful. The authors can perhaps use extra information in the dataset such as nuisance annotations to evaluate the obtained biased models and their reliance on semantics and nuisances. Another approach would be a qualitative analysis of some examples of success and failure to understand the reasons behind it. Such an analysis would be a great addition although not necessary for acceptance in my opinion.\n\nNovelty:\n\n1. The description of the result by Dormann et al below Proposition 1 should better clarify how Proposition 1 differs from it.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Previous work has developed biased-model-based spurious-correlation-avoiding methods (B-SCAMs) to avoid reliance on nuisances, i.e. features that would shift between the train and test domains. B-SCAMs require access to a biased model, a model that predicts the labels using the nuisances. The submission provides data corruption strategies that retain nuisances for training biased models to be used in B-SCAMs. The first type of corruption permutes batches in images and N-grams in text. The other types mask inputs in a certain region, certain frequency band, or certain range of brightness. The proposals can be used in conjunction with previous methods and these additions are shown to improve performance in the experiments. While the corruptions require some domain knowledge about nuisances, Theorem 1 shows that robustness to domain shift without any information about nuisances is not possible. Proposition 1 then shows that the overall procedure is effective if a model trained on the corrupted data is close to a model trained on nuisances.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The comments on presentation and novelty are requested changes for acceptance. The comment on correctness is a suggestion.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "KEKUihFdc4", "reviewer": "Reviewer_bQk6", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper states \"We develop an approach to use knowledge about the semantics via data augmentations.\" but this idea has been published previously as discussed by the authors (ie. NURD). Then the authors state \"We demonstrate the value of semantic corruption by using it to power a variety of b-scams\" so it is confusing what the contribution is. Is this a survey paper?\n\nHow is this work different from https://openreview.net/forum?id=12RoR2o32T which is cited by the authors as the basis for their experiments.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The contribution of this work is hard to assemble in one statement the way the paper is written. It would be very useful if the authors listed out short bullet points of the contribution.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Improve the clarity of the contributions, possibly with short bullet points. Please state this directly and succinctly.\n\nBecause I am not clear on what the contributions of the paper are I don't believe it is ready for publication.", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The majority of reviewer recommend acceptance and the AE agrees. The proposed work will likely find an audience in TMLR readers and seems technically sound. The proposed abstractions of semantic corruptions as they relate to B-SCAM methods is an interesting framework and the empirical results demonstrate the proposed approaches are useful. The initial draft was insufficiently clear on the contributions of the paper and could have been mistaken as a survey paper from the introduction alone -- leading to some confusion. The most recent revision has responded to reviewer concerns about this and is clearer. 

Reviewer bQk6 opposed acceptance due to unclear novelty over prior work by Puli et al. in ICLR 2022. As the authors explain the response, this manuscript can be viewed as an extension and generalization of the principles explored in Puli, 2022. The additional abstraction of semantic corruption powering biased-model-based spurious correlation avoiding methods is a useful framing and the resulting experiments are broader in terms of datasets and methodologies.
Decision: Accept (poster)