Title: Revisiting Visual Model Robustness: A Frequency Long-Tailed Distribution View
Venue: NeurIPS 2023
Accepted: yes
Keywords: visual models

robustness

frequency domain

long-tailed distribution
Abstract: A widely discussed hypothesis regarding the cause of visual models' lack of robustness is that they can exploit human-imperceptible high-frequency components (HFC) in images, which in turn leads to model vulnerabilities, such as the adversarial examples. However, (1) inconsistent findings regarding the validation of this hypothesis reflect in a limited understanding of HFC, and (2) solutions inspired by the hypothesis tend to involve a robustness-accuracy trade-off and leaning towards suppressing the model's learning on HFC. In this paper, inspired by the long-tailed characteristic observed in frequency spectrum, we first formally define the HFC from long-tailed perspective and then revisit the relationship between HFC and model robustness. In the frequency long-tailed scenario, experimental results on common datasets and various network structures consistently indicate that models in standard training exhibit high sensitivity to HFC. We investigate the reason of the sensitivity, which reflects in model's under-fitting behavior on HFC. Furthermore, the cause of the model's under-fitting behavior is attributed to the limited information content in HFC. Based on these findings, we propose a Balance Spectrum Sampling (BaSS) strategy, which effectively counteracts the long-tailed effect and enhances the model's learning on HFC. Extensive experimental results demonstrate that our method achieves a substantially better robustness-accuracy trade-off when combined with existing defense methods, while also indicating the potential of encouraging HFC learning in improving model performance.

Revisiting Visual Model Robustness: A Frequency Long-Tailed Distribution View

Abstract

A widely discussed hypothesis regarding the cause of visual models' lack of robustness is that they can exploit human-imperceptible high-frequency components (HFC) in images, which in turn leads to model vulnerabilities, such as the adversarial examples. However, (1) inconsistent findings regarding the validation of this hypothesis reflect in a limited understanding of HFC, and (2) solutions inspired by the hypothesis tend to involve a robustness-accuracy trade-off and leaning towards suppressing the model's learning on HFC. In this paper, inspired by the long-tailed characteristic observed in frequency spectrum, we first formally define the HFC from long-tailed perspective and then revisit the relationship between HFC and model robustness. In the frequency long-tailed scenario, experimental results on common datasets and various network structures consistently indicate that models in standard training exhibit high sensitivity to HFC. We investigate the reason of the sensitivity, which reflects in model's under-fitting behavior on HFC. Furthermore, the cause of the model's under-fitting behavior is attributed to the limited information content in HFC. Based on these findings, we propose a Ba lance S pectrum S ampling (BaSS) strategy, which effectively counteracts the long-tailed effect and enhances the model's learning on HFC. Extensive experimental results demonstrate that our method achieves a substantially better robustness-accuracy trade-off when combined with existing defense methods, while also indicating the potential of encouraging HFC learning in improving model performance.

1 Introduction

The disparity between deep visual models and the human visual system (HVS) in image signal processing enables the models to outperform the HVS on vision benchmarks [16, 33]. However, it is worth noting that most visual models lack the robustness exhibited by HVS [36, 17]. Specifically, the generalization advancement of visual models can be partially explained by the utilization of humanimperceptible information, such as high frequency components (HFC) [4, 39, 29]. Additionally, the adversarial vulnerability is also closely related to this information, as observed in adversarial examples phenomena [36]. The coexistence of both conditions gives rise to a widely discussed hypothesis: the vulnerability of the model stems from the utilization of imperceptible high-frequency information in images .

Based on this hypothesis, a line of research has been conducted to explain and enhance the robustness of the model [43, 1, 7, 9, 8, 35, 13]. However, these works share a common limitation: most of them solely rely on qualitative analysis of frequency components observed by humans, without further delving into the statistical properties. This limitation gives rise to the following issues in existing

works: (i) the division of the frequency spectrum is intuitively based on manually set radius, resulting in inconsistent conclusions across different datasets and models; and (ii) The understanding of high frequency utilization is limited. For example, improving model robustness often involves suppressing the learning on HFC, which is in stark contrast to the promotion of high frequency utilization to improve generalization performance. This leads to a trade-off between robustness and accuracy in some defense methods.

In this paper, to overcome the challenges posed by the aforementioned limitation, we are motivated by the long-tailed characteristics in the spectrum. Specifically, the power spectral density of an image naturally follows a power-law distribution, where a few low-frequency bands accounts for the majority of the spectrum power while a large number of high-frequency bands maintains a low power distribution. This new realization encourages us to revisit the significance of high-frequency components in addressing the problem of model robustness under the guidance of deep long-tailed learning.

In deep long-tailed learning [46], the presence of a large number of tail classes plays a critical role in improving model performance. These tail classes offer benefits such as ensuring data integrity and diversity [5] and capturing rare events [28]. However, it is commonly observed that models tend to under-fit these classes due to their numerical disadvantage. Intuitively, the long-tailed characteristics of the frequency spectrum also exhibit similar phenomena. We confirm the model's (standard training) under-fitting behavior on high frequencies through the lens of loss landscape [27]. Under the context of model under-fitting, the discussion regarding HFC and model generalization performance can be compatible in most studies [29, 39], as the common underlying cause is the low generalization resulting from under-fitting. In this paper, we establish a link between under-fitting behavior and model robustness, specifically identifying that the model's under-fitting of high-frequency components leads to high sensitivity towards them. We validate this relationship across different datasets and models, consistently confirming our findings. Model's under-fitting behavior on high frequency leads to both low generalization and high sensitivity towards HFC. Thus, it is crucial to improve the under-fitting behavior and further mitigate the trade-off between accuracy and robustness.

Drawing inspiration from deep long-tail learning, we introduce spectral entropy as a measure of the information content of frequency components and provide an explanation for model's under-fitting behavior on HFC. We attribute model's under-fitting behavior to the low spectral entropy of HFC. Based on this perspective, the principle of maximum entropy [23, 3, 32] guides us in constructing an image spectrum with a more balanced energy distribution to address the issue of low information entropy. Finally, our quantitative experiments and theoretical analyses inspire us to propose a simple yet highly effective Ba lance S pectrum S ampling (BaSS) strategy, which can work in conjunction with different training paradigms and enables the model to achieve a better trade-off between robustness and accuracy.

Our major contributions are as follows: (1) To the best of our knowledge, we are the first to propose focusing on the long-tailed distribution in instance-wise , specifically in the frequency domain. This novel perspective provides insights for analyzing and improving model performance. (2) We revisit the relationship between HFC and model robustness, revealing the under-fitting phenomenon and its association with high sensitivity and low generalization at high frequencies. To address the trade-off between accuracy and robustness, we propose to enhance the high-frequency learning. (3) We explain the under-fitting behavior through the lens of spectral entropy. Drawing inspiration from the principle of maximum entropy, we propose a simple yet highly effective spectral sampling strategy (BaSS) to improve the model's under-fitting behavior. By incorporating BaSS with other training paradigms, such as adversarial training and AugMix, model achieves better trade-off between accuracy and robustness. Comprehensive experiments and analyses reveal the effectiveness of our method.

2 The long-Tailed Distribution in Frequency Domain

2.1 Notations and Preliminaries

Image Processing in the Frequency Domain. We perform 2-D discrete Fourier transform (referred to as the DFT) F on image X ∈ R H × W to get Fourier spectrum ˜ X ∈ C H × W . Unless otherwise specified, the low frequencies are shifted towards the center of the Fourier spectrum. We denote ˜ X [ u, v ] as the frequency component where u ∈ { 0 , . . . , H -1 } and v ∈ { 0 , . . . , W -1 } . Addition-

ally, ω u,v denotes the Fourier Basis function [38] and r u,v denotes the Euclidean Distance from the spectrum coordinate [ u, v ] to the center of spectrum, where a larger distance correspond to a higher frequency, and vice versa.

Power Spectral Density. The power spectral density is defined by azimuthally averaging the magnitude of Fourier coefficients over radial frequencies. Specifically, the value of power density is estimated as the azimuthal integration (referred to as AI ) over radial frequencies ϕ according to Eq.1.

where r k is the Euclidean Distance from the k th frequency band to the center of the spectrum [6, 14], k ∈ { 0 , . . . , H/ 2 + 1 } .

2.2 Definition of Frequency Long-Tailed Scenario

Real-world data generally demonstrates a long-tailed distribution, where a small number of dominant categories comprise the majority of the data, and a large number of minority categories possess limited samples. Although previous studies [46, 37] have primarily investigated the degradation in model performance due to the long-tailed problem at the class level, they have not adequately considered the potential existence of a long-tailed issue within individual images. Through our analysis of the Fourier spectrum, we observe that the power spectral density follows a power-law distribution, which also exhibits the long-tailed characteristics. Specifically, the distribution (y-axis) of i th frequency band (x-axis) is calculated by the proportion of power in i th band to the total power of the spectrum, which is denoted as π i = AI ( r i ) / ∑ k AI ( r k ) . Without loss of generality, { π i } naturally present in decreasing trend ( i.e. , if k 1 < k 2 , then π k 1 < π k 2 ).

Consequently, we summarize the statistics of the frequency feature from the long-tailed model perspective as follows: (i) The head part, which is consisted of a few low-frequency bands, accounts for the majority of the spectrum power and is highly semantic and information dense; (ii) The tail part, which is composed of a large number of high-frequency bands, however maintains a low power distribution. This part includes high-frequency semantic information (e.g., texture) as well as human-imperceptible information.

Long Tail based Spectrum Division. Previous analysis [15, 39, 31] indicating that a few lowfrequency components form the image's main content, while most high-frequency components comprise a minor part. The rule that few factors determine main outcomes is encapsulated by the Pareto Principle and the "80/20" quantitative rule, found across various domains, where 80% of effects are caused by 20% of the reasons. Guided by this rule, we defined the boundary between frequencies using an 80/20 spectral energy ratio. We formally define the low- and high-frequencies according to the Eq.2, where the r n is the Euclidean Distance from the n th frequency band to the center of the spectrum. The set composed of ˜ X [ u, v ] occupying 80% of the total power in the spectrum is defined as the low-frequency component, and the remaining portion of the spectrum is defined as the high-frequency component. We experimented with various datasets, finding that different resolution images' high-low frequency boundaries are at a 20% radius from the spectrum's center (as shown in Appendix B.2). This confirms the stability and reasonableness of the classification system using spectral energy and the Pareto Principle.

3 Investigating and Explaining Model Robustness Behaviors: A Frequency Long-tailed View

Vision models have demonstrated a capability in learning frequency information [24, 39, 29, 43]. Intuitively, model's behavior could be affected by the long-tailed characteristics in the frequency

1.5

1.0

0.5

0.0

0.5

1.0

1.5

1.0

0.5

0.0

0.5

1.0

2.700

3.000

3.000

3.300

3.300

3.300

3.300

3.600

3.600

3.600

3.600

3.900

3.900

3.900

3.900

3.900

4.200

4.200

4.200

4.200

4.500

4.500

4.800

4.800

5.100

5.100

5.400

5.700

6.000

(a)

1.5

1.0

0.5

0.0

0.5

1.0

1.5

1.0

0.5

0.0

0.5

1.0

0.900

1.200

1.500

1.800

2.100

2.400

2.700

2.700

3.000

3.000

3.000

3.300

3.300

3.300

3.300

3.600

3.600

3.600

3.600

3.600

3.600

3.900

3.900

3.900

3.900

3.900

4.200

4.200

4.200

4.500

4.800

(b)

domain, which has not been fully explored in previous studies, and is crucial for improving model performance in visual tasks. In this section, we first summarize the impact of long-tailed characteristics as a phenomenon of the model's under-fitting of HFC (Sec. 3.1). We then explore the model's sensitivity to HFC from the perspective of under-fitting, and revisit the relationship between HFC and robustness (Sec. 3.2). Finally we explain the model's under-fitting behavior from the perspective of spectral entropy (Sec. 3.3)

3.1 Model's Under-fitting Behavior on HFC

In the long-tailed theory, the tail part is considered more deserving of attention than the head part. On one hand, the tail part is often overlooked by the system due to its numerical disadvantage(e.g., the sample size of the tail class is far less than that of the head class in the context of class-wise long tail). On the other hand, it plays a crucial role in enhancing the system's performance, primarily due to two characteristics (i) providing data integrity and diversity [5], and (ii) capturing rare events [28]. In this subsection, we explore the learning behavior of models regarding frequency components. Specifically, we visualize and analyze the loss landscape [27] of the classifier on both LFC and HFC. We present the detailed experimental procedure in the Appendix C.

Phenomenon of Model Under-fitting on HFC. The convergence result of LFC and HFC learning exhibits significant differences as shown in Fig. 1. Fig. 1(b) suggests that the loss landscape on LFC exhibits a benign characteristic: the parameter space around the model θ is relatively flat and close to the local minima, indicating that the model has precisely converged on LFC. In contrast, the loss landscape on HFC shown in Fig. 1(a) manifests a dramatic non-convexity in certain regions. It can be observed that the model θ are located in a steep region of the landscape, with loss rapidly decreasing when moving along the gradient directions (i.e., which are perpendicular to the contours). Additionally, in the bottom-left region of the Fig. 1(a), we also observe a better local minimum far away from current model. These observations indicate that the model still has the potential to improve its ability to learn HFC.

Positive Correlation between Generalization and HFC Learning. It is widely recognized that under-fitting is a cause of low generalization performance. Recent works have confirmed that models exhibit lower generalization ability on HFC compared to LFC [39, 29]. Meanwhile, ignoring the HFC can lead to inaccurate representation of the data distribution, resulting in a degradation in model generalization [39, 4]. This correlation can be attributed to the first characteristic of tail components mentioned above. Hence, it is vital to devise and employ strategies that alleviate or eliminate the under-fitting of HFC, as it substantially contributes to the enhancement of model generalization. performance [39, 29].

0

100

200

300

400

500

Rank Index

0

2

4

6

8

Gradient Magnitude

1e2

0

5

10

15

20

25

Frequency Radius

0.0

0.5

1.0

1.5

2.0

2.5

Density

1e

1

Rank Index

Top one

20%

40%

60%

80%

Last one

(a) CIFAR10

0

500

1000

1500

2000

Rank Index

0.0

0.2

0.4

0.6

0.8

1.0

Gradient Magnitude

1e3

0

10

20

30

40

50

Frequency Radius

0.0

0.2

0.4

0.6

0.8

1.0

1.2

1.4

Density

1e

1

Rank Index

Top one

20%

40%

60%

80%

Last one

(b) Tiny-ImageNet

0

5000

10000

15000

20000

25000

Rank Index

0.00

0.25

0.50

0.75

1.00

1.25

1.50

1.75

Gradient Magnitude

1e4

0

25

50

75

100

125

150

175

Frequency Radius

0.0

0.5

1.0

1.5

2.0

2.5

Density

1e

2

Rank Index

Top one

20%

40%

60%

80%

Last one

(c) ImageNet

3.2 Revisiting the Relationship between HFC and Model Robustness

3.2.1 Motivation

The phenomenon of under-fitting inspires us to revisit the issue of model robustness. Robustness is typically expressed as the sensitivity of model outputs to perturbations in inputs, and it can be evaluated in two ways: (i) changes of the outputs leaded by introducing additional perturbations to the inputs; and (ii) inputs gradients with respect to outputs. The results shown in Fig. 1(a) indicate that standard training classifier still exhibit significant loss values in HFC and may have large gradients with respect to high-frequencies, thus resulting in model vulnerability. In the context of long-tailed theory, the tail part usually represents special or extreme cases and thus is more likely to be affected by rare events, making HFC crucial for evaluating and analyzing model robustness. Existing studies [43, 7, 9] suggest that the vulnerability of models is attributed to HFC, however, this conclusion is not consistent across different datasets and models. We attribute the potential causes of inconsistency to the definition of HFC. We aim to further explore relationship between HFC and model robustness.

3.2.2 Analyzing Model Sensitivity to Frequency Components

Model sensitivity to different frequency components has been explored using the Fourier heatmap, which quantifies the changes in outputs when applying Fourier basis perturbations to images [43]. However, there are a few concerns about its applicability: (i) The theory of Fourier basis is based on linear networks while deep neural networks typically exhibit high non-linearity, (ii) The perturbations is excessively sensitive to the magnitude of the basis disturbance. Thus, we take inspiration from [29, 7] and employ the loss gradient across various frequency components to examine sensitivity.

Estimation of Model Sensitivity. Given an input image X with label y , the output of classifier f is f ( X ) . The objective function of model's training is formulated as L ( f ( X ) , y ) . Consequently, the gradient of the loss w.r.t. the original input X can be expressed as g = ∇ X L ( f ( X ) , y ) ∈ R H × W , whose magnitude can indicate the sensitivity of the classifier to pixel domain perturbations. To further assess the model's sensitivity in frequency domain, we employ the set of orthogonal Fourier basis vectors { ω u,v } and project g into frequency domain coordinate system. The corresponding coordinate of projection in ω u,v is defined as follows:

The sensitivity of model to the frequency components corresponding to the spectrum point [ u, v ] is measured by the gradient magnitude on ω u,v , which is defined as ∥ c u,v ∥ 2 . In order to identify the frequency domain sensitivity patterns of the model at the dataset level, we first sort w u,v according to ∥ c u,v ∥ 2 on a single image. For ease of statistical analysis, we replace w u,v with the frequency radius r u,v as the feature vector. Finally, we get the set of feature vector for all images and estimate the density of frequency radius using kernel density estimation (KDE) within the same rank index. We analyze the frequency sensitivity across the CIFAR10 [25], Tiny-ImageNet [26], and ImageNet [12] datasets with resolutions of 32 2 , 64 2 , and 224 2 pixels, respectively. We show detailed settings in the Appendix D.

Results and Discussions. From the first row of Fig. 2, we observe an imbalanced distribution of gradients in different frequency bands, and the degree of imbalance is quite pronounced, resembling a similar long-tailed distribution. The results in the second row of Fig. 2 indicate that the density peaks of frequency radius in high-magnitude gradients are mainly concentrated in the tail highfrequencies (i.e., represented by the darker colored curves). These observations clearly demonstrate the relationship between HFC and model vulnerability, indicating that perturbations in HFC are more easier to cause errors in the model. In the result of ImageNet as shown in Fig. 2, we notice a particular phenomenon where there are also large gradient magnitude in the head components. This could be due to the wide spectral range causing similar vulnerabilities in the head components. However, this phenomenon does not affect the consistency of our conclusions. It also suggests that addressing robustness in the ImageNet dataset is a more challenging task.

3.3 Reasons leads to the Under-fitting Behavior

In deep long-tailed learning, the lack of sufficient generalizable information on tail classes directly causes biased behavior in models. Similar phenomena inspire us to explain the under-fitting of the tail part from an information-theoretic perspective in the case of frequency long-tailed problems.

3.3.1 The Spectral Entropy of HFC is Much Lower than LFC

Spectral Entropy To quantitatively characterize the amount of information contained in a given image, spectral entropy is utilized analogously to Shannon entropy in information theory. The continuous frequency domain is discretized and represented by a discrete variable ξ , with ξ l and ξ h as its minimum and maximum values, respectively. Given that the spectral density of natural images follows a power-law distribution, its density function can be computed and normalized as follows: p ( ξ = k ) = 1 -α ξ 1 -α h -ξ 1 -α l · k -α , where α is the parameter determining the magnitude of the long-tailed effect, and its smaller value indicates a more significant long-tailed effect. We use π i to estimate p i , and then the spectral entropy of k th band is derived by applying the Shannon entropy formula: H k = -π k log π k . Consequently, the flat spectrum corresponds to maximal spectral entropy, while the spectrum of a single frequency signal has minimal spectral entropy, which is zero.

Theorem 1 Given any natural image X , k represents the order of frequency band, then the spectral entropy H k is given by: H k = ( αA α log k + H ( A ( α ))) · k -α , where A ( α ) = (1 -α ) · ( ξ 1 -α h -ξ 1 -α l ) -1 . Then we have, lim k → 0 H k = ∞ and lim k →∞ H k = 0 .

Theorem 1 demonstrates an inverse proportional relationship between the frequency band and spectral entropy, decreasing at an α order. This indicates that high-frequency bands in the tail contain substantially less information than low-frequency bands in the head. Unlike measuring the number of image samples, we provide a new way to measure image information from the frequency domain perspective, explaining the model's under-learning behavior for low-information data. Moreover, Theorem 1 also suggests that high-resolution data, such as ImageNet, often lack effective generalizable information in the tail. This finding aligns with Fig. 2, illustrating that the model fails to generate gradient components in the ultra-high frequency range of ImageNet data.

3.3.2 Balanced Spectral Entropy Benefits the Under-fitting Phenomena

The maximum entropy principle seeks to make reliable predictions on unknown data distributions by selecting probability distributions with the highest entropy, without introducing unnecessary biases or prior knowledge. Both generalization and robustness reflect a model's ability to infer unknown samples, which depends on its capacity to capture information during training. Based on

our analysis, we suggest that this principle explains the model's under-fitting on HFC: the model prioritizes utilizing LFC with higher information entropy to improve its capacity for fitting unknown data, leading to the observed under-fitting in high frequencies. To address under-fitting in HFC, we aim to increase the amount of information, and the maximum entropy principle offers a solution.

Theorem 2 Given the prior data ξ , and its corresponding probability distribution p ( ξ ) , the principle of maximum entropy consider the following optimization: ˆ p = { arg max p ∈ P H ( p ) | p ( ξ ) ≥ 0 , ∫ Ω p ( ξ ) dξ = 1 , ∫ Ω p ( ξ ) r i ( ξ ) dξ = α i , i = 1 , · · · m } . Without considering the moment constraints, the uniform distribution p ( ξ ) = 1 ξ h -ξ l 1 [ ξ l ,ξ h ] ( ξ ) satisfies the principle of maximum entropy.

Theorem 2 demonstrates that a uniform distribution with balanced information adheres to the maximum entropy principle when fitting an unknown distribution. Intuitively, this corresponds to fair learning for tail classes, which has been extensively studied in deep long-tailed learning to improve tail class generalization using techniques like re-weighting or re-sampling. This insight drives us to tackle the under-fitting issue of HFC by redistributing spectral energy through a balanced sampling strategy.

4 Methodology and Experiments

4.1 Balanced Spectrum Sampling (BaSS)

Previous analyses encourage us to HFC learning by balancing the power spectral density. Nonetheless, it is essential to consider the potential negative effects of noise present in the image while implementing a balanced spectrum. Noise components, often found in ultra-high-frequency parts, have been proven less beneficial for classification tasks [39, 29]. Moreover, uniformly allocating noise and other frequency components may (i) amplify noise influence on model learning, and (ii) allocate less energy to remaining frequency bands, both negatively impacting model learning. To address these challenges and achieve spectral balance, we propose a spectral sampling strategy in this subsection.

Sampling Strategy. For the i th frequency band, we sample the power spectral density according to Eq. 4 with a probability of ˆ π i , where τ ≥ 1 denotes the base and B is the maximum frequency band of the spectrum. Our approach is inspired by two background pieces of knowledge: solutions for the long-tail distribution of image categories and image sampling. The solution for the class-wise long-tail distribution adjusts the sampling frequency of samples with different class quantities through the inverse weighting of category quantities. However, features in images (like spatial pixels and spectral density) can not usually be directly chosen via the sampling theorem. Therefore, we refer to the method of sampling image pixels in the spatial domain: (i) discretizing image features that corresponds to the spectrum obtained from the Fourier transform; (ii) selecting and combining feature values from different regions: we re-weight features at different frequency bands based on the sampling probability ˆ π i and obtain a new image through the inverse Fourier transform.

Specifically, we employ a logarithmic function to: (i) establish a smooth connection between the power density of head and tail parts, mitigating the impact of ultra-high frequency components on the overall distribution, and (ii) adjust spectral power values in the head part to a reasonable range, while diminishing the power disparity between head and tail frequency bands, yielding a more balanced distribution overall.

4.2 Working Mechanism Exploration of BaSS

In this subsection, we validate the potential of the Balanced Spectrum Sampling strategy (BaSS). Specifically, we examine two paradigms for utilizing the sampled images: (i) Data augmentation, where each training image is performed by BaSS with a probability of γ . In this paradigm, the model will be validated on a test set comprised only of natural images. (ii) New dataset, where both the training and testing sets consist entirely of sampled images.

Experiments Settings. We refer to the dataset performing BaSS on CIFAR10 [25] as CIFAR10-B. For different values of γ , we obtain a set of ResNet-18 [19] models with standard training. We

0

0.25

0.5

0.75

1

60

80

100

Clean Acc(%)

test set

CIFAR10

CIFAR10-B

(a)

0

0.25

0.5

0.75

40

60

80

100

Robust Acc(%)

Corruption

Noise

Blur

Weather

Digital

(b)

0

0.25

0.5

0.75

0

20

40

60

Robust Acc(%)

1/255

2/255

4/255

8/255

(c)

CIFAR10

CIFAR10-B

0

25

50

75

100

Acc(%)

Clean

Corruption

Adversarial

(d)

1.5

1.0

0.5

0.0

0.5

1.0

1.5

1.0

0.5

0.0

0.5

1.0

2.800

2.800

2.800

3.000

3.000

3.000

3.200

3.200

3.200

3.400

3.400

3.400

3.400

3.600

3.600

3.600

3.600

3.800

3.800

3.800

3.800

4.000

4.000

4.000

4.000

4.200

4.200

4.200

4.200

4.400

4.400

4.400

4.400

4.600

4.600

4.600

4.800

4.800

5.000

5.000

(a)

γ

= 0

.

25

1.5

1.0

0.5

0.0

0.5

1.0

1.5

1.0

0.5

0.0

0.5

1.0

2.800

2.800

3.000

3.000

3.000

3.000

3.200

3.200

3.200

3.400

3.400

3.400

3.600

3.600

3.600

3.600

3.800

3.800

3.800

3.800

4.000

4.000

4.000

4.200

4.200

4.400

4.400

4.600

4.800

4.800

5.000

5.000

5.200

(b)

γ

= 0

.

5

1.5

1.0

0.5

0.0

0.5

1.0

1.5

1.0

0.5

0.0

0.5

1.0

2.800

3.000

3.200

3.400

3.400

3.400

3.600

3.600

3.600

3.800

3.800

3.800

4.000

4.000

4.000

4.200

4.200

4.200

4.400

4.400

4.600

4.600

4.800

4.800

5.000

5.000

5.000

5.200

5.200

5.200

5.400

5.400

5.400

5.600

5.600

5.800

6.000

6.200

6.400

6.600

6.800

7.000

7.200

7.400

7.600

7.800

(c)

γ

= 0

.

75

use clean accuracy, corruption robustness and adversarial robustness as the metric to measure the potential of BaSS strategy. Specifically, (i) the clean accuracy is evaluated on both CIFAR10 and CIFAR10-B test set. (ii) To evaluate the corruption robustness, we first construct a corruption version for CIFAR10-B, referring to the construction method of CIFAR10-C [20] and denotes as CIFAR10-B-C. We then calculate the mean accuracy across 19 corruption types and 5 severities from CIFAR10-C and CIFAR10-B-C. (iii) We perform PGD attack [30] with 20 steps and ℓ ∞ constraint ϵ = 1 / 255 , 2 / 255 , 4 / 255 , 8 / 255 to evaluate adversarial robustness.

CIFAR10-B as Data Augmentation. The results in Fig. 4 indicate that as the proportion of CIFAR10B images increases (from Fig. 4(a) to Fig. 4(c)), the model converges more on the high-frequency components (the black stars are closer to the local minimum). The results from Fig. 3(a), Fig.3(b) and Fig. 3(c) indicate that the data-augmented model achieves a better trade-off between robustness and accuracy. Specially, the corruption robustness is improved across all categories, further achieving a more balanced performance. The enhancement of adversarial robustness under small perturbation (e.g., ϵ =1/255, 2/55) is quite significant, with the improvement magnitude positively correlated with the mixing ratio. However, the issue of model robustness under large perturbations still remains.

CIFAR10-B as an New Dataset. The naturally trained model achieves a better robustness-accuracy trade-off on the CIFAR10-B than on the CIFAR-10 dataset, as shown in Fig.3(d). What attracts us is the improvement in adversarial robustness. From the more detailed results in the Appendix F.2.1, the performance of CIFAR10-B is superior to that of CIFAR-10 and all mixed datasets. Based on the anaylsis shown in the Appendix F.2.1, we observed that the model trained on the CIFAR10-B dataset has a more balanced gradient distribution across different frequency domains. This indicates that when facing adversarial attacks, the model's vulnerabilities aren't concentrated in the high-frequency direction of the image. As a result, the adversarial attack process needs to generate adversarial noise containing patterns from multiple frequency domains. This insight suggests that we use the CIFAR10-B dataset in place of the original dataset during the adversarial training process.

4.3 BaSS Working in Conjunction with Adversarial Training

Adversarial Training has been the most successful defense strategy, where models are explicitly trained to be robust in the presence of adversarial attacks [30, 2, 34, 45]. In this subsection, We utilize the BaSS strategy to modify the input image and train the models in conjunction with PGD-AT [30], TRADES [45] and MART [40].

Experiment Settings: We conducted experiments on the following three datasets: CIFAR10, CIFAR100 [25] and Restricted-ImageNet [12], using ResNet-18, WideResNet-34-10 [44] and ResNet50 [19] as backbone. We compare the performance of our method with the baseline defenses PGD-AT [30], TRADES [45], MART [40], and also state-of-the-art defenses DAJAT [2] and PORT [34] from the Robust Bench leaderboard [10]. To fairly evaluate each model, we assessed (a) clean accuracy (i.e., clean test data), robust accuracy under (b) PGD 20 attack, the PGD attack [30] with 20 steps and (c) AutoAttack(AA) [11]. The ℓ ∞ attack perturbation was bounded to ϵ = 8 / 255 with a step size of 2 / 255 in both the training and test processes of CIFAR-10 and CIFAR-100. For Restricted-ImageNet, ϵ = 4 / 255 with a step size of 1 / 255 . Detailed settings are available in the Appendix F.2.2.

Results . As shown in Tab. 1 and Tab. 2, by processing the dataset with BaSS strategy, our method consistently achieves a better robust-accuracy trade-off across datasets and architectures. Moreover, as shown in Tab. 3, our approach trained with WRN-34-10 achieves state-of-the-art performance compared with existing defenses on CIFAR10 and CIFAR100. Adversarial training has been observed to exhibit a more pronounced data hunger compared to natural training [2]. Existing defense methods that are capable of improving both generalization and robustness performance typically involve adversarial training on an enlarged training set [41, 18], which is accompanied by a substantial training overhead. It is worth noting that BaSS strategy barely increase the training cost (including the training time and the data size, comparison details are available in the Appendix F.2.2), and achieve a competitive performance. This further demonstrates the effectiveness of BaSS.

4.4 BaSS Working in Conjunction with AugMix

AugMix [21] generates complex and diverse images through data augmentation, improving the model's robustness to different types of corruption. Specifically, for the original data x , x augmix are generated by combining multiple simple data augmentation, then a consistency constraint is applied to the x augmix and x during the training process. Experiments typically involve two AugMix processes to obtain x augmix 1 and x augmix 2 . To verify that our method of increasing data information, BaSS, can be combined with the AugMix method, we perform BaSS operations on one of the augmented input data x to obtain x b and then perform AugMix to obtain x b augmix 1 . The model training process constrains the consistency of x , x b augmix 1 , and x augmix 2 .

Experiment Settings: We conduct experiments on CIFAR10 and CIFAR100, and utilize CIFAR10-B and CIFAR100-B in training process as mentioned above. We use various architectures including ResNet-50, WideResNet-40-2, DenseNet-29 [22], and ResNeXt [42]. During the testing phase, we

evaluated the clean accuracy on the test sets of CIFAR10 and CIFAR100, and assessed the corruption robustness on CIFAR10-C and CIFAR100-C [20] datasets.

Results . Our method further improves the performance of AugMix as shown in Tab. 4, achieving a better trade-off between generalization and robustness across all model structures. Different classes of corruption usually have their own frequency-domain characteristics [43], thus leads to a bias towards a certain type of corruption in existing defense methods (e.g., adversarial training and AugMix). Notably, our method significantly enhances the model's capabilities in defending against high-frequency patterns corruption (e.g., improving Noise corruption robustness by approximately 4%). This improvement enables the model to achieve a more balanced defense, indicating that our method has indeed enhanced in learning HFC.

We noticed that the BaSS strategy did not help the model's robustness in the "Digital" column of the in Tab. 4. Different types of perturbations usually act on different frequency bands of the image[43], bringing the challenge of diversity of frequency domain information. The Fourier heatmaps [43] show that the type of "Digital" corruption have a common feature: irregular range perturbations exist from low to high frequencies in the image. AugMix resists the above-mentioned irregular frequency band perturbations more efficiently by adopting random data augmentation strategies, producing images with better diversity in frequency domain information. The BaSS method we provided replaced one of the random data augmentation branches in AugMix, thus affecting the original performance of AugMix under the "Digital" type perturbations to some extent.

5 Conclusions

In this paper, we have gained a deeper understanding of the relationship between high frequency components (HFC) and model robustness by defining the frequency long-tailed problem. Observations and analyses have revealed that (i) the high sensitivity to HFC stems from the model's under-fitting behavior of HFC, (ii) the cause of the model's under-fitting behavior is attributes to the limited information content of HFC. Based on these insights, we have proposed a balanced spectrum sampling strategy (BaSS) that effectively improves the trade-off between robustness and accuracy when combined with different training paradigms. Our current results are mainly focused on the image classification tasks while we believe it is also rewarding to develop new techniques to other vision tasks. We also expect that this work could inspire a future explanations and defense method from model perspective such as, exploring model-side improvement that can work with BaSS strategy.

Acknowledgments

This work is supported by the Beijing Natural Science Foundation (No.JQ20023) and the National Natural Science Foundation of China (No. 61832002).

References

Antonio A Abello, Roberto Hirata, and Zhangyang Wang. Dissecting the high-frequency bias in convolutional neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 863-871, 2021.

Sravanti Addepalli, Samyak Jain, et al. Efficient and effective augmentation strategy for adversarial training. Advances in Neural Information Processing Systems , 35:1488-1501, 2022.

Alexei Baevski, Wei-Ning Hsu, Alexis Conneau, and Michael Auli. Unsupervised speech recognition. Advances in Neural Information Processing Systems , 34:27826-27839, 2021.

Jiawang Bai, Li Yuan, Shu-Tao Xia, Shuicheng Yan, Zhifeng Li, and Wei Liu. Improving vision transformers by revisiting high-frequency components. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XXIV , pages 1-18. Springer, 2022.

Christine L Borgman, Milena S Golshan, Ashley E Sands, Jillian C Wallis, Rebekah L Cummings, Peter T Darch, and Bernadette M Randles. Data management in the long tail: Science, software, and service. International Journal of Digital Curation , 11(1):128-149, 2016.

Mu Cai, Hong Zhang, Huijuan Huang, Qichuan Geng, Yixuan Li, and Gao Huang. Frequency domain image translation: More photo-realistic, better identity-preserving. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 13930-13940, 2021.

Alvin Chan, Yew-Soon Ong, and Clement Tan. How does frequency bias affect the robustness of neural image classifiers against common corruption and adversarial perturbations? In Proceedings of the International Joint Conference on Artificial Intelligence , pages 659-665, 2022.

Guangyao Chen, Peixi Peng, Li Ma, Jia Li, Lin Du, and Yonghong Tian. Amplitude-phase recombination: Rethinking robustness of convolutional neural networks in frequency domain. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 458-467, 2021.

Yiting Chen, Qibing Ren, and Junchi Yan. Rethinking and improving robustness of convolutional neural networks: a shapley value-based approach in frequency domain. Advances in Neural Information Processing Systems , 35:324-337, 2022.

Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670 , 2020.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML , 2020.

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A largescale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition , pages 248-255. Ieee, 2009.

Ranjie Duan, Yuefeng Chen, Dantong Niu, Yun Yang, A Kai Qin, and Yuan He. Advdrop: Adversarial attack to dnns by dropping information. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 7506-7515, 2021.

Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 7890-7899, 2020.

Lijie Fan, Sijia Liu, Pin-Yu Chen, Gaoyuan Zhang, and Chuang Gan. When does contrastive learning preserve adversarial robustness from pretraining to finetuning? Advances in neural information processing systems , 34:21480-21492, 2021.

Leon A Gatys, Alexander S Ecker, and Matthias Bethge. Image style transfer using convolutional neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2414-2423, 2016.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems , 34:4218-4233, 2021.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations , 2019.

Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. arXiv preprint arXiv:1912.02781 , 2019.

Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 4700-4708, 2017.

Edwin T Jaynes. Information theory and statistical mechanics. Physical review , 106(4):620, 1957.

Mahyar Khayatkhoei and Ahmed Elgammal. Spatial frequency bias in convolutional generative adversarial networks. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 36, pages 7152-7159, 2022.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N , 7(7):3, 2015.

Hao Li, Zheng Xu, Gavin Taylor, Christoph Studer, and Tom Goldstein. Visualizing the loss landscape of neural nets. Advances in neural information processing systems , 31, 2018.

Jiawen Li, Lu Meng, Zelin Zhang, and Kejia Yang. Low-frequency, high-impact: Discovering important rare events from ugc. Journal of Retailing and Consumer Services , 70:103153, 2023.

Zhiyu Lin, Yifei Gao, and Jitao Sang. Investigating and explaining the frequency bias in image classification. In Proceedings of the International Joint Conference on Artificial Intelligence , pages 717-723, 2022.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 , 2017.

Shishira R Maiya, Max Ehrlich, Vatsal Agarwal, Ser-Nam Lim, Tom Goldstein, and Abhinav Shrivastava. A frequency perspective of adversarial robustness. arXiv preprint arXiv:2111.00861 , 2021.

Gabriel Pereyra, George Tucker, Jan Chorowski, Łukasz Kaiser, and Geoffrey Hinton. Regularizing neural networks by penalizing confident output distributions. arXiv preprint arXiv:1701.06548 , 2017.

Rishi Rajalingham, Elias B Issa, Pouya Bashivan, Kohitij Kar, Kailyn Schmidt, and James J DiCarlo. Large-scale, high-resolution comparison of the core visual object recognition behavior of humans, monkeys, and state-of-the-art deep artificial neural networks. Journal of Neuroscience , 38(33):7255-7269, 2018.

Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? arXiv preprint arXiv:2104.09425 , 2021.

Jiachen Sun, Akshay Mehra, Bhavya Kailkhura, Pin-Yu Chen, Dan Hendrycks, Jihun Hamm, and Z Morley Mao. A spectral view of randomized smoothing under common corruptions: Benchmarking and improving certified robustness. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part IV , pages 654-671. Springer, 2022.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Kaihua Tang, Mingyuan Tao, Jiaxin Qi, Zhenguang Liu, and Hanwang Zhang. Invariant feature learning for generalized long-tailed classification. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XXIV , pages 709-726. Springer, 2022.

Yusuke Tsuzuku and Issei Sato. On the structural sensitivity of deep convolutional networks to the directions of fourier basis functions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 51-60, 2019.

Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 8684-8694, 2020.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations , 2019.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. arXiv preprint arXiv:2302.04638 , 2023.

Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 1492-1500, 2017.

Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. Advances in Neural Information Processing Systems , 32, 2019.

Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146 , 2016.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

Yifan Zhang, Bingyi Kang, Bryan Hooi, Shuicheng Yan, and Jiashi Feng. Deep long-tailed learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence , 2023.

Peer reviews:
comments: SUMMARY:
In this paper, the authors investigate the high-frequency components (HFC) in images from a long-tailed perspective. They revisit the relationship between HFC and model robustness and demonstrate that the cause of the model’s under-fitting behavior is attributed to the limited information content in HFC. A Balance Spectrum Sampling (BaSS) strategy, which effectively counteracts the long-tailed effect and enhances the model’s learning on HFC. Extensive experimental results demonstrate the effectiveness.

STRENGTHS:
1. Investigating the high-frequency components (HFC) in images from a long-tailed perspective for the model robustness task sounds good and very interesting.
2. The authors give detailed definitions and analysis of the frequency long-tailed scenario.
3. The proposed solution BaSS is simple and efficient.
4. Experiments are conducted on a various benchmarks.

WEAKNESSES:
1. To my end, the re-sampling/re-weighting method in the long-tailed situation generally improves the recognition ability of the tails at the expense of a portion of heads, does this phenomenon will weaken the recognition ability of LFC? 
2. Some typos, like:
    line 16, counteract -> counteracts
    line 17, enhance -> enhances

QUESTIONS:
1. Is this paper the first to analyze the problem of model robustness from the perspective of frequency long-tails?

LIMITATIONS:
The authors do not address the limitations in this paper.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-06-29

comments: SUMMARY:
This paper tackles the problem of visual models' robustness from the view of frequency components. Inspired by the long-tailed characteristic observed in frequency spectrum, the authors empirically prove that standardly trained models are sensitive to HFC. After analyzing its reasons, the authors proposed a sampling method and verified its effectiveness.

STRENGTHS:
1. The authors focuses on a novel perspective of long-tailed distribution in the frequency domain to analyze and improve model performance.
2. The paper provides interesting insights into this problem, revealing the underlying properties of the studied problem.
3. Abundant experiments and analysis are done. 
4. The paper is well-written.

WEAKNESSES:
I am not an expert in this area, thus my comments should be treated with caution.
1. Baseline comparisons: BaSS is a new sampling strategy, does there exist any other sampling methods for comparison? PGD-AT is from 2017 and is rather an old method.
2. It would be better to include: the difference in frequency distribution before and after BaSS is adopted.
3. Flaws in writing. E.g. Typo in Table 2 title.

QUESTIONS:
In Figure 2 second row, why does on Tiny-ImageNet and ImageNet (as opposed to CIFAR10), the tail ranking indices (e.g. "80%" and "Last one") have a high density in the high frequency area? This inconsistency may draw doubts on the generalizability of the conclusions the paper gets.

LIMITATIONS:
No. The authors should add it.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-06-29

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nUsing the long-tail features in the spectrum, this paper investigates the model's sensitivity to HFC and discovers patterns of underfitting behavior due to limited information content. The authors propose the Balance Spectrum Sampling (BaSS) strategy, which enhances model learning on HFC. Experimental results show that combining BaSS with existing defense methods improves model performance.\n\nSTRENGTHS:\n1. The paper introduces an interesting perspective by focusing on the long-tailed distribution in the frequency domain and revisits the relationship between high-frequency components (HFC) and model robustness.\n2. The under-fitting behavior is explained through the lens of spectral entropy, offering a clear understanding of the low information entropy of HFC.\n3. The proposed method achieves improved performance.\n\nWEAKNESSES:\n1. The paper lacks a discussion on the existing literature and its relevance to the topic in details, which could provide a stronger foundation for the research. The content in the Introduction section may not be sufficient.\n2. More experiments are needed to evaluate the proposed method:\n1) The proposed BaSS should be evaluated in combination with more baseline methods. For instance, MART[1] is a method that outperforms TRADES in performance. It would be insightful to see how BaSS performs when incorporated with such stronger baselines.\n2) The paper lacks a comparison with other methods, such as AWP[2]. It would provide a more comprehensive evaluation and analysis of the proposed approach.\n3. There are some small grammar mistakes in the paper. For instance, in the Abstract, it should be \"counteracts and enhances\" instead of \"counteract and enhance\" in lines 16-17. More attention should be given to checking the grammar details throughout the paper.\n\n[1] Improving Adversarial Robustness Requires Revisiting Misclassified Examples. ICLR2020\n[2] Adversarial Weight Perturbation Helps Robust Generalization. NeurIPS2020\n\nQUESTIONS:\n1. Is the proposed method also applicable to other visual models, such as Vision Transformer (ViT), in addition to CNNs?\n\nLIMITATIONS:\nNo potential negative societal impact", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies the effect of power imbalance across frequencies in natural image datasets on the accuracy and robustness of neural net classifiers, and empirically argues that the model is underfitted on frequencies with lower power concentration. Then, the paper proposes an augmentation strategy to improve the balance of power distribution per image, and evaluates its proposed method on several datasets and tasks to illustrate its effectiveness in boosting accuracy and robustness to data corruption and adversarial attacks.\n\nSTRENGTHS:\nStudying the effect of spectral power imbalance on the accuracy and robustness of neural networks is a novel and significant effort, and the paper provides several interesting experiments to provide insights into this effect. The proposed augmentation method seems to be effective, and works well in combination with other existing augmentations.\n\nWEAKNESSES:\nI think this is a valuable paper overall, however my main concern is a lack of clarity in its explanations and arguments, making several claims that seem incorrect and unjustified to me. Also, the experiments need better organization and more clear and nuanced explanations. I will elaborate my specific concerns and questions below.\n\n1. L115 claims “Inspired by the Pareto principle [34] in long-tailed theory, we propose a stable and quantitative approach”, the paper must be more specific on how the Pareto principle is inspiring the proposed approach and in what sense it is more stable, otherwise such broad statements hinder clarity and readability.\n\n2. Eq 2 set definitions are unclear because r_n is undefined. The explanation given in L117-120 is also unclear since “region” is undefined. Please be more careful and specific when writing definitions that form the foundation of a paper.\n\n3. L133 claims “On one hand, the tail part is often overlooked by the system due to its numerical disadvantage”, what does numerical disadvantage mean? Please be more specific in your statements.\n\n4. In Fig 1 and Section 3.1, the details of how the loss is computed separately for HFC and LFC are missing. Also the colorbar is missing.\n\n5. In Fig 2, top ranks having distributions centered towards the higher frequencies does not mean that the loss is most sensitive to higher frequencies. Please plot Gradient Magnitude versus Frequency Radius to directly observe which frequencies will have the largest effect on loss (largest average magnitude). If lower frequencies receive larger average magnitudes than higher ones, then it cannot be claimed that “perturbations in HFC are more easier to cause errors in the model” as is done in L198.\n\n6. Theorem 1 is just applying the formula plog(p) to the assumed density of p for natural images, this simple application does not need to be a theorem.\n\n7. The paper does not explain or cite why plog(p) is a sensible measure of information on the normalized spectrum (density of p). Note that the normalized spectrum does not have any immediate meaning as a probability distribution, it is a power density function. In particular, the claim in L223 that “This indicates that high-frequency bands in the tail contain substantially less information than low-frequency bands in the head” is misleading, since all that Theorem 1 indicates is that power is concentrated at lower frequencies which is immediate by the assumption on the density of p.\n\n8. Theorem 2 seems immediate from information theory. Could you explain why not simply state that the uniform distribution has maximum Shannon entropy instead of stating Theorem 2?\n\n9. The explanation of the BaSS in section 4.1 is not the same as shown in Algorithm 1 in the Appendix, in that there is no actual sampling happening in Algorithm 1, it is a reweighting of the spectrum based on the ratio of log power density over power density.\n\n10. In the experiments in Tables 1-4, the value of gamma is not specified. It is important to show an ablation study on gamma in all these settings (Fig 3 seems to be doing this, but it is unclear which plot is corresponding to which specific experiment setup from Tables 1-4). Also, the results lack error bars and therefore the significance of the improvements is unclear.\n\n11. Please include ImageNette in Fig 3 results to observe the effect of varying the dataset.\n\n12. In all Tables 1-4, reporting the standalone performance of BaSS is also important. Also, in some situations in Table 4 where BaSS does not help, it is important to comment on why that might be happening. \n\n13. Discussion of related works should be part of the main paper and not in Appendix.\n\n***Some typos***\n\nL1 claims “A widely discussed hypothesis regarding the cause of visual models’ robustness is that they can exploit human-imperceptible high-frequency components”, this seems to be a typo, “models’ lack of robustness” perhaps?\n\nL125: “has not yet to be fully explored” should be “has not been fully explored”.\n\nL136: “regards” be “regarding”.\n\nL321: “worth noted” be “worth noting”.\n\nQUESTIONS:\nSee the weaknesses section.\n\nLIMITATIONS:\nSee the weaknesses section.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-09"}

comments: SUMMARY:
This paper addresses the problem of model robustness, which is of great importance in the machine learning field. The authors revisit this problem and discuss the relationship between high-frequency components and model robustness. They verify the effectiveness of the proposed method on several datasets compared to other baselines.

STRENGTHS:
This paper addresses the model robustness problem, which is of great importance to the machine learning field.

The authors verify the effectiveness of the proposed method on several datasets compared to other baselines.

The proposed method is theoretically sound with supporting proofs.

WEAKNESSES:
How many times were these experiments conducted, and is it necessary to report the mean and standard variance of the results?

I noticed that the current experiments were mainly conducted on toy datasets, such as CIFAR or ImageNet subsets. What about scaling up the experiments to large-scale datasets in the real world?

The current experiments mainly focus on the PGD attack. Have you considered experimenting with other types of attacks to evaluate the performance of the proposed method in different scenarios? Additionally, apart from the single baseline PGD-AT, have you tested other baselines? Is the improvement consistent for all variants?

Although the proposed method is supported by theoretical proofs, it seems relatively naive. Further robustness analysis is needed for some hyperparameters in Eq. 4.

QUESTIONS:
(Just a remark) The figures in the supplementary materials are intuitive, and reorganizing the paper could improve its readability.

LIMITATIONS:
NA
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-10