Towards Combating Frequency Simplicity-biased Learning for Domain Generalization

Authors: xilin  he
jingyu  hu
qinliang  lin
cheng  luo
weicheng  xie
siyang  song
muhammad  haris khan
linlin  shen
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-10 18:48:25

Abstract: Domain generalization methods aim to learn transferable knowledge from source domains that can generalize well to unseen target domains. 
Recent studies show that neural networks frequently suffer from a simplicity-biased learning behavior which leads to over-reliance on specific frequency sets, namely as frequency shortcuts, instead of semantic information, resulting in poor generalization performance. 
Despite previous data augmentation techniques successfully enhancing generalization performances, they intend to apply more frequency shortcuts, thereby causing hallucinations of generalization improvement.
In this paper, we aim to prevent such learning behavior of applying frequency shortcuts from a data-driven perspective. Given the theoretical justification of models' biased learning behavior on different spatial frequency components, which is based on the dataset frequency properties, we argue that the learning behavior on various frequency components could be manipulated by changing the dataset statistical structure in the Fourier domain. 
Intuitively, as frequency shortcuts are hidden in the dominant and highly dependent frequencies of dataset structure, dynamically perturbating the over-reliance frequency components could prevent the application of frequency shortcuts.
To this end, we propose two effective data augmentation modules designed to collaboratively and adaptively adjust the frequency characteristic of the dataset, aiming to dynamically influence the learning behavior of the model and ultimately serving as a strategy to mitigate shortcut learning. Our code will be made publicly available.

Main paper: 
 introduction: 
 Previous studies have shown that the performance of deep neural networks usually degrades when processing previously unseen data whose distribution differs radically from the training data distribution, which largely constrains the deployment of well-trained deep models [11, 10] . Domain generalization (DG) aims to learn models with transferable knowledge, utilizing multiple source domains, that can generalize well to unseen test data to address this problem [19, 8] . In this paper, we focus on a more challenging scenario where only one source domain is available for training, namely as single source domain generalization (SDG) Deep models tend to learn the simplest solution (e.g. the specific class-wise most distinctive frequency bands) in classification tasks instead of the semantic cues. Our method proposes to adaptively modify the learning difficulty of different frequency components to prevent frequency shortcut learning..The domain generalization problem can be conventionally solved by learning domain invariant features [23, 7] , conducting adversarial training [20, 15] , employing meta-learning [4] or data augmentation [37, 16] . Among the proposed techniques, data augmentation is prone to be the simplest and the most effective one. Specifically, [12] proposes to mix various augmented version of images to enhance robustness. [16] proposes to generate diverse stylized samples to improve the generalization ability of neural networks. Recently, an interest in understanding the learning dynamic of neural networks to improve generalization has arisen [40, 26, 35, 31] . Neural networks are found to fit a function from low frequencies first in the regression task, which is widely known as F-principle [40] or spectral bias [26] . [28] reveal that neural networks tend to learn simple but effective patterns, such as the shortcut solutions that disregard semantics related to the problem at hand but are simpler to minimize the optimization loss, which leads to over-fitting and generalization performance degradation. With the generalization performance improvement brought by previous data augmentation techniques [12, 16] , it's widely believed that previous successful data augmentation techniques can effectively prevent shortcut learning. However, a recent study on frequency shortcuts [35] , which is the certain set of frequency bands used specifically to classify certain classes in classification task, empirically disproves this assumption. They have demonstrated that previous data augmentation techniques [12, 16] , despite gaining generalization performance improvement, learn more frequency shortcuts instead and cause the hallucination of generalization improvement.To this end, we aim to develop data augmentation techniques capable of preventing the learning of the frequency shortcuts, which are neglected by previous works and thereby achieving enhanced generalization performances. Since [24] has introduced a mathematical formulation demonstrating that the learning dynamics of neural networks are biased towards dominant frequencies of the statistical structure of the dataset, which maybe not necessarily low frequencies, the study [24] offers a theoretical basis for the manipulation of a model's learning behavior across different frequency components. In this paper, building upon the theoretical underpinning provided by [24] , we attempt to modify the frequency spectrum of the dataset statistical structure with aggressive frequency data augmentation, as this would affect the dominant frequencies of the dataset and thereby change the model's learning strength on different frequencies. By dynamically modifying the frequency property of the dataset, we would be able to adaptively manipulate model's learning behavior on various frequency components and thereby prevent the application of frequency shortcuts by suppressing the learning on the highly dependent frequencies. To this end, we propose two effective and practical adversarial frequency augmentation modules, i.e., Adversarial Amplitude Uncertainty Augmentation (AAUA) and Adversarial Amplitude Dropout (AAD). These modules are designed to effectively and aggressively alter the frequency characteristic, aiming to dynamically manipulate the model's learning behavior on over-reliance frequency components and ultimately help prevent the learning of frequency shortcuts. Our core contributions are summarized as follows:• Given the theoretical justification of neural network's learning behavior on frequency shortcuts, we propose two effective data augmentation modules, adversarial amplitude uncertainty augmentation module (AAUA) and adversarial amplitude dropout module (AAD) to dynamically and implicitly regularize and suppress the model's over-reliance to specific frequency bands, serving as the pioneering work to combat frequency shortcuts for domain generalization.• Our proposed method is evaluated under a variety of DG tasks and datasets, ranging from image classification to instance retrieval. The results show the superiority of the proposed augmentation algorithm over state of the arts (SOTAs). [20, 15, 21] with adversarial training [15, 29] or minimizing distance metrics between distributions [20, 21] . In addition, self-supervised learning [1, 17] and meta-learning [4, 30] have also been studied.Recently, data augmentation [50, 37, 51] , especially style augmentation [37, 51, 22, 16] , has been widely studied and shows appealing performances. L2D [37] diversifies image styles by playing a min-max game with mutual information. DSU [22] proposes to perform style augmentation in the feature level and augment feature statistics with uncertainty estimation to simulate the domain shifts.Rising methods resort to data augmentation in the frequency domain [41, 14, 38, 34, 43] . Represented by FACT [38] , the vast majority of the frequency augmentation methods resort to randomly swapping or mixing the amplitude spectrum maps within the same batch. SADA [43] proposes to inject adversarial perturbations into the amplitude spectrum maps, intending to suppress frequency sensitivity to gain generalization performance improvement. However, previous successful data augmentation techniques cannot successfully prevent the learning and application of frequency shortcuts despite gaining generalization performance improvement. Wang et. al. [35] demonstrate that data augmentation techniques such as AugMix [13] and style augmentation [37] surprisingly learn more frequency shortcuts and cause hallucinations of generalization ability improvement.Shortcut Learning: Shortcuts in classification tasks are known as the spurious correlations between the input data and ground truth labels, rather than the semantic information [5] . Since models that apply shortcuts tend to give predictions based on the presence of the specific shortcuts instead of the transferable semantic content of data, shortcut learning could damage the generalization ability of learned models. Recent studies look into the frequency domain to understand the shortcut learning behavior. [38] prove that neural networks tend to fit a function from low-frequencies priorly and then higher frequencies in the regression tasks, which is known as the F-principle. [24] mathematically formulated the finding that the neural network's learning behavior is biased towards the dominant frequencies of the dataset and could be manipulated. [35] demonstrate that models' learning order of different frequency components in the classification tasks is data-driven and models tend to learn the simplest and the most class-wise distinctive frequency components to give predictions, which is known as the frequency shortcut learning. They further reveal that previous successful data augmentation techniques cannot prevent the learning and application of frequency shortcuts. 
analysis: 
 In this section, we provide clarification on the definition of the discussed 'frequency' in this paper and a theoretical analysis of network's learning behavior on frequency components following [24] .Clarifying the definition of frequency. It is worth noting that wide misconceptions between spatial frequency and responsive frequency exist in the research community. We would have to emphasize that the frequency discussed in this paper is not the same as the frequency discussed in the wellknown F-principle [40] and spectral bias [26] . The frequency discussed in this paper is the nature of the image data itself, known as spatial frequency, which is the characteristic of the image data processed by Fourier transformation. In contrast, the term "frequency" in F-principle [40] and spectral bias [26] refers to the concept of responsive frequency or function frequency. This term describes the characteristics of the mapping function learned by networks, which transforms input images into probability vectors. It signifies the smoothness of the learned mapping by the trained networks.Learning behavior on frequencies. Since the two frequency definitions are different, the claim that networks prefer to learn low frequencies first [40] does not necessarily hold true. The claim holds true for responsive frequency. As for spatial frequency, frequency components that the model prioritizes to learn are not necessarily low-frequency components but are determined by the dataset's properties [24] . However, in real-world datasets, as low-frequency components are often the main contributors to the Fourier spectrum of the singular vectors to a dataset's statistical structure, neural networks might prioritize learning low-frequency components of images in most cases.Tasks of concern. Previous works on the responsive frequency focus on the regression task. In contrast, this paper aligns with recent studies on spatial frequency [35] , which mainly focus on the classification task.In this section, we refer to the theoretical observation from [24] as the justification for the provability of manipulating the model's learning behavior on various frequency components and preventing frequency shortcut learning.Preliminaries. For the sake of clarity, we first provide descriptions of basic variables.(i) Two-dimensional images are vectorized to 1 × n 2 .(ii) To represent the statistical structure of a dataset with p classes, following Pinson et. al. [24] , a p × n 2 input-output correlation matrix Σ yx is adopted. Given one-hot encoded ground truth labels y, each row of Σ yx contains the average of images in the corresponding class. The input-input correlation matrix Σ xx and prediction-input correlation matrix Σ ŷx is similarly defined.(iii) In an SVD basis, Σ yx can be decomposed as Σ ŷx = U SV T , where S and V contain the singular values and right singular vectors, respectively. The first p rows of V T , denoted as ϕ α , α ∈ 0, ..., p -1, are the principal components of the dataset structure. In the SVD basis of Σ ŷx , the prediction-output matrix Σ ŷx can be decomposed in a way similar to SVD with U and V T as Σ ŷx = U AV T . s α and a α denote the α-th diagonal elements in S and A, respectively.Data-driven frequency learning behavior. For the learning dynamics of networks, the learning behavior is biased toward the frequencies that are dominant in the Fourier spectrum of the singular vectors derived from the statistical structure of a dataset. This is mathematically formulated as [24] :EQUATIONwhere Q and r denote the vectorized 2D discrete Fourier transformation and the convolution kernel in a network. j and c denote the indices of the frequencies contributing to ϕ α and an irrelevant constant representation for simplicity, respectively. In Eq. 1, s α can be considered as the input, while (Q r) j represents the Fourier coefficients of the kernel r, indicating the kernel's reliance on the j-th frequency. As analyzed by Pinson et al. [24] , when the convolution kernels are initialized with small values, a α and (Q r) j would be small. In this case, the learning dynamic is mainly driven by the frequency property of the dataset structure (Q ϕ α ) j . Thereby, the model would be highly dependent on the dominant frequencies that contribute most to the singular vectors ϕ of the dataset.Risk of applying frequency shortcuts. Intuitively, in the natural image datasets, strong correlations between patterns could exist. These kinds of correlations could exhibit themselves in the statistical structure of the datasets, and thereby be picked up by the networks during the learning process [5] . Given the formulated biased learning behavior in Eq. 1, the focus of learning is biased toward frequency components that are dominant in the singular vectors of the Fourier spectrum of the dataset.As it is acknowledged that specific frequency components beneficial for the classification task in specific domains [5, 35] are outstanding in the dataset structure, a model directly trained on these images might take the risks of being over-reliance on these frequency components.Recently, [35] has highlighted a tendency in networks to leverage shortcuts of frequencies that are specific and highly discriminative frequency components across classes, rather than semantic cues. This frequency shortcut learning phenomenon is evidenced in Eq. 1, which shows that the learning process prioritizes frequency components specific to the singular vectors of Σ yx with higher singular values [24] . Consequently, the model captures the most discriminative frequency components in the spectrum of the dataset structure, potentially leading to the adoption of frequency shortcuts.Leveraging the learning behavior as a shield against frequency shortcuts. As the learning behavior in Eq. 1 is mathematically defined, it would be difficult to go against it with a fixed dataset structure. However, if the model is deemed to capture frequency shortcuts hidden in the dominant frequencies on a static dataset, natural questions emerge: Can we adaptively modify the dataset to reduce the possibility of frequency shortcuts by leveraging a biased frequency learning rule? Can we construct a dynamic dataset to modify its frequency property in each learning iteration?Motivation in preventing frequency shortcuts. To this end, this paper attempts to combat the frequency shortcut learning by dynamically modifying the frequency characteristic of the dataset structure. As shown in Eq. 1, the gradient is dynamically influenced by the highly coupled interplay of dataset frequency characteristics and model weight. Given the dynamic and decoupled learning process in Eq. 1, we attempt to make use of adversarial learning to bridge between model weight and the dataset frequency characteristics.To effectively remould the spectrum map of the dataset structure, we propose to conduct aggressive augmentation on the frequency spectrum, instead of simply injecting noises. Further, different from prior frequency augmentation methods [43] , this paper utilizes adversarial gradients w.r.t. the amplitude spectrum maps to locate the over-reliance frequency components, instead of following simple assumptions to mask specific frequency bands. However, it could be technically difficult to directly manipulate the frequency characteristic of the whole dataset statistical structure due to computational resource constraints when backpropagating on the entire dataset. Therefore, we propose two specific in-batch adversarial frequency augmentation modules to effectively modify the dataset frequency characteristic. 
methodology: 
 The main goal in single source domain generalization is to train a model f on a source domain, which should generalize well in various previously unseen target domains. We denote the source domain as D S = {(x, y)}, x ∈ R W ×H×C is a source image, W , H and C are the width, height and the number of channels of source images and y is the corresponding label.For convenience, we use F(•) to denote Fast Fourier Transformation (FFT). A(•) and P (•) denote the calculation of amplitude and phase, respectively. In the following sections, we propose the module of Adversarial Amplitude Uncertainty Augmentation (AAUA) and its complementary module of Adversarial Amplitude Dropout (AAD).As low-frequency components are the main contributors in natural image datasets, to effectively modify the frequency spectrum of dataset structure, we propose to inject adversarial noises into the low-frequency components. Instead of directly injecting noises [43] into the frequency spectrum map, we propose to combine adversarial learning with instance normalization to craft aggressive augmentations to effectively disrupt the overall dataset structure and thereby prevent the learning of frequency shortcuts hidden in the low-frequency components.Different from previous frequency augmentation methods [43, 34] that treat each amplitude spectrum map as deterministic values, we hypothesize that statistics of each low-frequency part of amplitude spectrum maps are samples drawn from a Gaussian distribution, based on which we adversarially draw new statistics to reconstruct the augmented low-frequency spectrum maps to properly model the uncertainty of domain shifts rich in diversity and hardness.Adversarial low-frequency component transformation. Given a batch of input images {x (k) } B k=1 , where B denotes the batch size, we first obtain the amplitude spectrum maps. We employ M low and M high = 1 -M low as the masks to separate low-frequency and high-frequency components as:Mlow(i, j) =    1 if i ∈ [hmin,hmax], j ∈ [wmin, wmax] 0 otherwise (2)whereh min = ⌊(1 -λ)H/2⌋, h max = ⌊(1 + λ)H/2⌋, w min = ⌊(1 -λ)W /2⌋ and w max = ⌊(1 + λ)W /2⌋denote the lower and upper bounds to obtain height and width of low-frequency mask. ⌊⌋ denotes the round-down operator. λ controls the size of the mask. As it would be difficult to precisely determine which band is low-frequency or not, λ is drawn from a uniform distribution U (0, 0.5). Then, we calculate the channel-wise statistics of the low-frequency part following:             µ(A(x)) = 1 λ 2 HW hmax ∑ i=h min wmax ∑ j=w min A(x)(i, j, :) σ(A(x)) = 1 λ 2 HW hmax ∑ i=h min wmax ∑ j=w min [A(x)(i, j, :) -µ(A(x))] 2 (3)where µ and σ denote mean and variance, respectively. We further use the standard deviations of these channel-wise statistics for the uncertainty estimationEQUATIONwhere x (k) and E b (•) denote the k-th image in a batch and the expectation operator within this batch. Then, augmentation-related statistics are updated following:EQUATION)where d µ t and d σ t control the intensity and direction of the adversarial perturbations to the channelwise mean and variance at the t-th iteration of AAUA, which are to be optimized. ⊙ denotes the Hadamard product. Then the augmented amplitude is derived as:EQUATIONwhere A low (x) = A(x) ⊙ M low denotes the low frequency parts of A(x). We can formulate the t + 1-th optimization step of adversarial channel-wise statistics control factors {d µ t+1 , d σ t+1 } as:EQUATIONwhere x AAUA = F -1 (A AAUA , P (x)) is generated with augmented amplitude A AAUA and original phase P (x) by Inverse Fast Fourier Transformation (IFFT) F -1 , and sign(), ∇ and L task denote the sign function, gradient operator and the task-related loss for adversarial gradient calculation, e.g. cross-entropy loss for image classification. We use the above optimization for T steps to generate the AAUA-augmented image x AAUA .Despite AAUA shifting the network's attention away from the low-frequency components, it may lead to models' over-fitting into the imperceptible noises hidden in high-frequency bands, leading to a decline in models' generalization abilities. Therefore, to prevent the learning of frequency shortcuts in the high-frequency components, we further propose an Adversarial Amplitude Dropout (AAD) module to adaptively modify the frequency spectrum maps with backward gradients to estimate the model's frequency characteristics, which allow us to dropout the highly dependent frequency components to remove the learned frequency shortcuts.Different from prior frequency masking methods [14, 41] that simply mask specific bands, we attempt to adaptively mask the over-reliance frequency bands. To locate the critical frequency bands, inspired by [43, 2] , we utilize the gradients w.r.t. amplitude as the surrogate of model's frequency sensitivity map across frequency bands:EQUATIONSince the larger magnitude of these gradients represents a stronger sensitivity to the corresponding frequency band, a larger probability of this frequency band is preferred to be dropout. Further, to craft more augmented samples with various learning difficulties, a random threshold for dropping frequency bands is introduced. Thereby, we generate a dropout mask with the amplitude gradients g a and a random threshold p drawn from a uniform distribution U (0, 1) following:EQUATIONwhere M AAD (i, j) denotes the mask value at the coordinate of [i, j] and min max mapping s(x) = (x -max(x))/(max(x) -min(x)). Then the dropout amplitude is derived by Hadamard product:EQUATION)where A AAD (x) denotes the dropout amplitude of image x. We further obtain the augmented sample x AAD with dropout amplitude and the original phase through IFFT following:EQUATIONwhere F -1 denotes the IFFT. For clarity of narrative, the pseudo-code of generating augmentation samples and samples generated by AAUA and AAD are shown in the supplementary material.To further regularize the prediction consistency between benign and augmented images, a Jensen-Shannon divergence consistency loss L JS [13] is also adopted. Therefore, we can formulate the total training loss as:EQUATION)where L task denotes the task-related loss, e.g. cross-entropy loss for image classification and instance retrieval. Both of the proposed modules generate augmented images for training in each iteration.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: Detailed implementation details to reproduce the main experimental results are provided in the appendix. The code would also be made publicly available after peer review.Guidelines:• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. , with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.• The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 10. Broader Impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [NA] Justification: There is no societal impact of the work performed. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
experiments: 
 We first conduct cross-domain image classification and instance retrieval experiments to study the proposed method's performance. We compare our method with traditional data augmentation based methods [13, 33, 39] , image-level style augmentation based methods [25, 37] , feature-level style augmentation methods [45, 22, 44] , two most relative frequency augmentation-based methods [38, 43] and other representative methods [23, 1] . Then we evaluate the frequency shortcuts following Wang's metric [35] . We further provide insights into models' data-driven frequency characteristics with the proposed AAUA and AAD. We also carry out detailed ablation studies. Datasets for image classification and instance retrieval: We evaluate the performance of the proposed method on three cross-domain image classification benchmarks of PACS [19] , Digits and CIFAR-10-C [10] . We conduct the cross-domain instance retrieval task on person re-identification (re-ID) datasets of Market1501 [47] and DukeMTMC [27] with OSNet [48] .Implementation Details In all the experiments, we set the iterative optimization steps T of AAUA as 5. For a fair comparison, the number of augmented samples used in each iteration is set as 3, following [43] . We adopt the same network architectures in previous works [43, 44] . Please see the supplementary material for more implementation details.We conduct experiments of cross-domain image classification and person re-ID in five benchmarks. models trained with our generated data obtain significant generalization performance improvement (Tab. 1). Specifically, our method outperforms SADA [43] and FACT [38] with large margins of 2.20% and 8.81% in PACS. Following [45, 44] , we conduct cross-domain instance retrieval of person re-ID task on Market1501 [47] and DukeMTMC [27] . Experiment results are shown in Tab. 2. Our method outperforms previous SOTA StyleNeophile [16] with a large margin, boosting the mAP on Market→Duke from 29.7 to 33.8, further validating the effectiveness of the proposed method.Wang et al. [35] propose to use TPR and FPR on the dominant frequency maps (DFM) filtered test sets of ImageNet-10 to evaluate how many frequency shortcuts the classifier is induced to learn and apply. Semantic information of DFM-filtered samples is severely damaged. In this paper, we use the average of class-wise TPR and FPR on the DFM-filtered test sets of ImageNet-10 to quantify how many frequency shortcuts are applied. Higher TPR and FPR values indicate that more frequency shortcuts are applied. Samples from the DFM-filtered test set are shown in the supplementary material.The frequency shortcuts quantitative results of the standard network of ResNet-18, AugMix, style augmentation and ours are shown in Tab. 3. As shown in Tab. 3, the combination of AAUA and AAD effectively suppresses the learning of frequency shortcuts, while previously successful data augmentation techniques apply more frequency shortcuts, causing the hallucinations of generalization ability improvement. It's worth noting that when AAUA or AAD is solely applied, the model achieves more frequency shortcuts. As AAUA solely perturbates the low-frequency components, leaving high-frequency components unchanged. Hence, using AAUA alone, without AAD, may lead to exploring frequency shortcuts in high-frequency bands. To validate that modifying the frequency property of the dataset structure could indeed affect the model's preferences on various frequency components, we further show the frequency sensitivity of baseline models and models trained with our method. Following Zhang et al. [2] , we obtain frequency sensitivity maps with backward gradients w.r.t amplitude spectrum maps as surrogates of model's frequency sensitivity. It's worth noting that the frequency sensitivity maps are derived after a softmax function. Therefore, it would only show relative sensitivity across frequency bands, but not indicate the application of frequency shortcuts.To validate the effectiveness of modifying the dataset frequency property with AAUA, we further compare the hardness between previous in-batch mixing frequency augmentation methods (e.g. FACT [38] ) and our proposed AAUA. As shown in Fig. 3 (b), we use one sample in the source domain to generate sufficient augmented samples. Compared with in-batch mixing methods, feature embeddings of samples generated with the proposed AAUA span across different domains and are further from the source domain, indicating that the proposed AAUA generates augmented samples with greater hardness and diversity. We conduct ablation studies in Tab. 4 on the proposed adversarial frequency augmentation modules to study the performance of each component in the proposed method. As shown in Tab. 4, the generalization performance on PACS dataset degrades by 1.44% or 4.00% without the proposed AAD or AAUA module, validating the effectiveness of the proposed augmentation modules. Analysis of the iterative optimization steps T in AAUA and the proportion of augmentation modules' impact on the generalization performance is shown in the supplementary material. 
conclusion: 
 In this paper, we attempt to counteract models' simplicity-biased learning behavior of applying frequency shortcuts from the perspective of data-driven and learning difficulty, with previous successful data augmentation techniques failing to do so. Since neural networks take up the simplest and the most class-wise distinctive frequency patterns as frequency shortcuts, we propose to adaptively modify the learning difficulty of different frequency components by combining adversarial training with instance normalization (AAUA) and dropout operation (AAD) in the frequency domain. By effectively preventing the simplicity-biased learning of frequency shortcuts and manipulating the trained models' frequency characteristics, the experimental results on five public benchmarking datasets ranging from classification to instance retrieval demonstrate the superiority of our method.Limitations and future work. Despite the proposed method indirectly preventing frequency shortcuts from a data-driven perspective, the direct location of frequency shortcuts remains a challenging problem with no effective solutions in the field. In the future, we would like to investigate more essential properties of frequency shortcuts to help locate them effectively and thereby introduce more effective techniques combating frequency shortcuts. Meanwhile, the robustness of the metric for frequency shortcut evaluation is yet to be explored in the future. 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA]Justification: The paper does not pose safety risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: Citations are made properly.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. 
 
 Appendix: In this section, we provide more experiment results in cross-domain classification tasks and gradients w.r.t. amplitude to analyze model's learning behavior on different frequency components.We provide detailed single domain generalization performances in Digits, PACS and CIFAR-10-C in Tabs. 5, 6 and 7, respectively. In this section, we provide more visualizations on feature manifold, t-SNE visualizations, generated augmented samples and dominant frequency maps (DFM) filtered samples.To intuitively show the augmentation space of different methods, we provide feature manifold visualization of images from the source domain with different augmentation variants. As shown in Fig. 4 , both the proposed AAD and AAUA explore a border augmentation space compared with the conventional in-batch mixing method [41, 38] .To study the distributions of features for the source and target domains, we provide more t-SNE visualizations of model trained with proposed methods in Fig. 5 . One can see that large overlapping areas exist between the source and the unseen target domains, indicating the superiority of the proposed method in exploring wider augmentation space.To give an intuitive perception of how our approach affects the images, we provide visualizations of benign images drawn from the PACS dataset and their corresponding augmented samples generated by AAUA and AAD in Fig. 6 .In this section, we provide benign samples drawn from ImageNet-10 and their corresponding ones with DFM-filtered out in Fig. 7 .Figure 4 : Feature manifold of images from source domain, AAD, in-batch mixing [41, 38] and AAUA. t-SNE [32] is used in this visualization.Photo Art Painting Photo Cartoon In the task of cross-domain image classification, for Digits, we train a convolution network with the same architecture in [49] with a SGD optimizer for 60 epochs. The initial learning rate is 0.001, which decays by the ratio of 0.1 for every 20 epochs. All the grey images are converted into RGB images. For PACS [19] , we train an ImageNet pretrained ResNet-18 [9] on the source domain with an Adam optimizer for 60 epochs. The initial learning rate is 0.0001, which follows a cosine annealing decay strategy. For CIFAR-10-C, we train a Wide Residual Network [42] with a width factor of 4 and 16 layers following previous works [10] . The network is optimized with a SGD optimizer for 120 epochs, with an initial learning rate of 0.1 which linearly decays by 0.1 every 40 epochs. Models are trained on CIFAR-10 [18] dataset and evaluated on CIFAR-10-C dataset with corruption severity level of 5. All the experiments are run on a Nvidia A100 80GB.In the task of cross-domain instance retrieval, we adopt the OSNet [48] pretrained on ImageNet, following experiment settings in [45, 44] . The network is optimized with an Adam optimizer for 60 epochs, with an initial learning rate of 0.0003 which linearly decays by 0.1 every 20 epochs. In this section, we discuss how to obtain model's frequency sensitivity maps. We utilize gradients as a surrogate of model's sensitivity to different frequency bands, following:EQUATIONwhere A(•), N , x (i) and y (i) denote the obtained amplitude spectrum map, number of images in the dataset, the i-th image from the datset and its label, respectively. G ∈ R H×W ×3 . We then calculate the mean of G across the channels, following :EQUATIONWe further scale the absolute value of Ḡ element-wise to the range between 0 and 1 to obtain the frequency sensitivity maps:EQUATION)where s is the min max mapping, which is defined in Eq. ( 10) of the main body, and M F S denotes the frequency sensitivity map. In this section, we discuss how to obtain the quantity of frequency contribution (FC). Specifically, FC is formulated as the normalization of Ḡ in Eq. ( 14) as:EQUATIONwhere Ḡn denotes the frequency contribution of the whole amplitude spectrum map. To further obtain the low, medium and high frequency contributions, masks for extracting corresponding frequency components are formulated as followsEQUATIONEQUATIONM high (i, j) = 1 -M mid (i, j) -M low (i, j) (19) where M low , M mid and M high denote the masks specific to the low, medium and high frequency components, respectively. D low and D mid denote the distances for distinguishing different frequency components. Since the area of low frequency components is relatively small and to obtain equal size of medium and high frequency areas, D low and D mid are set as 10 and 90 for PACS. Then the frequency contribution is obtained by:EQUATION)where F C low , F C mid and F C high denote frequency contributions of low, medium and high frequency components, respectively.In this section, we conduct hyperparameter analysis on λ, which controls the size of the low frequency mask in AAUA. Experiment results are shown in Fig. 8 (a). As λ increases, generalization performances first increase. When the perturbated area continues to expand, the injected adversarial noises could harm the stability of the generalized medium frequency components, leading to performance degradation.Answer: [No] Justification: The main theoretical observation is referred from Pinson et al. [24] , the theoretical analysis part serves as a motivational study. Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems. • The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 


Decision: The paper received mixed ratings at the first place. After discussion, Review szDc, who gave the most negative rating, changed his/her mind to increase the score to 5. leading to all positive, borderline accept ratings. After carefully reading the paper and all the rebuttal, the decision is a borderline acceptance. While the average score is not high enough, the paper truly has some merits, including novel problem setting, sufficient theoretical analysis, and compeling experimental results. The following is a summary of the review.

Reviewers acknowledge the innovative approach of using adversarial frequency augmentation techniques, AAUA and AAD, to mitigate frequency shortcuts in neural networks and improve domain generalization (reviewer uwHe, 57HS). However, the paper is criticized for lacking detailed explanations of the computational complexity, hyperparameter sensitivity, and training costs associated with the proposed methods (reviewer uwHe). Additionally, the experimental design and presentation are seen as problematic; the clarity of implementation details is insufficient, with arbitrary design choices and unclear motivations for some decisions (reviewer jMvT). The evaluations are limited in scope, involving only small datasets and missing comparisons with relevant frequency augmentation techniques, which undermines the generalizability and applicability of the findings (reviewer szDc). Moreover, inconsistencies in the theoretical justification and an unclear distinction from prior work further weaken the contribution (reviewer szDc). The writing and structure also need improvement, as the presentation is difficult to follow and lacks coherence in explaining the experimental results (reviewer jMvT). 

Overall, while the idea of addressing frequency bias in domain generalization is recognized as valuable.

Reviews: review: paper_summary: paper_summary: This paper aims to develop data augmentation techniques to prevent the learning of frequency shortcuts and achieve enhanced generalization performances. They modify the frequency spectrum of the dataset statistical structure with aggressive frequency data augmentation, aiming to adaptively manipulate the model’s learning behavior on various frequency components. This paper proposes two effective and practical adversarial frequency augmentation modules, AAUA and AAD, designed to alter the frequency characteristic and prevent the learning of frequency shortcuts.
strength_weakness: strength_weakness: 1.According to Figure 2, you used the AAUA and AAD networks for data augmentation. We would like to know the parameters and time complexity of the AAUA and AAD networks. Has the increase in parameters led to improved effectiveness? Do we still need to train your networks separately? How does the training time compare to that of the main network? Can we directly use the pre-trained parameters you provide for most networks?  
2. There are currently many research methods such as splicing, augmentation, mixup, cutmix, Mosaic, etc. How is their performance in terms of frequency? What is the difference between them and yours?  
3. The paper [1] elucidates that certain components of frequency are not conducive to network generalization, and therefore adaptive filtering out some frequencies may have additional effects if the remaining frequencies are enhanced. What are the differences between your paper and [1]? Can you compare it with [1]?  
[1] Deep frequency filtering for domain generalization[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2023: 11797-11807.
questions: questions: Please see the Weaknesses.
limitations: limitations: Please see the Weaknesses.
paper_summary: paper_summary: The paper proposes a method for single source domain generalization. The method is based on the insight of countering frequency shortcuts learnt during training. The paper proposes to augment images in the Fourier domain to achieve this. Such augmentation is done adversarially, by changing the mean and variance of low frequency components to maximize the loss on such samples, and by adversarially dropping some frequencies based on their gradients. The method is benchmarked on a variety of classification and retrieval tasks, and superior performance is demonstrated.
strength_weakness: strength_weakness: * The writing seems a bit belabored and hard to follow. The paper's presentation can be helped by a thorough rewrite, focussing on the grammar and readability.
* Some of the implementation and experimental details are not clearly mentioned. See list of questions below.
* Some of the design choices seem arbitrary, and I was not able to follow the motivation for them. See list of questions below.
questions: questions: * The choice of using AAUA only for low frequency components and AAD mainly for higher frequency seems a bit arbitrary. One could apply AAUA on both components, or only on high frequency components as well. Do the authors have an intuition/justification on whether this would work better?
* What is the JS loss over? Is it consistency between predictions on augmented and clean samples?
* The experimental setup is not clear enough - what are the training domains in Table 1? Was the experiment run multiple times? How were the hyper-parameters for each method chosen (i.e. was there an external validation set?) What is the in-domain accuracy (i.e. does AAUA hurt in-domain performance a lot)?
* Fig 3 is hard to follow. What is the conclusion from Fig 3(a)? 
* In Fig.5, what do baseline tSNE plots look like?
limitations: limitations: The authors have adequately addressed their limitations.
paper_summary: paper_summary: The paper addresses the challenge of domain generalization by focusing on the issue of frequency simplicity-biased learning in neural networks. This phenomenon leads to an over-reliance on specific frequency sets, known as frequency shortcuts, instead of semantic information, thereby impairing generalization performance. The innovative data augmentation techniques adaptively manipulate the learning difficulty of different frequency components, thereby enhancing domain generalization performance by combating frequency shortcut learning.
strength_weakness: strength_weakness: The effectiveness of AAUA and AAD might be sensitive to the choice of hyperparameters, such as the intensity of adversarial perturbations and the threshold for frequency dropout. The paper does not provide an in-depth analysis of the sensitivity of the results to these hyperparameters. The proposed adversarial frequency augmentation methods, AAUA and AAD, involve iterative optimization steps and adversarial gradient computations, which could be computationally expensive.
questions: questions: Why did you choose the specific baselines for comparison, and how do you think your methods would perform against other recent or diverse approaches?
What is the computational overhead associated with implementing AAUA and AAD?
limitations: limitations: The authors acknowledge the challenge of directly locating frequency shortcuts. Providing preliminary insights or future directions on how to address this limitation would be a constructive addition. This could involve discussing potential methods for identifying and mitigating these shortcuts more directly.
paper_summary: paper_summary: This paper proposed an augmentation technique in frequency domain, motivated by the phenomenon of frequency bias/frequency shortcut learning. The technique AAUA adversarially perturbs frequency components of images  which the models over-rely for classification. As AAUA might encourage shortcut learning in high-frequency, the authors further use AAD to drop out randomly frequency components that models highly depend on for classification. AAUA and AAD together can avoid frequency shortcut learning. It is shown that AAUA and AAD together can improve domain generalization capability of models.
strength_weakness: strength_weakness: 1. The first and second contribution points can be merged for a compact presentation. Moreover, whether this is the first work to combat frequency shortcuts for domain generalization is uncertain. Domain generalization is a broad topic, and it includes single-source domain generalization problem, e.g. training models on a clean dataset and evaluate them in a corrupted dataset. And the [1] focuses on reducing frequency shortcut learning to improve model robustness towards image corruptions, one of domain generalization problems. 

2. As this work proposed a frequency augmentation technique, there are more related work despite FACT and SADA mentioned in the paper, such as VIPAug [2], AFA [3], HybridAugment++ [4], etc. 

3. Vague statement: line 327-328: it is uncertain how the comparison is operated given the condition 'without the proposed AAD or AAUA module'. One has to calculate on their own to figure out the comparison is between AAD+L_JS and AAD+AAUA+L_JS, and AAUA+L_JS and AAD+AAUA+L_JS. 

4. Sec. 3.2 Theoretical justification is from others' work, motivating the design of the techniques but not having direct mathematical relationship with the proposed technique.  The input-input correlation matrix is introduced but not used.  Strictly speaking, Sec. 3 is more like a literature review explaining motivations instead of analysis carried out by the authors. 

5. Definition of the masks separating low and high frequency components: h_min of M_low is H/4, meaning that for frequency components close to the center will be considered as high-frequency, conflict to what is considered as low-frequency. This needs more clarification on why h_min is not 0. Same for w_min.  From the definition of M_low, AAUA seems to shift models' attention to partial mid-high frequencies. 

6. Experiments need to be comprehensive: 

*As AAUA and AAD augment images in the frequency domain, comparison with more other frequency augmentation techniques should be included, such as HybridAug++ [4], VIPAug [2], AFA [3], DFM-X [1], AugSVF [5]. 

*The experiments are limited to small datasets, with a few classes. It lacks comprehensive experiments on large datasets, e.g. ImageNet-1k with 1000 classes, to show the feasibility of the proposed technique as well as a fair comparison with other methods which provide results on ImageNet-1k. 

*Some results in Table 1 are missing and there lacks explanations. 

*In Sec. 3.1 the authors claimed that they focus on classification tasks. However, they abruptly show results on instance retrieval. It is understood that domain generalization is important to instance retrieval. But there needs more clarifications on how the proposed technique can address frequency shortcut learning in retrieval tasks when there are not many work analyzing shortcut learning in image retrieval. 

*Sec. 5.3 evaluates frequency shortcuts of trained models. Intuitively, the analyzed models are those trained in Sec. 5.2. However, the evaluation is carried out on ImageNet-10, which is not mentioned previously and not used for training. It is unclear at this stage whether the authors use the models trained in Sec. 5.2 for shortcut evaluation on the dataset ImageNet-10, or train new models on ImageNet-10 for shortcut evaluations. This needs clarifications.

*Sec. 5.4.1 demonstrates that the proposed augmentation technique increases the frequency sensitivity of models compared to baseline. This seems to be a bad sign to model generalization capability according to [43]. However, there is no related discussions and Fig. 3a is not referred anywhere in the main paper. 

*Sec. 5.4.2 analyzes the hardness of augmented samples. However, the comparison is between AAUA and FACT, which seems unfair as FACT does not include adversarial setup while AAUA does. 

Minor: 
Each formula should end with period/comma. Line 271 'relative' should be 'related' if understood correctly. Table 3 not in the same page where mentioned. Table 4 exceeds width limit. 

[1] Wang, et al., 'DFM-X: Augmentation by Leveraging Prior Knowledge of Shortcut Learning', ICCVW2023.

[2] Lee, et al., 'Domain Generalization with Vital Phase Augmentation', AAAI2024.

[3] Vaish, et al., 'Fourier-basis Functions to Bridge Augmentation Gap: Rethinking Frequency Augmentation in Image Classification', CVPR2024.

[4] Yucel, et al., 'HybridAugment++: Unified Frequency Spectra Perturbations for Model Robustness', ICCV2023.

[5] Soklaski, et al., 'Fourier-Based Augmentations for Improved Robustness and Uncertainty Calibration', Neurips2021.
questions: questions: 1. How are d_t^mu and the other initialized? Did the experiments consider different random seeds?

2. Speaking of hardness of the augmented samples, how do AAUA and AAD compare with other adversarial techniques? 

3. Line 121-123: If correctly understood, it should be: responsive frequency describes the characteristics of mapping functions learned by networks and the mapping function transforms images into probability vectors. How does the smoothness represented by the probability vectors and how does it relate to frequency? The concept of 'smoothness' appears abruptly. 

4. What are the meaning of the two target domains in Fig. 2? Are they to show the distributions of augmented images are close to them? How are the density distributions of each domain computed? What do the peak values of each distribution mean?
limitations: limitations: The authors addressed the limitations of their methods, regarding the infeasibility to directly locate frequency shortcuts.

Comments: title: Discussion Post 5
Official Comment
Official comment
Discussion Post 4
Discussion Post 1
Official Comment
Discussion Post 3
Discussion Post 2
Discussion Post 1
comment: We deeply appreciate your engagement in the discussion.

1. To help address the concerns, we would be happy to incorporate both the average metric and class-wise metric for frequency shortcut evaluation, across the ImageNet-1k and its OOD variants, in the final version of the paper. Further, we would also clarify this in both experiment settings and the discussion of limitations in the final version of the paper.

2. Regarding the motivation for adversarial technique, we would like to clarify that the connection between adversarial learning and DG performance is step-by-step, instead of simply aiming for the best DG performance. 
As mentioned in Line: 174-179, the learning behavior is deemed to pick up dominant frequencies (Line:150) given a static dataset with no augmentations applied, we thus turn to the side of data-centered method to leverage this learning behavior. 
To do so, as mentioned in Line: 180-194, we would have to create data augmentations that are aggressive enough to affect the statistical structure of the dataset. 
Given the dynamic learning behavior of a model, one way to create hard samples for the model in each iteration is adversarial learning, we thus propose to apply the adversarial technique.
Meanwhile, the adversarial gradient w.r.t amplitude utilized in AAD could be interpreted as the model's frequency preference when giving predictions [2], thus the adversarial technique is also applied to capture the over-reliance frequencies in each training iteration.

Once again, we deeply appreciate your engagement in the discussions for multiple rounds and truly hope that our discussion could convince the reviewer for a better rating.
Thank you again for the rebuttal. 
1. Concern regarding evaluation
As the title suggests, "Combating Frequency Simplicity-biased Learning for Domain Generalization," the authors implicitly hypothesize that reducing frequency shortcut learning will improve domain generalization. Therefore, I think it crucial to evaluate whether the proposed technique effectively reduces frequency shortcut learning. Thus, having an appropriate metric to evaluate this is important. If this is not the authors' intention, they should consider rephrasing their statements in the paper and possibly changing the title to avoid such confusion.

2. Concern regarding motivation
The assumption that "the least frequency shortcuts always result in the best DG performances" is inferred from the authors' methodology, where adversarial learning is used to prevent frequency shortcuts, with the aim of achieving the best DG performance. This naturally leaves the impression that the  well-generalized models are expected to exhibit the least frequency shortcut learning. This assumption is closely related to the motivation behind the method's design. If this is not the authors' intention, it needs to be clarified in the paper, and the motivation behind the design should be better explained.

If the authors can provide reasonable ideas for addressing the concerns and better formulate their motivation, I would be happy to reconsider my rating.
Thank you for taking the time to review our submission and for raising the score. We truly appreciate your constructive feedback and insights.
We are committed to implementing all the suggested changes in the final version to enhance the quality of our work. 

Thank you once again for your support.
I thank the authors for their response.

* The protocol for hyper-parameter selection is now clear to me. I missed the discussion in Appendix A.7 in my original review, and I apologise for the over-sight. One good thing is that the authors do not tune per-domain hyper-parameters, which could lead to an unfair comparison.  
* However, the hyper-parameter study is a bit concerning to me in terms of the results. It appears that the bulk of the accuracy improvement of the method on PACS come from the Photo domain. However, across all hyper-parameter sweeps, the Photo domain performance is especially sensitive to the correct hyper-parameters. This might cast some doubt on the ease of use of the method, and should be stated upfront by the authors while discussing the results.      
* The standard deviations provide more information about the method's empirical performance, and it seems like the method marginally out-performs ABA on PACS. The proposed method's lower variance is a positive trait. However, the claim of out-performing the state of the art by large margins needs to be toned down in the writing of section 5. I would also encourage the authors to include this information in future submissions as well, especially for methods whose performance is close to the proposed method (e.g. [36,43] on CIFAR-10C to further contextualize the empirical performance of the method.  


Overall, I believe that the paper needs to account for these concerns to make the claims of better empirical performance more water-tight. I am raising my score to marginally above accept, but **I believe that the presentation can be improved upon greatly**, and would encourage the authors to keep that in mind for future submissions.
Thank you for your response.

1. We follow the protocol in [35] to provide class-wise TPR/FPR results below. It can be seen that the proposed method outperforms the baseline across 8/10, 7/7 and 8/10 classes on ImageNet-10, PACS and CIFAR-10, respectively.

2. As mentioned in the limitations and future work, existing works (including ours) couldn't directly locate frequency shortcuts, thus it would be hard to measure this with a robust metric. We kindly ask if the reviewer could provide any more specific metrics or suggestions. Meanwhile, whether the TPR/FPR metric we followed from prior work [35] is robust, is beyond the scope of this paper.

3. In this paper, we focus on preventing frequency shortcuts to improve DG performance. Neither this paper nor [35] stated that the least frequency shortcuts always result into the best DG performances.

ImageNet-10

| Method           | Class 1     | Class 2 | Class 3  | Class 4     | Class 5     | Class 6     | Class 7     | Class 8     | Class 9     | Class 10    |
| ---------------- | ----------- | ------- | -------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- |
| ResNet-18        | 0.08/0.0044 | 0/0     | 0.4/0.02 | 0.8/0.0356  | 0.02/0.0311 | 0.02/0.0044 | 0.14/0.0044 | 0.8/0.1178  | 0.54/0.1889 | 0.06/0.0022 |
| ResNet-18 + Ours | 0/0         | 0/0     | 0.15/0   | 0.34/0.0465 | 0.08/0.0257 | 0/0.0142    | 0.12/0.0015 | 0.41/0.0612 | 0.24/0.1509 | 0.78/0      |

PACS

| Method           | Class 1    | Class 2     | Class 3     | Class 4     | Class 5     | Class 6     | Class 7     |
| ---------------- | ---------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- |
| ResNet-18        | 0.325/0.18 | 0.448/0.168 | 0.467/0.157 | 0.522/0.154 | 0.359/0.251 | 0.568/0.264 | 0.417/0.205 |
| ResNet-18 + Ours | 0.218/0    | 0.223/0.02  | 0.439/0.113 | 0.406/0.146 | 0.269/0.005 | 0.417/0.046 | 0.205/0     |

CIFAR-10

| Method           | Class 1    | Class 2      | Class 3     | Class 4     | Class 5     | Class 6     | Class 7     | Class 8     | Class 9     | Class 10    |
| ---------------- | ---------- | ------------ | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- | ----------- |
| ResNet-18        | 0.39/0.117 | 0.085/0.0011 | 0.483/0.184 | 0.749/0.303 | 0.856/0.457 | 0.461/0.140 | 0.268/0.023 | 0.254/0.015 | 0.556/0.054 | 0.132/0.003 |
| ResNet-18 + Ours | 0.29/0     | 0/0          | 0.254/0     | 0.538/0.364 | 0.502/0.127 | 0.155/0.002 | 0.216/0.015 | 0.41/0.132  | 0.209/0.092 | 0.04/0      |
Thank you for the rebuttal. I want to clarify that the discussion regarding DG and 'general robustness' is closely related to experiment design, especially in the choice of datasets. This is why I suggested conducting experiments on ImageNet-1k and its OOD variants (e.g. ImageNet-C-bar, ImageNet-P, ImageNet-A, ImageNet-Sketch, etc.), though I did not list all of them in my initial comments. 

However, I have concerns about the approach of using average TPR and FPR to evaluate frequency shortcuts. The paper [35] that investigates frequency shortcuts conducts its analysis on a class-wise manner rather than relying on average values. Thus, I examined the average TPR and FPR in [35] and compared them with the OOD results in this paper, I noticed some inconsistencies. For example, the model 'ResNet18+SIN,' which has the best average OOD performance, does not have the lowest average TPR on ImageNet-10. Instead, 'ResNet18+AutoAug' shows the lowest average TPR, yet it only achieves average OOD performance compared to other models. This discrepancy suggests that the chosen metric for evaluating frequency shortcuts may not be robust (could be the reason that [35] did not propose it in their paper), and its validity requires further substantiation.

Based on these considerations, I believe the manuscript is not ready for publication, as it still needs improvements in writing, readability (as noted by Reviewer jMvT) as well as addressing technical concerns. Thus, I will maintain my current rating.
Thank you for taking time to engage in the discussion.

1. As Gulrajani and Lopez-Paz, 2020 (DomainBed) discuss multi-source domain generalization, they are slightly different from the setting of single-source domain generalization. In the single-source domain generalization paradigm, the sole source domain is partitioned into training and validation sets, with an 8:2 ratio [3，6]. The model is trained using the training set and subsequently evaluated on the validation set. The model iteration that demonstrates optimal in-domain performance on the validation set is then selected for testing/ evaluation on the entirety of the target domain data. 
   Regarding the hyper-parameter selection, hyper-parameter studies are provided on the method-related hyper-parameters in Fig. 8 of appendix and Tab. Re6.Re7 in the rebuttal PDF. We didn't conduct hyper-parameter search on the other parameters (i.e. learning rate and batch size), but instead pre-defined them. This is aligned with the protocol in prior works[3,6]. These pre-defined values are provided in Sec. A.4 in the appendix.

2. As most of the single-source DG works in Tab. 1 didn't provide standard deviation in their paper, we thus previously excluded this term. We follow your suggestion to provide the performance along with the standard deviations below:

| Method | Digits       | PACS         |
| ------ | ------------ | ------------ |
| ABA    | 74.76 (0.52) | 66.02(1.15)  |
| ALT    | 72.49 (0.87) | 64.72 (-)    |
| Ours   | 81.39 (0.58) | 67.91 (0.57) |
I appreciate the author's response; According to the disscusions among all the reviewers' and the overall concerns, I keep the rating.
I thank the authors for their detailed response. 
* It is nice to see that the proposed method can get better domain generalization without sacrificing ID accuracy on PACS.
* The ablation study in table Re5 is interesting. It suggests that some domains (P,C) need AAUA on low frequencies for good performance, while others don't. 

However, I still have some concerns

* I am still not clear on the hyper-parameter selection. Looking at [43,46], I was unable to figure out how the hyper-parameters were selected in these works either. This is a crucial point, since it is easy to over-state the empirical results of a method by "leaking" test domains through hyper-parameters, e.g. see Gulrajani and Lopez-Paz, 2020. I would urge the authors to detail the exact mechanism behind their hyper-parameter selection method, i.e. define the space of hyperparameters searched, and specify the "external validation set" used.
* With regards to multiple run, I would like to know what the standard deviations were, and if the reported improvements in performance are significant. I stress on this point because the absolute value of improvements is low over previous methods.




Gulrajani, Ishaan, and David Lopez-Paz. "In search of lost domain generalization." arXiv preprint arXiv:2007.01434 (2020).
Thank you for taking time to respond to our comments. 

1. We kindly note that the discussion has now been drifting away from the scope of the paper. We previously talked about this in rebuttal to try to address the reviewer's concern on the "first claim" and "ImageNet results". As mentioned in the rebuttal, we would replace the "first claim" with "one of the pioneering works" and we've provided ImageNet-1k results following the reviewer's suggestions.

2. Following your suggestion, we further provide frequency shortcut evaluation on other datasets (PACS and CIFAR-10) below. The experiment results below further demonstrates the effectiveness of the proposed method in frequency shortcut mitigation.

| **Method** | **PACS (Avg.TPR$\downarrow$ / Avg.FPR $\downarrow$)** | **CIFAR-10(Avg.TPR$\downarrow$ / Avg.FPR $\downarrow$)** |
| ---------- | ----------------------------------------------------- | -------------------------------------------------------- |
| ResNet-18  | 0.444 / 0.197                                         | 0.423 / 0.130                                            |
| AFA        | 0.426 / 0.079                                         | 0.441 / 0.106                                            |
| VIP        | 0.455 / 0.133                                         | 0.416 / 0.127                                            |
| HAP        | 0.402 / 0.153                                         | 0.397 / 0.092                                            |
| Ours       | **0.311 / 0.047**                                     | **0.258 / 0.073**                                        |

3. Dominant frequencies are the spatial frequencies that contribute most to the singular vectors of the dataset's statistical structure. Low frequencies are generally the dominant ones for natural images because they contain most of the information images carry. Meanwhile, low frequencies are often considered to carry domain-specific information [38]. We thus put AAUA's focus on low-frequencies.
1.General Robustness and Domain Generalization (DG): The connection between corruption robustness and DG is discussed in the survey paper (https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9847099), which suggests that Out-of-Distribution (OOD) robustness can be seen as a type of single-source DG problem. You mentioned that "DG considers stronger distribution shifts and semantic variances." However, strong distribution shifts are also relevant in cases of corruption and adversarial attacks. Moreover, your statement that "DG [22,43,36,6,3,46,39,37,38] and general robustness [D1,D2,D3] are mostly different research communities" lacks clear criteria for measuring the magnitude of distribution shifts or semantic variances. There doesn't seem to be solid evidence supporting the idea that DG involves stronger semantic variances. In many DG studies, the term "domain" often just refers to different environments for data collection, without necessarily indicating strong semantic variance.


2. Evaluation on Frequency Shortcut Mitigation: Given the title "Combating Frequency Simplicity-biased Learning," it is crucial to demonstrate that the proposed method effectively mitigates frequency shortcuts. Therefore, a more comprehensive evaluation is necessary to validate the benefits of your approach in this context.


3. Intuition Behind AAUA: The explanation provided for AAUA’s focus is somewhat unclear. The response states that "frequency shortcuts are more likely hidden in the dominant frequencies," and adds that "in real-world datasets, the amplitude of a natural image is often dominated by low-frequency components." However, it’s not entirely clear what is meant by "dominant frequencies"—whether it refers to those dominating amplitude or classification. Furthermore, according to paper [35], the dominant frequencies in classes that use frequency shortcuts (as seen in their DFMs) often include many mid-high frequencies, rather than just low frequencies.
### Hardness Comparison

**(1)** Regarding the new question of whether hardness comparison is a sufficient metric, the hardness comparison map only serves as a qualitative visualization result to compare the strength of the augmentations. We kindly request the reviewer if he/she could provide any other metric to help further improve this analysis.

**(2)** Similar hardness comparisons are also provided in the supplementary material of ABA[3] and the main papers of ALT[6] and AdvST[46].

**(3)** On the other hand, we've never stated that learning hardness is highly correlated with generalization performances. Our primary focus is domain generalization performance, and so whether hardness is a sufficient metric for domain generalization is beyond our scope.

### Performance Improvement in Tab. Re1

Results in Tab. Re1 shows that our method achieves the shortest additional training time and the best DG performances among the adversarial augmentation SOTAs[3,6,46]. We outperform the SOTA ABA with a clear margin of 1.89\% in terms of performance. Note that we achieve the best performance with the shortest additional training time (about $\frac{1}{5}$ of ABA).



We hope that, our responses have adequately resolved reviewer's concerns. We would kindly request the reviewer to re-consider improving the rating.
### General Robustness and DG

**(1)** General robustness studies often engage with model robustness against simple distribution shifts, adversarial attacks and common corruptions [D1,D2,D3]. In general robustness, they typically focus on variations within the same domain (e.g., noise, adversarial attacks)[D1,D2,D3] 

**(2)** DG often considers stronger distribution shifts and semantic variances, where the training and testing data are considered as different domains. As such, DG [22,43,36,6,3,46,39,37,38] and general robustness [D1,D2,D3] are mostly different research communities. 

**(3)** Prior works on single-source DG never conducted experiments on ImageNet, but instead provided results on PACS, Digits and CIFAR-10-C[22,43,36,6,3,46,39,37,38]. We are following the evaluation protocol from these prior works.

#### References:

D1: Subbaswamy, Adarsh, Roy Adams, and Suchi Saria. "Evaluating model robustness and stability to dataset shift." International conference on artificial intelligence and statistics. PMLR, 2021.

D2: Yin, Dong, et al. "A fourier perspective on model robustness in computer vision." Advances in Neural Information Processing Systems 32 (2019).

D3: Liu, Chang, et al. "A comprehensive study on robustness of image classification models: Benchmarking and rethinking." International Journal of Computer Vision (2024): 1-23.

### Evaluation on Frequency Shortcut 

**(1)** Regarding the question on the effectiveness of evaluation on frequency shortcuts, we kindly emphasize that we strictly follow the frequency shortcut evaluation protocol from [35], which it evaluates on ImageNet-10. To the best of our knowledge, there's no existing literature conducting frequency shortcut evaluation on any other datasets except ImageNet-10.

**(2)** Given the time-consuming process of masking each frequency band separately and then evaluating accuracy per class, it is not feasible to conduct frequency shortcut evaluation on the ImageNet-1k in the relatively short rebuttal period.

### Intuition of AAUA

**(1)** In the theory section, one would notice that frequency shortcuts are more likely hidden in the dominant frequencies. Meanwhile, in real-world datasets, the amplitude of a natural image is often dominated by low-frequency components. 
In this case, we thus apply AAUA to the low frequencies. 

**(2)** [35] is a fully empirical study and they indeed did not provide such a claim. However, the reason we apply AAUA to low-frequencies is mainly analyzed from the theory section and the intuition of low-frequencies being dominant in natural images. The absence of such a statement in [35] does not imply that our intuition is incorrect.

### Some Missing Results in Tab.1

**(1)** To ensure a fair comparison with other methods, we directly report the results in Tab.1 from the corresponding papers. As stated in the rebuttal, missing results in the experiments indicate the corresponding papers didn't provide results on the corresponding datasets. It would not be possible to run all these methods ourselves during the limited time of the rebuttal period. We will complete them in the next version of the paper.

**(2)** We've already conducted extensive additional comparisons in the rebuttal, as shown in Tab. Re1,Re3,Re8,Re9,Re12.

### Large-scale Experiments

**(1)** We have already provided large-scale experiments on ImageNet and DomainNet in Tab. Re10 and Tab. Re12 in the rebuttal PDF, respectively. 

**(2)** To the best of our knowledge, existing DG papers [22,43,36,6,3,46,39,37,38] haven't conducted experiments on ImageNet. Conversely, they have the same dataset scope as ours (PACS, Digits, CIFAR-10-C). We are strictly following this protocol from previous DG works.

### Sensitivity Map

**(1)** Our sensitivity map with gradients is followed from [2], we are sorry for using the wrong citation in Sec. 5.4.1 and thus causing misunderstanding. Our sensitivity map shows the model's preferences on different frequency components when giving predictions [2].

**(2)** The claim that "accumulated errors might not indicate better generalization for target domains" is not mentioned in the paper, because the sensitivity map in the main paper is completely different from that of [43]. We claim this in the rebuttal because we show that our gradient sensitivity map in the paper and models on different domains exhibit different sensitivity and we intend to avoid any confusion regarding our sensitivity maps. As our primary focus is DG, we thus do not investigate differences between our sensitivity map and that from [43]. 

#### References: (In main paper)

[2] Alvin Chan, Y. Ong, and Clement Tan. How does frequency bias affect the robustness of neural image classifiers against common corruption and adversarial perturbations? In International Joint Conference on Artificial Intelligence, 2022
1. Unclear claim regarding general robustness and experiment scope: The paper and the rebuttal lack a clear definition of "general robustness" and assert that general robustness and domain generalization are distinct problems. This conclusion is drawn from comparing methods designed for general robustness within domain generalization tasks. However, since general robustness could be viewed as a subset of domain generalization, particularly as a single-source domain generalization problem, it's expected that methods designed for general robustness might underperform compared to those developed for the broader problem. Therefore, experimenting on ImageNet and its corruption and generalization variants is reasonable. The authors also provided results on CIFAR-C, a corruption dataset for 'general robustness', instead of DG problem. 
2. Limited evaluation of frequency shortcut mitigation: The evaluation of frequency shortcut mitigation is conducted only on ImageNet-10, which limits the range of the assessment. It’s unclear how well the proposed method addresses frequency shortcuts across other datasets, and a broader evaluation is needed to provide a more comprehensive understanding of the method’s effectiveness.
3. Intuition of AAUA's attention on mid-high frequencies: The paper suggests that AAUA focuses on mid-high frequencies because low frequencies are more likely to contain frequency shortcuts. However, this claim lacks sufficient support, as the referenced paper [35] does not make this claim. More evidence or clarification is needed to strengthen this reasoning.
4. Missing experiments for comprehensive comparison: Some key experiments from related work are not included in the paper, which limits the comparison. Running these experiments or explaining why they were omitted  is necessary for the comprehensiveness of this study. Additionally, the lack of large-scale experiments on ImageNet is a noticeable gap that should be addressed.
5. Use of gradients in sensitivity map: The paper uses gradients for the sensitivity map instead of accumulated errors, as in [43]. The authors suggest that accumulated errors might not indicate better generalization for target domains, but the paper and the rebuttal do not clearly explain how this issue is resolved. More explanation is needed to justify this approach and what the proposed sensitivity map represents.
6. Hardness comparison and method evaluation: The adversary nature is a core component of the proposed adversarial method, but comparing it with non-adversarial methods is not entirely fair. Moreover, while AAUA covers a broader range than ABA, the performance improvement is minimal (as shown in Table Re 1). This raises questions about whether hardness is a sufficient metric for comparison, and additional factors may need to be considered.