PixMix: Dreamlike Pictures Comprehensively Improve Safety Measures
Abstract
In real-world applications of machine learning, reliable and safe systems must consider measures of performance beyond standard test set accuracy.
These other goals include out-of-distribution (OOD) robustness, prediction consistency, resilience to adversaries, calibrated uncertainty estimates, and the ability to detect anomalous inputs.
However, improving performance towards these goals is often a balancing act that today’s methods cannot achieve without sacrificing performance on other safety axes.
For instance, adversarial training improves adversarial robustness but sharply degrades other classifier performance metrics.
Similarly, strong data augmentation and regularization techniques often improve OOD robustness but harm anomaly detection, raising the question of whether a Pareto improvement on all existing safety measures is possible.
To meet this challenge, we design a new data augmentation strategy utilizing the natural structural complexity of pictures such as fractals, which outperforms numerous baselines, is near Pareto-optimal, and comprehensively improves safety measures.
Introduction
A central challenge in machine learning is building models that are reliable and safe in the real world.
In addition to performing well on the training distribution, deployed models should be robust to distribution shifts, consistent in their predictions, resilient to adversaries, calibrated in their uncertainty estimates and capable of identifying anomalous inputs.
Numerous prior works have tackled each of these problems separately (Madry et al., 2018; Hendrycks and Dietterich, 2019; Guo et al., 2017; Emmott et al., 2015), but they can also be grouped together as various aspects of safety engineering for machine learning (Hendrycks et al., 2021b).
Consequently, the properties listed above can be thought of as safety measures.
Ideally, models deployed in real-world settings would perform well on multiple safety measures.
Unfortunately, prior work has shown that optimizing for some desirable properties often comes at the cost of others.
For example, adversarial training only improves adversarial robustness and degrades classification performance (Tsipras et al., 2018).
Similarly, inducing consistent predictions on out-of-distribution (OOD) inputs seems to be at odds with better detecting these inputs, an intuition supported by recent work (Chun et al., 2019) which finds that existing help with some safety metrics but harm others.
This raises the question of whether improving all safety measures is possible with a single model.
[Table]
Baseline
[Table]
Anomaly Detection
[Table]
While previous augmentation methods create images that are different (e [Table] g., translations) or more entropic (e
[Table]
g., additive Gaussian noise), we argue that an important underexplored axis is creating images that are more complex. As opposed to entropy or descriptive difficulty, which is maximized by pure noise distributions, structural complexity is often described in terms of the degree of organization (Lloyd, 2001).
A classic example of structurally complex objects is fractals, which have recently proven useful for pretraining image classifiers (Kataoka et al., 2020; Nakashima et al., 2021). Thus, an interesting question is whether sources of structural complexity can be leveraged to improve safety through data augmentation techniques.
We show that Pareto improvements are possible with P IX M IX , a simple and effective data processing method that leverages pictures with complex structures and substantially improves all existing safety measures. P IX M IX consists of a new data processing pipeline that incorporates structurally complex “dreamlike” images. These dreamlike images include fractals and feature visualizations.
We find that feature visualizations are a suitable source of complexity, thereby demonstrating that they have uses beyond interpretability. In extensive experiments, we find that P IX M IX provides substantial gains on a broad range of existing safety measures, outperforming numerous previous methods.
Approach
We propose P IX M IX , a simple and effective data augmentation technique that improves many ML Safety (Hendrycks et al., 2021b) measures simultaneously, in addition to accuracy.
P IX M IX is comprised of two main components: a set of structurally complex pictures (“Pix”) and a pipeline for augmenting clean training pictures (“Mix”).
At a high level, P IX M IX integrates diverse patterns from fractals and feature visualizations into the training set.
As fractals and feature visualizations do not belong to any particular class, we train networks to classify augmented images as the original class, as in standard data augmentation.
2.1 Picture Sources (P IX )
While P IX M IX can utilize arbitrary datasets of pictures, we discover that fractals and feature visualizations are especially useful pictures with complex structures.
Collectively we refer to these two picture sources as “dreamlike pictures.”
We analyze P IX M IX using other picture sources in the
Appendix. Fractals.
Fractals can be generated in several ways, with one of the most common being iterated function systems.
Rather than generate our own diverse fractals, which is a substantial research endeavor (Kataoka et al., 2020), we download 14 , 230 fractals from manually curated collections on DeviantArt.
The resulting fractals are visually diverse, which can be seen in the bottom portion of Figure 1. Feature Visualization.
Feature visualizations that maximize the response of neurons create archetypal images for neurons and often have high complexity (Mordvintsev et al., 2015; Olah et al., 2017).
Thus, we include feature visualizations in our mixing set. We collect 4 , 700 feature visualizations from the initial layers of several convolutional architectures using OpenAI Microscope. While feature visualizations have been primarily used for understanding network representations, we connect this line of interpretability work to improve performance on safety measures. 2.2 Mixing Pipeline (M IX )
The pipeline for augmenting clean training images is described in Figure 2. An instance of our mixing pipeline is shown in the top half of Figure 1.
First, a clean image has a 50% chance of having a randomly selected standard augmentation applied.
Next, we augment the image a random number of times with a maximum of k times. Each augmentation is carried out by either additively or multiplicatively mixing the current image with a freshly augmented clean image or an image from the mixing set.
Multiplicative mixing is performed similarly to the geometric mean.
For both additive and multiplicative mixing, we use coefficients that are not convex combinations but rather conic combinations.
Thus, additive and multiplicative mixing are performed with exponents and weights sampled from a Beta distribution independently. def pixmix( x orig , x mixing_pic , k=4, beta=3): x pixmix = random.choice([augment( x orig ), x orig ])
# random count of mixing rounds for i in range(random.choice([0,1,...,k])): # mixing_pic is from the mixing set # (e.g., fractal, natural image, etc.) mix_image =
random.choice([augment( x orig ), x mixing_pic ]) mix_op = random.choice([additive, multiplicative]) x pixmix = mix_op ( x pixmix , mix_image, beta) return x pixmix def augment(x): aug_op
=
random.choice([rotate, solarize, ..., posterize]) return aug_op(x)
Experiments 3.1 Tasks and Metrics
We compare P IX M IX to methods on five distinct ML Safety tasks.
Individual methods are trained on clean versions of CIFAR-10, CIFAR-100, and ImageNet. Then, they are evaluated on each of the following tasks.
Corruptions. This task is to classify corrupted images from the CIFAR-10-C, CIFAR-100-C, and ImageNet-C datasets.
The metric is the mean corruption error (mCE) across all fifteen corruptions and five severities for each corruption.
Lower is better. Consistency. This task is to consistently classify sequences of perturbed images from CIFAR-10-P, CIFAR-100-P, and ImageNet-P.
The main metric is the mean flip rate (mFR), which corresponds to the probability that adjacent images in a temporal sequence have different predicted classes. This can be written as P x ∼S ( f ( x j ) ̸ = f ( x j − 1 )) , where x i is the i th image in a sequence. For non-temporal sequences such as increasing noise values in a sequence S , the metric is modified to P x ∼S ( f ( x j ) ̸ = f ( x 1 )) .
Lower is better. Adversaries. This task is to classify images that have been adversarially perturbed by projected gradient descent (Madry et al., 2018).
For this task, we focus on untargeted perturbations on CIFAR10 and CIFAR-100 with an ℓ ∞ budget of 2 / 255 and 20 steps of optimization.
We do not display results of ImageNet models against adversaries in our tables, as for all tested methods the accuracy declines to zero with this budget.
The metric is the classifier error rate.
Lower is better. Calibration. This task is to classify images with calibrated prediction probabilities, i.e. matching the empirical frequency of correctness.
For example, if a weather forecast predicts that it will rain with 70% probability on ten occasions, then we would like the model to be correct 7 / 10 times.
Formally, we want posteriors from a model f to satisfy P ( Y = arg max i f ( X ) i | max i f ( X ) i =
C )
=
C , where X, Y are random variables representing the data distribution. The metric is RMS calibration error (Hendrycks et al., 2019c), which is computed as (cid:113) E C [( P ( Y = ˆ Y | C = c ) − c ) 2 ] , where C is the classifier’s confidence that its prediction ˆ Y is correct.
We use adaptive binning (Nguyen and
O’Connor, 2015b) to compute this metric. Lower is better. Anomaly Detection. In this task we detect out-of-distribution (Hendrycks and Gimpel, 2017) or out-of-class images from various unseen distributions.
The anomaly distributions are Gaussian, Rademacher, Blobs, {+Textures (Cimpoi et al., 2014), SVHN (Netzer et al., 2011), LSUN (Yu et al., 2015), Places
 (Zhou et al., 2017).+}
We describe each in the Appendix and report average AUROC. An AUROC of 50% is random chance and 100% is perfect detection.
Higher is better.
Training Setup. In the following CIFAR experiments, we train a 40-4 Wide ResNet (Zagoruyko and Komodakis, 2016) with a drop rate of 0 . 3 for 100 epochs.
All experiments use an initial learning rate of 0 . 1 which decays following a cosine learning rate schedule (Loshchilov and Hutter, 2016).
For P IX M IX experiments, we use k = 4 , β = 3 .
Hyperparameter robustness is discussed in the
Appendix.
Additionally, we use a weight decay of 0 . 0001 for Mixup and 0 . 0005 otherwise. Results. In Table 1, we see that P IX M IX improves over the standard baseline method on all safety measures. Moreover, all other methods decrease performance relative to the baseline for at least one metric, while P IX M IX is the first method to improve performance in all settings.
Results for all other methods are in Table 2.
P IX M IX obtains better performance than all methods on Corruptions,
Consistency, Adversaries, and Calibration.
Notably, P IX M IX is far better than other methods for improving confidence calibration, reaching acceptably low calibration error on CIFAR-10.
For corruption robustness, performance improvements on CIFAR-100 are especially large, with mCE on the Corruptions task dropping by 4 . 9% compared to AugMix and 19 . 5% compared to the baseline. In addition to robustness and calibration, P IX M IX also greatly improves anomaly detection.
P IX M IX nearly matches the anomaly detection performance of Outlier Exposure, the state-of-the-art anomaly detection method, without requiring large quantities of diverse, known outliers.
This is surprising, as P IX M IX uses a standard cross-entropy loss, which makes the augmented images seem more in-distribution.
Hence, one might expect unseen corruptions to be harder to distinguish as well, but in fact we observe the opposite—anomalies are easier to distinguish. Additional results and ablations are in the Appendix.
[Table]
Conclusion
We proposed P IX M IX , a simple and effective data augmentation technique for improving ML safety measures.
Unlike previous data augmentation techniques, P IX M IX introduces new complexity into the training procedure by leveraging fractals and feature visualizations.
We evaluated P IX M IX on numerous distinct ML Safety tasks: corruption robustness, rendition robustness, prediction consistency, adversarial robustness, confidence calibration, and anomaly detection.
We found that P IX M IX was the first method to provide substantial improvements over the baseline on all existing safety metrics, and it obtained state-of-the-art performance in nearly all settings.
A Related Work
Datasets.
We evaluate P IX M IX on extensions of CIFAR-10, CIFAR-100, and ImageNet-1K (henceforth referred to as ImageNet) for various safety tasks.
So as not to ignore performance on the original tasks, we also evaluate on the standard versions of these datasets.
ImageNet consists of 1 . 28 million color images.
As is common practice, we downsample ImageNet images to 224 × 224 resolution in all experiments. ImageNet consists of 1 , 000 classes from WordNet noun synsets, covering a wide variety of objects, including fine-grained distinctions. We use the validation set for evaluating clean accuracy, which contains 50 , 000 images. To measure corruption robustness, we use the CIFAR-10-C, CIFAR-100-C, and ImageNet-C datasets (Hendrycks and Dietterich, 2019).
Each dataset consists of 15 diverse corruptions applied to each image in the original test set.
The corruptions can be grouped into blur, weather, and digital corruptions.
Each corruption appears at five levels of severity.
We also evaluate on the similar
CIFAR-10-C and ImageNet-C datasets, which use a different set of corruptions (Mintun et al., 2021).
To measure robustness to different renditions of object categories, we use the ImageNet-R dataset (Hendrycks et al., 2021a).
These datasets enable evaluating the out-of-distribution generalization of classifiers trained on clean data and non-overlapping augmentations.
To measure consistency of predictions, we use the CIFAR-10-P, CIFAR-100-P, and ImageNet-P datasets.
Each dataset consists of 10 gradual shifts that images can undergo, such as zoom, translation, and brightness variation.
Unlike other datasets we evaluate on, each example in these datasets is a video, and the objective is to have robust predictions that do not change across per-frame perturbations.
These datasets enable measuring the stability, volatility, or “jaggedness” of network predictions in the face of minor perturbations.
Examples from these datasets are in Figure 3.
Methods.
We compare P IX M IX to various state-of-the-art data augmentation methods.
Baseline denotes standard data augmentation; for ImageNet, we use the a random resized crop and random horizontal flipping, while on CIFAR-10 and CIFAR-100, we use random cropping with zero padding followed by random horizontal flips.
Cutout aims to improve representations by randomly masking out image patches, using patch side lengths that are half the side length of the original image.
Mixup regularizes networks to behave linearly between training examples by training on pixel-wise linear interpolations between input images and labels.
CutMix combines the techniques of Cutout and
Mixup by replacing image patches with patches from other images in the training set.
The labels of the resulting images are combined in proportion to the pixels taken by each source image.
Auto Augment searches for compositions of augmentations that maximize accuracy on a validation set.
AugMix uses a ResNeXt-like pipeline to combine randomly augmented images.
Compared to AugMix, which requires up to 9 augmentations per image and can be slow to run, P IX M IX requires substantially fewer augmentations; we find an average of 2 augmentations is sufficient. For fairness, we follow (Mintun et al., 2021) and train AugMix without the Jensen-Shannon Divergence consistency loss, which requires at least thrice the memory per batch. Outlier Exposure trains networks to be uncertain on a training dataset of outliers, and these outliers are distinct from the out-of-distribution test sets that we use during evaluation.
For ImageNet experiments, we compare to several additional methods. SIN trains networks on a mixture of clean images and images rendered using neural style transfer (Geirhos et al., 2019). We opt for simple techniques that are widely used and do not evaluate all possible techniques from each of the areas we consider. More methods are evaluated in the Appendix.
Robustness. Out-of-distribution robustness considers how to make ML models resistant to various forms of data shift at test time. Geirhos et al., 2019 (Geirhos et al., 2019) uncover a texture bias in convolutional networks and show that training on diverse stylized images can improve robustness at test-time.
The ImageNet-C(orruptions) benchmark (Hendrycks and Dietterich, 2019) consists of diverse image corruptions known to track robustness on some real world data shifts (Hendrycks et al., 2021a). ImageNet-C is used to test models that are trained on ImageNet (Deng et al., 2009) and is used as a held-out, more difficult test set.
They also introduce ImageNet-P(erturbations) for measuring prediction consistency under various non-adversarial input perturbations. Others have introduced additional corruptions for evaluation called ImageNet-C
(Mintun et al., 2021). The ImageNetR(enditions) benchmark measures performance degradation under various renditions of objects including paintings, cartoons, graffiti, embroidery, origami, sculptures, toys, and more (Hendrycks et al., 2021a).
In the similar setting of domain adaptation, Bashkirova et al., 2021 (Bashkirova et al., 2021) consider evaluating test-time robustness of models and
even anomaly detection (Emmott et al., 2015; Liang et al., 2018; Ruff et al., 2021). Yin et al., 2019 (Yin et al., 2019) show that adversarial training can substantially reduce robustness on some corruptions and argue that part of model fragility is explained by overreliance on spurious cues (Sagawa et al., 2020; Koh et al., 2021).
Calibration. Calibrated prediction confidences are valuable for classification models in real-world settings.
Several works have investigated evaluating and improving the calibration of deep neural networks (Nguyen and O’Connor, 2015a; Guo et al., 2017) through the use of validation sets.
Others have shown that calibration can be improved without a validation set through methods such as ensembling (Lakshminarayanan et al., 2017) and pre-training (Hendrycks et al., 2019a).
Ovadia et al.
(Ovadia et al., 2019) find that models are markedly less calibrated under distribution shift. Anomaly Detection.
Since models should ideally know what they do not know, they will need to identify when an example is anomalous. Anomaly detection seeks to estimate whether an input is out-of-distribution (OOD) with respect to a given training set.
Hendrycks et al., 2017 (Hendrycks and Gimpel, 2017) propose a simple baseline for detecting classifier errors and OOD inputs.
Devries et al., 2018 (Devries and Taylor, 2018) propose training classifiers with an additional confidence branch for detecting OOD inputs.
Lee et {+al., 
+}
(Lee et al., 2018a) propose improving representations used for detectors with near-distribution images generated by GANs.
Lee et {+al., 
+}
(Lee et al., 2018b) also propose the Mahalanobis detector.
Outlier Exposure (Hendrycks et al., 2019b) fine-tunes classifiers with diverse, natural anomalies, and since it is the state-of-the-art for OOD detection, we test this method in our paper.
Data Augmentation.
Simulated and augmented inputs can help make ML systems more robust, and this approach is used in real-world applications such as autonomous driving (Tesla, 2021; Anguelov, 2019). For state-of-the-art models, data augmentation can improve clean accuracy comparably to a 10 × increase in model size (Steiner et al., 2021).
Further, data augmentation can improve out-ofdistribution robustness comparably to a 1 , 000 × increase in labeled data (Hendrycks et al., 2021a).
Various augmentation techniques for image data have been proposed, including Cutout (Devries and
Taylor, 2017; Zhong et al., 2017), Mixup (Zhang et al., 2017; Tokozume et al., 2018), CutMix (Yun et al., 2019; Takahashi et al., 2019), and AutoAugment (Cubuk et al., 2018; Yin et al., 2019). Lopes et al., 2019 (Lopes et al., 2019) find that inserting random noise patches into training images improves robustness.
AugMix is a data augmentation technique that specifically improves OOD generalization (Hendrycks et al., 2019e). Chun et al. (Chun et al., 2019) evaluates some of these techniques on CIFAR-10-C, a variant of ImageNet-C for the CIFAR-10 dataset (Hendrycks and Dietterich, 2019).
They find that these data augmentation techniques can improve OOD generalization at the cost of weaker OOD detection. Analyzing Safety Goals Simultaneously.
Recent works study how a given method influences safety goals (Hendrycks et al., 2021b) simultaneously.
Prior work has shown that Mixup, CutMix,
Cutout, ShakeDrop, adversarial training, Gaussian noise augmentation, and more have mixed effects on various safety metrics (Chun et al., 2019). Others have shown that different pretraining methods can improve some safety metrics and hardly affect others, but the pretraining method must be modified per task (Hendrycks et al., 2019a).
Self-supervised learning methods can also be repurposed to help with some safety goals, all while not affecting others, but to realize the benefit, each task requires different self-supervised learning models (Hendrycks et al., 2019d). Thus, creating a single method for improving performance across multiple safety metrics is an important next step.
Training on Complex Synthetic Images.
Kataoka et al., 2020 (Kataoka et al., 2020) introduce
FractalDB, a dataset of black-and-white fractals, and they show that pretraining on these algorithmically generated fractal images can yield better downstream performance than pretraining on many manually annotated natural datasets.
Nakashima et al.
(Nakashima et al., 2021) show that models trained on a large variant of FractalDB can match ImageNet-1K pretraining on downstream tasks.
Baradad et al., 2021 (Baradad et al., 2021) find that, for self-supervised learning, other synthetic datasets may be more effective than FractalDB, and they find that structural complexity and diversity are key properties for good downstream transfer.
We depart from this recent line of work and ask whether structurally complex images can be repurposed for data augmentation instead of training from scratch. While data augmentation techniques such as those that add Gaussian noise increase input entropy, such noise has maximal descriptive complexity but introduce little structural complexity (Lloyd, 2001).
Since a popular definition of structural complexity is the fractal dimension (Lloyd, 2001), we turn to fractals and other structurally complex images for data augmentation. B Additional Results [Table] but it is usually first, making it near Pareto-optimal.
B.1 Results on ImageNet Tasks
Training Setup.
Since regularization methods may require a greater number of training epochs to converge, we fine-tune a pre-trained ResNet-50 for 90 epochs. For P IX M IX experiments, we use k = 4 , β = 4 . We use a batch size of 512 and an initial learning rate of 0 . 01 following a cosine decay schedule.
Results.
We show ImageNet results in Table 3.
Compared to the standard augmentations of the baseline, P IX M IX has higher performance on all safety measures.
By contrast, other augmentation methods have lower performance than the baseline (cropping and flipping) on some metrics.
Thus,
P IX M IX is the first augmentation method with a Pareto improvement over the baseline on a broad range of safety measures.
On corruption robustness, P IX M IX outperforms state-of-the-art augmentation methods such as
AugMix, improving mCE by 12 . 4% over the baseline and 5 .
1% over the mCE of the next-best method.
On rendition robustness, P IX M IX outperforms all other methods save for SIN.
Note that
SIN is particularly well-suited to improving rendition robustness, as it trains on stylized ImageNet data.
However, SIN incurs a 2% loss to clean accuracy, while P IX M IX increases clean accuracy by 1 . 3% .
Maintaining strong performance on clean images is an important property for methods to have, as practitioners may be unwilling to adopt methods that markedly reduce performance in ideal conditions.
On calibration tasks, P IX M IX outperforms all methods.
As Ovadia et al.
(Ovadia et al., 2019) show, models are markedly less calibrated under distribution shift.
We find that P IX M IX cuts calibration error in half on ImageNet-C compared to the baseline.
On ImageNet-C, the improvement is even larger, with a 14 . 9% reduction in absolute error.
In Figure 4, we visualize how calibration error on
ImageNet-C and ImageNet-C varies as the corruption severities increase.
Compared to the baseline,
P IX M IX calibration error increases much more slowly.
Further uncertainty estimation results are in the Appendix.
For example, P IX M IX substantially improves anomaly detection performance with
Places365 as the in-distribution set.
B.2 Mixing Set Picture Source Ablations
While we provide a high-quality source of structural complexity with P IX M IX , our mixing pipeline could be used with other mixing sets.
In Table 4, we analyze the choice of mixing set on CIFARperformance.
We replace our Fractals and Feature Visualizations dataset (Fractals + FVis) with several synthetic datasets developed for unsupervised representation learning (Baradad et al., 2021;
Kataoka et al., 2020).
We also evaluate the 300K Random Images dataset of natural images used for
Outlier Exposure on CIFAR-10 and CIFAR-100 (Hendrycks et al., 2019c).
Compared to alternative sources of visual structure, the Fractals + FVis mixing set yields substantially better results.
This suggests that structural complexity in the mixing set is important.
Indeed, the
[Figure] [Figure]
ImageNet-C and C Calibration
Baseline [Figure] C) [Figure]
C)
[Figure]
C)
[Figure]
Anomaly
[Figure] [Table] [Figure]
Error mCE
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
other datasets from prior works (Baradad et al., 2021; Kataoka et al., 2020).
The 300K Random Images (Hendrycks et al., 2019c) are real images scraped from online for Outlier Exposure.
We discover the distinct utility of Fractals and FVis.
By utilizing the 300K Random Images mixing set, P IX M IX can attain a 19 . 6% error rate, though fractals can provide more robustness than these real images.
next-best method for reducing mCE on CIFAR-100-C is FractalDB, which consists of weakly curated black-and-white fractal images.
By contrast, our Fractals dataset consists of color images of fractals that were manually designed and curated for being visually interesting.
Furthermore, we find that removing either Fractals or FVis from the mixing set yields lower performance on safety metrics or lower performance on clean data, showing that both components of our mixing set are important.
Mixing Strategies.
In Table 5, we analyze different mixing strategies.
The full P IX M IX mixing strategy is depicted in Figures 2 and 3 of the main paper.
Mix Input only includes clean images in the mixing pipeline and does not use the mixing set at all.
This severely harms performance on all safety metrics.
Mix Aug only mixes with images from the mixing set.
This reduces RMS calibration error but increases error on robustness tasks compared to P IX M IX Original.
Finally, Iterative mixes with feature visualizations computed on the fly for the network being trained.
This performs well on robustness tasks but has weaker calibration and anomaly detection.
Additionally, computing feature visualizations at each iteration of training is substantially slower than precomputing them on fixed networks as we do in P IX M IX .
Full Results.
In Tables 7, 8, and 9, we report full results for CIFAR-10, CIFAR-100, and ImageNet.
The ImageNet results are copied from the main paper.
For CIFAR, we evaluate on additional datasets, including CIFAR-10-C and CIFAR-100-C, additional datasets of corrupted CIFAR images.
We also report the mT5D metric on ImageNet-P.
In all cases, P IX M IX provides the best overall performance.
Noise-Based Augmentations.
Since noise-based augmentations sometimes nearly overlap with the test distribution and thereby may have an unfair advantage, we separately compare to several additional baselines on ImageNet that use noise-based data augmentations.
ANT trains networks on inputs with adversarially transformed noise applied (Rusak et al., 2020).
Speckle trains on inputs with speckle noise added, which has been observed to improve robustness.
EDSR and Noise2Net inject noise using image-to-image neural networks with noisy parameters (Hendrycks et al., 2021a).
{+Adversarial trains networks with ℓ ∞ perturbations of magnitude ε = 8 / 
+}
(Madry et al., 2017).
Results are in Tables 10.
We find that ANT and Speckle have strong performance on ImageNet-P overall, but this mostly comes from the Gaussian and shot noise categories.
If we only consider prediction stability on non-noise categories, P IX M IX exhibits the least volatility in predictions out of all the methods considered.
Hyperparameter Sensitivity.
In Table 13, we examine the hyperparameter sensitivity of P IX M IX on corruption robustness for CIFAR-100.
We vary the β and k hyperparameters and find that performance is very stable across a range of hyperparameters.
Places365 Anomaly Detection.
In Table 12, we show anomaly detection performance with
Places365 as the in-distribution data.
For all methods, we use a ResNet-18 pre-trained on Places365.
P IX M IX and Outlier Exposure (OE) are fine-tuned for 10 epochs.
We find that P IX M IX nearly matches the state-of-the-art OE detector despite being a general data augmentation technique that improves many other safety metrics.
C Outlier Datasets
For anomaly detection, we use a suite of out-of-distribution datasets and average metrics across all
OOD datasets in the main results.
Gaussian noise is IID noise sampled from a normal distribution.
Rademacher Noise is noise with each pixel sampled from {− 1 , 1 } with equal probability.
Blobs are algorithmically generated blobs.
Textures are from the Describable Textures Dataset (Cimpoi et al., 2014).
SVHN has images of numbers from houses.
Places69 contains 69 held-out classes.
D Broader Impacts
As P IX M IX differentially improves safety metrics
[Table]
it could have various beneficial effects.
Improved robustness can result in more reliable machine learning systems deployed in safety-critical situations (Hendrycks et al., 2021b)
[Table]
such as self-driving cars.
Anomaly detection enables better human oversight of machine learning systems and fallback policies in cases where systems encounter inputs they were not designed to handle.
At the same time, anomaly detection could be misused as a surveillance tool, requiring careful consideration of individual use cases.
Calibration enables more meaningful predictions that increase trust with end users.
Additionally, compared to other methods for improving robustness, P IX M IX requires minimal modification of the training setup and a low computational overhead, resulting in lower costs to machine learning practitioners and the environment
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
Noise
Blur Weather Digital [Table]
Baseline 23.
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]