Towards Systematic Robustness for Scalable Visual Recognition
1. Introduction
There is widespread interest in developing robust recognition models, that can recognise a variety of object classes despite the presence of unlikely object, scene, or image properties.
This is reflected by the proliferation of challenging benchmarks that focus on various kinds of robust recognition behaviour, e.g. robustness to image corruptions (Hendrycks & Dietterich, 2019), to spatial transformations (Engstrom et al., 2019), to harsh weather conditions (Sakaridis et al., 2018), to imperceptible perturbations (Gilmer et al., 2018), and to abstract depictions of objects (Rusak et al., 2021).
While it is hard to formulate a compact definition of robustness that covers these diverse requirements and more, we can nonetheless impose a useful meta-requirement that we should pursue in general:
For robust behaviour to be scalable , it should transfer flexibly across familiar object classes, and not be separately learned for every class of interest.
We refer to this problem setting as systematic robustness .
We argue in ongoing work that current training and evaluation protocols – especially for large-scale image classification – should target this requirement.
We also demonstrate with extensive experiments that this remains a multi-faceted challenge for existing classification models and domain generalisation methods.
This extended abstract describes the experimental setting and specific instantations thereof that we examine in our work.
While there is significant work on related problems, e.g. systematic generalisation and spurious correlations (Bahdanau et al., 2019; Ruis et al., 2020; Geirhos et al., 2020; Montero et al., 2021; Schott et al., 2022) experiments are typically conducted on small datasets: Either synthetic ones where we have full control over the data generation process and can correspondingly work with tightly-controlled train/test splits, or naturalistic datasets with limited variability but which nonetheless admit some form of control.
Here we aim to bridge the gap between work on controlled systematic generalisation and work on large-scale recognition models, in which models are trained on large naturalistic datasets with an ”almost anything goes” approach.
We also depart Preprint. from related work on domain generalisation (Gulrajani &
Lopez-Paz, 2021; Koh et al., 2021), by acknowledging the need to learn specific robust behaviours from data: We are e.g. unlikely to be able to learn how to handle blurry images by only looking at clean and noisy ones.
Noise and blur are perturbations with very different frequency characteristics, and it’s not obvious that this should work without the appropriate evaluation.
Our experiments also complement work on domain adaptation under label shift (Johansson et al., 2019; Zhao et al., 2019; Ben-David et al., 2010).
We formulate a variety of challenges probing systematic robustness w.r.t.
(1) photometric transforms, (2) geometric transforms, (3) rendition styles.
Our proposed benchmarks are a compromise between a tightly-controlled but overly simplistic setups and large-scale datasets without meaningful experimental controls, and they build on top of existing data (Russakovsky et al., 2015; Hendrycks & Dietterich, 2019; Peng et al., 2019).
See Figure 1 for an example.
[Figure]
O B J E CT C L A SS c a t d og b i r d
[Figure]
2. Systematic Robustness
We now introduce the problem setting of systematic robustness, describe a simple metric for measuring the latter, and describe different problem instantiations that we examine.
Preliminaries In this work, we focus on the task of image classification.
Our goal is to train a classifier to recognise object classes from some closed set C
= { c i } Ni =1 given a training set of images annotated with class labels.
The training data is drawn from a set of ”environments” or ”domains”
E = { E 0 , . . .
, E M } .
Each environment E k
= T k × C k can be characterised by a set of classes C k and some property
T k that applies only to images from that environment, e.g.
”contain Gaussian noise”, “ are rotated by 90 ◦ ”, and “objects are depicted with line drawings”.
E 0 is the default environment in which all classes C are present.
The remaining training environments are restricted to disjoint subsets of classes { C 1 , . .
, C M } , s.t.: (1) (cid:83) M k =1 C k ⊆ C, and (2) ∀
( i, j ) ∈ { 1 , . . .
, M } : i ̸ =
j ⇒ C i ∩ C j = Ø.
At test time, we consider all possible environments: { T 0 ×
C } ∪ { T i ×
C j | i, j ∈ { 1 , . . .
, M }} .
Thus for any valid i, j , if i ̸
=
j then T i × C j has not been seen during training.
This allows us to contrast performance in seen and unseen environments, and determine how well robust behaviour learned for a subset of available classes transfers to the rest.
This also imposes strict restrictions on training settings, and it is vital that methods not violate the letter and spirit of the exercise by resorting to augmentations that fill in the intentional gaps of the data distribution.
Measuring Systematic Robustness To measure systematic robustness of a model f w.r.t.
some scene factor T k , we first need to measure classification accuracy acc f ( · ) in two environments: (1) the control environment T k × C k , i.e. the set of classes C k for which robustness to T k was learned during training, and (2) the experimental environment T k × C k , i.e. the environment in which the property
T k holds for classes
C k
=
C \ C k .
We can then simply normalise the accuracy in the experimental environment acc f
( T k × C k ) by the accuracy in the control environment acc f
( T k × C k ) .
This represents the degree to which robust behaviour learned in a seen environment transfers to an unseen one.
Sometimes it will make sense to compensate for some baseline robustness, e.g. if we are fine-tuning a pretrained model f 0 that already shows some degree of robust accuracy.
We simply subtract average robust accuracy of the baseline model acc f
( T k × C ) from the accuracy measured in both environments.
We refer to the resulting quantity as ρ k , i.e. systematic robustness w.r.t.
T k , and compute it as follows while limiting the range to [0 , 1] :
[Equation]
It should be noted that a value of 1 is trivial to achieve if f is not much more robust than the reference classifier f 0 .
Thus on its own, this measure of robustness is insufficient and has to be paired with the other metrics that measure absolute robust accuracy.
A related metric is that of effective robustness (Taori et al., 2020) which also relates robust accuracy to i.i.d.
accuracy.
Problem Instantiations We opt to study three instantiations of this problem: systematic robustness w.r.t.
(1) image corruptions (Hendrycks & Dietterich, 2019), (2) in-plane image rotations (Engstrom et al., 2019), and (3) rendition styles (e.g. natural images, line drawings) (Hendrycks et al., 2021;
Rusak et al., 2021).
These represent basic challenges in recognition that robust models should arguably handle in a flexible manner.
They also differ qualitatively: The first are photometric perturbations that can drastically affect image statistics, whereas recognising objects from different viewpoints can require reasoning of a more geometric nature.
While the way an object is depicted can also heavily affect the statistics of the resulting image, successfully managing this challenge requires non-trivial abstract reasoning about the essence of an object’s texture and shape.
We study these problems in the large-scale setting building on prior efforts to collect the relevant data.
We study systematic robustness w.r.t.
corruptions and rotations by applying selective data augmentation to ImageNet (Russakovsky et al., 2015;
Hendrycks & Dietterich, 2019), and w.r.t.
rendition styles by sampling images from DomainNet (Peng et al., 2019).
For image corruptions, we select four out of the 19 suggested for the ImageNet-C benchmark, each representing one of four categories: Gaussian noise ( N ), Gaussian blur ( B ), contrast ( D ), and snow ( W ).
Thus we have up to five environments including the default ”clean” one.
To generate ”corrupted” images, we sample one of five severity levels and apply the corresponding transformation.
For image rotations, we have just one additional environment ( R ) where images are randomly rotated by an angle sampled from a discrete set.
When reporting performance for image corruptions, we measure average accuracy or systematic robustness over the available severity levels.
For rotations, we restrict evaluation to right angles { 90 ◦ , 180 ◦ , 270 ◦ } as these do not introduce a confounding effect via pixel interpolation.
With image renditions, we use natural (or ”real”) images for the default environment, and then sample images corresponding to the remaining five rendition styles (”clipart”, ”quickdraw”, ”infograph”, ”sketch”, and ”painting”) while restricting each style to a subset of the available classes.
Conclusion We believe that our proposed setting represents a step towards putting large-scale classification methods on a more solid experimental footing, by targeting a more nuanced evaluation of model behaviour.
Our extensive experimental analysis will be the subject of a separate publication.